openSUSE-SU-2026:21933-1

This update for sdbootutil fixes the following issues:

Security issues fixed:

• CVE-2026-41676: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270192).
• CVE-2026-41677: out-of-bounds read in PEM password callback when returning an oversized length in rust-openssl crate (bsc#1270616).
• CVE-2026-41678: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270670).
• CVE-2026-41681: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270742).
• CVE-2026-41898: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270863).
• CVE-2026-42327: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270471).
• CVE-2026-44662: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270922).
• CVE-2026-45784: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270995).

Non security issues fixed:

• sdbootutil-update-predictions.service fails with Failed to start Update TPM predictions (bsc#1273384).
• systemd ordering cycle and other service problems with snapshot 20260722 (bsc#1272525).
• Unable to unlock multiple encrypted partitions with FIDO2 Key, Systemdboot+LUKS (bsc#1234010).

Changes for sdbootutil:

• Update to version 1+git20260908.c641fc2:

• Update the shim when required
• Warn when recovery PIN is different from recovery key
• Improves extra boot entries support
• Better report when the default snapshot diverges
• Explain how to do re-enrolling if recovery PIN fails
• Explain why update-prediction fails and how to solve it
• Hide comparison output
• Add bootctl default entry in the prediction

• Update to version 1+git20260903.f91f636:

• Include FIDO2 unlocked devices for ordering (bsc#1234010)
• Test in parallel for speed up
• Add --repair parameter to cleanup
• Fix shellcheck complain
• Report entries with missing files
• Avoid duplicate entries in non-snapper systems
• Add initial tests for sdbootutil
• Report the error if bootctl clean fails

• Update to version 1+git20260901.41540d5:

• No warn if a component is not in the event log
• Add status command
• Select the new sdbootutil if available
• Skip blank lines in measure-pcr-generator.sh
• Do not change crypttab for unrelated entries
• Report the bad PCR when update-prediction fail
• Do not write the recovery PIN in the journal
• Improves non snapshot system support
• Update help message for --measure-pcr
• Report when PCR 7 is dropped because shim update
• Add --strict parameter for --pcr policy
• Report dropped PCRs via a warn
• Adjust the limits for PolicyOR issues
• Avoid update predictions if the service is up
• Keep the exit status of sdbootutil call

• Update to version 1+git20260827.786f9a8:

• Do not accept empty passwords
• jeos-firstboot-enroll: report errors also in the journal
• Restore old crypttab via the exit trap
• Update CLAUDE data
• Detect half created openssl keys
• check_enrolled report when something was written in the LUKS2 header
• Improve a bit the disk-encryption-tool keyslot detection
• Avoid leak of env var secrets
• Wipe the d-e-t key in the enroll service and jeos module
• Remove the correct keyslot left by d-e-t
• Differentiate tpm2 and tpm2+pin for unattended unlock
• Use is_same_device in detect_tracked_device and drop greps
• Refactor check to avoid shellcheck complain
• Parse the entry file in a sigle place
• Validate the entry with the new kernel name
• Refactor enrollment interface and deprecate the old one
• New kernels will have different hash
• Warn If no crypttab entry found
• Extend is_same_device
• jeos-firstboot-enroll: validate the passwords
• sdbootutil-enroll: report when no encryption method is provided
• Write recovery pin after enrollment in jeos module
• Write recovery pin after enrollment
• Improve error detection in sdbootutil-enroll
• Increase keyctl timeout
• Merge require_unlock and set_unlock_method
• Be sure that the terminal check works with snapper
• Renerate initrd when new measure-pcr keys are created
• Separate ask-* parameters
• Fix reading credential and keyctl password
• Get the device password for each enrolling mechanism
• Drop elements from crypttab if the enrollment fails
• Validate the enrollment for each method
• Add warning when enrolling FIDO2 token

• Update to version 1+git20260825.c7a5a97:

• Refactor free space calculation
• Do not use /proc/cmdline in half configured systems
• Warning when the recovery PIN is not validated
• Show default and booted snapshots with marks
• Improve detection of snapshot systems
• Fix when searching for a boot entry
• Fix boot order and boot order entry
• Create the entries directory in the ESP
• Fix get_final_pcr parser
• Keep btrfs error and show it when fails
• Fix set -e early exit instances
• Fix measure-pcr-validator when there is no terminal
• Don't include measure-pcr-validator in initrd if TPM2 is not used
• Update predictions even if crypttab did not change
• Improve PCR 15 signing
• Detect NAME=VALUE passed as parameters and complain
• When asking a password, require a terminal
• Filter some warnings from pcrlock
• Detect directories that are not part of the snapshot
• Write bash completion errors to /dev/null
• Detect when t-u apply is done and avoid data corruption
• Detect pcr-oracle leftovers
• Show in title that it's the initial version for transactional systems
• Manually generate PCR7 measurements
• Regenerate pcrlock.json when it is missing

• Update to version 1+git20260813.357956d:

• Do not update the predictions without a TPM2 enrollment (bsc#1273384)

• Update to version 1+git20260812.305d9f2:

• Do not supplement if GRUB2-EFI is installed (bsc#1272525)

• Update to version 1+git20260714.d9bb736:

• tukit: do not fail if service is not found

• Update to version 1+git20260713.d869cf8:

• Ignore errors in the snapper plugin

• Update to version 1+git20260709.7dfd021:

• Remove the background process in the plugin
• Fix missing initrd condition (bsc#1270420)
• After reboot the shutdown service is not active
• Disable the shutdown service after main service
• Update uhmac dependencies (rust-openssl) bsc#1270192, CVE-2026-41676 bsc#1270995, CVE-2026-45784 bsc#1270922, CVE-2026-44662 bsc#1270863, CVE-2026-41898 bsc#1270742, CVE-2026-41681 bsc#1270670, CVE-2026-41678 bsc#1270616, CVE-2026-41677 bsc#1270471, CVE-2026-42327
• Add systemd transient service to update predictions
• Install extra EFI binaries

• Update to version 1+git20260625.7fa275e:

• Remove duplicate code and parametrize timers
• Check boot entry before kernel installation
• Re-install an old kernel if initrd cannot be reused
• Skip installation for already installed kernel
• Add configurable devicetree entry support
• Set explicit kernel and initrd paths
• Remove the full tmpdir in the service
• Fix /run/sdbootutil permissions
• Execute predictions in the background
• Add --disable-predictions parameter
• Fix comparison operator
• Add print-loader-path command