November 2020 - openSUSE Security Announce

[security-announce] openSUSE-SU-2020:1876-1: moderate: Security update for bluez
by opensuse-security＠opensuse.org 08 Nov '20

08 Nov '20

openSUSE Security Update: Security update for bluez ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1876-1 Rating: moderate References: #1177895 Cross-References: CVE-2020-27153 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bluez fixes the following issues: - CVE-2020-27153: Fixed possible crash on disconnect (bsc#1177895). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1876=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): bluez-5.48-lp151.8.15.1 bluez-cups-5.48-lp151.8.15.1 bluez-cups-debuginfo-5.48-lp151.8.15.1 bluez-debuginfo-5.48-lp151.8.15.1 bluez-debugsource-5.48-lp151.8.15.1 bluez-devel-5.48-lp151.8.15.1 bluez-test-5.48-lp151.8.15.1 bluez-test-debuginfo-5.48-lp151.8.15.1 libbluetooth3-5.48-lp151.8.15.1 libbluetooth3-debuginfo-5.48-lp151.8.15.1 - openSUSE Leap 15.1 (x86_64): bluez-devel-32bit-5.48-lp151.8.15.1 libbluetooth3-32bit-5.48-lp151.8.15.1 libbluetooth3-32bit-debuginfo-5.48-lp151.8.15.1 - openSUSE Leap 15.1 (noarch): bluez-auto-enable-devices-5.48-lp151.8.15.1 References: https://www.suse.com/security/cve/CVE-2020-27153.html https://bugzilla.suse.com/1177895 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1875-1: important: Security update for apache-commons-httpclient
by opensuse-security＠opensuse.org 08 Nov '20

08 Nov '20

openSUSE Security Update: Security update for apache-commons-httpclient ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1875-1 Rating: important References: #1178171 #945190 Cross-References: CVE-2014-3577 CVE-2015-5262 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for apache-commons-httpclient fixes the following issues: - http/conn/ssl/SSLConnectionSocketFactory.java ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors. [bsc#945190, CVE-2015-5262] - org.apache.http.conn.ssl.AbstractVerifier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows MITM attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate. [bsc#1178171, CVE-2014-3577] This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1875=1 Package List: - openSUSE Leap 15.2 (noarch): apache-commons-httpclient-3.1-lp152.6.3.1 apache-commons-httpclient-demo-3.1-lp152.6.3.1 apache-commons-httpclient-javadoc-3.1-lp152.6.3.1 apache-commons-httpclient-manual-3.1-lp152.6.3.1 References: https://www.suse.com/security/cve/CVE-2014-3577.html https://www.suse.com/security/cve/CVE-2015-5262.html https://bugzilla.suse.com/1178171 https://bugzilla.suse.com/945190 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1873-1: important: Security update for apache-commons-httpclient
by opensuse-security＠opensuse.org 07 Nov '20

07 Nov '20

openSUSE Security Update: Security update for apache-commons-httpclient ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1873-1 Rating: important References: #1178171 #945190 Cross-References: CVE-2014-3577 CVE-2015-5262 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for apache-commons-httpclient fixes the following issues: - http/conn/ssl/SSLConnectionSocketFactory.java ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors. [bsc#945190, CVE-2015-5262] - org.apache.http.conn.ssl.AbstractVerifier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows MITM attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate. [bsc#1178171, CVE-2014-3577] This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1873=1 Package List: - openSUSE Leap 15.1 (noarch): apache-commons-httpclient-3.1-lp151.4.3.1 apache-commons-httpclient-demo-3.1-lp151.4.3.1 apache-commons-httpclient-javadoc-3.1-lp151.4.3.1 apache-commons-httpclient-manual-3.1-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2014-3577.html https://www.suse.com/security/cve/CVE-2015-5262.html https://bugzilla.suse.com/1178171 https://bugzilla.suse.com/945190 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1870-1: moderate: Security update for sddm
by opensuse-security＠opensuse.org 07 Nov '20

07 Nov '20

openSUSE Security Update: Security update for sddm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1870-1 Rating: moderate References: #1177201 Cross-References: CVE-2020-28049 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for sddm fixes the following issue: - Fix X not having access control on startup (boo#1177201, CVE-2020-28049). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1870=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1870=1 Package List: - openSUSE Leap 15.2 (x86_64): sddm-0.18.0-lp152.5.3.1 sddm-branding-openSUSE-0.18.0-lp152.5.3.1 sddm-branding-upstream-0.18.0-lp152.5.3.1 sddm-debuginfo-0.18.0-lp152.5.3.1 sddm-debugsource-0.18.0-lp152.5.3.1 - openSUSE Leap 15.1 (x86_64): sddm-0.18.0-lp151.3.6.1 sddm-branding-openSUSE-0.18.0-lp151.3.6.1 sddm-branding-upstream-0.18.0-lp151.3.6.1 sddm-debuginfo-0.18.0-lp151.3.6.1 sddm-debugsource-0.18.0-lp151.3.6.1 References: https://www.suse.com/security/cve/CVE-2020-28049.html https://bugzilla.suse.com/1177201 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1869-1: important: Security update for u-boot
by opensuse-security＠opensuse.org 07 Nov '20

07 Nov '20

openSUSE Security Update: Security update for u-boot ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1869-1 Rating: important References: #1162198 #1167209 Cross-References: CVE-2020-10648 CVE-2020-8432 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for u-boot fixes the following issues: - CVE-2020-8432: Fixed a double free in the cmd/gpt.c do_rename_gpt_parts() function, which allowed an attacker to execute arbitrary code (bsc#1162198) - CVE-2020-10648: Fixed improper signature verification during verified boot (bsc#1167209). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1869=1 Package List: - openSUSE Leap 15.2 (x86_64): u-boot-tools-2020.01-lp152.9.9.1 u-boot-tools-debuginfo-2020.01-lp152.9.9.1 References: https://www.suse.com/security/cve/CVE-2020-10648.html https://www.suse.com/security/cve/CVE-2020-8432.html https://bugzilla.suse.com/1162198 https://bugzilla.suse.com/1167209 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1868-1: critical: Security update for salt
by opensuse-security＠opensuse.org 07 Nov '20

07 Nov '20

openSUSE Security Update: Security update for salt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1868-1 Rating: critical References: #1159670 #1175987 #1176024 #1176294 #1176397 #1177867 #1178319 #1178361 #1178362 #1178485 Cross-References: CVE-2020-16846 CVE-2020-17490 CVE-2020-25592 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves three vulnerabilities and has 7 fixes is now available. Description: This update for salt fixes the following issues: - Avoid regression on "salt-master": set passphrase for salt-ssh keys to empty string (bsc#1178485) - Properly validate eauth credentials and tokens on SSH calls made by Salt API (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846) - Fix disk.blkid to avoid unexpected keyword argument '__pub_user'. (bsc#1177867) - Ensure virt.update stop_on_reboot is updated with its default value. - Do not break package building for systemd OSes. - Drop wrong mock from chroot unit test. - Support systemd versions with dot. (bsc#1176294) - Fix for grains.test_core unit test. - Fix file/directory user and group ownership containing UTF-8 characters. (bsc#1176024) - Several changes to virtualization: * Fix virt update when cpu and memory are changed. * Memory Tuning GSoC. * Properly fix memory setting regression in virt.update. * Expose libvirt on_reboot in virt states. - Support transactional systems (MicroOS). - zypperpkg module ignores retcode 104 for search(). (bsc#1159670) - Xen disk fixes. No longer generates volumes for Xen disks, but the corresponding file or block disk. (bsc#1175987) - Invalidate file list cache when cache file modified time is in the future. (bsc#1176397) - Prevent import errors when running test_btrfs unit tests This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1868=1 Package List: - openSUSE Leap 15.1 (noarch): salt-bash-completion-3000-lp151.5.30.1 salt-fish-completion-3000-lp151.5.30.1 salt-zsh-completion-3000-lp151.5.30.1 - openSUSE Leap 15.1 (x86_64): python2-salt-3000-lp151.5.30.1 python3-salt-3000-lp151.5.30.1 salt-3000-lp151.5.30.1 salt-api-3000-lp151.5.30.1 salt-cloud-3000-lp151.5.30.1 salt-doc-3000-lp151.5.30.1 salt-master-3000-lp151.5.30.1 salt-minion-3000-lp151.5.30.1 salt-proxy-3000-lp151.5.30.1 salt-ssh-3000-lp151.5.30.1 salt-standalone-formulas-configuration-3000-lp151.5.30.1 salt-syndic-3000-lp151.5.30.1 References: https://www.suse.com/security/cve/CVE-2020-16846.html https://www.suse.com/security/cve/CVE-2020-17490.html https://www.suse.com/security/cve/CVE-2020-25592.html https://bugzilla.suse.com/1159670 https://bugzilla.suse.com/1175987 https://bugzilla.suse.com/1176024 https://bugzilla.suse.com/1176294 https://bugzilla.suse.com/1176397 https://bugzilla.suse.com/1177867 https://bugzilla.suse.com/1178319 https://bugzilla.suse.com/1178361 https://bugzilla.suse.com/1178362 https://bugzilla.suse.com/1178485 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1861-1: moderate: Security update for gnome-settings-daemon, gnome-shell
by opensuse-security＠opensuse.org 07 Nov '20

07 Nov '20

openSUSE Security Update: Security update for gnome-settings-daemon, gnome-shell ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1861-1 Rating: moderate References: #1172760 #1175155 Cross-References: CVE-2020-17489 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for gnome-settings-daemon, gnome-shell fixes the following issues: gnome-settings-daemon: - Add support for recent UCM related changes in ALSA and PulseAudio. (jsc#SLE-16518) - Don't warn when a default source or sink is missing and the PulseAudio daemon is restarting. (jsc#SLE-16518) - Don't warn about starting/stopping services which don't exist. (bsc#1172760). gnome-shell: - Add support for recent UCM related changes in ALSA and PulseAudio. (jsc#SLE-16518) - CVE-2020-17489: reset auth prompt on vt switch before fade in in loginDialog (bsc#1175155). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1861=1 Package List: - openSUSE Leap 15.2 (noarch): gnome-settings-daemon-lang-3.34.2+0-lp152.3.3.1 gnome-shell-lang-3.34.5-lp152.2.9.1 - openSUSE Leap 15.2 (x86_64): gnome-settings-daemon-3.34.2+0-lp152.3.3.1 gnome-settings-daemon-debuginfo-3.34.2+0-lp152.3.3.1 gnome-settings-daemon-debugsource-3.34.2+0-lp152.3.3.1 gnome-settings-daemon-devel-3.34.2+0-lp152.3.3.1 gnome-shell-3.34.5-lp152.2.9.1 gnome-shell-calendar-3.34.5-lp152.2.9.1 gnome-shell-calendar-debuginfo-3.34.5-lp152.2.9.1 gnome-shell-debuginfo-3.34.5-lp152.2.9.1 gnome-shell-debugsource-3.34.5-lp152.2.9.1 gnome-shell-devel-3.34.5-lp152.2.9.1 References: https://www.suse.com/security/cve/CVE-2020-17489.html https://bugzilla.suse.com/1172760 https://bugzilla.suse.com/1175155 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1859-1: moderate: Security update for python
by opensuse-security＠opensuse.org 07 Nov '20

07 Nov '20

openSUSE Security Update: Security update for python ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1859-1 Rating: moderate References: #1177211 Cross-References: CVE-2020-26116 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python fixes the following issues: - bsc#1177211 (CVE-2020-26116) no longer allowing special characters in the method parameter of HTTPConnection.putrequest in httplib, stopping injection of headers. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1859=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libpython2_7-1_0-2.7.17-lp151.10.25.1 libpython2_7-1_0-debuginfo-2.7.17-lp151.10.25.1 python-2.7.17-lp151.10.25.1 python-base-2.7.17-lp151.10.25.1 python-base-debuginfo-2.7.17-lp151.10.25.1 python-base-debugsource-2.7.17-lp151.10.25.1 python-curses-2.7.17-lp151.10.25.1 python-curses-debuginfo-2.7.17-lp151.10.25.1 python-debuginfo-2.7.17-lp151.10.25.1 python-debugsource-2.7.17-lp151.10.25.1 python-demo-2.7.17-lp151.10.25.1 python-devel-2.7.17-lp151.10.25.1 python-gdbm-2.7.17-lp151.10.25.1 python-gdbm-debuginfo-2.7.17-lp151.10.25.1 python-idle-2.7.17-lp151.10.25.1 python-tk-2.7.17-lp151.10.25.1 python-tk-debuginfo-2.7.17-lp151.10.25.1 python-xml-2.7.17-lp151.10.25.1 python-xml-debuginfo-2.7.17-lp151.10.25.1 - openSUSE Leap 15.1 (noarch): python-doc-2.7.17-lp151.10.25.1 python-doc-pdf-2.7.17-lp151.10.25.1 - openSUSE Leap 15.1 (x86_64): libpython2_7-1_0-32bit-2.7.17-lp151.10.25.1 libpython2_7-1_0-32bit-debuginfo-2.7.17-lp151.10.25.1 python-32bit-2.7.17-lp151.10.25.1 python-32bit-debuginfo-2.7.17-lp151.10.25.1 python-base-32bit-2.7.17-lp151.10.25.1 python-base-32bit-debuginfo-2.7.17-lp151.10.25.1 References: https://www.suse.com/security/cve/CVE-2020-26116.html https://bugzilla.suse.com/1177211 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1856-1: moderate: Security update for virt-bootstrap
by opensuse-security＠opensuse.org 07 Nov '20

07 Nov '20

openSUSE Security Update: Security update for virt-bootstrap ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1856-1 Rating: moderate References: #1140750 Cross-References: CVE-2019-13314 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for virt-bootstrap fixes the following issues: Security issue fixed: - CVE-2019-13314: Allow providing the container's root password using a file (bsc#1140750). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1856=1 Package List: - openSUSE Leap 15.1 (noarch): python2-virt-bootstrap-1.0.0-lp151.4.3.1 python3-virt-bootstrap-1.0.0-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-13314.html https://bugzilla.suse.com/1140750 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1844-1: important: Security update for xen
by opensuse-security＠opensuse.org 06 Nov '20

06 Nov '20

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1844-1 Rating: important References: #1177409 #1177412 #1177413 #1177414 Cross-References: CVE-2020-27670 CVE-2020-27671 CVE-2020-27672 CVE-2020-27673 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for xen fixes the following issues: - bsc#1177409 - VUL-0: CVE-2020-27673: xen: x86 PV guest INVLPG-like flushes may leave stale TLB entries (XSA-286) - bsc#1177412 - VUL-0: CVE-2020-27672: xen: Race condition in Xen mapping code (XSA-345) - bsc#1177413 - VUL-0: CVE-2020-27671: xen: undue deferral of IOMMU TLB flushes (XSA-346) - bsc#1177414 - VUL-0: CVE-2020-27670: xen: unsafe AMD IOMMU page table updates (XSA-347) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1844=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): xen-debugsource-4.12.3_10-lp151.2.27.1 xen-devel-4.12.3_10-lp151.2.27.1 xen-libs-4.12.3_10-lp151.2.27.1 xen-libs-debuginfo-4.12.3_10-lp151.2.27.1 xen-tools-domU-4.12.3_10-lp151.2.27.1 xen-tools-domU-debuginfo-4.12.3_10-lp151.2.27.1 - openSUSE Leap 15.1 (x86_64): xen-4.12.3_10-lp151.2.27.1 xen-doc-html-4.12.3_10-lp151.2.27.1 xen-libs-32bit-4.12.3_10-lp151.2.27.1 xen-libs-32bit-debuginfo-4.12.3_10-lp151.2.27.1 xen-tools-4.12.3_10-lp151.2.27.1 xen-tools-debuginfo-4.12.3_10-lp151.2.27.1 References: https://www.suse.com/security/cve/CVE-2020-27670.html https://www.suse.com/security/cve/CVE-2020-27671.html https://www.suse.com/security/cve/CVE-2020-27672.html https://www.suse.com/security/cve/CVE-2020-27673.html https://bugzilla.suse.com/1177409 https://bugzilla.suse.com/1177412 https://bugzilla.suse.com/1177413 https://bugzilla.suse.com/1177414 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0