documentation.suse.com / SUSE Solution Security Risk Report 2023
Documentation survey

SUSE Solution Security Risk Report 2023

SUSE Best Practices

Security

Author
Stoyan Manolov, Head of Solution Security (SUSE)
SUSE logo
All SUSE Products
Date: 2024-05-27

SUSE Solution Security is committed to delivering best-in-class software security to its customers and to the open source community. The primary objectives are to treat software security as an ongoing and continual process.

The goal of this report is to provide a summary of all security vulnerabilities which affected SUSE products in calendar year 2023.

Disclaimer: This document is part of the SUSE Best Practices series. All documents published in this series were contributed voluntarily by SUSE employees and by third parties. If not stated otherwise inside the document, the articles are intended only to be one example of how a particular action could be taken. Also, SUSE cannot verify either that the actions described in the articles do what they claim to do or that they do not have unintended consequences. All information found in this document has been compiled with utmost attention to detail. However, this does not guarantee complete accuracy. Therefore, we need to specifically state that neither SUSE LLC, its affiliates, the authors, nor the translators may be held liable for possible errors or the consequences thereof.

1 Motivation

SUSE Solution Security is committed to delivering best-in-class software security to customers and to the open source community. The primary objectives are to treat software security as an ongoing and continual process that never ends. This implies to:

  • promptly react to security incidents and deliver premium quality security updates.

  • continuously improve the security-related functionality in SUSE products.

  • continuously contribute to the rapidly growing maturity of open source software.

  • respect the open source software security principles of openness, transparency and traceability.

The SUSE Security Team addresses all aspects of software security on an ongoing basis. Software security cannot be thought of as a state you can achieve at a specific point in time. Instead, it is a process that must be executed with professional expertise and continuous development. This persistent focus is what has given open source software, Linux and SUSE an excellent reputation for security. Our SUSE Solution Security team is responsible for handling all SUSE product-related security incidents. In that team, clear and well-defined roles are assigned for tracking new incidents and coordinating needed updates. The team closely collaborates with all SUSE software engineer specialists.

The objective of this report is to provide a summary of all security vulnerabilities which affected SUSE products in calendar year 2023. We will go into details on the high impact vulnerabilities and elaborate on how we responded to these incidents.

2 Background

A modern Linux operating system, such as SUSE Linux Enterprise Server for enterprise use or the openSUSE community distribution for home use, features a rich set of security programs and functions. Those range from access control, intrusion prevention and detection, flexible and trustworthy authentication mechanisms, encryption for files and network connections, file integrity checking utilities, to network analysis tools and monitoring/logging utilities for your system. To complement this, there are advanced tools that help you to securely configure and administer your system, and to securely download and install update packages. These utilities are standard in SUSE products. The update packages fix security bugs that have been found after your product has been released. The security features of your Linux system are waiting for you to explore them. SUSE encourages our customers to take advantage of them to further improve the level of privacy and security that is built into every system by default.

Programs are usually written by humans, and humans make mistakes. By consequence, all software can contain errors. Some of these errors appear as instabilities (the software or the entire system crashes), while others may not have any apparent, visible effect. However, some software errors may introduce a security risk. A local or a remote attacker may be able to feed specially drafted data to the software which takes advantage of the programming error. In the case of a remotely exploitable bug, the data comes from an attached network device, such as a cable or DSL modem, or a wireless network interface card. The application then either crashes, resulting in a Denial of Service (DoS) attack. Or it executes code that originates from the attacker, transferring control over the execution context from what the programmer intended to what the attacker has in mind for the exploitation of the error. Depending on the functionality of the software, the resulting security breach may pose a low or high security risk to your data and system, potentially giving an attacker the opportunity to delete, modify or even steal your data or exploit the system for their own purposes.

The SUSE Solution Security team is responsible for handling all SUSE product-related security incidents. In that team, clear and well-defined roles are assigned for tracking new incidents and coordinating needed updates. The team works with all SUSE engineering software specialists.

We use multiple sources to understand security incidents. These sources include the Mitre and NVD Common Vulnerabilities and Exposures (CVE) databases, various security mailing lists (OSS security, Linux distros, distros, bugtraq, and full-disclosure), direct reports, and other Linux vendors databases. We are also part of various pre-notification mailing lists for software components, like Xen, Samba, X.ORG. Confidential pre-notifications about vulnerabilities will be treated according to established responsible disclosure procedures.

3 Incident rating and tracking

We rate the severity of incidents with two different systems, a simplified rating system and the Common Vulnerability Scoring System (CVSS) v3.1 scoring system. The CVSS is an open framework for communicating the characteristics and severity of software vulnerabilities. It is being developed by the US-based non-profit organization FIRST.org: Its main goal is to assign the right score to a vulnerability to help security administrators prioritize responses and resources to specific threats. CVSS v3.1 scoring consists of three metric groups: Base, Temporal, and Environmental. The Base group represents the intrinsic qualities of a vulnerability that are constant over time and across user environments. The Temporal group reflects the characteristics of a vulnerability that change over time. The Environmental group represents the characteristics of a vulnerability that are unique to a user's environment. The Base metrics produce a score ranging from 0 to 10, which can then be modified by scoring the Temporal and Environmental metrics. A CVSS score is also represented as a vector string, a compressed textual representation of the values used to derive the score. Today, SUSE uses the Base score methodology to evaluate vulnerabilities throughout the support life cycle of our products. SUSE keeps the right to adjust the final score of the vulnerability as more details become known and available throughout the analysis. The most current CVSS resources can be found at https://www.first.org/cvss/ . The CVSS v3.1 calculator used by SUSE could be found at https://www.first.org/cvss/calculator/3.1. The framework is measuring the severity of a given vulnerability, not the associated risk alone. The scoring of any vulnerability may vary with different analysts hence the final score could be slightly different between vendors impacted by that vulnerability. For a more accurate assessment of the impact, vendors and application owners must always consider factors outside of CVSS such as exposure or threat.

The security incidents are tracked in our own workflow system. Technical details are tracked in the SUSE bug-tracking system, and the updated software package is built, processed, and published by our internal Open Build System. Internal Service Level Agreements (SLAs) corresponding to the severity rating are monitored and reviewed regularly. Our packagers backport the required security fixes to our version of the software. To protect the stability of our customer setups, we only rarely do minor version upgrades. After receiving fixes for the affected software, four eye reviews cross-check the source patches. Several automated checks verify source and binary compatibility and the completeness of patch meta information. They also check whether patches can be installed without problems. Dedicated QA teams provide integration, bug fix, and regression testing for all updates before they are released to our customers. After the release of an update, automated processes publish the updates, update notices, and cross reference information on our CVE index pages and machine-readable OVAL and CVRF XML information.

For a better understanding of our classification mechanisms, we have described our rating system along with the equivalency of each rating to the CVSS v3.1 scoring calculator:

Table 1: Incident rating and CVSS score
RatingCVSS ScoreDefinition
Critical9.0 and aboveThis rating is given to flaws that could be easily exploited by a remote unauthenticated attacker and lead to system compromise (arbitrary code execution) without requiring user interaction. These are the types of vulnerabilities that can be exploited by worms. Flaws that require an authenticated remote user, a local user, or an unlikely configuration are not classed as critical impact.
Important7.0 to 8.9This rating is given to flaws that can easily compromise the confidentiality, integrity, or availability of resources. These are the types of vulnerabilities that allow local users to gain privileges, allow authenticated remote users to execute arbitrary code, and finally allow unauthenticated remote users to view resources that should otherwise be protected by authentication and to cause a denial of service without user interaction.
Moderate 4.0 to 6.9This rating is given to flaws that may be more difficult to exploit but could still lead to some compromise of the confidentiality, integrity, or availability of resources, under certain circumstances. These are the types of vulnerabilities that could have had a critical impact or important impact but are less easily exploited based on a technical evaluation of the flaw, or affect unlikely configurations. Local, persistent (service needs to be restarted) denial of service conditions for basic system services (kernel, systemd, polkit, dbus, etc.) with and without user interaction should also be rated moderate.
Low up to 3.9 This rating is given to all other issues that have a security impact. These are the types of vulnerabilities that are believed to require unlikely circumstances to be able to be exploited, or where a successful exploit would give minimal consequences.

4 When to prefer version upgrades over backports

It is a general policy rule that no new upstream versions of a package are introduced into our enterprise products. This rule is not an absolute rule however. For certain types of packages, in particular antivirus software, security concerns weigh heavier than the conservative approach that is preferable from the perspective of quality assurance. For packages in that class, occasionally newer versions are introduced to a released version of an enterprise product line.

Sometimes also for other package types the decision is made to introduce a new version instead of a backport. This happens when producing a backport is not economically feasible or if there is a very relevant technical reason for introducing the newer version.

5 Major security vulnerabilities in 2023

5.1 CVE-2023-38408: Remote code execution in OpenSSH's forwarded ssh-agent

Overview

In July 2023, The Qualys Threat Research Unit (TRU) has discovered a remote code execution vulnerability in OpenSSH’s forwarded ssh-agent. This vulnerability allows a remote attacker to potentially execute arbitrary commands on vulnerable OpenSSH’s forwarded ssh-agent.

Attackers must be able to access a host via SSH to escalate privileges on that host by exploiting a flaw in the pkcs11 module loading of the SSH agent. As the pkcs11 agent helper allowed loading of system dynamic libraries, certain loading patterns and problems in system libraries could be used to gain code execution as the pkcs11 helper.

Solution

Installing the updated packages provided by SUSE is sufficient to fix the problem. Use

zypper lp -a --cve=CVE-2023-38408

to search for the specific patch information. A restart of the service is not required.

Note that for any SPx (Service Pack level) which is no longer in general support, you might need an LTSS or ESPOS subscription to obtain the update. See the SUSE CVE Page link in the References paragraph below for more details about each SPx.

Workaround

In case PKCS11 smartcards are not used for SSH agent support, remove /usr/lib/ssh/ssh-pkcs11-helper from the system until maintenance updates have been released.

The workaround prevents exploitation and might be the right thing to do given how easy the exploit it, but customers must be aware that this will break functionality until the update is installed.

References

5.2 CVE-2023-20593: AMD CPU: "ZenBleed" - VZEROUPPER does not clear upper bits under certain conditions

Overview

Researchers at Google have discovered Zenbleed, a hardware bug causing corruption of the vector registers.

When a VZEROUPPER instruction is discarded as part of a bad transient execution path, its effect on internal tracking is not unwound correctly. This manifests as the wrong micro-architectural state becoming architectural, and corrupting the vector registers.

Note: While this malfunction is related to speculative execution, this is not a speculative side-channel vulnerability.

The corruption is not random. It happens to be stale values from the physical vector register file, a structure competitively shared between sibling threads. Therefore, an attacker can directly access data from the sibling thread, or from a more privileged context.

Solution

Packages containing a fix for this security issue were made available quickly. To apply the fixes, install the new packages with the following command:

zypper patch --cve=CVE-2023-20593

References

5.3 CVE-2023-44487: HTTP/2 Rapid Reset attack

Overview

In August 2023, Amazon Web Services, Cloudflare and Google noticed a new type of distributed denial-of-service (DDoS) attacks on their networks. These attacks had record breaking sizes, three times bigger than previous attacks.

As it turned out, the problem that was exploited was not an implementation bug, but an issue inside the internal design of the HTTP/2 protocol itself. The principle of the Rapid Reset attack is quite simple.

With HTTP/1.1, all requests to the server are processed serially on one connection. The client is sending a request, the server will read and process it and send a response. Then the next request is processed. The newer HTTP/2 protocol allows multiple bidirectional streams via a single TCP connection. A client can therefore send several requests at the same time, which are then answered by the server. This results in a much higher utilization of each connection.

The Rapid Reset attack now uses the fact that each of those inner streams can be canceled at any point in time via an RST_STREAM frame. This can be done even before data has been transmitted back to the client. The problem that arises is as follows: The request is processed by the server, and for this purposes, resources are allocated per stream. These resources must be deleted again a moment later when the RST_STREAM frame has arrived.

This comes at almost no cost for the attacker, but depending on the server implementation, it can result in significant resource utilization for the victim.

Solution

Several upstream projects updated their code to implement or extent the mitigation mechanisms that prevent or lower the impact of those attacks. This is usually done by setting a reset rate limit.

To install the respective patches, use:

zypper patch --cve=CVE-2023-44487

References

5.4 CVE-2023-48795: SSH prefix truncation attack (aka Terrapin Attack)

Overview

Security researchers from the Ruhr University Bochum have published a new attack on the SSH v2 protocol, which allows active person-in-the-middle attackers to impact SSH connections by removing initial encrypted SSH packets.

This can lead to protocol security downgrades or similar problems. Changing SSH packages or injecting new encrypted SSH packages is not possible with this attack.

Software on all SUSE Linux Enterprise versions were originally affected. The problem is inherent to the existing SSH v2 protocol, so new protocol addition(s) and enforcement of them are needed to avoid the problem.

The protocol vulnerability needs to be exploited in tandem with specific SSH ciphers. The chacha20-poly1305 SSH cipher is the one that was shown to be exploitable most easily, also other ciphers using Encrypt-Then-MAC Message Authentication Codes (MACs) might be exploitable under certain conditions.

Note that the ciphers themselves are not problematic. They could lead to exploitable scenarios only in combination with the SSH v2 protocol weakness.

Find below a list of SSH v2 implementations that are shipped by SUSE and their exploitability status:

  • openssh: is affected in all shipping versions up to 9.5p1. All versions of SUSE Linux Enterprise Server are affected.

  • putty: is affected. It is shipped via SUSE PackageHub 15.

  • libssh.org (aka libssh): supports chacha20-poly1305 since 0.8.0. SUSE Linux Enterprise Server 12 SP5 and SUSE Linux Enterprise Server 15 SP1 and newer are affected.

  • libssh2.org (aka libssh2_org): does not implement the chacha20-poly1305 cipher in the newest release 1.11.0. ETM MACs were only implemented in 1.11.0, therefore versions before 1.11.0 are not affected. SUSE Linux Enterprise Server 12 SP5 and SUSE Linux Enterprise Server 15 come with version 1.11.0 and are affected by this problem.

  • jsch (Java SSH): chacha20-poly1305 was added with version 0.1.66, ETM MACs in 0.1.58. Versions from 0.1.58 to current 0.2.9 are considered affected. SUSE currently does not ship affected versions of jsch.

  • proftpd: its mod_sftp module, which is shipped via SUSE PackageHub 15, is affected. It supports ETM MACs, but not chacha20-poly1305. The module, however, is not enabled by default.

  • golang.org/x/crypto/ssh: The Golang SSH module is also affected. The SSH module is used and/or included by a long list of software written in GO.s of an issue, as in scenarios relying on secure boot, like public systems.

Solution

The solution is to install respective updates on server and client machines.

openssh updates were provided on December 18th. Other SSH software was also updated after backporting upstream security fixes. Note that both SSH clients and servers must be adjusted for the protocol adjustments to be effective.

Mitigations like removal of ciphers can be done on either side to be effective. Because rollout may take some time and not all clients are under administrative control, configuration adjustments such as removing ciphers should be made to avoid using affected ciphers (see the References section below).

References

5.5 TTY injection via sudo

Overview

The Linux TTY subsystem allows pushing back keypresses into the TTY stack. This is a not well-known feature and may lead to unexpected consequences or potential attacks. As an example, in cases where untrusted code using a command such as sudo is executed, the untrusted code could push keypresses into the TTY stack, which could then be executed after the sudo execution completes.

While sudo is commonly used for transitioning to root where this would not be an issue, other sudo scenarios are possible where this could be used to escalate privileges. The untrusted code would then be able to execute commands as root using this attack.

To avoid this injection, sudo has the option to create a new pseudo terminal device (PTY), which is discarded after running sudo, and would not be affected by this keypress push back attack. However, note that this might impact terminal output or the use of interactive keys like backspace or delete.

Solution

Add the line

Default use_pty

to the /etc/sudoers configuration file using the visudo command. Starting with sudo version 1.9.14p1, this setting is the default for new installations.

References

5.6 CVE-2022-40982: CPU transient information leakage from GATHER instructions aka Gather Data Sampling aka DOWNFALL

Overview

Security researcher Daniel Moghimi has identified a transient information leakage from GATHER instructions on modern Intel CPUs (Skylake to Tiger Lake generations).

This can be used to reveal secret data contained in vector registers, which can essentially be any information due to the use of these instructions in memory copy operations. This information leak can cross process and privilege boundaries.

Solution

Intel has released CPU microcode to mitigate these issues. The CPU microcode is mandatory for mitigation, the mitigation is enabled by default.

Updated ucode-intel packages released by SUSE, version 20230808 or later, contain the mitigations. If there is no CPU Microcode available, the avx instructions can be hidden from CPUID reporting by the kernel.

In addition, kernel and XEN changes are being applied to:

  • allow disabling the mitigation.

  • report affectedness of the CPU and state of the mitigation.

SUSE will release kernel and XEN updates.

Mitigation reporting

The mitigation state is reported via the sysfs file /sys/devices/system/cpu/vulnerabilities/gather_data_sampling. The file can report the following states:

  • Not affected

    This processor is not vulnerable.

  • Vulnerable

    This processor is vulnerable and the mitigation is disabled.

  • Vulnerable: No microcode

    This processor is vulnerable and the microcode is missing mitigation.

  • Mitigation: Microcode

    This processor is vulnerable and the mitigation is in effect.

  • Mitigation: Microcode (locked)

    This processor is vulnerable and the mitigation is in effect and cannot be disabled.

  • Unknown: Dependent on hypervisor status

    Running on a virtual guest processor that is affected but with no way to know if the host processor is mitigated or vulnerable. This can happen if the hypervisor does not expose necessary MSR registers to guests.

Kernel command line options:

  • gather_data_sampling=off

    Switch off this specific mitigation (the default is on).

  • mitigations=off

    Switch off all CPU transient execution mitigations, including the gather_data_sampling one.

  • clearcpuid=avx

    This option hides the AVX instructions from CPUID flags. Therefore, existing optimized code will not use AVX instructions, or fallback to other variants, and thus not expose the vulnerability.

Performance considerations

The mitigation impacts performance of the GATHER parts of the AVX2 and AVX512 instructions, and potentially operations that are translated within the CPU to use these vector instructions (for example potentially REP MOVS, or other instruction sets like SSE).

According to the technical paper linked from the Intel Product Security Center Advisory listed below, the impact might be as follows:

When the mitigation is enabled, there is additional latency before results of the gather load can be consumed. Although the performance impact to most workloads is minimal, specific workloads may show performance impacts of up to 50%.

References

5.7 CVE-2023-24932: BlackLotus bootkit

Overview

A UEFI bootkit called BlackLotus has been spotted in the wild, which uses buggy secure boot binaries to bypass the UEFI secure boot chain. While this component is not shipped by SUSE, to ensure the integrity of the UEFI secure boot chain, the affected components will need to be excluded from the UEFI secure boot space. Any UEFI secure boot-enabled installation could be impacted by this vulnerability.

Solution

You can exclude affected components via a so-called DBX file which blocks UEFI binaries using signatures/has. DBX file updates can be delivered and deployed in different ways:

  1. Via BIOS or Windows updates

    The DBX file can be delivered via BIOS updates. In case of a dual boot system, it is delivered with Windows updates. If it is installed via BIOS or Windows updates, no additional deployment on Linux is required.

  2. Via the firmware update tool (fwupd)

    Download the current DBX revocation list from https://uefi.org/revocationlistfile  for the respective hardware platform. Use the command fwupdmgr install x64_DBXUpdate.bin and follow the prompts. This update method only works starting with SUSE Linux Enterprise 15 SP3 based products and newer.

    Note: This is a manual deployment and is only required if there are concerns about UEFI bootkits, as they are not a common attack scenario.

References

5.8 CVE-2023-29552: New SLP-based traffic amplification attack

Overview

Security researchers Pedro Umbelino at BitSight and Marco Lux at Curesec have published a new network traffic amplification attack using the Service Location Protocol (SLP, RFC 2608). This new attack allows for up to 2200x amplification, enabling very effective distributed denial of service attacks.

This flaw is a network protocol design flaw, a software fix is not easily possible.

Solution

The SLP protocol IP ports 427, both UDP and TCP, outside of your network boundary should be blocked or filtered.

References

6 Vulnerability management in 2023

The SUSE Solution Security team constantly monitors all the software components used in our products for security issues. More and improved tools are now available to find zero-day vulnerabilities and scan for existing vulnerabilities. Such tools can check and report whether the application code written conforms to standard security best practices or whether there are major holes in potential attack vectors such as buffer overflow, denial of service, or unwanted elevated access. It is clear that developers are becoming more and more security-aware and that the quality of the code being developed has improved significantly, both in quantity and quality. While we are seeing an increasing number of important vulnerabilities, the number of critical vulnerabilities is decreasing year over year.

Table 2: Vulnerabilities with a unique CVE identified, impacting SUSE products in 2023
LowModerateImportantCritical
1235973879
Table 3: Security updates and patches released to fix these vulnerabilities in 2023
LowModerateImportantCritical
49718213737
Security updates and patches released per month in 2023
Figure 1: Security updates and patches released per month in 2023

7 Securing the software supply chain

Securing our software supply chain is a top priority for SUSE to protect our customers from security risks, known and zero-day vulnerabilities. Ensuring that no threat actor can inject malicious code into our build service systems is certified by industry leading security certifications. Our teams continually work to certify all SUSE products, and develop security solutions to offer our customers the highest level of trust and reliability.

7.1 Proactive review of code

Our skilled team of security engineers regularly reviews the code we ship. We harden our products and conduct security audits on selected packages. Packages and products are continually reviewed to ensure we protect our customers' systems with the latest state of the art technology. To this end, we have introduced an automation setup that notifies our team of potentially dangerous changes in existing or new packages (for example important permission changes) and triggers an audit if necessary.

Over the last year, our proactive Security team has found and assigned CVE IDs to a number of vulnerabilities which document the more important findings. Find more information on our blog page.

7.2 Software Bill of Materials (SBOM) available

Following recent supply chain attacks and increasing security automation, software inventory management in particular is becoming increasingly important. Governments and other regulated industries now require the publication of a so-called Software Bill Of Materials (SBOM) for software products.

Various SBOM formats have appeared on the market. SUSE has begun releasing SBOM in the two formats most commonly used by operating system vendors: SPDX 2.0 and CycloneDX. SPDX 2.0 has even been standardized in ISO/ICE 5962:2021.

SUSE Linux Enterprise product media:

For our product media (ISO images), the SBOM materials are available from our download Web site in both SPDX 2.0 and CycloneDX formats. The granularity of this data is currently at RPM level.

SUSE Linux Enterprise BCI container images:

For our BCI container images, the SBOM data is delivered in the sigstore attestation blob in SPDX 2.0 format. The data is supposed to be processed automatically, but manual retrieval is also possible. Because of multi-arch container manifests it is a two step operation.

Example call:

Use the external crane tool to extract the x86_64 container part, the cosign tool to retrieve and verify the attestation, and the jq tool to extract the SPDX 2.0 SBOM data.

crane digest --platform linux/amd64 registry.suse.com/suse/sle15:15.4

Example result:

sha256:c8aeb5a7662c38716d303fb854c5baa2329afccb4637c0f3c7c44b971181fdbb

Then run the following on the command line:

 cosign verify-attestation --type spdxjson –key
 /usr/share/pki/containers/suse-container-key.pem 
 registry.suse.com/suse/sle15@sha256:c8aeb5a7662c38716d303fb854c5baa2329afccb4637c0f3c7c44b971181fdbb | jq '.payload | @base64d | fromjson 
 | .predicate'

7.3 Security information in CSAF format

The Common Security Advisory Format (CSAF) is an industry-standard format for publishing security advisories in machine readable form. It is the descendant of the CVRF format and standardized by the OASIS foundation.

It differs from the OVAL format, whose goal is to be able to machine-check the health of a system for security, while the CVRF and CSAF formats are intended for machine import into ticketing systems and bug trackers to respond to vulnerabilities.

SUSE currently offers:

  • CSAF data indexed by Security Advisory in CSAF 2.0 format.

  • CSAF VEX data indexed by CVE in CSAF 2.0 VEX format.

SUSE has started generating CSAF data for SUSE security update notifications and CVEs in February 2023, including all previous security advisories and CVEs.

The CSAF 2.0 security advisory data can be downloaded from this SUSE ftp site.

The CSAF 2.0 VEX data indexed by CVE can be downloaded from this SUSE ftp site.

The data is available under the Creative Commons license, with attribution CC-BY-4.0. The CSAF format is a verbose and simple JSON format, so it can be hooked into other tools pretty easily even without additional libraries.

A list of reference tools is also provided by OASIS.

7.4 Open Source Vulnerabilities (OSV) data

OSV is a Google-based vulnerability database and triage infrastructure for open source projects aimed at helping both open source maintainers and consumers of open source.

SUSE is publishing regularly updated OSV data, which is available in beta status at https://ftp.suse.com/pub/projects/security/osv/.

8 Securing our product portfolio

January 17th 2023

SUSE Linux Enterprise Micro 5.2 (SLE Micro) has received the PSA Certified Security Assurance Certificate (PSA Certified Level 1) on ARM. PSA (Platform Security Architecture) Certified is a security certification scheme for Internet of Things (IoT) hardware, software and devices. You can view our certification at https://www.psacertified.org/products/suse-linux-enterprise-micro/.

April 26th 2023

IST has validated 17 new algorithms for SUSE Linux Enterprise Server (SLES) 15 SP4. You can view these certifications at https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program/validation-search? when you search by Implementation and Vendor Name SUSE.

June 5th 2023

The University of New Hampshire Interoperability Laboratory (UNH-IOL) has certified SUSE Linux Enterprise Server (SLES) 15 SP4 under the USGv6 R1 technical requirements. UNH-IOL provides testing and evaluation services of IPv6 technologies and certifies compliance.

August 23rd 2023

The University of New Hampshire Interoperability Laboratory (UNH-IOL) has certified SUSE Linux Enterprise Micro (SLE Micro) 5.3 under the IPv6 Ready Logo Program.

September 29th 2023

The University of New Hampshire Interoperability Laboratory (UNH-IOL) has certified SUSE Linux Enterprise Micro (SLE Micro) 5.4 under the USGv6 R1 technical requirements. UNH-IOL provides testing and evaluation services of IPv6 technologies and certifies compliance.

November 1st 2023

SUSE Rancher Hosted completed its annual SOC2 audit and achieved SOC2 Type 2 Compliance. SUSE also achieved the AICPA System and Organization Controls (SOC2) Type 1 certification. The audits were conducted by Armanino LLP, one of the largest independent accounting and business consulting firms in the United States. SUSE is proud to provide yet another level of compliance to its clients.

December 15th 2023

SUSE Linux Enterprise Server 15 SP4 is now Common Criteria certified with the BSI scheme.  This guarantees that our operating system meets all the requirements of the NIAP Protection Profile General Purpose Operating System along with Functional Package for Secure Shell (SSH).

9 About SUSE

SUSE is a global leader in innovative, reliable and secure enterprise open source solutions, including SUSE Linux Enterprise, Rancher and NeuVector. More than 60% of the Fortune 500 rely on SUSE to power their mission-critical workloads, enabling them to innovate everywhere – from the data center to the cloud, to the edge and beyond. SUSE puts the open back in open source, collaborating with partners and communities to give customers the agility to tackle innovation challenges today and the freedom to evolve their strategy and solutions tomorrow. For more information, visit https://www.suse.com.

10 Forward-looking statements

Any statements in this document about future expectations, plans and prospects for the company, including statements containing the words aims, targets, will, believes, anticipates, plans, expects, and similar expressions, may constitute forward-looking statements and should be read with caution.

Actual results may differ materially from those indicated by such forward-looking statements as a result of various important factors, including competitive landscape, development of customer deals, reliance upon customer relationships, management of growth and acquisitions, the possibility of undetected software issues, the risks of impacts of the COVID-19 pandemic and economic downturns, pricing pressures and the viability of the Internet. In addition, any forward-looking statements included herein represent views as of the date of this document and these views could change. The Company does not have any obligation to update its forward-looking statements. These forward-looking statements are subject to change and should not be relied upon as representing the Company’s views as of any date other than the publication date of this document.

11 Legal notice

Copyright ©2006-2025 SUSE LLC and contributors. All rights reserved.

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or (at your option) version 1.3; with the Invariant Section being this copyright notice and license. A copy of the license version 1.2 is included in the section entitled GNU Free Documentation License.

SUSE, the SUSE logo and YaST are registered trademarks of SUSE LLC in the United States and other countries. For SUSE trademarks, see http://www.suse.com/company/legal/. Linux is a registered trademark of Linus Torvalds. All other names or trademarks mentioned in this document may be trademarks or registered trademarks of their respective owners.

Documents published as part of the SUSE Best Practices series have been contributed voluntarily by SUSE employees and third parties. They are meant to serve as examples of how particular actions can be performed. They have been compiled with utmost attention to detail. However, this does not guarantee complete accuracy. SUSE cannot verify that actions described in these documents do what is claimed or whether actions described have unintended consequences. SUSE LLC, its affiliates, the authors, and the translators may not be held liable for possible errors or the consequences thereof.

Below we draw your attention to the license under which the articles are published.

Documentation survey