Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package dracut for openSUSE:Factory checked in at 2026-08-12 16:10:44 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/dracut (Old) and /work/SRC/openSUSE:Factory/.dracut.new.17972 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "dracut" Wed Aug 12 16:10:44 2026 rev:265 rq:1370698 version:112+suse.29.gc0c5e1d Changes: -------- --- /work/SRC/openSUSE:Factory/dracut/dracut.changes 2026-08-09 21:34:02.071510581 +0200 +++ /work/SRC/openSUSE:Factory/.dracut.new.17972/dracut.changes 2026-08-12 16:11:14.883282551 +0200 @@ -1,0 +2,9 @@ +Tue Aug 11 08:51:45 UTC 2026 - [email protected] + +- Update to version 112+suse.29.gc0c5e1d + * fix(base): sanitize message written by die() to the emergency hook + +- CVE-2026-15816: root code execution via unescaped error message written to + sourced emergency hook script in die() (bsc#1274432) + +------------------------------------------------------------------- Old: ---- dracut-112+suse.28.g84b3ea7.tar.xz New: ---- dracut-112+suse.29.gc0c5e1d.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ dracut.spec ++++++ --- /var/tmp/diff_new_pack.sJbd4m/_old 2026-08-12 16:11:16.363344362 +0200 +++ /var/tmp/diff_new_pack.sJbd4m/_new 2026-08-12 16:11:16.367344529 +0200 @@ -26,7 +26,7 @@ %endif Name: dracut -Version: 112+suse.28.g84b3ea7 +Version: 112+suse.29.gc0c5e1d Release: 0 Summary: Event driven initramfs infrastructure License: GPL-2.0-only AND GPL-2.0-or-later AND LGPL-2.1-or-later ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.sJbd4m/_old 2026-08-12 16:11:16.443347703 +0200 +++ /var/tmp/diff_new_pack.sJbd4m/_new 2026-08-12 16:11:16.447347870 +0200 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/opensuse/dracut-ng.git</param> - <param name="changesrevision">84b3ea7acb73aa9843ccca59fcb6bc12255c37d0</param></service></servicedata> + <param name="changesrevision">c0c5e1d368ebf9e44629c5735a773c064f6d5ebb</param></service></servicedata> (No newline at EOF) ++++++ dracut-112+suse.28.g84b3ea7.tar.xz -> dracut-112+suse.29.gc0c5e1d.tar.xz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/dracut-112+suse.28.g84b3ea7/modules.d/80base/dracut-lib.sh new/dracut-112+suse.29.gc0c5e1d/modules.d/80base/dracut-lib.sh --- old/dracut-112+suse.28.g84b3ea7/modules.d/80base/dracut-lib.sh 2026-08-07 07:35:54.000000000 +0200 +++ new/dracut-112+suse.29.gc0c5e1d/modules.d/80base/dracut-lib.sh 2026-08-11 09:31:06.000000000 +0200 @@ -433,7 +433,7 @@ } > /dev/kmsg { - echo "warn dracut: FATAL: \"$*\"" + printf "warn dracut: FATAL: '%s'\n" "$(escape "$*")" echo "warn dracut: Refusing to continue" } >> $hookdir/emergency/01-die.sh [ -d /run/initramfs ] || mkdir -p -- /run/initramfs
