February 2023 - openSUSE Security Announce

SUSE-SU-2023:0310-1: important: Security update for openssl-1_1
by opensuse-security＠opensuse.org 07 Feb '23

07 Feb '23

SUSE Security Update: Security update for openssl-1_1 ______________________________________________________________________________ Announcement ID: SUSE-SU-2023:0310-1 Rating: important References: #1121365 #1198472 #1207533 #1207534 #1207536 #1207538 Cross-References: CVE-2022-4304 CVE-2022-4450 CVE-2023-0215 CVE-2023-0286 CVSS scores: CVE-2022-4304 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2022-4450 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2023-0215 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2023-0286 (SUSE): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H Affected Products: SUSE Enterprise Storage 7 SUSE Enterprise Storage 7.1 SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Realtime Extension 15-SP3 SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server 15-SP3-LTSS SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Linux Enterprise Server for SAP 15-SP3 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap Micro 5.2 ______________________________________________________________________________ An update that solves four vulnerabilities and has two fixes is now available. Description: This update for openssl-1_1 fixes the following issues: - CVE-2023-0286: Fixed X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address (bsc#1207533). - CVE-2023-0215: Fixed use-after-free following BIO_new_NDEF() (bsc#1207536). - CVE-2022-4450: Fixed double free after calling PEM_read_bio_ex() (bsc#1207538). - CVE-2022-4304: Fixed timing Oracle in RSA Decryption (bsc#1207534). - FIPS: list only FIPS approved public key algorithms (bsc#1121365, bsc#1198472) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap Micro 5.2: zypper in -t patch openSUSE-Leap-Micro-5.2-2023-310=1 - SUSE Manager Server 4.2: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-310=1 - SUSE Manager Retail Branch Server 4.2: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.2-2023-310=1 - SUSE Manager Proxy 4.2: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.2-2023-310=1 - SUSE Linux Enterprise Server for SAP 15-SP3: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-310=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2023-310=1 - SUSE Linux Enterprise Server 15-SP3-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-310=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2023-310=1 - SUSE Linux Enterprise Realtime Extension 15-SP3: zypper in -t patch SUSE-SLE-Product-RT-15-SP3-2023-310=1 - SUSE Linux Enterprise Micro 5.2: zypper in -t patch SUSE-SUSE-MicroOS-5.2-2023-310=1 - SUSE Linux Enterprise Micro 5.1: zypper in -t patch SUSE-SUSE-MicroOS-5.1-2023-310=1 - SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-310=1 - SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-310=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2023-310=1 - SUSE Enterprise Storage 7.1: zypper in -t patch SUSE-Storage-7.1-2023-310=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2023-310=1 Package List: - openSUSE Leap Micro 5.2 (aarch64 x86_64): libopenssl-1_1-devel-1.1.1d-150200.11.57.1 libopenssl1_1-1.1.1d-150200.11.57.1 libopenssl1_1-debuginfo-1.1.1d-150200.11.57.1 libopenssl1_1-hmac-1.1.1d-150200.11.57.1 openssl-1_1-1.1.1d-150200.11.57.1 openssl-1_1-debuginfo-1.1.1d-150200.11.57.1 openssl-1_1-debugsource-1.1.1d-150200.11.57.1 - SUSE Manager Server 4.2 (ppc64le s390x x86_64): libopenssl-1_1-devel-1.1.1d-150200.11.57.1 libopenssl1_1-1.1.1d-150200.11.57.1 libopenssl1_1-debuginfo-1.1.1d-150200.11.57.1 libopenssl1_1-hmac-1.1.1d-150200.11.57.1 openssl-1_1-1.1.1d-150200.11.57.1 openssl-1_1-debuginfo-1.1.1d-150200.11.57.1 openssl-1_1-debugsource-1.1.1d-150200.11.57.1 - SUSE Manager Server 4.2 (x86_64): libopenssl-1_1-devel-32bit-1.1.1d-150200.11.57.1 libopenssl1_1-32bit-1.1.1d-150200.11.57.1 libopenssl1_1-32bit-debuginfo-1.1.1d-150200.11.57.1 libopenssl1_1-hmac-32bit-1.1.1d-150200.11.57.1 - SUSE Manager Retail Branch Server 4.2 (x86_64): libopenssl-1_1-devel-1.1.1d-150200.11.57.1 libopenssl-1_1-devel-32bit-1.1.1d-150200.11.57.1 libopenssl1_1-1.1.1d-150200.11.57.1 libopenssl1_1-32bit-1.1.1d-150200.11.57.1 libopenssl1_1-32bit-debuginfo-1.1.1d-150200.11.57.1 libopenssl1_1-debuginfo-1.1.1d-150200.11.57.1 libopenssl1_1-hmac-1.1.1d-150200.11.57.1 libopenssl1_1-hmac-32bit-1.1.1d-150200.11.57.1 openssl-1_1-1.1.1d-150200.11.57.1 openssl-1_1-debuginfo-1.1.1d-150200.11.57.1 openssl-1_1-debugsource-1.1.1d-150200.11.57.1 - SUSE Manager Proxy 4.2 (x86_64): libopenssl-1_1-devel-1.1.1d-150200.11.57.1 libopenssl-1_1-devel-32bit-1.1.1d-150200.11.57.1 libopenssl1_1-1.1.1d-150200.11.57.1 libopenssl1_1-32bit-1.1.1d-150200.11.57.1 libopenssl1_1-32bit-debuginfo-1.1.1d-150200.11.57.1 libopenssl1_1-debuginfo-1.1.1d-150200.11.57.1 libopenssl1_1-hmac-1.1.1d-150200.11.57.1 libopenssl1_1-hmac-32bit-1.1.1d-150200.11.57.1 openssl-1_1-1.1.1d-150200.11.57.1 openssl-1_1-debuginfo-1.1.1d-150200.11.57.1 openssl-1_1-debugsource-1.1.1d-150200.11.57.1 - SUSE Linux Enterprise Server for SAP 15-SP3 (ppc64le x86_64): libopenssl-1_1-devel-1.1.1d-150200.11.57.1 libopenssl1_1-1.1.1d-150200.11.57.1 libopenssl1_1-debuginfo-1.1.1d-150200.11.57.1 libopenssl1_1-hmac-1.1.1d-150200.11.57.1 openssl-1_1-1.1.1d-150200.11.57.1 openssl-1_1-debuginfo-1.1.1d-150200.11.57.1 openssl-1_1-debugsource-1.1.1d-150200.11.57.1 - SUSE Linux Enterprise Server for SAP 15-SP3 (noarch): openssl-1_1-doc-1.1.1d-150200.11.57.1 - SUSE Linux Enterprise Server for SAP 15-SP3 (x86_64): libopenssl-1_1-devel-32bit-1.1.1d-150200.11.57.1 libopenssl1_1-32bit-1.1.1d-150200.11.57.1 libopenssl1_1-32bit-debuginfo-1.1.1d-150200.11.57.1 libopenssl1_1-hmac-32bit-1.1.1d-150200.11.57.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): libopenssl-1_1-devel-1.1.1d-150200.11.57.1 libopenssl1_1-1.1.1d-150200.11.57.1 libopenssl1_1-debuginfo-1.1.1d-150200.11.57.1 libopenssl1_1-hmac-1.1.1d-150200.11.57.1 openssl-1_1-1.1.1d-150200.11.57.1 openssl-1_1-debuginfo-1.1.1d-150200.11.57.1 openssl-1_1-debugsource-1.1.1d-150200.11.57.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (x86_64): libopenssl1_1-32bit-1.1.1d-150200.11.57.1 libopenssl1_1-32bit-debuginfo-1.1.1d-150200.11.57.1 libopenssl1_1-hmac-32bit-1.1.1d-150200.11.57.1 - SUSE Linux Enterprise Server 15-SP3-LTSS (aarch64 ppc64le s390x x86_64): libopenssl-1_1-devel-1.1.1d-150200.11.57.1 libopenssl1_1-1.1.1d-150200.11.57.1 libopenssl1_1-debuginfo-1.1.1d-150200.11.57.1 libopenssl1_1-hmac-1.1.1d-150200.11.57.1 openssl-1_1-1.1.1d-150200.11.57.1 openssl-1_1-debuginfo-1.1.1d-150200.11.57.1 openssl-1_1-debugsource-1.1.1d-150200.11.57.1 - SUSE Linux Enterprise Server 15-SP3-LTSS (noarch): openssl-1_1-doc-1.1.1d-150200.11.57.1 - SUSE Linux Enterprise Server 15-SP3-LTSS (x86_64): libopenssl-1_1-devel-32bit-1.1.1d-150200.11.57.1 libopenssl1_1-32bit-1.1.1d-150200.11.57.1 libopenssl1_1-32bit-debuginfo-1.1.1d-150200.11.57.1 libopenssl1_1-hmac-32bit-1.1.1d-150200.11.57.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): libopenssl-1_1-devel-1.1.1d-150200.11.57.1 libopenssl1_1-1.1.1d-150200.11.57.1 libopenssl1_1-debuginfo-1.1.1d-150200.11.57.1 libopenssl1_1-hmac-1.1.1d-150200.11.57.1 openssl-1_1-1.1.1d-150200.11.57.1 openssl-1_1-debuginfo-1.1.1d-150200.11.57.1 openssl-1_1-debugsource-1.1.1d-150200.11.57.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (x86_64): libopenssl1_1-32bit-1.1.1d-150200.11.57.1 libopenssl1_1-32bit-debuginfo-1.1.1d-150200.11.57.1 libopenssl1_1-hmac-32bit-1.1.1d-150200.11.57.1 - SUSE Linux Enterprise Realtime Extension 15-SP3 (x86_64): libopenssl-1_1-devel-1.1.1d-150200.11.57.1 libopenssl-1_1-devel-32bit-1.1.1d-150200.11.57.1 libopenssl1_1-1.1.1d-150200.11.57.1 libopenssl1_1-32bit-1.1.1d-150200.11.57.1 libopenssl1_1-32bit-debuginfo-1.1.1d-150200.11.57.1 libopenssl1_1-debuginfo-1.1.1d-150200.11.57.1 libopenssl1_1-hmac-1.1.1d-150200.11.57.1 libopenssl1_1-hmac-32bit-1.1.1d-150200.11.57.1 openssl-1_1-1.1.1d-150200.11.57.1 openssl-1_1-debuginfo-1.1.1d-150200.11.57.1 openssl-1_1-debugsource-1.1.1d-150200.11.57.1 - SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64): libopenssl-1_1-devel-1.1.1d-150200.11.57.1 libopenssl1_1-1.1.1d-150200.11.57.1 libopenssl1_1-debuginfo-1.1.1d-150200.11.57.1 libopenssl1_1-hmac-1.1.1d-150200.11.57.1 openssl-1_1-1.1.1d-150200.11.57.1 openssl-1_1-debuginfo-1.1.1d-150200.11.57.1 openssl-1_1-debugsource-1.1.1d-150200.11.57.1 - SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64): libopenssl-1_1-devel-1.1.1d-150200.11.57.1 libopenssl1_1-1.1.1d-150200.11.57.1 libopenssl1_1-debuginfo-1.1.1d-150200.11.57.1 libopenssl1_1-hmac-1.1.1d-150200.11.57.1 openssl-1_1-1.1.1d-150200.11.57.1 openssl-1_1-debuginfo-1.1.1d-150200.11.57.1 openssl-1_1-debugsource-1.1.1d-150200.11.57.1 - SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS (aarch64 x86_64): libopenssl-1_1-devel-1.1.1d-150200.11.57.1 libopenssl1_1-1.1.1d-150200.11.57.1 libopenssl1_1-debuginfo-1.1.1d-150200.11.57.1 libopenssl1_1-hmac-1.1.1d-150200.11.57.1 openssl-1_1-1.1.1d-150200.11.57.1 openssl-1_1-debuginfo-1.1.1d-150200.11.57.1 openssl-1_1-debugsource-1.1.1d-150200.11.57.1 - SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS (x86_64): libopenssl-1_1-devel-32bit-1.1.1d-150200.11.57.1 libopenssl1_1-32bit-1.1.1d-150200.11.57.1 libopenssl1_1-32bit-debuginfo-1.1.1d-150200.11.57.1 libopenssl1_1-hmac-32bit-1.1.1d-150200.11.57.1 - SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS (noarch): openssl-1_1-doc-1.1.1d-150200.11.57.1 - SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS (aarch64 x86_64): libopenssl-1_1-devel-1.1.1d-150200.11.57.1 libopenssl1_1-1.1.1d-150200.11.57.1 libopenssl1_1-debuginfo-1.1.1d-150200.11.57.1 libopenssl1_1-hmac-1.1.1d-150200.11.57.1 openssl-1_1-1.1.1d-150200.11.57.1 openssl-1_1-debuginfo-1.1.1d-150200.11.57.1 openssl-1_1-debugsource-1.1.1d-150200.11.57.1 - SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS (x86_64): libopenssl-1_1-devel-32bit-1.1.1d-150200.11.57.1 libopenssl1_1-32bit-1.1.1d-150200.11.57.1 libopenssl1_1-32bit-debuginfo-1.1.1d-150200.11.57.1 libopenssl1_1-hmac-32bit-1.1.1d-150200.11.57.1 - SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS (noarch): openssl-1_1-doc-1.1.1d-150200.11.57.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64): libopenssl-1_1-devel-1.1.1d-150200.11.57.1 libopenssl1_1-1.1.1d-150200.11.57.1 libopenssl1_1-debuginfo-1.1.1d-150200.11.57.1 libopenssl1_1-hmac-1.1.1d-150200.11.57.1 openssl-1_1-1.1.1d-150200.11.57.1 openssl-1_1-debuginfo-1.1.1d-150200.11.57.1 openssl-1_1-debugsource-1.1.1d-150200.11.57.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (x86_64): libopenssl1_1-32bit-1.1.1d-150200.11.57.1 libopenssl1_1-32bit-debuginfo-1.1.1d-150200.11.57.1 libopenssl1_1-hmac-32bit-1.1.1d-150200.11.57.1 - SUSE Enterprise Storage 7.1 (aarch64 x86_64): libopenssl-1_1-devel-1.1.1d-150200.11.57.1 libopenssl1_1-1.1.1d-150200.11.57.1 libopenssl1_1-debuginfo-1.1.1d-150200.11.57.1 libopenssl1_1-hmac-1.1.1d-150200.11.57.1 openssl-1_1-1.1.1d-150200.11.57.1 openssl-1_1-debuginfo-1.1.1d-150200.11.57.1 openssl-1_1-debugsource-1.1.1d-150200.11.57.1 - SUSE Enterprise Storage 7.1 (noarch): openssl-1_1-doc-1.1.1d-150200.11.57.1 - SUSE Enterprise Storage 7.1 (x86_64): libopenssl-1_1-devel-32bit-1.1.1d-150200.11.57.1 libopenssl1_1-32bit-1.1.1d-150200.11.57.1 libopenssl1_1-32bit-debuginfo-1.1.1d-150200.11.57.1 libopenssl1_1-hmac-32bit-1.1.1d-150200.11.57.1 - SUSE Enterprise Storage 7 (aarch64 x86_64): libopenssl-1_1-devel-1.1.1d-150200.11.57.1 libopenssl1_1-1.1.1d-150200.11.57.1 libopenssl1_1-debuginfo-1.1.1d-150200.11.57.1 libopenssl1_1-hmac-1.1.1d-150200.11.57.1 openssl-1_1-1.1.1d-150200.11.57.1 openssl-1_1-debuginfo-1.1.1d-150200.11.57.1 openssl-1_1-debugsource-1.1.1d-150200.11.57.1 - SUSE Enterprise Storage 7 (x86_64): libopenssl1_1-32bit-1.1.1d-150200.11.57.1 libopenssl1_1-32bit-debuginfo-1.1.1d-150200.11.57.1 libopenssl1_1-hmac-32bit-1.1.1d-150200.11.57.1 References: https://www.suse.com/security/cve/CVE-2022-4304.html https://www.suse.com/security/cve/CVE-2022-4450.html https://www.suse.com/security/cve/CVE-2023-0215.html https://www.suse.com/security/cve/CVE-2023-0286.html https://bugzilla.suse.com/1121365 https://bugzilla.suse.com/1198472 https://bugzilla.suse.com/1207533 https://bugzilla.suse.com/1207534 https://bugzilla.suse.com/1207536 https://bugzilla.suse.com/1207538

1 0

SUSE-SU-2023:0311-1: important: Security update for openssl-1_1
by opensuse-security＠opensuse.org 07 Feb '23

07 Feb '23

SUSE Security Update: Security update for openssl-1_1 ______________________________________________________________________________ Announcement ID: SUSE-SU-2023:0311-1 Rating: important References: #1207533 #1207534 #1207536 #1207538 Cross-References: CVE-2022-4304 CVE-2022-4450 CVE-2023-0215 CVE-2023-0286 CVSS scores: CVE-2022-4304 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2022-4450 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2023-0215 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2023-0286 (SUSE): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 openSUSE Leap Micro 5.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for openssl-1_1 fixes the following issues: - CVE-2023-0286: Fixed X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address (bsc#1207533). - CVE-2023-0215: Fixed use-after-free following BIO_new_NDEF() (bsc#1207536). - CVE-2022-4450: Fixed double free after calling PEM_read_bio_ex() (bsc#1207538). - CVE-2022-4304: Fixed timing Oracle in RSA Decryption (bsc#1207534). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap Micro 5.3: zypper in -t patch openSUSE-Leap-Micro-5.3-2023-311=1 - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2023-311=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-311=1 - SUSE Linux Enterprise Micro 5.3: zypper in -t patch SUSE-SLE-Micro-5.3-2023-311=1 Package List: - openSUSE Leap Micro 5.3 (aarch64 x86_64): libopenssl-1_1-devel-1.1.1l-150400.7.22.1 libopenssl1_1-1.1.1l-150400.7.22.1 libopenssl1_1-debuginfo-1.1.1l-150400.7.22.1 libopenssl1_1-hmac-1.1.1l-150400.7.22.1 openssl-1_1-1.1.1l-150400.7.22.1 openssl-1_1-debuginfo-1.1.1l-150400.7.22.1 openssl-1_1-debugsource-1.1.1l-150400.7.22.1 - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libopenssl-1_1-devel-1.1.1l-150400.7.22.1 libopenssl1_1-1.1.1l-150400.7.22.1 libopenssl1_1-debuginfo-1.1.1l-150400.7.22.1 libopenssl1_1-hmac-1.1.1l-150400.7.22.1 openssl-1_1-1.1.1l-150400.7.22.1 openssl-1_1-debuginfo-1.1.1l-150400.7.22.1 openssl-1_1-debugsource-1.1.1l-150400.7.22.1 - openSUSE Leap 15.4 (x86_64): libopenssl-1_1-devel-32bit-1.1.1l-150400.7.22.1 libopenssl1_1-32bit-1.1.1l-150400.7.22.1 libopenssl1_1-32bit-debuginfo-1.1.1l-150400.7.22.1 libopenssl1_1-hmac-32bit-1.1.1l-150400.7.22.1 - openSUSE Leap 15.4 (noarch): openssl-1_1-doc-1.1.1l-150400.7.22.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): libopenssl-1_1-devel-1.1.1l-150400.7.22.1 libopenssl1_1-1.1.1l-150400.7.22.1 libopenssl1_1-debuginfo-1.1.1l-150400.7.22.1 libopenssl1_1-hmac-1.1.1l-150400.7.22.1 openssl-1_1-1.1.1l-150400.7.22.1 openssl-1_1-debuginfo-1.1.1l-150400.7.22.1 openssl-1_1-debugsource-1.1.1l-150400.7.22.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (x86_64): libopenssl-1_1-devel-32bit-1.1.1l-150400.7.22.1 libopenssl1_1-32bit-1.1.1l-150400.7.22.1 libopenssl1_1-32bit-debuginfo-1.1.1l-150400.7.22.1 libopenssl1_1-hmac-32bit-1.1.1l-150400.7.22.1 - SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64): libopenssl-1_1-devel-1.1.1l-150400.7.22.1 libopenssl1_1-1.1.1l-150400.7.22.1 libopenssl1_1-debuginfo-1.1.1l-150400.7.22.1 libopenssl1_1-hmac-1.1.1l-150400.7.22.1 openssl-1_1-1.1.1l-150400.7.22.1 openssl-1_1-debuginfo-1.1.1l-150400.7.22.1 openssl-1_1-debugsource-1.1.1l-150400.7.22.1 References: https://www.suse.com/security/cve/CVE-2022-4304.html https://www.suse.com/security/cve/CVE-2022-4450.html https://www.suse.com/security/cve/CVE-2023-0215.html https://www.suse.com/security/cve/CVE-2023-0286.html https://bugzilla.suse.com/1207533 https://bugzilla.suse.com/1207534 https://bugzilla.suse.com/1207536 https://bugzilla.suse.com/1207538

1 0

SUSE-SU-2023:0305-1: important: Security update for openssl-1_0_0
by opensuse-security＠opensuse.org 07 Feb '23

07 Feb '23

SUSE Security Update: Security update for openssl-1_0_0 ______________________________________________________________________________ Announcement ID: SUSE-SU-2023:0305-1 Rating: important References: #1207533 #1207534 #1207536 Cross-References: CVE-2022-4304 CVE-2023-0215 CVE-2023-0286 CVSS scores: CVE-2022-4304 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2023-0215 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2023-0286 (SUSE): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H Affected Products: SUSE CaaS Platform 4.0 SUSE Enterprise Storage 7 SUSE Enterprise Storage 7.1 SUSE Linux Enterprise High Performance Computing SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS SUSE Linux Enterprise Module for Legacy Software 15-SP4 SUSE Linux Enterprise Server SUSE Linux Enterprise Server 15-SP1-LTSS SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server 15-SP3-LTSS SUSE Linux Enterprise Server for SAP 15-SP1 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Linux Enterprise Server for SAP 15-SP3 SUSE Linux Enterprise Server for SAP Applications SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for openssl-1_0_0 fixes the following issues: - CVE-2023-0286: Fixed X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address (bsc#1207533). - CVE-2023-0215: Fixed use-after-free following BIO_new_NDEF() (bsc#1207536). - CVE-2022-4304: Fixed timing Oracle in RSA Decryption (bsc#1207534). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2023-305=1 - SUSE Linux Enterprise Server for SAP 15-SP3: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-305=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2023-305=1 - SUSE Linux Enterprise Server for SAP 15-SP1: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2023-305=1 - SUSE Linux Enterprise Server 15-SP3-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-305=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2023-305=1 - SUSE Linux Enterprise Server 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2023-305=1 - SUSE Linux Enterprise Module for Legacy Software 15-SP4: zypper in -t patch SUSE-SLE-Module-Legacy-15-SP4-2023-305=1 - SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-305=1 - SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-305=1 - SUSE Enterprise Storage 7.1: zypper in -t patch SUSE-Storage-7.1-2023-305=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2023-305=1 - SUSE CaaS Platform 4.0: To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.65.1 libopenssl10-1.0.2p-150000.3.65.1 libopenssl10-debuginfo-1.0.2p-150000.3.65.1 libopenssl1_0_0-1.0.2p-150000.3.65.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.65.1 libopenssl1_0_0-hmac-1.0.2p-150000.3.65.1 libopenssl1_0_0-steam-1.0.2p-150000.3.65.1 libopenssl1_0_0-steam-debuginfo-1.0.2p-150000.3.65.1 openssl-1_0_0-1.0.2p-150000.3.65.1 openssl-1_0_0-cavs-1.0.2p-150000.3.65.1 openssl-1_0_0-cavs-debuginfo-1.0.2p-150000.3.65.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.65.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.65.1 - openSUSE Leap 15.4 (x86_64): libopenssl-1_0_0-devel-32bit-1.0.2p-150000.3.65.1 libopenssl1_0_0-32bit-1.0.2p-150000.3.65.1 libopenssl1_0_0-32bit-debuginfo-1.0.2p-150000.3.65.1 libopenssl1_0_0-hmac-32bit-1.0.2p-150000.3.65.1 libopenssl1_0_0-steam-32bit-1.0.2p-150000.3.65.1 libopenssl1_0_0-steam-32bit-debuginfo-1.0.2p-150000.3.65.1 - openSUSE Leap 15.4 (noarch): openssl-1_0_0-doc-1.0.2p-150000.3.65.1 - SUSE Linux Enterprise Server for SAP 15-SP3 (ppc64le x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.65.1 libopenssl10-1.0.2p-150000.3.65.1 libopenssl10-debuginfo-1.0.2p-150000.3.65.1 libopenssl1_0_0-1.0.2p-150000.3.65.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.65.1 openssl-1_0_0-1.0.2p-150000.3.65.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.65.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.65.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.65.1 libopenssl1_0_0-1.0.2p-150000.3.65.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.65.1 openssl-1_0_0-1.0.2p-150000.3.65.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.65.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.65.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (ppc64le x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.65.1 libopenssl1_0_0-1.0.2p-150000.3.65.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.65.1 openssl-1_0_0-1.0.2p-150000.3.65.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.65.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.65.1 - SUSE Linux Enterprise Server 15-SP3-LTSS (aarch64 ppc64le s390x x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.65.1 libopenssl10-1.0.2p-150000.3.65.1 libopenssl10-debuginfo-1.0.2p-150000.3.65.1 libopenssl1_0_0-1.0.2p-150000.3.65.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.65.1 openssl-1_0_0-1.0.2p-150000.3.65.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.65.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.65.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.65.1 libopenssl1_0_0-1.0.2p-150000.3.65.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.65.1 openssl-1_0_0-1.0.2p-150000.3.65.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.65.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.65.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (aarch64 ppc64le s390x x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.65.1 libopenssl1_0_0-1.0.2p-150000.3.65.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.65.1 openssl-1_0_0-1.0.2p-150000.3.65.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.65.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.65.1 - SUSE Linux Enterprise Module for Legacy Software 15-SP4 (aarch64 ppc64le s390x x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.65.1 libopenssl10-1.0.2p-150000.3.65.1 libopenssl10-debuginfo-1.0.2p-150000.3.65.1 libopenssl1_0_0-1.0.2p-150000.3.65.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.65.1 openssl-1_0_0-1.0.2p-150000.3.65.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.65.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.65.1 - SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS (aarch64 x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.65.1 libopenssl10-1.0.2p-150000.3.65.1 libopenssl10-debuginfo-1.0.2p-150000.3.65.1 libopenssl1_0_0-1.0.2p-150000.3.65.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.65.1 openssl-1_0_0-1.0.2p-150000.3.65.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.65.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.65.1 - SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS (aarch64 x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.65.1 libopenssl10-1.0.2p-150000.3.65.1 libopenssl10-debuginfo-1.0.2p-150000.3.65.1 libopenssl1_0_0-1.0.2p-150000.3.65.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.65.1 openssl-1_0_0-1.0.2p-150000.3.65.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.65.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.65.1 - SUSE Enterprise Storage 7.1 (aarch64 x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.65.1 libopenssl10-1.0.2p-150000.3.65.1 libopenssl10-debuginfo-1.0.2p-150000.3.65.1 libopenssl1_0_0-1.0.2p-150000.3.65.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.65.1 openssl-1_0_0-1.0.2p-150000.3.65.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.65.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.65.1 - SUSE Enterprise Storage 7 (aarch64 x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.65.1 libopenssl1_0_0-1.0.2p-150000.3.65.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.65.1 openssl-1_0_0-1.0.2p-150000.3.65.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.65.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.65.1 - SUSE CaaS Platform 4.0 (x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.65.1 libopenssl1_0_0-1.0.2p-150000.3.65.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.65.1 openssl-1_0_0-1.0.2p-150000.3.65.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.65.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.65.1 References: https://www.suse.com/security/cve/CVE-2022-4304.html https://www.suse.com/security/cve/CVE-2023-0215.html https://www.suse.com/security/cve/CVE-2023-0286.html https://bugzilla.suse.com/1207533 https://bugzilla.suse.com/1207534 https://bugzilla.suse.com/1207536

1 0

SUSE-SU-2023:0312-1: important: Security update for openssl-3
by opensuse-security＠opensuse.org 07 Feb '23

07 Feb '23

SUSE Security Update: Security update for openssl-3 ______________________________________________________________________________ Announcement ID: SUSE-SU-2023:0312-1 Rating: important References: #1195149 #1206222 #1207533 #1207534 #1207535 #1207536 #1207538 #1207539 #1207540 #1207541 Cross-References: CVE-2022-4203 CVE-2022-4304 CVE-2022-4450 CVE-2023-0215 CVE-2023-0216 CVE-2023-0217 CVE-2023-0286 CVE-2023-0401 CVSS scores: CVE-2022-4203 (SUSE): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H CVE-2022-4304 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2022-4450 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2023-0215 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2023-0216 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2023-0217 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2023-0286 (SUSE): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H CVE-2023-0401 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves 8 vulnerabilities and has two fixes is now available. Description: This update for openssl-3 fixes the following issues: Security fixes: - CVE-2023-0286: Fixed X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address (bsc#1207533). - CVE-2023-0401: Fixed NULL pointer dereference during PKCS7 data verification (bsc#1207541). - CVE-2023-0217: Fixed NULL pointer dereference validating DSA public key (bsc#1207540). - CVE-2023-0216: Fixed invalid pointer dereference in d2i_PKCS7 functions (bsc#1207539). - CVE-2023-0215: Fixed use-after-free following BIO_new_NDEF() (bsc#1207536). - CVE-2022-4450: Fixed double free after calling PEM_read_bio_ex() (bsc#1207538). - CVE-2022-4304: Fixed timing Oracle in RSA Decryption (bsc#1207534). - CVE-2022-4203: Fixed read Buffer Overflow with X.509 Name Constraints (bsc#1207535). Non-security fixes: - Fix SHA, SHAKE, KECCAK ASM and EC ASM flag passing (bsc#1206222). - Enable zlib compression support (bsc#1195149). - Add crypto-policies dependency. Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2023-312=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-312=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libopenssl-3-devel-3.0.1-150400.4.17.1 libopenssl3-3.0.1-150400.4.17.1 libopenssl3-debuginfo-3.0.1-150400.4.17.1 openssl-3-3.0.1-150400.4.17.1 openssl-3-debuginfo-3.0.1-150400.4.17.1 openssl-3-debugsource-3.0.1-150400.4.17.1 - openSUSE Leap 15.4 (x86_64): libopenssl-3-devel-32bit-3.0.1-150400.4.17.1 libopenssl3-32bit-3.0.1-150400.4.17.1 libopenssl3-32bit-debuginfo-3.0.1-150400.4.17.1 - openSUSE Leap 15.4 (noarch): openssl-3-doc-3.0.1-150400.4.17.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): libopenssl-3-devel-3.0.1-150400.4.17.1 libopenssl3-3.0.1-150400.4.17.1 libopenssl3-debuginfo-3.0.1-150400.4.17.1 openssl-3-3.0.1-150400.4.17.1 openssl-3-debuginfo-3.0.1-150400.4.17.1 openssl-3-debugsource-3.0.1-150400.4.17.1 References: https://www.suse.com/security/cve/CVE-2022-4203.html https://www.suse.com/security/cve/CVE-2022-4304.html https://www.suse.com/security/cve/CVE-2022-4450.html https://www.suse.com/security/cve/CVE-2023-0215.html https://www.suse.com/security/cve/CVE-2023-0216.html https://www.suse.com/security/cve/CVE-2023-0217.html https://www.suse.com/security/cve/CVE-2023-0286.html https://www.suse.com/security/cve/CVE-2023-0401.html https://bugzilla.suse.com/1195149 https://bugzilla.suse.com/1206222 https://bugzilla.suse.com/1207533 https://bugzilla.suse.com/1207534 https://bugzilla.suse.com/1207535 https://bugzilla.suse.com/1207536 https://bugzilla.suse.com/1207538 https://bugzilla.suse.com/1207539 https://bugzilla.suse.com/1207540 https://bugzilla.suse.com/1207541

1 0

SUSE-SU-2022:3198-2: moderate: Security update for php8-pear
by opensuse-security＠opensuse.org 07 Feb '23

07 Feb '23

SUSE Security Update: Security update for php8-pear ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3198-2 Rating: moderate References: SLE-24728 Cross-References: CVE-2021-32610 CVSS scores: CVE-2021-32610 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Affected Products: openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability, contains one feature is now available. Description: This update for php8-pear fixes the following issues: - Add php8-pear to SLE15-SP4 (jsc#SLE-24728) - Update to 1.10.21 - PEAR 1.10.13 * unsupported protocol - use --force to continue * Add $this operator to _determineIfPowerpc calls - Update to 1.10.20 - Archive_Tar 1.4.14 * Properly fix symbolic link path traversal (CVE-2021-32610) - Archive_Tar 1.4.13 * Relative symlinks failing (out-of path file extraction) - Archive_Tar 1.4.12 - Archive_Tar 1.4.11 - Archive_Tar 1.4.10 * Fix block padding when the file buffer length is a multiple of 512 and smaller than Archive_Tar buffer length * Don't try to copy username/groupname in chroot jail - provides and obsoletes php7-pear-Archive_Tar, former location of PEAR/Archive/Tar.php - Update to version 1.10.19 - PEAR 1.10.12 * adjust dependencies based on new releases - XML_Util 1.4.5 * fix Trying to access array offset on value of type int - Update to version 1.10.18 - Remove pear-cacheid-array-check.patch (upstreamed) - Contents of .filemap are now sorted internally - Sort contents of .filemap to make build reproducible - Recommend php7-openssl to allow https sources to be used - Modify metadata_dir for system configuration only - Add /var/lib/pear directory where xml files are stored - Cleanup %files section - Only use the GPG keys of Chuck Burgess. Extracted from the Release Manager public keys. - Add release versions of PEAR modules - Install metadata files (registry, filemap, channels, ...) in /var/lib/pear/ instead of /usr/share/php7/PEAR/ - Update to version 1.10.17 Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2023-291=1 Package List: - openSUSE Leap 15.4 (noarch): php8-pear-1.10.21-150400.9.3.1 php8-pecl-1.10.21-150400.9.3.1 References: https://www.suse.com/security/cve/CVE-2021-32610.html

1 0

SUSE-SU-2023:0288-1: important: Security update for xorg-x11-server
by opensuse-security＠opensuse.org 07 Feb '23

07 Feb '23

SUSE Security Update: Security update for xorg-x11-server ______________________________________________________________________________ Announcement ID: SUSE-SU-2023:0288-1 Rating: important References: #1207783 Cross-References: CVE-2023-0494 CVSS scores: CVE-2023-0494 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Module for Development Tools 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for xorg-x11-server fixes the following issues: - CVE-2023-0494: Fixed a use-after-free in DeepCopyPointerClasses (bsc#1207783). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2023-288=1 - SUSE Linux Enterprise Module for Development Tools 15-SP4: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2023-288=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-288=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): xorg-x11-server-1.20.3-150400.38.16.1 xorg-x11-server-debuginfo-1.20.3-150400.38.16.1 xorg-x11-server-debugsource-1.20.3-150400.38.16.1 xorg-x11-server-extra-1.20.3-150400.38.16.1 xorg-x11-server-extra-debuginfo-1.20.3-150400.38.16.1 xorg-x11-server-sdk-1.20.3-150400.38.16.1 xorg-x11-server-source-1.20.3-150400.38.16.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 ppc64le s390x x86_64): xorg-x11-server-debuginfo-1.20.3-150400.38.16.1 xorg-x11-server-debugsource-1.20.3-150400.38.16.1 xorg-x11-server-sdk-1.20.3-150400.38.16.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): xorg-x11-server-1.20.3-150400.38.16.1 xorg-x11-server-debuginfo-1.20.3-150400.38.16.1 xorg-x11-server-debugsource-1.20.3-150400.38.16.1 xorg-x11-server-extra-1.20.3-150400.38.16.1 xorg-x11-server-extra-debuginfo-1.20.3-150400.38.16.1 References: https://www.suse.com/security/cve/CVE-2023-0494.html https://bugzilla.suse.com/1207783

1 0

SUSE-SU-2023:0285-1: important: Security update for xorg-x11-server
by opensuse-security＠opensuse.org 07 Feb '23

07 Feb '23

SUSE Security Update: Security update for xorg-x11-server ______________________________________________________________________________ Announcement ID: SUSE-SU-2023:0285-1 Rating: important References: #1207783 Cross-References: CVE-2023-0494 CVSS scores: CVE-2023-0494 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Enterprise Storage 7 SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS SUSE Linux Enterprise Realtime Extension 15-SP3 SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server 15-SP3-LTSS SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Linux Enterprise Server for SAP 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Workstation Extension 15-SP4 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for xorg-x11-server fixes the following issues: - CVE-2023-0494: Fixed a use-after-free in DeepCopyPointerClasses (bsc#1207783). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2023-285=1 - SUSE Manager Server 4.2: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-285=1 - SUSE Manager Retail Branch Server 4.2: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.2-2023-285=1 - SUSE Manager Proxy 4.2: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.2-2023-285=1 - SUSE Linux Enterprise Workstation Extension 15-SP4: zypper in -t patch SUSE-SLE-Product-WE-15-SP4-2023-285=1 - SUSE Linux Enterprise Server for SAP 15-SP3: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-285=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2023-285=1 - SUSE Linux Enterprise Server 15-SP3-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-285=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2023-285=1 - SUSE Linux Enterprise Realtime Extension 15-SP3: zypper in -t patch SUSE-SLE-Product-RT-15-SP3-2023-285=1 - SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-285=1 - SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-285=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2023-285=1 - SUSE Enterprise Storage 7.1: zypper in -t patch SUSE-Storage-7.1-2023-285=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2023-285=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): xorg-x11-server-wayland-1.20.3-150200.22.5.66.1 xorg-x11-server-wayland-debuginfo-1.20.3-150200.22.5.66.1 - SUSE Manager Server 4.2 (ppc64le s390x x86_64): xorg-x11-server-1.20.3-150200.22.5.66.1 xorg-x11-server-debuginfo-1.20.3-150200.22.5.66.1 xorg-x11-server-debugsource-1.20.3-150200.22.5.66.1 xorg-x11-server-extra-1.20.3-150200.22.5.66.1 xorg-x11-server-extra-debuginfo-1.20.3-150200.22.5.66.1 - SUSE Manager Retail Branch Server 4.2 (x86_64): xorg-x11-server-1.20.3-150200.22.5.66.1 xorg-x11-server-debuginfo-1.20.3-150200.22.5.66.1 xorg-x11-server-debugsource-1.20.3-150200.22.5.66.1 xorg-x11-server-extra-1.20.3-150200.22.5.66.1 xorg-x11-server-extra-debuginfo-1.20.3-150200.22.5.66.1 - SUSE Manager Proxy 4.2 (x86_64): xorg-x11-server-1.20.3-150200.22.5.66.1 xorg-x11-server-debuginfo-1.20.3-150200.22.5.66.1 xorg-x11-server-debugsource-1.20.3-150200.22.5.66.1 xorg-x11-server-extra-1.20.3-150200.22.5.66.1 xorg-x11-server-extra-debuginfo-1.20.3-150200.22.5.66.1 - SUSE Linux Enterprise Workstation Extension 15-SP4 (x86_64): xorg-x11-server-debuginfo-1.20.3-150200.22.5.66.1 xorg-x11-server-debugsource-1.20.3-150200.22.5.66.1 xorg-x11-server-wayland-1.20.3-150200.22.5.66.1 xorg-x11-server-wayland-debuginfo-1.20.3-150200.22.5.66.1 - SUSE Linux Enterprise Server for SAP 15-SP3 (ppc64le x86_64): xorg-x11-server-1.20.3-150200.22.5.66.1 xorg-x11-server-debuginfo-1.20.3-150200.22.5.66.1 xorg-x11-server-debugsource-1.20.3-150200.22.5.66.1 xorg-x11-server-extra-1.20.3-150200.22.5.66.1 xorg-x11-server-extra-debuginfo-1.20.3-150200.22.5.66.1 xorg-x11-server-sdk-1.20.3-150200.22.5.66.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): xorg-x11-server-1.20.3-150200.22.5.66.1 xorg-x11-server-debuginfo-1.20.3-150200.22.5.66.1 xorg-x11-server-debugsource-1.20.3-150200.22.5.66.1 xorg-x11-server-extra-1.20.3-150200.22.5.66.1 xorg-x11-server-extra-debuginfo-1.20.3-150200.22.5.66.1 xorg-x11-server-sdk-1.20.3-150200.22.5.66.1 - SUSE Linux Enterprise Server 15-SP3-LTSS (aarch64 ppc64le s390x x86_64): xorg-x11-server-1.20.3-150200.22.5.66.1 xorg-x11-server-debuginfo-1.20.3-150200.22.5.66.1 xorg-x11-server-debugsource-1.20.3-150200.22.5.66.1 xorg-x11-server-extra-1.20.3-150200.22.5.66.1 xorg-x11-server-extra-debuginfo-1.20.3-150200.22.5.66.1 xorg-x11-server-sdk-1.20.3-150200.22.5.66.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): xorg-x11-server-1.20.3-150200.22.5.66.1 xorg-x11-server-debuginfo-1.20.3-150200.22.5.66.1 xorg-x11-server-debugsource-1.20.3-150200.22.5.66.1 xorg-x11-server-extra-1.20.3-150200.22.5.66.1 xorg-x11-server-extra-debuginfo-1.20.3-150200.22.5.66.1 xorg-x11-server-sdk-1.20.3-150200.22.5.66.1 - SUSE Linux Enterprise Realtime Extension 15-SP3 (x86_64): xorg-x11-server-1.20.3-150200.22.5.66.1 xorg-x11-server-debuginfo-1.20.3-150200.22.5.66.1 xorg-x11-server-debugsource-1.20.3-150200.22.5.66.1 xorg-x11-server-extra-1.20.3-150200.22.5.66.1 xorg-x11-server-extra-debuginfo-1.20.3-150200.22.5.66.1 xorg-x11-server-sdk-1.20.3-150200.22.5.66.1 - SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS (aarch64 x86_64): xorg-x11-server-1.20.3-150200.22.5.66.1 xorg-x11-server-debuginfo-1.20.3-150200.22.5.66.1 xorg-x11-server-debugsource-1.20.3-150200.22.5.66.1 xorg-x11-server-extra-1.20.3-150200.22.5.66.1 xorg-x11-server-extra-debuginfo-1.20.3-150200.22.5.66.1 xorg-x11-server-sdk-1.20.3-150200.22.5.66.1 - SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS (aarch64 x86_64): xorg-x11-server-1.20.3-150200.22.5.66.1 xorg-x11-server-debuginfo-1.20.3-150200.22.5.66.1 xorg-x11-server-debugsource-1.20.3-150200.22.5.66.1 xorg-x11-server-extra-1.20.3-150200.22.5.66.1 xorg-x11-server-extra-debuginfo-1.20.3-150200.22.5.66.1 xorg-x11-server-sdk-1.20.3-150200.22.5.66.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64): xorg-x11-server-1.20.3-150200.22.5.66.1 xorg-x11-server-debuginfo-1.20.3-150200.22.5.66.1 xorg-x11-server-debugsource-1.20.3-150200.22.5.66.1 xorg-x11-server-extra-1.20.3-150200.22.5.66.1 xorg-x11-server-extra-debuginfo-1.20.3-150200.22.5.66.1 xorg-x11-server-sdk-1.20.3-150200.22.5.66.1 - SUSE Enterprise Storage 7.1 (aarch64 x86_64): xorg-x11-server-1.20.3-150200.22.5.66.1 xorg-x11-server-debuginfo-1.20.3-150200.22.5.66.1 xorg-x11-server-debugsource-1.20.3-150200.22.5.66.1 xorg-x11-server-extra-1.20.3-150200.22.5.66.1 xorg-x11-server-extra-debuginfo-1.20.3-150200.22.5.66.1 xorg-x11-server-sdk-1.20.3-150200.22.5.66.1 - SUSE Enterprise Storage 7 (aarch64 x86_64): xorg-x11-server-1.20.3-150200.22.5.66.1 xorg-x11-server-debuginfo-1.20.3-150200.22.5.66.1 xorg-x11-server-debugsource-1.20.3-150200.22.5.66.1 xorg-x11-server-extra-1.20.3-150200.22.5.66.1 xorg-x11-server-extra-debuginfo-1.20.3-150200.22.5.66.1 xorg-x11-server-sdk-1.20.3-150200.22.5.66.1 References: https://www.suse.com/security/cve/CVE-2023-0494.html https://bugzilla.suse.com/1207783

1 0

SUSE-SU-2023:0289-1: important: Security update for xwayland
by opensuse-security＠opensuse.org 07 Feb '23

07 Feb '23

SUSE Security Update: Security update for xwayland ______________________________________________________________________________ Announcement ID: SUSE-SU-2023:0289-1 Rating: important References: #1207783 Cross-References: CVE-2023-0494 CVSS scores: CVE-2023-0494 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Workstation Extension 15-SP4 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for xwayland fixes the following issues: - CVE-2023-0494: Fixed a use-after-free in DeepCopyPointerClasses (bsc#1207783). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2023-289=1 - SUSE Linux Enterprise Workstation Extension 15-SP4: zypper in -t patch SUSE-SLE-Product-WE-15-SP4-2023-289=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): xwayland-21.1.4-150400.3.9.1 xwayland-debuginfo-21.1.4-150400.3.9.1 xwayland-debugsource-21.1.4-150400.3.9.1 xwayland-devel-21.1.4-150400.3.9.1 - SUSE Linux Enterprise Workstation Extension 15-SP4 (x86_64): xwayland-21.1.4-150400.3.9.1 xwayland-debuginfo-21.1.4-150400.3.9.1 xwayland-debugsource-21.1.4-150400.3.9.1 References: https://www.suse.com/security/cve/CVE-2023-0494.html https://bugzilla.suse.com/1207783

1 0

SUSE-SU-2023:0295-1: important: Security update for redis
by opensuse-security＠opensuse.org 07 Feb '23

07 Feb '23

SUSE Security Update: Security update for redis ______________________________________________________________________________ Announcement ID: SUSE-SU-2023:0295-1 Rating: important References: #1207202 #1207203 #1207448 Cross-References: CVE-2022-35977 CVE-2023-22458 CVSS scores: CVE-2022-35977 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-35977 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2023-22458 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2023-22458 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Server Applications 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for redis fixes the following issues: - CVE-2022-35977: Fixed an integer overflow that could allow authenticated users to cause a crash (bsc#1207202). - CVE-2023-22458: Fixed a missing check that could allow authenticated users to cause a crash (bsc#1207203). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2023-295=1 - SUSE Linux Enterprise Module for Server Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2023-295=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): redis-6.2.6-150400.3.11.1 redis-debuginfo-6.2.6-150400.3.11.1 redis-debugsource-6.2.6-150400.3.11.1 - SUSE Linux Enterprise Module for Server Applications 15-SP4 (aarch64 ppc64le s390x x86_64): redis-6.2.6-150400.3.11.1 redis-debuginfo-6.2.6-150400.3.11.1 redis-debugsource-6.2.6-150400.3.11.1 References: https://www.suse.com/security/cve/CVE-2022-35977.html https://www.suse.com/security/cve/CVE-2023-22458.html https://bugzilla.suse.com/1207202 https://bugzilla.suse.com/1207203 https://bugzilla.suse.com/1207448

1 0

SUSE-SU-2023:0275-1: moderate: Security update for rubygem-activesupport-5_1
by opensuse-security＠opensuse.org 06 Feb '23

06 Feb '23

SUSE Security Update: Security update for rubygem-activesupport-5_1 ______________________________________________________________________________ Announcement ID: SUSE-SU-2023:0275-1 Rating: moderate References: #1207454 Cross-References: CVE-2023-22796 CVSS scores: CVE-2023-22796 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: SUSE Enterprise Storage 6 SUSE Enterprise Storage 7 SUSE Enterprise Storage 7.1 SUSE Linux Enterprise High Availability 15-SP1 SUSE Linux Enterprise High Availability 15-SP2 SUSE Linux Enterprise High Availability 15-SP3 SUSE Linux Enterprise High Availability 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP1 SUSE Linux Enterprise High Performance Computing 15-SP2 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Server 15-SP1 SUSE Linux Enterprise Server 15-SP2 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP1 SUSE Linux Enterprise Server for SAP Applications 15-SP2 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.0 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.0 SUSE Manager Retail Branch Server 4.1 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.0 SUSE Manager Server 4.1 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rubygem-activesupport-5_1 fixes the following issues: - CVE-2023-22796: Fixed a potential denial of service when passing a crafted input to the underscore method due to an inefficient regular expression (bsc#1207454). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2023-275=1 - SUSE Linux Enterprise High Availability 15-SP4: zypper in -t patch SUSE-SLE-Product-HA-15-SP4-2023-275=1 - SUSE Linux Enterprise High Availability 15-SP3: zypper in -t patch SUSE-SLE-Product-HA-15-SP3-2023-275=1 - SUSE Linux Enterprise High Availability 15-SP2: zypper in -t patch SUSE-SLE-Product-HA-15-SP2-2023-275=1 - SUSE Linux Enterprise High Availability 15-SP1: zypper in -t patch SUSE-SLE-Product-HA-15-SP1-2023-275=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-activesupport-5_1-5.1.4-150000.3.12.1 ruby2.5-rubygem-activesupport-doc-5_1-5.1.4-150000.3.12.1 - SUSE Linux Enterprise High Availability 15-SP4 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-activesupport-5_1-5.1.4-150000.3.12.1 - SUSE Linux Enterprise High Availability 15-SP3 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-activesupport-5_1-5.1.4-150000.3.12.1 - SUSE Linux Enterprise High Availability 15-SP2 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-activesupport-5_1-5.1.4-150000.3.12.1 - SUSE Linux Enterprise High Availability 15-SP1 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-activesupport-5_1-5.1.4-150000.3.12.1 References: https://www.suse.com/security/cve/CVE-2023-22796.html https://bugzilla.suse.com/1207454

1 0