Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package traefik for openSUSE:Factory checked in at 2026-10-26 14:17:03 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/traefik (Old) and /work/SRC/openSUSE:Factory/.traefik.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "traefik" Mon Oct 26 14:17:03 2026 rev:60 rq:1392679 version:3.7.16 Changes: -------- --- /work/SRC/openSUSE:Factory/traefik/traefik.changes 2026-10-07 19:36:06.263438125 +0200 +++ /work/SRC/openSUSE:Factory/.traefik.new.2252680/traefik.changes 2026-10-26 14:17:10.150029813 +0100 @@ -1,0 +2,42 @@ +Sat Oct 24 17:55:48 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to version 3.7.16 + (covers upstream 3.7.14, 3.7.15 and 3.7.16) + * CVE-2026-114635: snicheck skipped when request TLS state + is nil, bypassing authentication (boo#1286655) + * CVE-2026-114636: ingress-nginx ssl-passthrough sibling + HTTP router served auth-protected backends (boo#1286656) + * CVE-2026-114637: FastProxy pool leaked connection-bound + NTLM/Negotiate identity to other clients (boo#1286657) + * CVE-2026-114638: colliding ingress-nginx auth-tls-secret + names merged two client CAs into one option (boo#1286658) + * CVE-2026-114639: preauthenticated Negotiate contaminated + the shared backend connection pool (boo#1286659) + * CVE-2026-114640: ingress-nginx forwarded forged + Ssl-Client-* identity headers on HTTP route (boo#1286660) + * CVE-2026-114641: unsynchronized write to the + per-connection sticky round tripper (boo#1286661) + * CVE-2026-114642: NTLM/Kerberos sticky round tripper not + keyed by service, reusing one TLS config (boo#1286663) + * CVE-2026-114656: negated Host matchers counted as served + domains, skipping client-cert checks (boo#1286664) + * Upstream advisory GHSA-p8wx-ph99-xgcr (no CVE assigned): + ingress-nginx mTLS silently disabled for a host missing + the auth-tls annotation + * Upstream advisory GHSA-ww7c-q3mv-xx22 (no CVE assigned): + FastProxy data race after HTTP/1 upgrade panicking + the process + * Upstream advisory GHSA-28hp-c82p-8vqj (no CVE assigned): + TLS-option cache hit skipped cross-namespace + authorization check + * Upstream advisory GHSA-hrpp-p4fc-wwf8 (no CVE assigned): + ForwardAuth shared the auth-server pool across clients, + leaking NTLM/Negotiate-bound identity + * Support NTLM and Kerberos authentication in ForwardAuth + and ingress-nginx auth-url + * Reject CONNECT requests before reaching the muxer; bump + golang.org/x/net to v0.60.0 and lego to v5.5.2 + * Many more fixes and improvements; see upstream release + notes for the full list + +------------------------------------------------------------------- Old: ---- traefik-v3.7.13.src.tar.gz New: ---- traefik-v3.7.16.src.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ traefik.spec ++++++ --- /var/tmp/diff_new_pack.p7ojDy/_old 2026-10-26 14:17:12.396123789 +0100 +++ /var/tmp/diff_new_pack.p7ojDy/_new 2026-10-26 14:17:12.398123873 +0100 @@ -23,11 +23,10 @@ %define buildmode pie %endif Name: traefik -Version: 3.7.13 +Version: 3.7.16 Release: 0 Summary: The Cloud Native Application Proxy License: MIT -Group: Productivity/Networking/Web/Proxy URL: https://traefik.io/ # set the desired version in the spec-file # download the source files and create the vendor tarball with "osc service mr" @@ -38,11 +37,11 @@ Source4: %{name}-user.conf Source5: 90-%{name}.conf Source6: %{name}.logrotate +BuildRequires: (golang(API) >= 1.26) BuildRequires: go-bindata BuildRequires: golang-packaging BuildRequires: systemd-rpm-macros BuildRequires: sysuser-tools -BuildRequires: (golang(API) >= 1.26) Requires: logrotate Recommends: podman Conflicts: traefik2 ++++++ traefik-v3.7.13.src.tar.gz -> traefik-v3.7.16.src.tar.gz ++++++ /work/SRC/openSUSE:Factory/traefik/traefik-v3.7.13.src.tar.gz /work/SRC/openSUSE:Factory/.traefik.new.2252680/traefik-v3.7.16.src.tar.gz differ: char 12, line 1 ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/traefik/vendor.tar.gz /work/SRC/openSUSE:Factory/.traefik.new.2252680/vendor.tar.gz differ: char 5, line 1
