Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package amazon-ssm-agent for
openSUSE:Factory checked in at 2026-09-07 11:30:49
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/amazon-ssm-agent (Old)
and /work/SRC/openSUSE:Factory/.amazon-ssm-agent.new.1265 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "amazon-ssm-agent"
Mon Sep 7 11:30:49 2026 rev:49 rq:1375781 version:3.3.5226.0
Changes:
--------
--- /work/SRC/openSUSE:Factory/amazon-ssm-agent/amazon-ssm-agent.changes
2026-07-15 16:59:33.702966930 +0200
+++
/work/SRC/openSUSE:Factory/.amazon-ssm-agent.new.1265/amazon-ssm-agent.changes
2026-09-07 11:33:01.307761886 +0200
@@ -1,0 +2,24 @@
+Fri Sep 4 06:29:48 UTC 2026 - John Paul Adrian Glaubitz
<[email protected]>
+
+- Update to version 3.3.5226.0
+ * Add bounds check for HeaderLength in AgentMessage Deserialize
+ * Bump github.com/go-git/go-git/v5 to v5.19.2
+ (bsc#1276981, CVE-2026-71556) (bsc#1276994, CVE-2026-71557)
+ * Bump golang.org/x/sync to v0.21.0
+ * Detect Azure Linux and potential future unregistered Linux platforms
+ * Fix Windows session command parsing by removing shlex
+ * Fix shell injection in Windows domainjoin plugin parameters
+ * Prevent control channel deadlock on ProcessorBufferFull
+ * Revert migration from aws-sdk-go v1 to aws-sdk-go-v2 change
+ * Update the logic for loading RegistrationInfo
+ * Upgrade Go version to 1.25.13
+- from version 3.3.5068.0
+ * Migrate from aws-sdk-go v1 to aws-sdk-go-v2
+ * Fix flaky registration/connection channel tests
+ * Sync AWS SDK fork in extra/ with multicloud vendor changes
+ * Harden function create file with permissions in a single syscall
+ * Upgrade Go version to 1.25.12
+ * Bump golang.org/x/[email protected] to golang.org/x/[email protected]
+ * Fix loopback bypass in remote-host port forwarding denylist
+
+-------------------------------------------------------------------
@@ -35,0 +60,4 @@
+- Drop CVE-2025-22869.patch, merged upstream
+- Drop CVE-2025-22870.patch, merged upstream
+- Drop CVE-2025-47913.patch, merged upstream
+- Drop CVE-2026-25934.patch, merged upstream
@@ -55,0 +84,13 @@
+Thu May 21 11:01:27 UTC 2026 - John Paul Adrian Glaubitz
<[email protected]>
+
+- Add CVE-2026-25934.patch to fix improper verification of data integrity
+ values for .pack and .idx files that can lead to the consumption of
+ corrupted files (bsc#1258095, CVE-2026-25934)
+
+-------------------------------------------------------------------
+Tue May 12 11:46:36 UTC 2026 - John Paul Adrian Glaubitz
<[email protected]>
+
+- Add CVE-2025-22869.patch to fix Denial of Service in the Key
+ Exchange of golang.org/x/crypto/ssh (bsc#1239342, CVE-2025-22869)
+
+-------------------------------------------------------------------
@@ -105 +146 @@
- * Update github.com/go-git/go-git/v5 to 5.16.5
+ * Update github.com/go-git/go-git/v5 to 5.16.5 (bsc#1258095, CVE-2026-25934)
@@ -110,0 +152 @@
+ (bsc#1253611, CVE-2025-47913)
@@ -152 +194 @@
- * Update golang.org/x/crypto to v0.37.0
+ * Update golang.org/x/crypto to v0.37.0 (bsc#1238702, CVE-2025-22870)
@@ -210 +252 @@
- * Update golang.org/x/crypto from v0.32.0 to v0.36.0
+ * Update golang.org/x/crypto from v0.32.0 to v0.36.0 (bsc#1239342,
CVE-2025-22869)
Old:
----
amazon-ssm-agent-3.3.4851.0.tar.gz
New:
----
amazon-ssm-agent-3.3.5226.0.tar.gz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ amazon-ssm-agent.spec ++++++
--- /var/tmp/diff_new_pack.4WhbZA/_old 2026-09-07 11:33:02.137790969 +0200
+++ /var/tmp/diff_new_pack.4WhbZA/_new 2026-09-07 11:33:02.138791004 +0200
@@ -17,7 +17,7 @@
Name: amazon-ssm-agent
-Version: 3.3.4851.0
+Version: 3.3.5226.0
Release: 0
Summary: Amazon Remote System Config Management
License: Apache-2.0
++++++ amazon-ssm-agent-3.3.4851.0.tar.gz -> amazon-ssm-agent-3.3.5226.0.tar.gz
++++++
/work/SRC/openSUSE:Factory/amazon-ssm-agent/amazon-ssm-agent-3.3.4851.0.tar.gz
/work/SRC/openSUSE:Factory/.amazon-ssm-agent.new.1265/amazon-ssm-agent-3.3.5226.0.tar.gz
differ: char 15, line 1
