September 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2021:1320-1: moderate: Recommended update for crmsh
by maintenance＠opensuse.org 29 Sep '21

29 Sep '21

openSUSE Recommended Update: Recommended update for crmsh ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1320-1 Rating: moderate References: #1188971 #1189641 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for crmsh fixes the following issues: - Fix for 'hb_report': Using python way to collect ra trace files. (bsc#1189641) - Fix for 'bootstrap': Adjust host list for parallax to get and copy 'known_hosts' file. (bsc#1188971) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1320=1 Package List: - openSUSE Leap 15.2 (noarch): crmsh-4.3.1+20210827.4fb174c4-lp152.4.67.1 crmsh-scripts-4.3.1+20210827.4fb174c4-lp152.4.67.1 crmsh-test-4.3.1+20210827.4fb174c4-lp152.4.67.1 References: https://bugzilla.suse.com/1188971 https://bugzilla.suse.com/1189641

1 0

openSUSE-RU-2021:3245-1: important: Recommended update for docker
by maintenance＠opensuse.org 28 Sep '21

28 Sep '21

openSUSE Recommended Update: Recommended update for docker ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3245-1 Rating: important References: #1190670 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for docker fixes the following issues: - Return ENOSYS for clone3 in the seccomp profile to avoid breaking containers using glibc 2.34. - Add shell requires for the *-completion subpackages. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3245=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): docker-20.10.6_ce-153.1 docker-debuginfo-20.10.6_ce-153.1 docker-kubic-20.10.6_ce-6.52.1 docker-kubic-debuginfo-20.10.6_ce-6.52.1 docker-kubic-kubeadm-criconfig-20.10.6_ce-6.52.1 - openSUSE Leap 15.3 (noarch): docker-bash-completion-20.10.6_ce-153.1 docker-fish-completion-20.10.6_ce-153.1 docker-kubic-bash-completion-20.10.6_ce-6.52.1 docker-kubic-fish-completion-20.10.6_ce-6.52.1 docker-kubic-zsh-completion-20.10.6_ce-6.52.1 docker-zsh-completion-20.10.6_ce-153.1 References: https://bugzilla.suse.com/1190670

1 0

openSUSE-SU-2021:1318-1: moderate: Security update for transfig
by opensuse-security＠opensuse.org 28 Sep '21

28 Sep '21

openSUSE Security Update: Security update for transfig ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1318-1 Rating: moderate References: #1143650 #1159130 #1159293 #1161698 #1186329 Cross-References: CVE-2019-14275 CVE-2019-19555 CVE-2019-19746 CVE-2019-19797 CVE-2021-3561 CVSS scores: CVE-2019-14275 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-14275 (SUSE): 4.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L CVE-2019-19555 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-19555 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVE-2019-19746 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-19746 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVE-2019-19797 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-19797 (SUSE): 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L CVE-2021-3561 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-3561 (SUSE): 5.3 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for transfig fixes the following issues: Update to version 3.2.8, including fixes for - CVE-2021-3561: overflow in fig2dev/read.c in function read_colordef() (bsc#1186329). - CVE-2019-19797: out-of-bounds write in read_colordef in read.c (bsc#1159293). - CVE-2019-19555: stack-based buffer overflow because of an incorrect sscanf (bsc#1161698). - CVE-2019-19746: segmentation fault and out-of-bounds write because of an integer overflow via a large arrow type (bsc#1159130). - CVE-2019-14275: stack-based buffer overflow in the calc_arrow function in bound.c (bsc#1143650). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1318=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x): transfig-3.2.8a-bp153.3.3.2 References: https://www.suse.com/security/cve/CVE-2019-14275.html https://www.suse.com/security/cve/CVE-2019-19555.html https://www.suse.com/security/cve/CVE-2019-19746.html https://www.suse.com/security/cve/CVE-2019-19797.html https://www.suse.com/security/cve/CVE-2021-3561.html https://bugzilla.suse.com/1143650 https://bugzilla.suse.com/1159130 https://bugzilla.suse.com/1159293 https://bugzilla.suse.com/1161698 https://bugzilla.suse.com/1186329

1 0

openSUSE-SU-2021:3244-1: Security update for shibboleth-sp
by opensuse-security＠opensuse.org 28 Sep '21

28 Sep '21

openSUSE Security Update: Security update for shibboleth-sp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3244-1 Rating: low References: #1184222 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for shibboleth-sp fixes the following issues: - Template generation allows external parameters to override placeholders (bsc#1184222) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3244=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libshibsp-lite8-3.1.0-3.3.1 libshibsp-lite8-debuginfo-3.1.0-3.3.1 libshibsp9-3.1.0-3.3.1 libshibsp9-debuginfo-3.1.0-3.3.1 shibboleth-sp-3.1.0-3.3.1 shibboleth-sp-debuginfo-3.1.0-3.3.1 shibboleth-sp-debugsource-3.1.0-3.3.1 shibboleth-sp-devel-3.1.0-3.3.1 References: https://bugzilla.suse.com/1184222

1 0

openSUSE-RU-2021:1315-1: moderate: Recommended update for sssd
by maintenance＠opensuse.org 28 Sep '21

28 Sep '21

openSUSE Recommended Update: Recommended update for sssd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1315-1 Rating: moderate References: #1182058 #1182637 #1184289 #1187120 #1189492 #1190021 ECO-3493 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability, contains one feature and has 5 fixes is now available. Description: This update for sssd fixes the following issues: - Fix a dependency loop by moving internal libraries to sssd-common package. (bsc#1182058) - Moved sssctl command from sssd to sssd-tools package. (bsc#1184289) - Create timestamp attribute in cache objects if missing. (bsc#1182637) - Fix watchdog not terminating tasks. (bsc#1187120) - Improve logs to record the reason why internal watchdog terminates. - Fixed security issue with sssd: shell command injection in sssctl. (CVE-2021-3621, bsc#1189492) - Fixes a segfault with newer libcares2 versions when the library fails to parse a dns name. (bsc#1190021) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1315=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libipa_hbac-devel-1.16.1-lp152.16.3.1 libipa_hbac0-1.16.1-lp152.16.3.1 libipa_hbac0-debuginfo-1.16.1-lp152.16.3.1 libnfsidmap-sss-1.16.1-lp152.16.3.1 libnfsidmap-sss-debuginfo-1.16.1-lp152.16.3.1 libsss_certmap-devel-1.16.1-lp152.16.3.1 libsss_certmap0-1.16.1-lp152.16.3.1 libsss_certmap0-debuginfo-1.16.1-lp152.16.3.1 libsss_idmap-devel-1.16.1-lp152.16.3.1 libsss_idmap0-1.16.1-lp152.16.3.1 libsss_idmap0-debuginfo-1.16.1-lp152.16.3.1 libsss_nss_idmap-devel-1.16.1-lp152.16.3.1 libsss_nss_idmap0-1.16.1-lp152.16.3.1 libsss_nss_idmap0-debuginfo-1.16.1-lp152.16.3.1 libsss_simpleifp-devel-1.16.1-lp152.16.3.1 libsss_simpleifp0-1.16.1-lp152.16.3.1 libsss_simpleifp0-debuginfo-1.16.1-lp152.16.3.1 python3-ipa_hbac-1.16.1-lp152.16.3.1 python3-ipa_hbac-debuginfo-1.16.1-lp152.16.3.1 python3-sss-murmur-1.16.1-lp152.16.3.1 python3-sss-murmur-debuginfo-1.16.1-lp152.16.3.1 python3-sss_nss_idmap-1.16.1-lp152.16.3.1 python3-sss_nss_idmap-debuginfo-1.16.1-lp152.16.3.1 python3-sssd-config-1.16.1-lp152.16.3.1 python3-sssd-config-debuginfo-1.16.1-lp152.16.3.1 sssd-1.16.1-lp152.16.3.1 sssd-ad-1.16.1-lp152.16.3.1 sssd-ad-debuginfo-1.16.1-lp152.16.3.1 sssd-common-1.16.1-lp152.16.3.1 sssd-common-debuginfo-1.16.1-lp152.16.3.1 sssd-dbus-1.16.1-lp152.16.3.1 sssd-dbus-debuginfo-1.16.1-lp152.16.3.1 sssd-debugsource-1.16.1-lp152.16.3.1 sssd-ipa-1.16.1-lp152.16.3.1 sssd-ipa-debuginfo-1.16.1-lp152.16.3.1 sssd-krb5-1.16.1-lp152.16.3.1 sssd-krb5-common-1.16.1-lp152.16.3.1 sssd-krb5-common-debuginfo-1.16.1-lp152.16.3.1 sssd-krb5-debuginfo-1.16.1-lp152.16.3.1 sssd-ldap-1.16.1-lp152.16.3.1 sssd-ldap-debuginfo-1.16.1-lp152.16.3.1 sssd-proxy-1.16.1-lp152.16.3.1 sssd-proxy-debuginfo-1.16.1-lp152.16.3.1 sssd-tools-1.16.1-lp152.16.3.1 sssd-tools-debuginfo-1.16.1-lp152.16.3.1 sssd-wbclient-1.16.1-lp152.16.3.1 sssd-wbclient-debuginfo-1.16.1-lp152.16.3.1 sssd-wbclient-devel-1.16.1-lp152.16.3.1 sssd-winbind-idmap-1.16.1-lp152.16.3.1 sssd-winbind-idmap-debuginfo-1.16.1-lp152.16.3.1 References: https://www.suse.com/security/cve/CVE-2021-3621.html https://bugzilla.suse.com/1182058 https://bugzilla.suse.com/1182637 https://bugzilla.suse.com/1184289 https://bugzilla.suse.com/1187120 https://bugzilla.suse.com/1189492 https://bugzilla.suse.com/1190021

1 0

openSUSE-RU-2021:1316-1: moderate: Recommended update for sapnwbootstrap-formula
by maintenance＠opensuse.org 28 Sep '21

28 Sep '21

openSUSE Recommended Update: Recommended update for sapnwbootstrap-formula ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1316-1 Rating: moderate References: #1181541 #1185093 #1185627 #1186236 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for sapnwbootstrap-formula fixes the following issues: Update to version 0.6.4+git.1621842068.a86c37c: - Set the default empty dictionary for 'virtual_addresses'. (bsc#1185627) - This also ensures that a dictionary is obtained if the value is None (needed by SUSE Manager) - Fix issue when 'azure-lb' resource for 'ASCS/ERS' is not added in the corresponding Resource Group (bsc#1186236) - Set the virtual ip addresses as permanent, except for HA scenarios, to have them even after a reboot of the machine. (bsc#1185093) - Give the option to mount '/sapmnt' folder locally without using a 'NFS' share. - Make '/sapmnt' path configurable using 'sapmnt_path' pillar variable - Update PAS and AAS templates to use HANA sid and instance number to create the configuration file - Fix error about missing instance installation requisite when monitoring is enabled. (bsc#1181541) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1316=1 Package List: - openSUSE Leap 15.2 (noarch): sapnwbootstrap-formula-0.6.4+git.1621842068.a86c37c-lp152.2.17.1 References: https://bugzilla.suse.com/1181541 https://bugzilla.suse.com/1185093 https://bugzilla.suse.com/1185627 https://bugzilla.suse.com/1186236

1 0

openSUSE-RU-2021:3242-1: moderate: Recommended update for apache2-mod_auth_mellon, lasso
by maintenance＠opensuse.org 28 Sep '21

28 Sep '21

openSUSE Recommended Update: Recommended update for apache2-mod_auth_mellon, lasso ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3242-1 Rating: moderate References: ECO-1309 SLE-8958 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has 0 recommended fixes and contains two features can now be installed. Description: This update for lasso fixes the following issues: - Implement package 'apache2-mod_auth_mellon' along with its dependency 'lasso' in SLE-15-SP2. (jsc#SLE-8958, jsc#ECO-1309) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3242=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): lasso-debuginfo-2.6.1-16.2 lasso-debugsource-2.6.1-16.2 liblasso-devel-2.6.1-16.2 liblasso3-2.6.1-16.2 liblasso3-debuginfo-2.6.1-16.2 python3-lasso-2.6.1-16.2 python3-lasso-debuginfo-2.6.1-16.2 - openSUSE Leap 15.3 (aarch64 s390x x86_64): apache2-mod_auth_mellon-0.17.0-5.4.1 apache2-mod_auth_mellon-debuginfo-0.17.0-5.4.1 apache2-mod_auth_mellon-debugsource-0.17.0-5.4.1 apache2-mod_auth_mellon-diagnostics-0.17.0-5.4.1 apache2-mod_auth_mellon-diagnostics-debuginfo-0.17.0-5.4.1 apache2-mod_auth_mellon-doc-0.17.0-5.4.1 References:

1 0

openSUSE-RU-2021:1314-1: moderate: Recommended update for gtk3
by maintenance＠opensuse.org 28 Sep '21

28 Sep '21

openSUSE Recommended Update: Recommended update for gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1314-1 Rating: moderate References: #1094486 #1189238 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for gtk3 fixes the following issue: - Ensure printer entries from Avahi are usable (bsc#1094486, bsc#1189238). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1314=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): gettext-its-gtk3-3.24.20-lp152.2.6.1 gtk3-debugsource-3.24.20-lp152.2.6.1 gtk3-devel-3.24.20-lp152.2.6.1 gtk3-devel-debuginfo-3.24.20-lp152.2.6.1 gtk3-devel-doc-3.24.20-lp152.2.6.1 gtk3-immodule-amharic-3.24.20-lp152.2.6.1 gtk3-immodule-amharic-debuginfo-3.24.20-lp152.2.6.1 gtk3-immodule-broadway-3.24.20-lp152.2.6.1 gtk3-immodule-broadway-debuginfo-3.24.20-lp152.2.6.1 gtk3-immodule-inuktitut-3.24.20-lp152.2.6.1 gtk3-immodule-inuktitut-debuginfo-3.24.20-lp152.2.6.1 gtk3-immodule-multipress-3.24.20-lp152.2.6.1 gtk3-immodule-multipress-debuginfo-3.24.20-lp152.2.6.1 gtk3-immodule-thai-3.24.20-lp152.2.6.1 gtk3-immodule-thai-debuginfo-3.24.20-lp152.2.6.1 gtk3-immodule-tigrigna-3.24.20-lp152.2.6.1 gtk3-immodule-tigrigna-debuginfo-3.24.20-lp152.2.6.1 gtk3-immodule-vietnamese-3.24.20-lp152.2.6.1 gtk3-immodule-vietnamese-debuginfo-3.24.20-lp152.2.6.1 gtk3-immodule-wayland-3.24.20-lp152.2.6.1 gtk3-immodule-wayland-debuginfo-3.24.20-lp152.2.6.1 gtk3-immodule-xim-3.24.20-lp152.2.6.1 gtk3-immodule-xim-debuginfo-3.24.20-lp152.2.6.1 gtk3-tools-3.24.20-lp152.2.6.1 gtk3-tools-debuginfo-3.24.20-lp152.2.6.1 libgtk-3-0-3.24.20-lp152.2.6.1 libgtk-3-0-debuginfo-3.24.20-lp152.2.6.1 typelib-1_0-Gtk-3_0-3.24.20-lp152.2.6.1 - openSUSE Leap 15.2 (x86_64): gtk3-devel-32bit-3.24.20-lp152.2.6.1 gtk3-devel-32bit-debuginfo-3.24.20-lp152.2.6.1 gtk3-immodule-amharic-32bit-3.24.20-lp152.2.6.1 gtk3-immodule-amharic-32bit-debuginfo-3.24.20-lp152.2.6.1 gtk3-immodule-inuktitut-32bit-3.24.20-lp152.2.6.1 gtk3-immodule-inuktitut-32bit-debuginfo-3.24.20-lp152.2.6.1 gtk3-immodule-multipress-32bit-3.24.20-lp152.2.6.1 gtk3-immodule-multipress-32bit-debuginfo-3.24.20-lp152.2.6.1 gtk3-immodule-thai-32bit-3.24.20-lp152.2.6.1 gtk3-immodule-thai-32bit-debuginfo-3.24.20-lp152.2.6.1 gtk3-immodule-tigrigna-32bit-3.24.20-lp152.2.6.1 gtk3-immodule-tigrigna-32bit-debuginfo-3.24.20-lp152.2.6.1 gtk3-immodule-vietnamese-32bit-3.24.20-lp152.2.6.1 gtk3-immodule-vietnamese-32bit-debuginfo-3.24.20-lp152.2.6.1 gtk3-immodule-wayland-32bit-3.24.20-lp152.2.6.1 gtk3-immodule-wayland-32bit-debuginfo-3.24.20-lp152.2.6.1 gtk3-immodule-xim-32bit-3.24.20-lp152.2.6.1 gtk3-immodule-xim-32bit-debuginfo-3.24.20-lp152.2.6.1 gtk3-tools-32bit-3.24.20-lp152.2.6.1 gtk3-tools-32bit-debuginfo-3.24.20-lp152.2.6.1 libgtk-3-0-32bit-3.24.20-lp152.2.6.1 libgtk-3-0-32bit-debuginfo-3.24.20-lp152.2.6.1 - openSUSE Leap 15.2 (noarch): gtk3-branding-upstream-3.24.20-lp152.2.6.1 gtk3-data-3.24.20-lp152.2.6.1 gtk3-lang-3.24.20-lp152.2.6.1 gtk3-schema-3.24.20-lp152.2.6.1 References: https://bugzilla.suse.com/1094486 https://bugzilla.suse.com/1189238

1 0

openSUSE-RU-2021:1317-1: moderate: Recommended update for gnome-shell-extensions
by maintenance＠opensuse.org 28 Sep '21

28 Sep '21

openSUSE Recommended Update: Recommended update for gnome-shell-extensions ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1317-1 Rating: moderate References: #1190016 SLE-20311 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix and contains one feature can now be installed. Description: This update for gnome-shell-extensions fixes the following issues: - Add gnome-shell-extensions-common as dependency (bsc#1190016 jsc#SLE-20311). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1317=1 Package List: - openSUSE Leap 15.2 (noarch): gnome-shell-classic-3.34.2-lp152.4.16.1 gnome-shell-extensions-common-3.34.2-lp152.4.16.1 gnome-shell-extensions-common-lang-3.34.2-lp152.4.16.1 - openSUSE Leap 15.2 (x86_64): gnome-shell-classic-session-3.34.2-lp152.4.16.1 gnome-shell-extension-user-theme-3.34.2-lp152.4.16.1 References: https://bugzilla.suse.com/1190016

1 0

openSUSE-SU-2021:1313-1: important: Security update for nodejs14
by opensuse-security＠opensuse.org 28 Sep '21

28 Sep '21

openSUSE Security Update: Security update for nodejs14 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1313-1 Rating: important References: #1188881 #1188917 #1189368 #1189369 #1189370 Cross-References: CVE-2021-22930 CVE-2021-22931 CVE-2021-22939 CVE-2021-22940 CVE-2021-3672 CVSS scores: CVE-2021-22930 (SUSE): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2021-22931 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-22939 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2021-22940 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-3672 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for nodejs14 fixes the following issues: - CVE-2021-3672: Fixed missing input validation on hostnames (bsc#1188881). - CVE-2021-22931: Fixed improper handling of untypical characters in domain names (bsc#1189370). - CVE-2021-22940: Use after free on close http2 on stream canceling (bsc#1189368) - CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (bsc#1189369) - CVE-2021-22930: Fixed use after free on close http2 on stream canceling (bsc#1188917). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1313=1 Package List: - openSUSE Leap 15.2 (noarch): nodejs14-docs-14.17.5-lp152.14.1 - openSUSE Leap 15.2 (x86_64): nodejs14-14.17.5-lp152.14.1 nodejs14-debuginfo-14.17.5-lp152.14.1 nodejs14-debugsource-14.17.5-lp152.14.1 nodejs14-devel-14.17.5-lp152.14.1 npm14-14.17.5-lp152.14.1 References: https://www.suse.com/security/cve/CVE-2021-22930.html https://www.suse.com/security/cve/CVE-2021-22931.html https://www.suse.com/security/cve/CVE-2021-22939.html https://www.suse.com/security/cve/CVE-2021-22940.html https://www.suse.com/security/cve/CVE-2021-3672.html https://bugzilla.suse.com/1188881 https://bugzilla.suse.com/1188917 https://bugzilla.suse.com/1189368 https://bugzilla.suse.com/1189369 https://bugzilla.suse.com/1189370

1 0