August 2022 - openSUSE Security Announce

openSUSE-SU-2022:10103-1: important: Security update for python-Django
by opensuse-security＠opensuse.org 27 Aug '22

27 Aug '22

openSUSE Security Update: Security update for python-Django ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10103-1 Rating: important References: #1201923 Cross-References: CVE-2022-36359 CVSS scores: CVE-2022-36359 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-36359 (SUSE): 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-Django fixes the following issues: - CVE-2022-36359: Fixed potential reflected file download vulnerability in FileResponse (boo#1201923) * Backport fix and tests from uptream branch 3.2.X Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10103=1 Package List: - openSUSE Backports SLE-15-SP4 (noarch): python3-Django-2.2.28-bp154.2.3.3 References: https://www.suse.com/security/cve/CVE-2022-36359.html https://bugzilla.suse.com/1201923

1 0

openSUSE-SU-2022:10102-1: important: Security update for freeciv
by opensuse-security＠opensuse.org 27 Aug '22

27 Aug '22

openSUSE Security Update: Security update for freeciv ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10102-1 Rating: important References: #1202548 Cross-References: CVE-2022-6083 Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for freeciv fixes the following issues: - update to 3.0.3 (boo#1202548, CVE-2022-6083): * 3.0.3 is a bugfix release * see https://freeciv.fandom.com/wiki/NEWS-3.0.3 - update to 3.0.2: * 3.0.2 is a generic bugfix release * see https://freeciv.fandom.com/wiki/NEWS-3.0.2 - update to 3.0.1: * 3.0.1 is a generic bugfix release * see https://freeciv.fandom.com/wiki/NEWS-3.0.1 - update to 3.0.0: * This release is a major upgrade which with some changes that can support backward compatible rulesets * see https://freeciv.fandom.com/wiki/NEWS-3.0.0#WHAT.27S_CHANGED_SINCE_2.6 - update to 2.6.6: * https://freeciv.fandom.com/wiki/NEWS-2.6.5 * 2.6.6 is a bugfix release. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10102=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 i586 ppc64le s390x x86_64): freeciv-3.0.3-bp154.2.3.1 freeciv-gtk3-3.0.3-bp154.2.3.1 freeciv-lang-3.0.3-bp154.2.3.1 freeciv-qt-3.0.3-bp154.2.3.1 References: https://www.suse.com/security/cve/CVE-2022-6083.html https://bugzilla.suse.com/1202548

1 0

openSUSE-SU-2022:10101-1: important: Security update for nim
by opensuse-security＠opensuse.org 27 Aug '22

27 Aug '22

openSUSE Security Update: Security update for nim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10101-1 Rating: important References: #1175332 #1175333 #1175334 #1181705 #1185083 #1185084 #1185085 #1185948 #1192712 Cross-References: CVE-2020-15690 CVE-2020-15692 CVE-2020-15693 CVE-2020-15694 CVE-2021-21372 CVE-2021-21373 CVE-2021-21374 CVE-2021-29495 CVE-2021-41259 CVSS scores: CVE-2020-15690 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2020-15692 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2020-15693 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2020-15694 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2021-21372 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21373 (NVD) : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2021-21374 (NVD) : 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-29495 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2021-41259 (NVD) : 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for nim fixes the following issues: Includes upstream security fixes for: * (boo#1175333, CVE-2020-15693) httpClient is vulnerable to a CR-LF injection * (boo#1175334, CVE-2020-15692) mishandle of argument to browsers.openDefaultBrowser * (boo#1175332, CVE-2020-15694) httpClient.get().contentLength() fails to properly validate the server response * (boo#1192712, CVE-2021-41259) null byte accepted in getContent function, leading to URI validation bypass * (boo#1185948, CVE-2021-29495) stdlib httpClient does not validate peer certificates by default * (boo#1185085, CVE-2021-21374) Improper verification of the SSL/TLS certificate * (boo#1185084, CVE-2021-21373) "nimble refresh" falls back to a non-TLS URL in case of error * (boo#1185083, CVE-2021-21372) doCmd can be leveraged to execute arbitrary commands * (boo#1181705, CVE-2020-15690) Standard library asyncftpclient lacks a check for newline character Update to 1.6.6 * standard library use consistent styles for variable names so it can be used in projects which force a consistent style with --styleCheck:usages option. * ARC/ORC are now considerably faster at method dispatching, bringing its performance back on the level of the refc memory management. * Full changelog: https://nim-lang.org/blog/2022/05/05/version-166-released.html - Previous updates and changelogs: * 1.6.4: https://nim-lang.org/blog/2022/02/08/version-164-released.html * 1.6.2: https://nim-lang.org/blog/2021/12/17/version-162-released.html * 1.6.0: https://nim-lang.org/blog/2021/10/19/version-160-released.html * 1.4.8: https://nim-lang.org/blog/2021/05/25/version-148-released.html * 1.4.6: https://nim-lang.org/blog/2021/04/15/versions-146-and-1212-released.html * 1.4.4: https://nim-lang.org/blog/2021/02/23/versions-144-and-1210-released.html * 1.4.2: https://nim-lang.org/blog/2020/12/01/version-142-released.html * 1.4.0: https://nim-lang.org/blog/2020/10/16/version-140-released.html update to 1.2.16 * oids: switch from PRNG to random module * nimc.rst: fix table markup * nimRawSetjmp: support Windows * correctly enable chronos * bigints are not supposed to work on 1.2.x * disable nimpy * misc bugfixes * fixes a 'mixin' statement handling regression [backport:1.2 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10101=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 ppc64le x86_64): nim-1.6.6-bp154.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-15690.html https://www.suse.com/security/cve/CVE-2020-15692.html https://www.suse.com/security/cve/CVE-2020-15693.html https://www.suse.com/security/cve/CVE-2020-15694.html https://www.suse.com/security/cve/CVE-2021-21372.html https://www.suse.com/security/cve/CVE-2021-21373.html https://www.suse.com/security/cve/CVE-2021-21374.html https://www.suse.com/security/cve/CVE-2021-29495.html https://www.suse.com/security/cve/CVE-2021-41259.html https://bugzilla.suse.com/1175332 https://bugzilla.suse.com/1175333 https://bugzilla.suse.com/1175334 https://bugzilla.suse.com/1181705 https://bugzilla.suse.com/1185083 https://bugzilla.suse.com/1185084 https://bugzilla.suse.com/1185085 https://bugzilla.suse.com/1185948 https://bugzilla.suse.com/1192712

1 0

openSUSE-SU-2022:10104-1: important: Security update for varnish
by opensuse-security＠opensuse.org 27 Aug '22

27 Aug '22

openSUSE Security Update: Security update for varnish ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10104-1 Rating: important References: #1202350 Cross-References: CVE-2022-38150 CVSS scores: CVE-2022-38150 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for varnish fixes the following issues: Update to release 7.1.1: - CVE-2022-38150: Resolve a denial of service attack involving reason phrases (boo#1202350). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10104=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 i586 ppc64le s390x x86_64): libvarnishapi3-7.1.1-bp154.2.6.1 varnish-7.1.1-bp154.2.6.1 varnish-devel-7.1.1-bp154.2.6.1 References: https://www.suse.com/security/cve/CVE-2022-38150.html https://bugzilla.suse.com/1202350

1 0

SUSE-SU-2022:2922-1: important: Security update for libyang
by opensuse-security＠opensuse.org 26 Aug '22

26 Aug '22

SUSE Security Update: Security update for libyang ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:2922-1 Rating: important References: #1186377 Cross-References: CVE-2021-28905 CVSS scores: CVE-2021-28905 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-28905 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Server Applications 15-SP3 SUSE Linux Enterprise Module for Server Applications 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libyang fixes the following issues: - CVE-2021-28905: Fixed a reachable assertion which could be exploited by an attacker to cause a denial of service (bsc#1186377). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-2922=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-2922=1 - SUSE Linux Enterprise Module for Server Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2022-2922=1 - SUSE Linux Enterprise Module for Server Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP3-2022-2922=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libyang-cpp-devel-1.0.184-150300.3.3.1 libyang-cpp1-1.0.184-150300.3.3.1 libyang-cpp1-debuginfo-1.0.184-150300.3.3.1 libyang-debuginfo-1.0.184-150300.3.3.1 libyang-debugsource-1.0.184-150300.3.3.1 libyang-devel-1.0.184-150300.3.3.1 libyang-extentions-1.0.184-150300.3.3.1 libyang-extentions-debuginfo-1.0.184-150300.3.3.1 libyang1-1.0.184-150300.3.3.1 libyang1-debuginfo-1.0.184-150300.3.3.1 python3-yang-1.0.184-150300.3.3.1 python3-yang-debuginfo-1.0.184-150300.3.3.1 yang-tools-1.0.184-150300.3.3.1 yang-tools-debuginfo-1.0.184-150300.3.3.1 - openSUSE Leap 15.4 (noarch): libyang-doc-1.0.184-150300.3.3.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libyang-cpp-devel-1.0.184-150300.3.3.1 libyang-cpp1-1.0.184-150300.3.3.1 libyang-cpp1-debuginfo-1.0.184-150300.3.3.1 libyang-debuginfo-1.0.184-150300.3.3.1 libyang-debugsource-1.0.184-150300.3.3.1 libyang-devel-1.0.184-150300.3.3.1 libyang-extentions-1.0.184-150300.3.3.1 libyang-extentions-debuginfo-1.0.184-150300.3.3.1 libyang1-1.0.184-150300.3.3.1 libyang1-debuginfo-1.0.184-150300.3.3.1 python3-yang-1.0.184-150300.3.3.1 python3-yang-debuginfo-1.0.184-150300.3.3.1 yang-tools-1.0.184-150300.3.3.1 yang-tools-debuginfo-1.0.184-150300.3.3.1 - openSUSE Leap 15.3 (noarch): libyang-doc-1.0.184-150300.3.3.1 - SUSE Linux Enterprise Module for Server Applications 15-SP4 (aarch64 ppc64le s390x x86_64): libyang-debuginfo-1.0.184-150300.3.3.1 libyang-debugsource-1.0.184-150300.3.3.1 libyang-extentions-1.0.184-150300.3.3.1 libyang-extentions-debuginfo-1.0.184-150300.3.3.1 libyang1-1.0.184-150300.3.3.1 libyang1-debuginfo-1.0.184-150300.3.3.1 - SUSE Linux Enterprise Module for Server Applications 15-SP3 (aarch64 ppc64le s390x x86_64): libyang-debuginfo-1.0.184-150300.3.3.1 libyang-debugsource-1.0.184-150300.3.3.1 libyang-extentions-1.0.184-150300.3.3.1 libyang-extentions-debuginfo-1.0.184-150300.3.3.1 libyang1-1.0.184-150300.3.3.1 libyang1-debuginfo-1.0.184-150300.3.3.1 References: https://www.suse.com/security/cve/CVE-2021-28905.html https://bugzilla.suse.com/1186377

1 0

SUSE-SU-2022:2923-1: important: Security update for keepalived
by opensuse-security＠opensuse.org 26 Aug '22

26 Aug '22

SUSE Security Update: Security update for keepalived ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:2923-1 Rating: important References: #1193115 Cross-References: CVE-2021-44225 CVSS scores: CVE-2021-44225 (NVD) : 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVE-2021-44225 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N Affected Products: SUSE Linux Enterprise High Availability 15-SP1 SUSE Linux Enterprise High Availability 15-SP2 SUSE Linux Enterprise High Availability 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP1 SUSE Linux Enterprise High Performance Computing 15-SP2 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Server 15-SP1 SUSE Linux Enterprise Server 15-SP2 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP1 SUSE Linux Enterprise Server for SAP Applications 15-SP2 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Storage 6 SUSE Linux Enterprise Storage 7 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.0 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.0 SUSE Manager Retail Branch Server 4.1 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.0 SUSE Manager Server 4.1 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for keepalived fixes the following issues: - CVE-2021-44225: Fix a potential privilege escalation due to insufficient control in the D-Bus policy (bsc#1193115). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-2923=1 - SUSE Linux Enterprise High Availability 15-SP3: zypper in -t patch SUSE-SLE-Product-HA-15-SP3-2022-2923=1 - SUSE Linux Enterprise High Availability 15-SP2: zypper in -t patch SUSE-SLE-Product-HA-15-SP2-2022-2923=1 - SUSE Linux Enterprise High Availability 15-SP1: zypper in -t patch SUSE-SLE-Product-HA-15-SP1-2022-2923=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): keepalived-2.0.19-150100.3.6.1 keepalived-debuginfo-2.0.19-150100.3.6.1 keepalived-debugsource-2.0.19-150100.3.6.1 - SUSE Linux Enterprise High Availability 15-SP3 (aarch64 ppc64le s390x x86_64): keepalived-2.0.19-150100.3.6.1 keepalived-debuginfo-2.0.19-150100.3.6.1 keepalived-debugsource-2.0.19-150100.3.6.1 - SUSE Linux Enterprise High Availability 15-SP2 (aarch64 ppc64le s390x x86_64): keepalived-2.0.19-150100.3.6.1 keepalived-debuginfo-2.0.19-150100.3.6.1 keepalived-debugsource-2.0.19-150100.3.6.1 - SUSE Linux Enterprise High Availability 15-SP1 (aarch64 ppc64le s390x x86_64): keepalived-2.0.19-150100.3.6.1 keepalived-debuginfo-2.0.19-150100.3.6.1 keepalived-debugsource-2.0.19-150100.3.6.1 References: https://www.suse.com/security/cve/CVE-2021-44225.html https://bugzilla.suse.com/1193115

1 0

SUSE-SU-2022:2919-1: important: Security update for gnutls
by opensuse-security＠opensuse.org 26 Aug '22

26 Aug '22

SUSE Security Update: Security update for gnutls ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:2919-1 Rating: important References: #1190698 #1198979 #1202020 Cross-References: CVE-2022-2509 CVSS scores: CVE-2022-2509 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-2509 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for gnutls fixes the following issues: - CVE-2022-2509: Fixed a double free issue during PKCS7 verification (bsc#1202020). Non-security fixes: - FIPS: Check minimum keylength for symmetric key generation [bsc#1190698] - FIPS: Only allows ECDSA signature with valid set of hashes (SHA2 and SHA3) [bsc#1190698] - FIPS: Provides interface for running library self tests on-demand [bsc#1198979] Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-2919=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-2919=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): gnutls-3.7.3-150400.4.10.1 gnutls-debuginfo-3.7.3-150400.4.10.1 gnutls-debugsource-3.7.3-150400.4.10.1 gnutls-guile-3.7.3-150400.4.10.1 gnutls-guile-debuginfo-3.7.3-150400.4.10.1 libgnutls-devel-3.7.3-150400.4.10.1 libgnutls30-3.7.3-150400.4.10.1 libgnutls30-debuginfo-3.7.3-150400.4.10.1 libgnutls30-hmac-3.7.3-150400.4.10.1 libgnutlsxx-devel-3.7.3-150400.4.10.1 libgnutlsxx28-3.7.3-150400.4.10.1 libgnutlsxx28-debuginfo-3.7.3-150400.4.10.1 - openSUSE Leap 15.4 (x86_64): libgnutls-devel-32bit-3.7.3-150400.4.10.1 libgnutls30-32bit-3.7.3-150400.4.10.1 libgnutls30-32bit-debuginfo-3.7.3-150400.4.10.1 libgnutls30-hmac-32bit-3.7.3-150400.4.10.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): gnutls-3.7.3-150400.4.10.1 gnutls-debuginfo-3.7.3-150400.4.10.1 gnutls-debugsource-3.7.3-150400.4.10.1 libgnutls-devel-3.7.3-150400.4.10.1 libgnutls30-3.7.3-150400.4.10.1 libgnutls30-debuginfo-3.7.3-150400.4.10.1 libgnutls30-hmac-3.7.3-150400.4.10.1 libgnutlsxx-devel-3.7.3-150400.4.10.1 libgnutlsxx28-3.7.3-150400.4.10.1 libgnutlsxx28-debuginfo-3.7.3-150400.4.10.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (x86_64): libgnutls30-32bit-3.7.3-150400.4.10.1 libgnutls30-32bit-debuginfo-3.7.3-150400.4.10.1 libgnutls30-hmac-32bit-3.7.3-150400.4.10.1 References: https://www.suse.com/security/cve/CVE-2022-2509.html https://bugzilla.suse.com/1190698 https://bugzilla.suse.com/1198979 https://bugzilla.suse.com/1202020

1 0

SUSE-SU-2022:2908-1: important: Security update for python-lxml
by opensuse-security＠opensuse.org 26 Aug '22

26 Aug '22

SUSE Security Update: Security update for python-lxml ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:2908-1 Rating: important References: #1201253 Cross-References: CVE-2022-2309 CVSS scores: CVE-2022-2309 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-2309 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: SUSE Enterprise Storage 7 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Module for Python2 15-SP3 SUSE Linux Enterprise Server 15-SP2-BCL SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.1 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.1 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-lxml fixes the following issues: - CVE-2022-2309: Fixed NULL pointer dereference due to state leak between parser runs (bsc#1201253). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-2908=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-2908=1 - SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-2908=1 - SUSE Manager Retail Branch Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-2908=1 - SUSE Manager Proxy 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-2908=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-2908=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-2908=1 - SUSE Linux Enterprise Server 15-SP2-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-2908=1 - SUSE Linux Enterprise Module for Python2 15-SP3: zypper in -t patch SUSE-SLE-Module-Python2-15-SP3-2022-2908=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-2908=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-2908=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-2908=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-2908=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2022-2908=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): python-lxml-debuginfo-4.7.1-150200.3.10.1 python-lxml-debugsource-4.7.1-150200.3.10.1 python3-lxml-4.7.1-150200.3.10.1 python3-lxml-debuginfo-4.7.1-150200.3.10.1 python3-lxml-devel-4.7.1-150200.3.10.1 - openSUSE Leap 15.4 (noarch): python3-lxml-doc-4.7.1-150200.3.10.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): python-lxml-debuginfo-4.7.1-150200.3.10.1 python-lxml-debugsource-4.7.1-150200.3.10.1 python2-lxml-4.7.1-150200.3.10.1 python2-lxml-debuginfo-4.7.1-150200.3.10.1 python2-lxml-devel-4.7.1-150200.3.10.1 python3-lxml-4.7.1-150200.3.10.1 python3-lxml-debuginfo-4.7.1-150200.3.10.1 python3-lxml-devel-4.7.1-150200.3.10.1 - SUSE Manager Server 4.1 (ppc64le s390x x86_64): python-lxml-debuginfo-4.7.1-150200.3.10.1 python-lxml-debugsource-4.7.1-150200.3.10.1 python2-lxml-4.7.1-150200.3.10.1 python2-lxml-debuginfo-4.7.1-150200.3.10.1 python2-lxml-devel-4.7.1-150200.3.10.1 python3-lxml-4.7.1-150200.3.10.1 python3-lxml-debuginfo-4.7.1-150200.3.10.1 python3-lxml-devel-4.7.1-150200.3.10.1 - SUSE Manager Retail Branch Server 4.1 (x86_64): python-lxml-debuginfo-4.7.1-150200.3.10.1 python-lxml-debugsource-4.7.1-150200.3.10.1 python2-lxml-4.7.1-150200.3.10.1 python2-lxml-debuginfo-4.7.1-150200.3.10.1 python2-lxml-devel-4.7.1-150200.3.10.1 python3-lxml-4.7.1-150200.3.10.1 python3-lxml-debuginfo-4.7.1-150200.3.10.1 python3-lxml-devel-4.7.1-150200.3.10.1 - SUSE Manager Proxy 4.1 (x86_64): python-lxml-debuginfo-4.7.1-150200.3.10.1 python-lxml-debugsource-4.7.1-150200.3.10.1 python2-lxml-4.7.1-150200.3.10.1 python2-lxml-debuginfo-4.7.1-150200.3.10.1 python2-lxml-devel-4.7.1-150200.3.10.1 python3-lxml-4.7.1-150200.3.10.1 python3-lxml-debuginfo-4.7.1-150200.3.10.1 python3-lxml-devel-4.7.1-150200.3.10.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): python-lxml-debuginfo-4.7.1-150200.3.10.1 python-lxml-debugsource-4.7.1-150200.3.10.1 python2-lxml-4.7.1-150200.3.10.1 python2-lxml-debuginfo-4.7.1-150200.3.10.1 python2-lxml-devel-4.7.1-150200.3.10.1 python3-lxml-4.7.1-150200.3.10.1 python3-lxml-debuginfo-4.7.1-150200.3.10.1 python3-lxml-devel-4.7.1-150200.3.10.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): python-lxml-debuginfo-4.7.1-150200.3.10.1 python-lxml-debugsource-4.7.1-150200.3.10.1 python2-lxml-4.7.1-150200.3.10.1 python2-lxml-debuginfo-4.7.1-150200.3.10.1 python2-lxml-devel-4.7.1-150200.3.10.1 python3-lxml-4.7.1-150200.3.10.1 python3-lxml-debuginfo-4.7.1-150200.3.10.1 python3-lxml-devel-4.7.1-150200.3.10.1 - SUSE Linux Enterprise Server 15-SP2-BCL (x86_64): python-lxml-debuginfo-4.7.1-150200.3.10.1 python-lxml-debugsource-4.7.1-150200.3.10.1 python3-lxml-4.7.1-150200.3.10.1 python3-lxml-debuginfo-4.7.1-150200.3.10.1 python3-lxml-devel-4.7.1-150200.3.10.1 - SUSE Linux Enterprise Module for Python2 15-SP3 (aarch64 ppc64le s390x x86_64): python-lxml-debuginfo-4.7.1-150200.3.10.1 python-lxml-debugsource-4.7.1-150200.3.10.1 python2-lxml-4.7.1-150200.3.10.1 python2-lxml-debuginfo-4.7.1-150200.3.10.1 python2-lxml-devel-4.7.1-150200.3.10.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): python-lxml-debuginfo-4.7.1-150200.3.10.1 python-lxml-debugsource-4.7.1-150200.3.10.1 python3-lxml-4.7.1-150200.3.10.1 python3-lxml-debuginfo-4.7.1-150200.3.10.1 python3-lxml-devel-4.7.1-150200.3.10.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): python-lxml-debuginfo-4.7.1-150200.3.10.1 python-lxml-debugsource-4.7.1-150200.3.10.1 python3-lxml-4.7.1-150200.3.10.1 python3-lxml-debuginfo-4.7.1-150200.3.10.1 python3-lxml-devel-4.7.1-150200.3.10.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64): python-lxml-debuginfo-4.7.1-150200.3.10.1 python-lxml-debugsource-4.7.1-150200.3.10.1 python2-lxml-4.7.1-150200.3.10.1 python2-lxml-debuginfo-4.7.1-150200.3.10.1 python2-lxml-devel-4.7.1-150200.3.10.1 python3-lxml-4.7.1-150200.3.10.1 python3-lxml-debuginfo-4.7.1-150200.3.10.1 python3-lxml-devel-4.7.1-150200.3.10.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64): python-lxml-debuginfo-4.7.1-150200.3.10.1 python-lxml-debugsource-4.7.1-150200.3.10.1 python2-lxml-4.7.1-150200.3.10.1 python2-lxml-debuginfo-4.7.1-150200.3.10.1 python2-lxml-devel-4.7.1-150200.3.10.1 python3-lxml-4.7.1-150200.3.10.1 python3-lxml-debuginfo-4.7.1-150200.3.10.1 python3-lxml-devel-4.7.1-150200.3.10.1 - SUSE Enterprise Storage 7 (aarch64 x86_64): python-lxml-debuginfo-4.7.1-150200.3.10.1 python-lxml-debugsource-4.7.1-150200.3.10.1 python2-lxml-4.7.1-150200.3.10.1 python2-lxml-debuginfo-4.7.1-150200.3.10.1 python2-lxml-devel-4.7.1-150200.3.10.1 python3-lxml-4.7.1-150200.3.10.1 python3-lxml-debuginfo-4.7.1-150200.3.10.1 python3-lxml-devel-4.7.1-150200.3.10.1 References: https://www.suse.com/security/cve/CVE-2022-2309.html https://bugzilla.suse.com/1201253

1 0

openSUSE-SU-2022:10099-1: important: Security update for chromium
by opensuse-security＠opensuse.org 25 Aug '22

25 Aug '22

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10099-1 Rating: important References: #1202509 Cross-References: CVE-2022-2852 CVE-2022-2853 CVE-2022-2854 CVE-2022-2855 CVE-2022-2856 CVE-2022-2857 CVE-2022-2858 CVE-2022-2859 CVE-2022-2860 CVE-2022-2861 Affected Products: openSUSE Backports SLE-15-SP3 openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium 104.0.5112.101 (boo#1202509): * CVE-2022-2852: Use after free in FedCM * CVE-2022-2854: Use after free in SwiftShader * CVE-2022-2855: Use after free in ANGLE * CVE-2022-2857: Use after free in Blink * CVE-2022-2858: Use after free in Sign-In Flow * CVE-2022-2853: Heap buffer overflow in Downloads * CVE-2022-2856: Insufficient validation of untrusted input in Intents * CVE-2022-2859: Use after free in Chrome OS Shell * CVE-2022-2860: Insufficient policy enforcement in Cookies * CVE-2022-2861: Inappropriate implementation in Extensions API - Re-enable our version of chrome-wrapper - Set no sandbox if root is being used (https://crbug.com/638180) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10099=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-10099=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 x86_64): chromedriver-104.0.5112.101-bp154.2.23.1 chromedriver-debuginfo-104.0.5112.101-bp154.2.23.1 chromium-104.0.5112.101-bp154.2.23.1 chromium-debuginfo-104.0.5112.101-bp154.2.23.1 - openSUSE Backports SLE-15-SP3 (aarch64 x86_64): chromedriver-104.0.5112.101-bp153.2.116.1 chromium-104.0.5112.101-bp153.2.116.1 References: https://www.suse.com/security/cve/CVE-2022-2852.html https://www.suse.com/security/cve/CVE-2022-2853.html https://www.suse.com/security/cve/CVE-2022-2854.html https://www.suse.com/security/cve/CVE-2022-2855.html https://www.suse.com/security/cve/CVE-2022-2856.html https://www.suse.com/security/cve/CVE-2022-2857.html https://www.suse.com/security/cve/CVE-2022-2858.html https://www.suse.com/security/cve/CVE-2022-2859.html https://www.suse.com/security/cve/CVE-2022-2860.html https://www.suse.com/security/cve/CVE-2022-2861.html https://bugzilla.suse.com/1202509

1 0

SUSE-SU-2022:2896-1: moderate: Security update for raptor
by opensuse-security＠opensuse.org 25 Aug '22

25 Aug '22

SUSE Security Update: Security update for raptor ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:2896-1 Rating: moderate References: #1178903 Cross-References: CVE-2020-25713 CVSS scores: CVE-2020-25713 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2020-25713 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Desktop Applications 15-SP3 SUSE Linux Enterprise Module for Desktop Applications 15-SP4 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for raptor fixes the following issues: - CVE-2020-25713: Fixed an out of bounds access triggered via a malformed input file (bsc#1178903). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-2896=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-2896=1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3: zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP3-2022-2896=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP4-2022-2896=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP3-2022-2896=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libraptor-devel-2.0.15-150200.9.12.1 libraptor2-0-2.0.15-150200.9.12.1 libraptor2-0-debuginfo-2.0.15-150200.9.12.1 raptor-2.0.15-150200.9.12.1 raptor-debuginfo-2.0.15-150200.9.12.1 raptor-debugsource-2.0.15-150200.9.12.1 - openSUSE Leap 15.4 (x86_64): libraptor2-0-32bit-2.0.15-150200.9.12.1 libraptor2-0-32bit-debuginfo-2.0.15-150200.9.12.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libraptor-devel-2.0.15-150200.9.12.1 libraptor2-0-2.0.15-150200.9.12.1 libraptor2-0-debuginfo-2.0.15-150200.9.12.1 raptor-2.0.15-150200.9.12.1 raptor-debuginfo-2.0.15-150200.9.12.1 raptor-debugsource-2.0.15-150200.9.12.1 - openSUSE Leap 15.3 (x86_64): libraptor2-0-32bit-2.0.15-150200.9.12.1 libraptor2-0-32bit-debuginfo-2.0.15-150200.9.12.1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (aarch64 ppc64le s390x): libraptor-devel-2.0.15-150200.9.12.1 libraptor2-0-2.0.15-150200.9.12.1 libraptor2-0-debuginfo-2.0.15-150200.9.12.1 raptor-2.0.15-150200.9.12.1 raptor-debuginfo-2.0.15-150200.9.12.1 raptor-debugsource-2.0.15-150200.9.12.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4 (aarch64 ppc64le s390x x86_64): libraptor-devel-2.0.15-150200.9.12.1 libraptor2-0-2.0.15-150200.9.12.1 libraptor2-0-debuginfo-2.0.15-150200.9.12.1 raptor-2.0.15-150200.9.12.1 raptor-debuginfo-2.0.15-150200.9.12.1 raptor-debugsource-2.0.15-150200.9.12.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (aarch64 ppc64le s390x x86_64): libraptor-devel-2.0.15-150200.9.12.1 libraptor2-0-2.0.15-150200.9.12.1 libraptor2-0-debuginfo-2.0.15-150200.9.12.1 raptor-2.0.15-150200.9.12.1 raptor-debuginfo-2.0.15-150200.9.12.1 raptor-debugsource-2.0.15-150200.9.12.1 References: https://www.suse.com/security/cve/CVE-2020-25713.html https://bugzilla.suse.com/1178903

1 0