Security update for rust-keylime SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2025:02962-1 Final 1 1 2025-08-22T12:50:26Z current 2025-08-22T12:50:26Z 2025-08-22T12:50:26Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for rust-keylime This update for rust-keylime fixes the following issues: - Update slab to version 0.4.11: * CVE-2025-55159: Fixed incorrect bounds check in get_disjoint_mut function (bsc#1248006) - Update to version 0.2.8+12: * build(deps): bump actions/checkout from 4 to 5 * build(deps): bump cfg-if from 1.0.0 to 1.0.1 * build(deps): bump openssl from 0.10.72 to 0.10.73 * build(deps): bump clap from 4.5.39 to 4.5.45 * build(deps): bump pest from 2.8.0 to 2.8.1 * Fix clippy warnings * Use verifier-provided interval for continuous attestation timing * Add meta object with seconds_to_next_attestation to evidence response * Fix boot time retrieval * Fix IMA log format (it must be ['text/plain']) (#1073) * Remove unnecessary configuration fields * cargo: Bump retry-policies to version 0.4.0 The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2025-2962,SUSE-SLE-Micro-5.5-2025-2962 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2025/suse-su-202502962-1/ Link for SUSE-SU-2025:02962-1 https://lists.suse.com/pipermail/sle-updates/2025-August/041342.html E-Mail link for SUSE-SU-2025:02962-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1248006 SUSE Bug 1248006 https://www.suse.com/security/cve/CVE-2025-55159/ SUSE CVE CVE-2025-55159 page SUSE Linux Enterprise Micro 5.5 keylime-ima-policy-0.2.8+12-150500.3.8.1 rust-keylime-0.2.8+12-150500.3.8.1 rust-keylime-0.2.8+12-150500.3.8.1 as a component of SUSE Linux Enterprise Micro 5.5 slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab's actual length. CVE-2025-55159 SUSE Linux Enterprise Micro 5.5:rust-keylime-0.2.8+12-150500.3.8.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202502962-1/ https://www.suse.com/security/cve/CVE-2025-55159.html CVE-2025-55159 https://bugzilla.suse.com/1248000 SUSE Bug 1248000