January 2021 - openSUSE Security Announce

openSUSE-SU-2021:0093-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 17 Jan '21

17 Jan '21

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0093-1 Rating: important References: #1180623 Cross-References: CVE-2020-16044 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for MozillaThunderbird fixes the following issues: - Mozilla Thunderbird 78.6.1 * changed: MailExtensions: browserAction, composeAction, and messageDisplayAction toolbar buttons now support label and default_label properties (bmo#1583478) * fixed: Running a quicksearch that returned no results did not offer to re-run as a global search (bmo#1663153) * fixed: Message search toolbar fixes (bmo#1681010) * fixed: Very long subject lines distorted the message compose and display windows, making them unusable (bmo#77806) * fixed: Compose window: Recipient addresses that had not yet been autocompleted were lost when clicking Send button (bmo#1674054) * fixed: Compose window: New message is no longer marked as "changed" just from tabbing out of the recipient field without editing anything (bmo#1681389) * fixed: Account autodiscover fixes when using MS Exchange servers (bmo#1679759) * fixed: LDAP address book stability fix (bmo#1680914) * fixed: Messages with invalid vcard attachments were not marked as read when viewed in the preview window (bmo#1680468) * fixed: Chat: Could not add TLS certificate exceptions for XMPP connections (bmo#1590471) * fixed: Calendar: System timezone was not always properly detected (bmo#1678839) * fixed: Calendar: Descriptions were sometimes blank when editing a single occurrence of a repeating event (bmo#1664731) * fixed: Various printing bugfixes (bmo#1676166) * fixed: Visual consistency and theme improvements (bmo#1682808) MFSA 2021-02 (bsc#1180623) * CVE-2020-16044 (bmo#1683964) Use-after-free write when handling a malicious COOKIE-ECHO SCTP chunk This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-93=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaThunderbird-78.6.1-lp152.2.26.1 MozillaThunderbird-debuginfo-78.6.1-lp152.2.26.1 MozillaThunderbird-debugsource-78.6.1-lp152.2.26.1 MozillaThunderbird-translations-common-78.6.1-lp152.2.26.1 MozillaThunderbird-translations-other-78.6.1-lp152.2.26.1 References: https://www.suse.com/security/cve/CVE-2020-16044.html https://bugzilla.suse.com/1180623

1 0

openSUSE-SU-2021:0091-1: important: Security update for vlc
by opensuse-security＠opensuse.org 17 Jan '21

17 Jan '21

openSUSE Security Update: Security update for vlc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0091-1 Rating: important References: #1133290 #1172727 #1180755 Cross-References: CVE-2020-13428 CVE-2020-26664 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for vlc fixes the following issues: Update to 3.0.11.1: - CVE-2020-13428: Fixed heap-based buffer overflow in the hxxx_AnnexB_to_xVC () (boo#1172727) - CVE-2020-26664: Fixed heap-based buffer overflow in EbmlTypeDispatcher:send () (boo#1180755) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-91=1 Package List: - openSUSE Leap 15.2 (x86_64): libvlc5-3.0.11.1-lp152.2.9.1 libvlc5-debuginfo-3.0.11.1-lp152.2.9.1 libvlccore9-3.0.11.1-lp152.2.9.1 libvlccore9-debuginfo-3.0.11.1-lp152.2.9.1 vlc-3.0.11.1-lp152.2.9.1 vlc-codec-gstreamer-3.0.11.1-lp152.2.9.1 vlc-codec-gstreamer-debuginfo-3.0.11.1-lp152.2.9.1 vlc-debuginfo-3.0.11.1-lp152.2.9.1 vlc-debugsource-3.0.11.1-lp152.2.9.1 vlc-devel-3.0.11.1-lp152.2.9.1 vlc-jack-3.0.11.1-lp152.2.9.1 vlc-jack-debuginfo-3.0.11.1-lp152.2.9.1 vlc-noX-3.0.11.1-lp152.2.9.1 vlc-noX-debuginfo-3.0.11.1-lp152.2.9.1 vlc-opencv-3.0.11.1-lp152.2.9.1 vlc-opencv-debuginfo-3.0.11.1-lp152.2.9.1 vlc-qt-3.0.11.1-lp152.2.9.1 vlc-qt-debuginfo-3.0.11.1-lp152.2.9.1 vlc-vdpau-3.0.11.1-lp152.2.9.1 vlc-vdpau-debuginfo-3.0.11.1-lp152.2.9.1 - openSUSE Leap 15.2 (noarch): vlc-lang-3.0.11.1-lp152.2.9.1 References: https://www.suse.com/security/cve/CVE-2020-13428.html https://www.suse.com/security/cve/CVE-2020-26664.html https://bugzilla.suse.com/1133290 https://bugzilla.suse.com/1172727 https://bugzilla.suse.com/1180755

1 0

openSUSE-SU-2021:0082-1: moderate: Security update for nodejs10
by opensuse-security＠opensuse.org 16 Jan '21

16 Jan '21

openSUSE Security Update: Security update for nodejs10 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0082-1 Rating: moderate References: #1179491 #1180553 #1180554 Cross-References: CVE-2020-1971 CVE-2020-8265 CVE-2020-8287 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for nodejs10 fixes the following issues: - New upstream LTS version 10.23.1: * CVE-2020-8265: use-after-free in TLSWrap (High) bug in TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits (bsc#1180553) * CVE-2020-8287: HTTP Request Smuggling allow two copies of a header field in a http request. For example, two Transfer-Encoding header fields. In this case Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling (https://cwe.mitre.org/data/definitions/444.html). (bsc#1180554) * CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference (High) This is a vulnerability in OpenSSL which may be exploited through Node.js. (bsc#1179491) - New upstream LTS version 10.23.0: * deps: upgrade npm to 6.14.8 * n-api: + create N-API version 7 + expose napi_build_version variable This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2021-82=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): nodejs10-10.23.1-lp151.2.15.1 nodejs10-debuginfo-10.23.1-lp151.2.15.1 nodejs10-debugsource-10.23.1-lp151.2.15.1 nodejs10-devel-10.23.1-lp151.2.15.1 npm10-10.23.1-lp151.2.15.1 - openSUSE Leap 15.1 (noarch): nodejs10-docs-10.23.1-lp151.2.15.1 References: https://www.suse.com/security/cve/CVE-2020-1971.html https://www.suse.com/security/cve/CVE-2020-8265.html https://www.suse.com/security/cve/CVE-2020-8287.html https://bugzilla.suse.com/1179491 https://bugzilla.suse.com/1180553 https://bugzilla.suse.com/1180554

1 0

openSUSE-SU-2021:0084-1: moderate: Security update for viewvc
by opensuse-security＠opensuse.org 16 Jan '21

16 Jan '21

openSUSE Security Update: Security update for viewvc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0084-1 Rating: moderate References: #1167974 Cross-References: CVE-2020-5283 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for viewvc fixes the following issues: - update to 1.1.28 (boo#1167974, CVE-2020-5283): * security fix: escape subdir lastmod file name (#211) * fix standalone.py first request failure (#195) * suppress stack traces (with option to show) (#140) * distinguish text/binary/image files by icons (#166, #175) * colorize alternating file content lines (#167) * link to the instance root from the ViewVC logo (#168) * display directory and root counts, too (#169) * fix double fault error in standalone.py (#157) * support timezone offsets with minutes piece (#176) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2021-84=1 Package List: - openSUSE Leap 15.1 (noarch): viewvc-1.1.28-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-5283.html https://bugzilla.suse.com/1167974

1 0

openSUSE-SU-2021:0079-1: moderate: Security update for ceph
by opensuse-security＠opensuse.org 16 Jan '21

16 Jan '21

openSUSE Security Update: Security update for ceph ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0079-1 Rating: moderate References: #1178837 #1179139 #1179452 #1179802 #1180118 #1180155 Cross-References: CVE-2020-27781 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has 5 fixes is now available. Description: This update for ceph fixes the following issues: Security issues fixed: - CVE-2020-27781: Fixed a privilege escalation via the ceph_volume_client Python interface (bsc#1179802 bsc#1180155). Non-security issues fixed: - Fixes an issue when check in legacy collection reaches end. (bsc#1179139) - Fixes an issue when storage service stops. (bsc#1178837) - Fix for failing test run due to missing module 'six'. (bsc#1179452) - Provide a different name for the fallback allocator in bluestore. (bsc#1180118) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2021-79=1 Package List: - openSUSE Leap 15.1 (x86_64): ceph-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 ceph-base-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 ceph-base-debuginfo-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 ceph-common-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 ceph-common-debuginfo-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 ceph-debugsource-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 ceph-fuse-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 ceph-fuse-debuginfo-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 ceph-mds-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 ceph-mds-debuginfo-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 ceph-mgr-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 ceph-mgr-debuginfo-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 ceph-mon-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 ceph-mon-debuginfo-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 ceph-osd-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 ceph-osd-debuginfo-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 ceph-radosgw-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 ceph-radosgw-debuginfo-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 ceph-resource-agents-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 ceph-test-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 ceph-test-debuginfo-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 ceph-test-debugsource-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 cephfs-shell-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 libcephfs-devel-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 libcephfs2-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 libcephfs2-debuginfo-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 librados-devel-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 librados-devel-debuginfo-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 librados2-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 librados2-debuginfo-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 libradospp-devel-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 libradosstriper-devel-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 libradosstriper1-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 libradosstriper1-debuginfo-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 librbd-devel-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 librbd1-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 librbd1-debuginfo-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 librgw-devel-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 librgw2-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 librgw2-debuginfo-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 python3-ceph-argparse-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 python3-cephfs-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 python3-cephfs-debuginfo-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 python3-rados-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 python3-rados-debuginfo-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 python3-rbd-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 python3-rbd-debuginfo-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 python3-rgw-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 python3-rgw-debuginfo-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 rados-objclass-devel-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 rbd-fuse-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 rbd-fuse-debuginfo-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 rbd-mirror-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 rbd-mirror-debuginfo-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 rbd-nbd-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 rbd-nbd-debuginfo-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 - openSUSE Leap 15.1 (noarch): ceph-dashboard-e2e-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 ceph-grafana-dashboards-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 ceph-mgr-dashboard-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 ceph-mgr-diskprediction-cloud-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 ceph-mgr-diskprediction-local-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 ceph-mgr-k8sevents-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 ceph-mgr-rook-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 ceph-mgr-ssh-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 ceph-prometheus-alerts-14.2.16.402+g7d47dbaf4d-lp151.2.31.1 References: https://www.suse.com/security/cve/CVE-2020-27781.html https://bugzilla.suse.com/1178837 https://bugzilla.suse.com/1179139 https://bugzilla.suse.com/1179452 https://bugzilla.suse.com/1179802 https://bugzilla.suse.com/1180118 https://bugzilla.suse.com/1180155

1 0

openSUSE-SU-2021:0073-1: important: Security update for crmsh
by opensuse-security＠opensuse.org 16 Jan '21

16 Jan '21

openSUSE Security Update: Security update for crmsh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0073-1 Rating: important References: #1179999 Cross-References: CVE-2020-35459 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for crmsh fixes the following issue: - CVE-2020-35459: Fixed a privilege escalation in hawk_invoke (bsc#1179999). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2021-73=1 Package List: - openSUSE Leap 15.1 (noarch): crmsh-4.2.0+git.1607075079.a25648d8-lp151.2.45.1 crmsh-scripts-4.2.0+git.1607075079.a25648d8-lp151.2.45.1 crmsh-test-4.2.0+git.1607075079.a25648d8-lp151.2.45.1 References: https://www.suse.com/security/cve/CVE-2020-35459.html https://bugzilla.suse.com/1179999

1 0

openSUSE-SU-2021:0074-1: important: Security update for hawk2
by opensuse-security＠opensuse.org 16 Jan '21

16 Jan '21

openSUSE Security Update: Security update for hawk2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0074-1 Rating: important References: #1179998 Cross-References: CVE-2020-35458 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for hawk2 fixes the following security issue: - CVE-2020-35458: Fixed an insufficient input handler that could have led to remote code execution (bsc#1179998). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2021-74=1 Package List: - openSUSE Leap 15.1 (x86_64): hawk2-2.3.0+git.1603969748.10468582-lp151.2.18.1 hawk2-debuginfo-2.3.0+git.1603969748.10468582-lp151.2.18.1 hawk2-debugsource-2.3.0+git.1603969748.10468582-lp151.2.18.1 References: https://www.suse.com/security/cve/CVE-2020-35458.html https://bugzilla.suse.com/1179998

1 0

openSUSE-SU-2021:0076-1: important: Security update for vlc
by opensuse-security＠opensuse.org 16 Jan '21

16 Jan '21

openSUSE Security Update: Security update for vlc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0076-1 Rating: important References: #1133290 #1172727 #1180755 Cross-References: CVE-2020-13428 CVE-2020-26664 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for vlc fixes the following issues: Update to 3.0.11.1: - CVE-2020-13428: Fixed heap-based buffer overflow in the hxxx_AnnexB_to_xVC () (boo#1172727) - CVE-2020-26664: Fixed heap-based buffer overflow in EbmlTypeDispatcher:send () (boo#1180755) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2021-76=1 Package List: - openSUSE Leap 15.1 (noarch): vlc-lang-3.0.11.1-lp151.6.12.1 - openSUSE Leap 15.1 (x86_64): libvlc5-3.0.11.1-lp151.6.12.1 libvlc5-debuginfo-3.0.11.1-lp151.6.12.1 libvlccore9-3.0.11.1-lp151.6.12.1 libvlccore9-debuginfo-3.0.11.1-lp151.6.12.1 vlc-3.0.11.1-lp151.6.12.1 vlc-codec-gstreamer-3.0.11.1-lp151.6.12.1 vlc-codec-gstreamer-debuginfo-3.0.11.1-lp151.6.12.1 vlc-debuginfo-3.0.11.1-lp151.6.12.1 vlc-debugsource-3.0.11.1-lp151.6.12.1 vlc-devel-3.0.11.1-lp151.6.12.1 vlc-jack-3.0.11.1-lp151.6.12.1 vlc-jack-debuginfo-3.0.11.1-lp151.6.12.1 vlc-noX-3.0.11.1-lp151.6.12.1 vlc-noX-debuginfo-3.0.11.1-lp151.6.12.1 vlc-opencv-3.0.11.1-lp151.6.12.1 vlc-opencv-debuginfo-3.0.11.1-lp151.6.12.1 vlc-qt-3.0.11.1-lp151.6.12.1 vlc-qt-debuginfo-3.0.11.1-lp151.6.12.1 vlc-vdpau-3.0.11.1-lp151.6.12.1 vlc-vdpau-debuginfo-3.0.11.1-lp151.6.12.1 References: https://www.suse.com/security/cve/CVE-2020-13428.html https://www.suse.com/security/cve/CVE-2020-26664.html https://bugzilla.suse.com/1133290 https://bugzilla.suse.com/1172727 https://bugzilla.suse.com/1180755

1 0

openSUSE-SU-2021:0078-1: moderate: Security update for python-jupyter_notebook
by opensuse-security＠opensuse.org 16 Jan '21

16 Jan '21

openSUSE Security Update: Security update for python-jupyter_notebook ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0078-1 Rating: moderate References: #1180458 Cross-References: CVE-2020-26215 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-jupyter_notebook fixes the following issue: - CVE-2020-26215: Fixed an open redirect vulnerability (boo#1180458). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2021-78=1 Package List: - openSUSE Leap 15.1 (noarch): python-jupyter_notebook-doc-5.7.7-lp151.2.3.1 python2-jupyter_notebook-5.7.7-lp151.2.3.1 python2-jupyter_notebook-lang-5.7.7-lp151.2.3.1 python2-jupyter_notebook-latex-5.7.7-lp151.2.3.1 python3-jupyter_notebook-5.7.7-lp151.2.3.1 python3-jupyter_notebook-lang-5.7.7-lp151.2.3.1 python3-jupyter_notebook-latex-5.7.7-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-26215.html https://bugzilla.suse.com/1180458

1 0

openSUSE-SU-2021:0081-1: moderate: Security update for tomcat
by opensuse-security＠opensuse.org 16 Jan '21

16 Jan '21

openSUSE Security Update: Security update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0081-1 Rating: moderate References: #1179602 Cross-References: CVE-2020-17527 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tomcat fixes the following issue: - CVE-2020-17527: Fixed a HTTP/2 request header mix-up (bsc#1179602). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2021-81=1 Package List: - openSUSE Leap 15.1 (noarch): tomcat-9.0.36-lp151.3.39.1 tomcat-admin-webapps-9.0.36-lp151.3.39.1 tomcat-docs-webapp-9.0.36-lp151.3.39.1 tomcat-el-3_0-api-9.0.36-lp151.3.39.1 tomcat-embed-9.0.36-lp151.3.39.1 tomcat-javadoc-9.0.36-lp151.3.39.1 tomcat-jsp-2_3-api-9.0.36-lp151.3.39.1 tomcat-jsvc-9.0.36-lp151.3.39.1 tomcat-lib-9.0.36-lp151.3.39.1 tomcat-servlet-4_0-api-9.0.36-lp151.3.39.1 tomcat-webapps-9.0.36-lp151.3.39.1 References: https://www.suse.com/security/cve/CVE-2020-17527.html https://bugzilla.suse.com/1179602

1 0