December 2020 - openSUSE Updates - openSUSE Mailing Lists

[opensuse-updates] openSUSE-RU-2020:2130-1: moderate: Recommended update for gnutls
by maintenance＠opensuse.org 01 Dec '20

01 Dec '20

openSUSE Recommended Update: Recommended update for gnutls ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:2130-1 Rating: moderate References: #1172695 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gnutls fixes the following issue: - Avoid spurious audit messages about incompatible signature algorithms (bsc#1172695) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2130=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): gnutls-3.6.7-lp152.9.6.1 gnutls-debuginfo-3.6.7-lp152.9.6.1 gnutls-debugsource-3.6.7-lp152.9.6.1 gnutls-guile-3.6.7-lp152.9.6.1 gnutls-guile-debuginfo-3.6.7-lp152.9.6.1 libgnutls-dane-devel-3.6.7-lp152.9.6.1 libgnutls-dane0-3.6.7-lp152.9.6.1 libgnutls-dane0-debuginfo-3.6.7-lp152.9.6.1 libgnutls-devel-3.6.7-lp152.9.6.1 libgnutls30-3.6.7-lp152.9.6.1 libgnutls30-debuginfo-3.6.7-lp152.9.6.1 libgnutls30-hmac-3.6.7-lp152.9.6.1 libgnutlsxx-devel-3.6.7-lp152.9.6.1 libgnutlsxx28-3.6.7-lp152.9.6.1 libgnutlsxx28-debuginfo-3.6.7-lp152.9.6.1 - openSUSE Leap 15.2 (x86_64): libgnutls-devel-32bit-3.6.7-lp152.9.6.1 libgnutls30-32bit-3.6.7-lp152.9.6.1 libgnutls30-32bit-debuginfo-3.6.7-lp152.9.6.1 libgnutls30-hmac-32bit-3.6.7-lp152.9.6.1 References: https://bugzilla.suse.com/1172695

1 0

[opensuse-updates] openSUSE-SU-2020:2129-1: moderate: Security update for libssh2_org
by opensuse-security＠opensuse.org 01 Dec '20

01 Dec '20

openSUSE Security Update: Security update for libssh2_org ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2129-1 Rating: moderate References: #1130103 #1178083 Cross-References: CVE-2019-17498 CVE-2019-3855 CVE-2019-3856 CVE-2019-3857 CVE-2019-3858 CVE-2019-3859 CVE-2019-3860 CVE-2019-3861 CVE-2019-3862 CVE-2019-3863 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for libssh2_org fixes the following issues: - Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922] Enhancements and bugfixes: * adds ECDSA keys and host key support when using OpenSSL * adds ED25519 key and host key support when using OpenSSL 1.1.1 * adds OpenSSH style key file reading * adds AES CTR mode support when using WinCNG * adds PEM passphrase protected file support for Libgcrypt and WinCNG * adds SHA256 hostkey fingerprint * adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path() * adds explicit zeroing of sensitive data in memory * adds additional bounds checks to network buffer reads * adds the ability to use the server default permissions when creating sftp directories * adds support for building with OpenSSL no engine flag * adds support for building with LibreSSL * increased sftp packet size to 256k * fixed oversized packet handling in sftp * fixed building with OpenSSL 1.1 * fixed a possible crash if sftp stat gets an unexpected response * fixed incorrect parsing of the KEX preference string value * fixed conditional RSA and AES-CTR support * fixed a small memory leak during the key exchange process * fixed a possible memory leak of the ssh banner string * fixed various small memory leaks in the backends * fixed possible out of bounds read when parsing public keys from the server * fixed possible out of bounds read when parsing invalid PEM files * no longer null terminates the scp remote exec command * now handle errors when diffie hellman key pair generation fails * improved building instructions * improved unit tests - Version update to 1.8.2: [bsc#1130103] Bug fixes: * Fixed the misapplied userauth patch that broke 1.8.1 * moved the MAX size declarations from the public header This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2129=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libssh2-1-1.9.0-lp152.8.3.1 libssh2-1-debuginfo-1.9.0-lp152.8.3.1 libssh2-devel-1.9.0-lp152.8.3.1 libssh2_org-debugsource-1.9.0-lp152.8.3.1 - openSUSE Leap 15.2 (x86_64): libssh2-1-32bit-1.9.0-lp152.8.3.1 libssh2-1-32bit-debuginfo-1.9.0-lp152.8.3.1 References: https://www.suse.com/security/cve/CVE-2019-17498.html https://www.suse.com/security/cve/CVE-2019-3855.html https://www.suse.com/security/cve/CVE-2019-3856.html https://www.suse.com/security/cve/CVE-2019-3857.html https://www.suse.com/security/cve/CVE-2019-3858.html https://www.suse.com/security/cve/CVE-2019-3859.html https://www.suse.com/security/cve/CVE-2019-3860.html https://www.suse.com/security/cve/CVE-2019-3861.html https://www.suse.com/security/cve/CVE-2019-3862.html https://www.suse.com/security/cve/CVE-2019-3863.html https://bugzilla.suse.com/1130103 https://bugzilla.suse.com/1178083

1 0

[opensuse-updates] openSUSE-SU-2020:2128-1: important: Security update for mutt
by opensuse-security＠opensuse.org 01 Dec '20

01 Dec '20

openSUSE Security Update: Security update for mutt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2128-1 Rating: important References: #1179035 #1179113 Cross-References: CVE-2020-28896 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for mutt fixes the following issues: - CVE-2020-28896: incomplete connection termination could lead to sending credentials over unencrypted connections (bsc#1179035) - Avoid that message with a million tiny parts can freeze MUA for several minutes (bsc#1179113) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2128=1 Package List: - openSUSE Leap 15.1 (x86_64): mutt-1.10.1-lp151.2.6.1 mutt-debuginfo-1.10.1-lp151.2.6.1 mutt-debugsource-1.10.1-lp151.2.6.1 - openSUSE Leap 15.1 (noarch): mutt-doc-1.10.1-lp151.2.6.1 mutt-lang-1.10.1-lp151.2.6.1 References: https://www.suse.com/security/cve/CVE-2020-28896.html https://bugzilla.suse.com/1179035 https://bugzilla.suse.com/1179113

1 0