FlawAtlas
Search the atlas
SUSE-SU-2025:02289-2 Not scored

Security update for docker

This update for docker fixes the following issues: Update to Docker 28.2.2-ce (bsc#1243833, bsc#1242114): - CVE-2025-0495: Fixed credential leakage to telemetry endpoints when credentials allowed to be set as attribute values in cache-to/cache-from configuration.(bsc#1239765) - CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction (bsc#1241830). Other fixes: - Update to docker-buildx v0.22.0. - Always clear SUSEConnect suse_* secrets when starting containers (bsc#1244035). - Disable transparent SUSEConnect support for SLE-16. (jsc#PED-12534) - Now that the only blocker for docker-buildx support was removed for SLE-16, enable docker-buildx for SLE-16 as well. (jsc#PED-8905) - SUSEConnect secrets fails in SLES rootless docker containers (bsc#1240150).

Exploit probability Not scored
Published July 16, 2025
Required by Not available
Last source change March 23, 2026

02 / AFFECTED SOFTWARE

Affected packages

SUSE:Enterprise Storage 7.1 docker
SUSE:Enterprise Storage 7.1 docker-stable
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS docker
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS docker-stable
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS docker
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS docker-stable
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS docker
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS docker-stable
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS docker
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS docker-stable
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS docker
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS docker-stable
SUSE:Linux Enterprise Server 15 SP3-LTSS docker
SUSE:Linux Enterprise Server 15 SP3-LTSS docker-stable
SUSE:Linux Enterprise Server 15 SP4-LTSS docker
SUSE:Linux Enterprise Server 15 SP4-LTSS docker-stable
SUSE:Linux Enterprise Server 15 SP5-LTSS docker
SUSE:Linux Enterprise Server 15 SP5-LTSS docker-stable
SUSE:Linux Enterprise Server for SAP Applications 15 SP3 docker
SUSE:Linux Enterprise Server for SAP Applications 15 SP3 docker-stable
SUSE:Linux Enterprise Server for SAP Applications 15 SP4 docker
SUSE:Linux Enterprise Server for SAP Applications 15 SP4 docker-stable
SUSE:Linux Enterprise Server for SAP Applications 15 SP5 docker
SUSE:Linux Enterprise Server for SAP Applications 15 SP5 docker-stable

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities SUSE-SU-2025:02289-2

This update for docker fixes the following issues: Update to Docker 28.2.2-ce (bsc#1243833, bsc#1242114): - CVE-2025-0495: Fixed credential leakage to telemetry endpoints when credentials allowed to be set as attribute values in cache-to/cache-from configuration.(bsc#1239765) - CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction (bsc#1241830). Other fixes: - Update to docker-buildx v0.22.0. - Always clear SUSEConnect suse_* secrets when starting containers (bsc#1244035). - Disable transparent SUSEConnect support for SLE-16. (jsc#PED-12534) - Now that the only blocker for docker-buildx support was removed for SLE-16, enable docker-buildx for SLE-16 as well. (jsc#PED-8905) - SUSEConnect secrets fails in SLES rootless docker containers (bsc#1240150).

View original source

05 / REFERENCES

Further evidence