SUSE-SU-2026:5067-1: Security update for amazon-ssm-agent
This update for amazon-ssm-agent fixes the following issues:
- CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253611). - CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1254082). - CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253946).
Update to version 3.3.5678.0:
Bump golang.org/x/sys from v0.47.0 to v0.48.0 Bump golang.org/x/net from v0.57.0 to v0.60.0 Upgrade Go version to 1.26.10 Bug fixes for aws-sdk-go-v2 Upgrade Go version to 1.26.9
Other sources
This update for amazon-ssm-agent fixes the following issues: CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253611). CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1254082). CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253946). Update to version 3.3.5678.0: Bump golang.org/x/sys from v0.47.0 to v0.48.0 Bump golang.org/x/net from v0.57.0 to v0.60.0 Upgrade Go version to 1.26.10 Bug fixes for aws-sdk-go-v2 Upgrade Go version to 1.26.9
— SUSE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/amazon-ssm-agentto a version that resolves this vulnerability.Fixed in 3.3.5678.0-4.55.1 - Upgrade
Upgrade
golang.org/x/netto a version that resolves this vulnerability.Fixed in v0.60.0 - Upgrade
Upgrade
golang.org/x/systo a version that resolves this vulnerability.Fixed in v0.48.0 - Upgrade
Upgrade
Goto a version that resolves this vulnerability.Fixed in 1.26.10 - Upgrade
Upgrade
Goto a version that resolves this vulnerability.Fixed in 1.26.9 - Upgrade
Upgrade
amazon-ssm-agentto a version that resolves this vulnerability.Fixed in 3.3.5678.0Patch SUSE-SLE-Module-Public-Cloud-12-2026-5067
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which systems are covered by this advisory?
The advisory applies to amazon-ssm-agent from the SUSE Public Cloud Module 12 on aarch64 and x86_64 architectures.
What version should be installed to obtain the fixes?
Update amazon-ssm-agent to version 3.3.5678.0.