December 2021 - openSUSE Security Announce

openSUSE-SU-2021:4186-1: moderate: Security update for go1.17
by opensuse-security＠opensuse.org 23 Dec '21

23 Dec '21

openSUSE Security Update: Security update for go1.17 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4186-1 Rating: moderate References: #1190649 #1193597 #1193598 Cross-References: CVE-2021-44716 CVE-2021-44717 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for go1.17 fixes the following issues: Updated to upstream version 1.17.5 to include fixes to the compiler, linker, syscall, runtime, the net/http, go/types, and time packages (bsc#1190649) - CVE-2021-44717: syscall: don't close fd 0 on ForkExec error (bsc#1193598). - CVE-2021-44716: net/http: limit growth of header canonicalization cache (bsc#1193597). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4186=1 Package List: - openSUSE Leap 15.3 (aarch64 i586 ppc64le s390x x86_64): go1.17-1.17.5-1.14.2 go1.17-doc-1.17.5-1.14.2 - openSUSE Leap 15.3 (aarch64 x86_64): go1.17-race-1.17.5-1.14.2 References: https://www.suse.com/security/cve/CVE-2021-44716.html https://www.suse.com/security/cve/CVE-2021-44717.html https://bugzilla.suse.com/1190649 https://bugzilla.suse.com/1193597 https://bugzilla.suse.com/1193598

1 0

openSUSE-SU-2021:4171-1: moderate: Security update for runc
by opensuse-security＠opensuse.org 23 Dec '21

23 Dec '21

openSUSE Security Update: Security update for runc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4171-1 Rating: moderate References: #1193436 Cross-References: CVE-2021-43784 CVSS scores: CVE-2021-43784 (NVD) : 6 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for runc fixes the following issues: Update to runc v1.0.3. * CVE-2021-43784: Fixed a potential vulnerability related to the internal usage of netlink, which is believed to not be exploitable with any released versions of runc (bsc#1193436) * Fixed inability to start a container with read-write bind mount of a read-only fuse host mount. * Fixed inability to start when read-only /dev in set in spec. * Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2 is used with older systemd. * Fixed returning error from GetStats when hugetlb is unsupported (which causes excessive logging for kubernetes). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4171=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): runc-1.0.3-27.1 runc-debuginfo-1.0.3-27.1 References: https://www.suse.com/security/cve/CVE-2021-43784.html https://bugzilla.suse.com/1193436

1 0

openSUSE-SU-2021:4150-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 22 Dec '21

22 Dec '21

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4150-1 Rating: important References: #1182863 #1189547 #1190244 #1190269 #1191332 #1192250 #1193485 Cross-References: CVE-2021-29981 CVE-2021-29982 CVE-2021-29987 CVE-2021-29991 CVE-2021-32810 CVE-2021-38492 CVE-2021-38493 CVE-2021-38495 CVE-2021-38496 CVE-2021-38497 CVE-2021-38498 CVE-2021-38500 CVE-2021-38501 CVE-2021-38502 CVE-2021-38503 CVE-2021-38504 CVE-2021-38505 CVE-2021-38506 CVE-2021-38507 CVE-2021-38508 CVE-2021-38509 CVE-2021-38510 CVE-2021-40529 CVE-2021-43528 CVE-2021-43536 CVE-2021-43537 CVE-2021-43538 CVE-2021-43539 CVE-2021-43541 CVE-2021-43542 CVE-2021-43543 CVE-2021-43545 CVE-2021-43546 CVSS scores: CVE-2021-29991 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2021-32810 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-32810 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-38492 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-38493 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-38497 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-38498 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-38501 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-38507 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-38509 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2021-43536 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2021-43537 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-43538 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2021-43539 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-43541 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-43542 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2021-43543 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-43545 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 33 vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: - Update to version 91.4 MFSA 2021-54 (bsc#1193485) - CVE-2021-43536: URL leakage when navigating while executing asynchronous function - CVE-2021-43537: Heap buffer overflow when using structured clone - CVE-2021-43538: Missing fullscreen and pointer lock notification when requesting both - CVE-2021-43539: GC rooting failure when calling wasm instance methods - CVE-2021-43541: External protocol handler parameters were unescaped - CVE-2021-43542: XMLHttpRequest error codes could have leaked the existence of an external protocol handler - CVE-2021-43543: Bypass of CSP sandbox directive when embedding - CVE-2021-43545: Denial of Service when using the Location API in a loop - CVE-2021-43546: Cursor spoofing could overlay user interface when native cursor is zoomed - CVE-2021-43528: JavaScript unexpectedly enabled for the composition area - Update to version 91.3.2 - CVE-2021-40529: Fixed ElGamal implementation could allow plaintext recovery (bsc#1190244) - Update to version 91.3 MFSA 2021-50 (bsc#1192250) - CVE-2021-38503: Fixed iframe sandbox rules did not apply to XSLT stylesheets - CVE-2021-38504: Fixed use-after-free in file picker dialog - CVE-2021-38505: Fixed Windows 10 Cloud Clipboard may have recorded sensitive user data - CVE-2021-38506: Fixed Thunderbird could be coaxed into going into fullscreen mode without notification or warning - CVE-2021-38507: Fixed opportunistic Encryption in HTTP2 could be used to bypass the Same-Origin-Policy on services hosted on other ports - CVE-2021-38508: Fixed permission Prompt could be overlaid, resulting in user confusion and potential spoofing - CVE-2021-38509: Fixed Javascript alert box could have been spoofed onto an arbitrary domain - CVE-2021-38510: Fixed Download Protections were bypassed by .inetloc files on Mac OS - Fixed plain text reformatting regression (bsc#1182863) - Update to version 91.2 MFSA 2021-47 (bsc#1191332) - CVE-2021-29981: Live range splitting could have led to conflicting assignments in the JIT - CVE-2021-29982: Single bit data leak due to incorrect JIT optimization and type confusion - CVE-2021-29987: Users could have been tricked into accepting unwanted permissions on Linux - CVE-2021-32810: Data race in crossbeam-deque - CVE-2021-38493: Memory safety bugs fixed in Thunderbird 78.14 and Thunderbird 91.1 - CVE-2021-38496: Use-after-free in MessageTask - CVE-2021-38497: Validation message could have been overlaid on another origin - CVE-2021-38498: Use-after-free of nsLanguageAtomService object - CVE-2021-38500: Memory safety bugs fixed in Thunderbird 91.2 - CVE-2021-38501: Memory safety bugs fixed in Thunderbird 91.2 - CVE-2021-38502: Downgrade attack on SMTP STARTTLS connections - Update to version 91.1.0 MFSA 2021-41 (bsc#1190269) - CVE-2021-38492: Navigating to `mk:` URL scheme could load Internet Explorer - CVE-2021-38495: Memory safety bugs fixed in Thunderbird 91.1 - Update to version 91.0.1 MFSA 2021-37 (bsc#1189547) - CVE-2021-29991: Header Splitting possible with HTTP/3 Responses Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4150=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): MozillaThunderbird-91.4.0-8.45.2 MozillaThunderbird-debuginfo-91.4.0-8.45.2 MozillaThunderbird-debugsource-91.4.0-8.45.2 MozillaThunderbird-translations-common-91.4.0-8.45.2 MozillaThunderbird-translations-other-91.4.0-8.45.2 References: https://www.suse.com/security/cve/CVE-2021-29981.html https://www.suse.com/security/cve/CVE-2021-29982.html https://www.suse.com/security/cve/CVE-2021-29987.html https://www.suse.com/security/cve/CVE-2021-29991.html https://www.suse.com/security/cve/CVE-2021-32810.html https://www.suse.com/security/cve/CVE-2021-38492.html https://www.suse.com/security/cve/CVE-2021-38493.html https://www.suse.com/security/cve/CVE-2021-38495.html https://www.suse.com/security/cve/CVE-2021-38496.html https://www.suse.com/security/cve/CVE-2021-38497.html https://www.suse.com/security/cve/CVE-2021-38498.html https://www.suse.com/security/cve/CVE-2021-38500.html https://www.suse.com/security/cve/CVE-2021-38501.html https://www.suse.com/security/cve/CVE-2021-38502.html https://www.suse.com/security/cve/CVE-2021-38503.html https://www.suse.com/security/cve/CVE-2021-38504.html https://www.suse.com/security/cve/CVE-2021-38505.html https://www.suse.com/security/cve/CVE-2021-38506.html https://www.suse.com/security/cve/CVE-2021-38507.html https://www.suse.com/security/cve/CVE-2021-38508.html https://www.suse.com/security/cve/CVE-2021-38509.html https://www.suse.com/security/cve/CVE-2021-38510.html https://www.suse.com/security/cve/CVE-2021-40529.html https://www.suse.com/security/cve/CVE-2021-43528.html https://www.suse.com/security/cve/CVE-2021-43536.html https://www.suse.com/security/cve/CVE-2021-43537.html https://www.suse.com/security/cve/CVE-2021-43538.html https://www.suse.com/security/cve/CVE-2021-43539.html https://www.suse.com/security/cve/CVE-2021-43541.html https://www.suse.com/security/cve/CVE-2021-43542.html https://www.suse.com/security/cve/CVE-2021-43543.html https://www.suse.com/security/cve/CVE-2021-43545.html https://www.suse.com/security/cve/CVE-2021-43546.html https://bugzilla.suse.com/1182863 https://bugzilla.suse.com/1189547 https://bugzilla.suse.com/1190244 https://bugzilla.suse.com/1190269 https://bugzilla.suse.com/1191332 https://bugzilla.suse.com/1192250 https://bugzilla.suse.com/1193485

1 0

openSUSE-SU-2021:4154-1: important: Security update for p11-kit
by opensuse-security＠opensuse.org 22 Dec '21

22 Dec '21

openSUSE Security Update: Security update for p11-kit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4154-1 Rating: important References: #1180064 #1187993 Cross-References: CVE-2020-29361 CVSS scores: CVE-2020-29361 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-29361 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for p11-kit fixes the following issues: - CVE-2020-29361: Fixed multiple integer overflows in rpc code (bsc#1180064) - Add support for CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER (bsc#1187993). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4154=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libp11-kit0-0.23.2-4.13.1 libp11-kit0-debuginfo-0.23.2-4.13.1 p11-kit-0.23.2-4.13.1 p11-kit-debuginfo-0.23.2-4.13.1 p11-kit-debugsource-0.23.2-4.13.1 p11-kit-devel-0.23.2-4.13.1 p11-kit-nss-trust-0.23.2-4.13.1 p11-kit-tools-0.23.2-4.13.1 p11-kit-tools-debuginfo-0.23.2-4.13.1 - openSUSE Leap 15.3 (x86_64): libp11-kit0-32bit-0.23.2-4.13.1 libp11-kit0-32bit-debuginfo-0.23.2-4.13.1 p11-kit-32bit-0.23.2-4.13.1 p11-kit-32bit-debuginfo-0.23.2-4.13.1 p11-kit-nss-trust-32bit-0.23.2-4.13.1 References: https://www.suse.com/security/cve/CVE-2020-29361.html https://bugzilla.suse.com/1180064 https://bugzilla.suse.com/1187993

1 0

openSUSE-SU-2021:4153-1: important: Security update for openssh
by opensuse-security＠opensuse.org 22 Dec '21

22 Dec '21

openSUSE Security Update: Security update for openssh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4153-1 Rating: important References: #1183137 Cross-References: CVE-2021-28041 CVSS scores: CVE-2021-28041 (NVD) : 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H CVE-2021-28041 (SUSE): 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openssh fixes the following issues: - CVE-2021-28041: Fixed double free in ssh-agent (bsc#1183137). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4153=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): openssh-8.4p1-3.9.1 openssh-askpass-gnome-8.4p1-3.9.1 openssh-askpass-gnome-debuginfo-8.4p1-3.9.1 openssh-askpass-gnome-debugsource-8.4p1-3.9.1 openssh-cavs-8.4p1-3.9.1 openssh-cavs-debuginfo-8.4p1-3.9.1 openssh-clients-8.4p1-3.9.1 openssh-clients-debuginfo-8.4p1-3.9.1 openssh-common-8.4p1-3.9.1 openssh-common-debuginfo-8.4p1-3.9.1 openssh-debuginfo-8.4p1-3.9.1 openssh-debugsource-8.4p1-3.9.1 openssh-fips-8.4p1-3.9.1 openssh-helpers-8.4p1-3.9.1 openssh-helpers-debuginfo-8.4p1-3.9.1 openssh-server-8.4p1-3.9.1 openssh-server-debuginfo-8.4p1-3.9.1 References: https://www.suse.com/security/cve/CVE-2021-28041.html https://bugzilla.suse.com/1183137

1 0

openSUSE-SU-2021:1606-1: important: Security update for xorg-x11-server
by opensuse-security＠opensuse.org 22 Dec '21

22 Dec '21

openSUSE Security Update: Security update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1606-1 Rating: important References: #1190487 #1190488 #1190489 Cross-References: CVE-2021-4009 CVE-2021-4010 CVE-2021-4011 CVSS scores: CVE-2021-4009 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-4010 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-4011 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for xorg-x11-server fixes the following issues: - CVE-2021-4009: The handler for the CreatePointerBarrier request of the XFixes extension does not properly validate the request length leading to out of bounds memory write. (bsc#1190487) - CVE-2021-4010: The handler for the Suspend request of the Screen Saver extension does not properly validate the request length leading to out of bounds memory write. (bsc#1190488) - CVE-2021-4011: The handlers for the RecordCreateContext and RecordRegisterClients requests of the Record extension do not properly validate the request length leading to out of bounds memory write. (bsc#1190489) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1606=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): xorg-x11-server-1.20.3-lp152.8.36.1 xorg-x11-server-debuginfo-1.20.3-lp152.8.36.1 xorg-x11-server-debugsource-1.20.3-lp152.8.36.1 xorg-x11-server-extra-1.20.3-lp152.8.36.1 xorg-x11-server-extra-debuginfo-1.20.3-lp152.8.36.1 xorg-x11-server-sdk-1.20.3-lp152.8.36.1 xorg-x11-server-source-1.20.3-lp152.8.36.1 xorg-x11-server-wayland-1.20.3-lp152.8.36.1 xorg-x11-server-wayland-debuginfo-1.20.3-lp152.8.36.1 References: https://www.suse.com/security/cve/CVE-2021-4009.html https://www.suse.com/security/cve/CVE-2021-4010.html https://www.suse.com/security/cve/CVE-2021-4011.html https://bugzilla.suse.com/1190487 https://bugzilla.suse.com/1190488 https://bugzilla.suse.com/1190489

1 0

openSUSE-SU-2021:1605-1: important: Security update for log4j
by opensuse-security＠opensuse.org 22 Dec '21

22 Dec '21

openSUSE Security Update: Security update for log4j ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1605-1 Rating: important References: #1193887 #1193888 Cross-References: CVE-2021-45105 CVSS scores: CVE-2021-45105 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for log4j fixes the following issues: - Update to 2.17.0 - CVE-2021-45105: Apache Log4j2 does not always protect from infinite recursion in lookup evaluation. (bsc#1193887, bsc#1193888) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1605=1 Package List: - openSUSE Leap 15.2 (noarch): log4j-2.17.0-lp152.3.12.1 log4j-javadoc-2.17.0-lp152.3.12.1 log4j-jcl-2.17.0-lp152.3.12.1 log4j-slf4j-2.17.0-lp152.3.12.1 References: https://www.suse.com/security/cve/CVE-2021-45105.html https://bugzilla.suse.com/1193887 https://bugzilla.suse.com/1193888

1 0

openSUSE-SU-2021:4136-1: important: Security update for xorg-x11-server
by opensuse-security＠opensuse.org 21 Dec '21

21 Dec '21

openSUSE Security Update: Security update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4136-1 Rating: important References: #1190487 #1190488 #1190489 Cross-References: CVE-2021-4009 CVE-2021-4010 CVE-2021-4011 CVSS scores: CVE-2021-4009 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-4010 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-4011 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for xorg-x11-server fixes the following issues: - CVE-2021-4009: The handler for the CreatePointerBarrier request of the XFixes extension does not properly validate the request length leading to out of bounds memory write. (bsc#1190487) - CVE-2021-4010: The handler for the Suspend request of the Screen Saver extension does not properly validate the request length leading to out of bounds memory write. (bsc#1190488) - CVE-2021-4011: The handlers for the RecordCreateContext and RecordRegisterClients requests of the Record extension do not properly validate the request length leading to out of bounds memory write. (bsc#1190489) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4136=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): xorg-x11-server-1.20.3-22.5.42.1 xorg-x11-server-debuginfo-1.20.3-22.5.42.1 xorg-x11-server-debugsource-1.20.3-22.5.42.1 xorg-x11-server-extra-1.20.3-22.5.42.1 xorg-x11-server-extra-debuginfo-1.20.3-22.5.42.1 xorg-x11-server-sdk-1.20.3-22.5.42.1 xorg-x11-server-source-1.20.3-22.5.42.1 xorg-x11-server-wayland-1.20.3-22.5.42.1 xorg-x11-server-wayland-debuginfo-1.20.3-22.5.42.1 References: https://www.suse.com/security/cve/CVE-2021-4009.html https://www.suse.com/security/cve/CVE-2021-4010.html https://www.suse.com/security/cve/CVE-2021-4011.html https://bugzilla.suse.com/1190487 https://bugzilla.suse.com/1190488 https://bugzilla.suse.com/1190489

1 0

openSUSE-SU-2021:1603-1: moderate: Security update for netdata
by opensuse-security＠opensuse.org 20 Dec '21

20 Dec '21

openSUSE Security Update: Security update for netdata ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1603-1 Rating: moderate References: #1139094 #1139095 #1139098 Cross-References: CVE-2018-18836 CVE-2018-18837 CVE-2018-18838 CVE-2018-18839 CVSS scores: CVE-2018-18836 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2018-18837 (NVD) : 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2018-18838 (NVD) : 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2018-18839 (NVD) : 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for netdata fixes the following issues: Update to 1.31.0 (go.d.plugin 0.29.0) The v1.31.0 release of Netdata comes with re-packaged and redesigned elements of the dashboard to help you focus on your metrics, even more Linux kernel insights via eBPF, on-node machine learning to help you find anomalies, and much more. This release contains 10 new collectors, 54 improvements (7 in the dashboard), 31 documentation updates, and 29 bug fixes. At a glance We re-packaged and redesigned portions of the dashboard to improve the overall experience. Part of this effort is better handling of dashboard code during installation��anyone using third-party packages (such as the Netdata Homebrew formula) will start seeing new features and the new designs starting today. The timeframe picker has moved to the top panel, and just to its right are two counters with live CRITICAL and WARNING alarm statuses for your node. Click on either of these two open the alarms modal. We've also pushed a number of powerful new collectors, including directory cache monitoring via eBPF. By monitoring directory cache, developers and SREs alike can find opportunities to optimize memory usage and reduce disk-intensive operations. Our new Z-scores and changefinder collectors use machine learning to let you know, at a glance, when key metrics start to behave oddly. We'd love to get feedback on these sophisticated, subjective new brand of collectors! Improvements * Automatically trigger Helmchart PR on Agent release. (gh#netdata/netdata#11084) * Implement ACLK env endpoint. (gh#netdata/netdata#10833) * Implement new HTTPS client for ACLK. (gh#netdata/netdata#10805) * Update ACLK passwd endpoint to match specifications of the new architecture. (gh#netdata/netdata#10859) * Implement ACLK new backoff (TBEB) architecture. (gh#netdata/netdata#10941) * Add functionality to store node_id for a host. (gh#netdata/netdata#11059) * Remove version negotiation from ACLK-NG. (gh#netdata/netdata#10980) * Persist claim IDs in local database for parent and children. (gh#netdata/netdata#10993) * Provide more agent analytics to PostHog. (gh#netdata/netdata#11020) * Reduce logging when sending agent analytics. (gh#netdata/netdata#11091) * Remove error message on Netdata restart. (gh#netdata/netdata#8685) * Add a timeout when sending anonymous statistics using curl. (gh#netdata/netdata#11010) * Improve dash-example.html. (gh#netdata/netdata#10870) * Add host_cloud_enabled attribute to analytics. (gh#netdata/netdata#11100) Dashboard * Bundle the react dashboard code into the agent repo directly. (gh#netdata/netdata#11139) * Add dashboard info strings for systemdunits collector. (gh#netdata/netdata#10904) * Update dashboard version to v2.17.0. (gh#netdata/netdata#10856) + Top bar, side panel and overall navigation has been redesigned. + Top bar now includes a light bulb icon with news/features and the number of CRITICAL or WARNING alarms. + Documentation and settings buttons moved to the sidebar. + Improved rendering of sign in/sign up option button along with an operational status option (under user settings). + In the left panel, nodes show a status badge and are now searchable if there are more than 4. Health * Improvements + Add charts configuration option to templates. (gh#netdata/netdata#11054) + Add new attributes to health configuration files. (gh#netdata/netdata#10961) + Add inconsistent state to the mysql_galera_cluster_state alarm. (gh#netdata/netdata#10945) + Add systemdunits collector alarms. (gh#netdata/netdata#10906) + Use average instead of sum in VerneMQ alarms. (gh#netdata/netdata#11037) + Check configuration for CUSTOM and MSTEAM. (gh#netdata/netdata#11113) + Reduce alarms notifications dump logging. (gh#netdata/netdata#11116) * Bug fixes + Add synchronization.conf to the Makefile. (gh#netdata/netdata#10907) + Fix Microsoft Teams naming. (gh#netdata/netdata#9905) Collectors * New + Add a chart for out of memory kills. (gh#netdata/netdata#10880) + Add a chart with Netdata uptime. (gh#netdata/netdata#10997) + Add a module for ZFS pool state. (gh#netdata/netdata#11071) + Add a plugin for the system clock synchronization state. (gh#netdata/netdata#10895) + Add new charts for extended disk metrics. (gh#netdata/netdata#10939) + Add support for renaming libvirtd LXC containers. (gh#netdata/netdata#11006) + Add a metric for Percpu memory. (gh#netdata/netdata#10964) + Add an eBPF directory cache collector. (gh#netdata/netdata#10855) + Add a Z-scores python collector. (gh#netdata/netdata#10673) + Add changefinder python collector. (gh#netdata/netdata#10672) * Improvements + Remove dots in cgroup IDs. (gh#netdata/netdata#11050) + Add support for attribute 249 (NAND Writes 1GiB) to the smartd_log module. (gh#netdata/netdata#10872) + Add RAID level to the mdstat collector chart families. (gh#netdata/netdata#11024) + Update fping version. (gh#netdata/netdata#10977) + Add plugin and module names to the python.d.plugin runtime charts. (gh#netdata/netdata#11007) + Move global stats to a separate thread. (gh#netdata/netdata#10991) + Add memory size adjustments for eBPF hash tables. (gh#netdata/netdata#10962) + Add improvements to anomalies collector. (gh#netdata/netdata#11003) + Add support for loading of kprobe names in the eBPF plugin. (gh#netdata/netdata#11034) + Don't repeat the cgroup discovery cleanup info message. (gh#netdata/netdata#11101) + Change ACLK statistics charts units from kB/s to KiB/s. (gh#netdata/netdata#11103) * Bug fixes + Fix the detection of cgroups v2 by checking the version of the default cgroup mountpoint. (gh#netdata/netdata#11102) + Fix eBPF cachestat chart type. (gh#netdata/netdata#11074) + Fix gaps in eBPF cachestat charts. (gh#netdata/netdata#10972) + Fix detection of opensipsctl executable. (gh#netdata/netdata#10978) + Fix network interfaces detection when using virsh. (gh#netdata/netdata#11096) + Fix eBPF plugin crash during shutdown. (gh#netdata/netdata#10957) Exporting * Improvements + Allow the remote write configuration to have multiple destinations (gh#netdata/netdata#11005) * Bug fixes + Fix backend chart filtering backward compatibility. (gh#netdata/netdata#11002) Bug fixes * Reduce the number of ACLK chart updates during chart obsoletion. (gh#netdata/netdata#11133) * Fix SSL random failures when using multithreaded web server with OpenSSL < 1.1.0. (gh#netdata/netdata#11089) * Fix storing an NULL claim ID on a parent node. (gh#netdata/netdata#11036) * Prevent MQTT connection attempt on OTP failure. (gh#netdata/netdata#10839) * Rename struct fields from class to classification. (gh#netdata/netdata#11019) * Fix spelling mistakes in various components: + aclk (gh#netdata/netdata#10910) + build (gh#netdata/netdata#10909) + collectors (gh#netdata/netdata#10912) + daemon (gh#netdata/netdata#10913) + database (gh#netdata/netdata#10914) + exporting (gh#netdata/netdata#10915) + libnetdata (gh#netdata/netdata#10917) + health (gh#netdata/netdata#10916) + streaming (gh#netdata/netdata#10919) + tests (gh#netdata/netdata#10920) + backend (gh#netdata/netdata#10911) + bidirectional (gh#netdata/netdata#10918) + HTTP API (gh#netdata/netdata#10921) + web (gh#netdata/netdata#10922) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1603=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 ppc64le s390x x86_64): netdata-1.31.0-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-18836.html https://www.suse.com/security/cve/CVE-2018-18837.html https://www.suse.com/security/cve/CVE-2018-18838.html https://www.suse.com/security/cve/CVE-2018-18839.html https://bugzilla.suse.com/1139094 https://bugzilla.suse.com/1139095 https://bugzilla.suse.com/1139098

1 0

openSUSE-SU-2021:4118-1: important: Security update for log4j
by opensuse-security＠opensuse.org 20 Dec '21

20 Dec '21

openSUSE Security Update: Security update for log4j ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4118-1 Rating: important References: #1193887 #1193888 Cross-References: CVE-2021-45105 CVSS scores: CVE-2021-45105 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for log4j fixes the following issues: - Update to 2.17.0 - CVE-2021-45105: Apache Log4j2 does not always protect from infinite recursion in lookup evaluation. (bsc#1193887, bsc#1193888) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4118=1 Package List: - openSUSE Leap 15.3 (noarch): log4j-2.17.0-4.13.1 log4j-javadoc-2.17.0-4.13.1 log4j-jcl-2.17.0-4.13.1 log4j-slf4j-2.17.0-4.13.1 References: https://www.suse.com/security/cve/CVE-2021-45105.html https://bugzilla.suse.com/1193887 https://bugzilla.suse.com/1193888

1 0