Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Wicked Security Update Fixes Remote Shell Injection
published 4 months ago
Summary
This update for Wicked fixes a security risk that could allow hackers to run commands on your system. The update is important for systems that use Wicked, especially those connected to the internet. To stay secure, apply this update as soon as possible.
What to do
- Update opensuse wicked to version 0.6.79-bp160.1.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| openSUSE:Leap 16.0 | opensuse | wicked |
< 0.6.79-bp160.1.1 Fix: upgrade to 0.6.79-bp160.1.1
|
Original advisory text
Security update for wicked
This update for wicked fixes the following issues:
Changes in wicked:
- Update to version 0.6.79
- Fix an indirect remote shell command injection via unsanitized
dhcp strings and leaseinfo dump (bsc#1265221,CVE-2026-44932):
- Fix to escape single-quotes in leaseinfo dump output used by the
`wicked test dhcp4` and `wicked test dhcp6` and written to the
/run/wicked/leaseinfo.* files, e.g. to pass them to netconfig.
A netconfig modify filtered for strict key='value' lines without
any escaped quotes and discarded these lines already before.
- Fix posix-tz-dbname and tz-string option processing checks to
permit only valid characters according to RFC4833.
- Discard string values containing single-quotes in other options.
- Trigger to regenerate initrd that may contain wicked binaries on
updates from wicked versions <= 0.6.78.
Changes in wicked:
- Update to version 0.6.79
- Fix an indirect remote shell command injection via unsanitized
dhcp strings and leaseinfo dump (bsc#1265221,CVE-2026-44932):
- Fix to escape single-quotes in leaseinfo dump output used by the
`wicked test dhcp4` and `wicked test dhcp6` and written to the
/run/wicked/leaseinfo.* files, e.g. to pass them to netconfig.
A netconfig modify filtered for strict key='value' lines without
any escaped quotes and discarded these lines already before.
- Fix posix-tz-dbname and tz-string option processing checks to
permit only valid characters according to RFC4833.
- Discard string values containing single-quotes in other options.
- Trigger to regenerate initrd that may contain wicked binaries on
updates from wicked versions <= 0.6.78.
References
- https://bugzilla.suse.com/1265221 Third Party Advisory
- https://www.suse.com/security/cve/CVE-2026-44932 URL
Timeline
Published12 Jun 2026
Updated13 Jun 2026
First seen13 Jun 2026
Sources
openSUSE-SU-2026:20949-1 · OSV
Track software like this
Free during beta