December 2021 - openSUSE Security Announce

openSUSE-SU-2021:1632-1: important: Security update for chromium
by opensuse-security＠opensuse.org 28 Dec '21

28 Dec '21

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1632-1 Rating: important References: #1192310 #1192734 #1193519 #1193713 Cross-References: CVE-2021-38005 CVE-2021-38006 CVE-2021-38007 CVE-2021-38008 CVE-2021-38009 CVE-2021-38010 CVE-2021-38011 CVE-2021-38012 CVE-2021-38013 CVE-2021-38014 CVE-2021-38015 CVE-2021-38016 CVE-2021-38017 CVE-2021-38018 CVE-2021-38019 CVE-2021-38020 CVE-2021-38021 CVE-2021-38022 CVE-2021-4052 CVE-2021-4053 CVE-2021-4054 CVE-2021-4055 CVE-2021-4056 CVE-2021-4057 CVE-2021-4058 CVE-2021-4059 CVE-2021-4061 CVE-2021-4062 CVE-2021-4063 CVE-2021-4064 CVE-2021-4065 CVE-2021-4066 CVE-2021-4067 CVE-2021-4068 CVE-2021-4078 CVE-2021-4079 CVE-2021-4098 CVE-2021-4099 CVE-2021-4100 CVE-2021-4101 CVE-2021-4102 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 41 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium 96.0.4664.110 (boo#1193713): * CVE-2021-4098: Insufficient data validation in Mojo * CVE-2021-4099: Use after free in Swiftshader * CVE-2021-4100: Object lifecycle issue in ANGLE * CVE-2021-4101: Heap buffer overflow in Swiftshader * CVE-2021-4102: Use after free in V8 Lord of the Browsers: The Two Compilers: * Go back to GCC * GCC: LTO removes needed assembly symbols * Clang: issues with libstdc++ Chromium 96.0.4664.93 (boo#1193519): * CVE-2021-4052: Use after free in web apps * CVE-2021-4053: Use after free in UI * CVE-2021-4079: Out of bounds write in WebRTC * CVE-2021-4054: Incorrect security UI in autofill * CVE-2021-4078: Type confusion in V8 * CVE-2021-4055: Heap buffer overflow in extensions * CVE-2021-4056: Type Confusion in loader * CVE-2021-4057: Use after free in file API * CVE-2021-4058: Heap buffer overflow in ANGLE * CVE-2021-4059: Insufficient data validation in loader * CVE-2021-4061: Type Confusion in V8 * CVE-2021-4062: Heap buffer overflow in BFCache * CVE-2021-4063: Use after free in developer tools * CVE-2021-4064: Use after free in screen capture * CVE-2021-4065: Use after free in autofill * CVE-2021-4066: Integer underflow in ANGLE * CVE-2021-4067: Use after free in window manager * CVE-2021-4068: Insufficient validation of untrusted input in new tab page Chromium 96.0.4664.45 (boo#1192734): * CVE-2021-38007: Type Confusion in V8 * CVE-2021-38008: Use after free in media * CVE-2021-38009: Inappropriate implementation in cache * CVE-2021-38006: Use after free in storage foundation * CVE-2021-38005: Use after free in loader * CVE-2021-38010: Inappropriate implementation in service workers * CVE-2021-38011: Use after free in storage foundation * CVE-2021-38012: Type Confusion in V8 * CVE-2021-38013: Heap buffer overflow in fingerprint recognition * CVE-2021-38014: Out of bounds write in Swiftshader * CVE-2021-38015: Inappropriate implementation in input * CVE-2021-38016: Insufficient policy enforcement in background fetch * CVE-2021-38017: Insufficient policy enforcement in iframe sandbox * CVE-2021-38018: Inappropriate implementation in navigation * CVE-2021-38019: Insufficient policy enforcement in CORS * CVE-2021-38020: Insufficient policy enforcement in contacts picker * CVE-2021-38021: Inappropriate implementation in referrer * CVE-2021-38022: Inappropriate implementation in WebAuthentication Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1632=1 Package List: - openSUSE Leap 15.2 (x86_64): chromedriver-96.0.4664.110-lp152.2.143.1 chromedriver-debuginfo-96.0.4664.110-lp152.2.143.1 chromium-96.0.4664.110-lp152.2.143.1 chromium-debuginfo-96.0.4664.110-lp152.2.143.1 References: https://www.suse.com/security/cve/CVE-2021-38005.html https://www.suse.com/security/cve/CVE-2021-38006.html https://www.suse.com/security/cve/CVE-2021-38007.html https://www.suse.com/security/cve/CVE-2021-38008.html https://www.suse.com/security/cve/CVE-2021-38009.html https://www.suse.com/security/cve/CVE-2021-38010.html https://www.suse.com/security/cve/CVE-2021-38011.html https://www.suse.com/security/cve/CVE-2021-38012.html https://www.suse.com/security/cve/CVE-2021-38013.html https://www.suse.com/security/cve/CVE-2021-38014.html https://www.suse.com/security/cve/CVE-2021-38015.html https://www.suse.com/security/cve/CVE-2021-38016.html https://www.suse.com/security/cve/CVE-2021-38017.html https://www.suse.com/security/cve/CVE-2021-38018.html https://www.suse.com/security/cve/CVE-2021-38019.html https://www.suse.com/security/cve/CVE-2021-38020.html https://www.suse.com/security/cve/CVE-2021-38021.html https://www.suse.com/security/cve/CVE-2021-38022.html https://www.suse.com/security/cve/CVE-2021-4052.html https://www.suse.com/security/cve/CVE-2021-4053.html https://www.suse.com/security/cve/CVE-2021-4054.html https://www.suse.com/security/cve/CVE-2021-4055.html https://www.suse.com/security/cve/CVE-2021-4056.html https://www.suse.com/security/cve/CVE-2021-4057.html https://www.suse.com/security/cve/CVE-2021-4058.html https://www.suse.com/security/cve/CVE-2021-4059.html https://www.suse.com/security/cve/CVE-2021-4061.html https://www.suse.com/security/cve/CVE-2021-4062.html https://www.suse.com/security/cve/CVE-2021-4063.html https://www.suse.com/security/cve/CVE-2021-4064.html https://www.suse.com/security/cve/CVE-2021-4065.html https://www.suse.com/security/cve/CVE-2021-4066.html https://www.suse.com/security/cve/CVE-2021-4067.html https://www.suse.com/security/cve/CVE-2021-4068.html https://www.suse.com/security/cve/CVE-2021-4078.html https://www.suse.com/security/cve/CVE-2021-4079.html https://www.suse.com/security/cve/CVE-2021-4098.html https://www.suse.com/security/cve/CVE-2021-4099.html https://www.suse.com/security/cve/CVE-2021-4100.html https://www.suse.com/security/cve/CVE-2021-4101.html https://www.suse.com/security/cve/CVE-2021-4102.html https://bugzilla.suse.com/1192310 https://bugzilla.suse.com/1192734 https://bugzilla.suse.com/1193519 https://bugzilla.suse.com/1193713

1 0

openSUSE-SU-2021:1631-1: important: Security update for kafka
by opensuse-security＠opensuse.org 28 Dec '21

28 Dec '21

openSUSE Security Update: Security update for kafka ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1631-1 Rating: important References: #1193662 Cross-References: CVE-2021-4104 CVSS scores: CVE-2021-4104 (SUSE): 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This security update of kafka fixes the following issue: - CVE-2021-4104: Remove JMSAppender from log4j jars during build to prevent bsc#1193662, Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1631=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): kafka-source-2.1.0-bp153.2.3.1 - openSUSE Backports SLE-15-SP3 (x86_64): kafka-kit-2.1.0-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-4104.html https://bugzilla.suse.com/1193662

1 0

openSUSE-SU-2021:1625-1: moderate: Security update for runc
by opensuse-security＠opensuse.org 26 Dec '21

26 Dec '21

openSUSE Security Update: Security update for runc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1625-1 Rating: moderate References: #1193436 Cross-References: CVE-2021-43784 CVSS scores: CVE-2021-43784 (NVD) : 6 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for runc fixes the following issues: Update to runc v1.0.3. * CVE-2021-43784: Fixed a potential vulnerability related to the internal usage of netlink, which is believed to not be exploitable with any released versions of runc (bsc#1193436) * Fixed inability to start a container with read-write bind mount of a read-only fuse host mount. * Fixed inability to start when read-only /dev in set in spec. * Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2 is used with older systemd. * Fixed returning error from GetStats when hugetlb is unsupported (which causes excessive logging for kubernetes). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1625=1 Package List: - openSUSE Leap 15.2 (x86_64): runc-1.0.3-lp152.2.12.1 runc-debuginfo-1.0.3-lp152.2.12.1 References: https://www.suse.com/security/cve/CVE-2021-43784.html https://bugzilla.suse.com/1193436

1 0

openSUSE-SU-2021:1626-1: moderate: Security update for go1.16
by opensuse-security＠opensuse.org 26 Dec '21

26 Dec '21

openSUSE Security Update: Security update for go1.16 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1626-1 Rating: moderate References: #1182345 #1193597 #1193598 Cross-References: CVE-2021-44716 CVE-2021-44717 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for go1.16 fixes the following issues: Updated to upstream version 1.16.12 to include security fixes to the compiler, syscall, runtime, the net/http, net/http/httptest, and time packages (bsc#1182345) - CVE-2021-44717: syscall: don't close fd 0 on ForkExec error (bsc#1193598). - CVE-2021-44716: net/http: limit growth of header canonicalization cache (bsc#1193597). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1626=1 Package List: - openSUSE Leap 15.2 (x86_64): go1.16-1.16.12-lp152.20.1 go1.16-doc-1.16.12-lp152.20.1 go1.16-race-1.16.12-lp152.20.1 References: https://www.suse.com/security/cve/CVE-2021-44716.html https://www.suse.com/security/cve/CVE-2021-44717.html https://bugzilla.suse.com/1182345 https://bugzilla.suse.com/1193597 https://bugzilla.suse.com/1193598

1 0

openSUSE-SU-2021:1624-1: moderate: Security update for libaom
by opensuse-security＠opensuse.org 26 Dec '21

26 Dec '21

openSUSE Security Update: Security update for libaom ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1624-1 Rating: moderate References: #1193356 #1193365 #1193366 #1193369 Cross-References: CVE-2020-36129 CVE-2020-36130 CVE-2020-36131 CVE-2020-36135 CVSS scores: CVE-2020-36129 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-36130 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-36131 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-36135 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for libaom fixes the following issues: - CVE-2020-36129: Fixed stack buffer overflow via the component src/aom_image.c (bsc#1193356). - CVE-2020-36131: Fixed stack buffer overflow via the component stats/rate_hist.c (bsc#1193365). - CVE-2020-36135: Fixed NULL pointer dereference via the component rate_hist.c (bsc#1193366). - CVE-2020-36130: Fixed NULL pointer dereference via the component av1/av1_dx_iface.c (bsc#1193369). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1624=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): aom-tools-1.0.0-lp152.3.9.1 aom-tools-debuginfo-1.0.0-lp152.3.9.1 libaom-debugsource-1.0.0-lp152.3.9.1 libaom-devel-1.0.0-lp152.3.9.1 libaom0-1.0.0-lp152.3.9.1 libaom0-debuginfo-1.0.0-lp152.3.9.1 - openSUSE Leap 15.2 (noarch): libaom-devel-doc-1.0.0-lp152.3.9.1 - openSUSE Leap 15.2 (x86_64): libaom0-32bit-1.0.0-lp152.3.9.1 libaom0-32bit-debuginfo-1.0.0-lp152.3.9.1 References: https://www.suse.com/security/cve/CVE-2020-36129.html https://www.suse.com/security/cve/CVE-2020-36130.html https://www.suse.com/security/cve/CVE-2020-36131.html https://www.suse.com/security/cve/CVE-2020-36135.html https://bugzilla.suse.com/1193356 https://bugzilla.suse.com/1193365 https://bugzilla.suse.com/1193366 https://bugzilla.suse.com/1193369

1 0

openSUSE-SU-2021:1612-1: important: Security update for log4j12
by opensuse-security＠opensuse.org 24 Dec '21

24 Dec '21

openSUSE Security Update: Security update for log4j12 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1612-1 Rating: important References: #1193662 Cross-References: CVE-2021-4104 CVSS scores: CVE-2021-4104 (SUSE): 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for log4j12 fixes the following issues: - CVE-2021-4104: Disable the JMSAppender class from log4j to protect against the log4jshell vulnerability. [bsc#1193662] This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1612=1 Package List: - openSUSE Leap 15.2 (noarch): log4j12-1.2.17-lp152.3.3.2 log4j12-javadoc-1.2.17-lp152.3.3.2 log4j12-manual-1.2.17-lp152.3.3.2 log4j12-mini-1.2.17-lp152.3.3.2 References: https://www.suse.com/security/cve/CVE-2021-4104.html https://bugzilla.suse.com/1193662

1 0

openSUSE-SU-2021:1613-1: important: Security update for logback
by opensuse-security＠opensuse.org 24 Dec '21

24 Dec '21

openSUSE Security Update: Security update for logback ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1613-1 Rating: important References: #1193795 Cross-References: CVE-2021-44228 CVSS scores: CVE-2021-44228 (NVD) : 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVE-2021-44228 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for logback fixes the following issues: Upgrade to version 1.2.8 + In response to log4Shell/CVE-2021-44228, all JNDI lookup code in logback has been disabled until further notice. This impacts ContextJNDISelector and insertFromJNDI element in configuration files. + Also in response to log4Shell/CVE-2021-44228, all database (JDBC) related code in the project has been removed with no replacement. + Note that the vulnerability mentioned in LOGBACK-1591 requires write access to logback's configuration file as a prerequisite. The log4Shell/CVE-2021-44228 and LOGBACK-1591 are of different severity levels. A successful RCE requires all of the following conditions to be met: - write access to logback.xml - use of versions lower then 1.2.8 - reloading of poisoned configuration data, which implies application restart or scan="true" set prior to attack This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1613=1 Package List: - openSUSE Leap 15.2 (noarch): logback-1.2.8-lp152.2.3.2 logback-access-1.2.8-lp152.2.3.2 logback-examples-1.2.8-lp152.2.3.2 logback-javadoc-1.2.8-lp152.2.3.2 References: https://www.suse.com/security/cve/CVE-2021-44228.html https://bugzilla.suse.com/1193795

1 0

openSUSE-SU-2021:1611-1: important: Security update for p11-kit
by opensuse-security＠opensuse.org 23 Dec '21

23 Dec '21

openSUSE Security Update: Security update for p11-kit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1611-1 Rating: important References: #1180064 #1187993 Cross-References: CVE-2020-29361 CVSS scores: CVE-2020-29361 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-29361 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for p11-kit fixes the following issues: - CVE-2020-29361: Fixed multiple integer overflows in rpc code (bsc#1180064) - Add support for CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER (bsc#1187993). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1611=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libp11-kit0-0.23.2-lp152.7.3.1 libp11-kit0-debuginfo-0.23.2-lp152.7.3.1 p11-kit-0.23.2-lp152.7.3.1 p11-kit-debuginfo-0.23.2-lp152.7.3.1 p11-kit-debugsource-0.23.2-lp152.7.3.1 p11-kit-devel-0.23.2-lp152.7.3.1 p11-kit-nss-trust-0.23.2-lp152.7.3.1 p11-kit-tools-0.23.2-lp152.7.3.1 p11-kit-tools-debuginfo-0.23.2-lp152.7.3.1 - openSUSE Leap 15.2 (x86_64): libp11-kit0-32bit-0.23.2-lp152.7.3.1 libp11-kit0-32bit-debuginfo-0.23.2-lp152.7.3.1 p11-kit-32bit-0.23.2-lp152.7.3.1 p11-kit-32bit-debuginfo-0.23.2-lp152.7.3.1 p11-kit-nss-trust-32bit-0.23.2-lp152.7.3.1 References: https://www.suse.com/security/cve/CVE-2020-29361.html https://bugzilla.suse.com/1180064 https://bugzilla.suse.com/1187993

1 0

openSUSE-SU-2021:4170-1: moderate: Security update for libaom
by opensuse-security＠opensuse.org 23 Dec '21

23 Dec '21

openSUSE Security Update: Security update for libaom ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4170-1 Rating: moderate References: #1193356 #1193365 #1193366 #1193369 Cross-References: CVE-2020-36129 CVE-2020-36130 CVE-2020-36131 CVE-2020-36135 CVSS scores: CVE-2020-36129 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-36130 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-36131 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-36135 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for libaom fixes the following issues: - CVE-2020-36129: Fixed stack buffer overflow via the component src/aom_image.c (bsc#1193356). - CVE-2020-36131: Fixed stack buffer overflow via the component stats/rate_hist.c (bsc#1193365). - CVE-2020-36135: Fixed NULL pointer dereference via the component rate_hist.c (bsc#1193366). - CVE-2020-36130: Fixed NULL pointer dereference via the component av1/av1_dx_iface.c (bsc#1193369). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4170=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): aom-tools-1.0.0-3.9.1 aom-tools-debuginfo-1.0.0-3.9.1 libaom-debugsource-1.0.0-3.9.1 libaom-devel-1.0.0-3.9.1 libaom0-1.0.0-3.9.1 libaom0-debuginfo-1.0.0-3.9.1 - openSUSE Leap 15.3 (noarch): libaom-devel-doc-1.0.0-3.9.1 - openSUSE Leap 15.3 (x86_64): libaom0-32bit-1.0.0-3.9.1 libaom0-32bit-debuginfo-1.0.0-3.9.1 References: https://www.suse.com/security/cve/CVE-2020-36129.html https://www.suse.com/security/cve/CVE-2020-36130.html https://www.suse.com/security/cve/CVE-2020-36131.html https://www.suse.com/security/cve/CVE-2020-36135.html https://bugzilla.suse.com/1193356 https://bugzilla.suse.com/1193365 https://bugzilla.suse.com/1193366 https://bugzilla.suse.com/1193369

1 0

openSUSE-SU-2021:4169-1: moderate: Security update for go1.16
by opensuse-security＠opensuse.org 23 Dec '21

23 Dec '21

openSUSE Security Update: Security update for go1.16 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4169-1 Rating: moderate References: #1182345 #1193597 #1193598 Cross-References: CVE-2021-44716 CVE-2021-44717 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for go1.16 fixes the following issues: Updated to upstream version 1.16.12 to include security fixes to the compiler, syscall, runtime, the net/http, net/http/httptest, and time packages (bsc#1182345) - CVE-2021-44717: syscall: don't close fd 0 on ForkExec error (bsc#1193598). - CVE-2021-44716: net/http: limit growth of header canonicalization cache (bsc#1193597). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4169=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): go1.16-1.16.12-1.37.2 go1.16-doc-1.16.12-1.37.2 - openSUSE Leap 15.3 (aarch64 x86_64): go1.16-race-1.16.12-1.37.2 References: https://www.suse.com/security/cve/CVE-2021-44716.html https://www.suse.com/security/cve/CVE-2021-44717.html https://bugzilla.suse.com/1182345 https://bugzilla.suse.com/1193597 https://bugzilla.suse.com/1193598

1 0