January 2021 - openSUSE Security Announce

openSUSE-SU-2021:0026-1: important: Security update for dovecot23
by opensuse-security＠opensuse.org 07 Jan '21

07 Jan '21

openSUSE Security Update: Security update for dovecot23 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0026-1 Rating: important References: #1174920 #1180405 #1180406 Cross-References: CVE-2020-12100 CVE-2020-24386 CVE-2020-25275 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for dovecot23 fixes the following issues: Security issues fixed: - CVE-2020-12100: Fixed a resource exhaustion caused by deeply nested MIME parts (bsc#1174920). - CVE-2020-24386: Fixed an issue with IMAP hibernation that allowed users to access other users' emails (bsc#1180405). - CVE-2020-25275: Fixed a crash when the 10000th MIME part was message/rfc822 (bsc#1180406). Non-security issues fixed: - Pigeonhole was updated to version 0.5.11. - Dovecot was updated to version 2.3.11.3. This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-26=1 Package List: - openSUSE Leap 15.2 (x86_64): dovecot23-2.3.11.3-lp152.2.6.1 dovecot23-backend-mysql-2.3.11.3-lp152.2.6.1 dovecot23-backend-mysql-debuginfo-2.3.11.3-lp152.2.6.1 dovecot23-backend-pgsql-2.3.11.3-lp152.2.6.1 dovecot23-backend-pgsql-debuginfo-2.3.11.3-lp152.2.6.1 dovecot23-backend-sqlite-2.3.11.3-lp152.2.6.1 dovecot23-backend-sqlite-debuginfo-2.3.11.3-lp152.2.6.1 dovecot23-debuginfo-2.3.11.3-lp152.2.6.1 dovecot23-debugsource-2.3.11.3-lp152.2.6.1 dovecot23-devel-2.3.11.3-lp152.2.6.1 dovecot23-fts-2.3.11.3-lp152.2.6.1 dovecot23-fts-debuginfo-2.3.11.3-lp152.2.6.1 dovecot23-fts-lucene-2.3.11.3-lp152.2.6.1 dovecot23-fts-lucene-debuginfo-2.3.11.3-lp152.2.6.1 dovecot23-fts-solr-2.3.11.3-lp152.2.6.1 dovecot23-fts-solr-debuginfo-2.3.11.3-lp152.2.6.1 dovecot23-fts-squat-2.3.11.3-lp152.2.6.1 dovecot23-fts-squat-debuginfo-2.3.11.3-lp152.2.6.1 References: https://www.suse.com/security/cve/CVE-2020-12100.html https://www.suse.com/security/cve/CVE-2020-24386.html https://www.suse.com/security/cve/CVE-2020-25275.html https://bugzilla.suse.com/1174920 https://bugzilla.suse.com/1180405 https://bugzilla.suse.com/1180406

1 0

openSUSE-SU-2021:0025-1: important: Security update for kitty
by opensuse-security＠opensuse.org 07 Jan '21

07 Jan '21

openSUSE Security Update: Security update for kitty ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0025-1 Rating: important References: #1180298 Cross-References: CVE-2020-35605 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for kitty fixes the following issue: - CVE-2020-35605: Fixed an RCE due to filenames containing special characters contained in error messages (boo#1180298). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-25=1 Package List: - openSUSE Leap 15.2 (x86_64): kitty-0.16.0-lp152.2.3.1 kitty-debuginfo-0.16.0-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-35605.html https://bugzilla.suse.com/1180298

1 0

openSUSE-SU-2021:0024-1: moderate: Security update for python-notebook
by opensuse-security＠opensuse.org 07 Jan '21

07 Jan '21

openSUSE Security Update: Security update for python-notebook ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0024-1 Rating: moderate References: #1180458 Cross-References: CVE-2020-26215 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-notebook fixes the following issue: - CVE-2020-26215: Fixed an open redirect vulnerability (boo#1180458). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-24=1 Package List: - openSUSE Leap 15.2 (noarch): jupyter-notebook-5.7.8-lp152.2.3.1 jupyter-notebook-doc-5.7.8-lp152.2.3.1 jupyter-notebook-lang-5.7.8-lp152.2.3.1 jupyter-notebook-latex-5.7.8-lp152.2.3.1 python2-notebook-5.7.8-lp152.2.3.1 python2-notebook-lang-5.7.8-lp152.2.3.1 python3-notebook-5.7.8-lp152.2.3.1 python3-notebook-lang-5.7.8-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-26215.html https://bugzilla.suse.com/1180458

1 0

openSUSE-SU-2021:0016-1: moderate: Security update for privoxy
by opensuse-security＠opensuse.org 05 Jan '21

05 Jan '21

openSUSE Security Update: Security update for privoxy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0016-1 Rating: moderate References: #1157449 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for privoxy fixes the following issues: privoxy was updated to 3.0.29: * Fixed memory leaks when a response is buffered and the buffer limit is reached or Privoxy is running out of memory. OVE-20201118-0001 * Fixed a memory leak in the show-status CGI handler when no action files are configured OVE-20201118-0002 * Fixed a memory leak in the show-status CGI handler when no filter files are configured OVE-20201118-0003 * Fixes a memory leak when client tags are active OVE-20201118-0004 * Fixed a memory leak if multiple filters are executed and the last one is skipped due to a pcre error OVE-20201118-0005 * Prevent an unlikely dereference of a NULL-pointer that could result in a crash if accept-intercepted-requests was enabled, Privoxy failed to get the request destination from the Host header and a memory allocation failed. OVE-20201118-0006 * Fixed memory leaks in the client-tags CGI handler when client tags are configured and memory allocations fail. OVE-20201118-0007 * Fixed memory leaks in the show-status CGI handler when memory allocations fail OVE-20201118-0008 * Add experimental https inspection support * Use JIT compilation for static filtering for speedup * Add support for Brotli decompression, add 'no-brotli-accepted' filter which prevents the use of Brotli compression * Add feature to gather exended statistics * Use IP_FREEBIND socket option to help with failover * Allow to use extended host patterns and vanilla host patterns at the same time by prefixing extended host patterns with "PCRE-HOST-PATTERN:" * Added "Cross-origin resource sharing" (CORS) support * Add SOCKS5 username/password support * Bump the maximum number of action and filter files to 100 each * Fixed handling of filters with "split-large-forms 1" when using the CGI editor. * Better detect a mismatch of connection details when figuring out whether or not a connection can be reused * Don't send a "Connection failure" message instead of the "DNS failure" message * Let LOG_LEVEL_REQUEST log all requests * Improvements to default Action file License changed to GPLv3. - remove packaging vulnerability boo#1157449 This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-16=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): privoxy-3.0.29-bp151.3.3.1 - openSUSE Backports SLE-15-SP1 (noarch): privoxy-doc-3.0.29-bp151.3.3.1 References: https://bugzilla.suse.com/1157449

1 0

openSUSE-SU-2021:0017-1: moderate: Security update for privoxy
by opensuse-security＠opensuse.org 05 Jan '21

05 Jan '21

openSUSE Security Update: Security update for privoxy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0017-1 Rating: moderate References: #1157449 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for privoxy fixes the following issues: privoxy was updated to 3.0.29: * Fixed memory leaks when a response is buffered and the buffer limit is reached or Privoxy is running out of memory. OVE-20201118-0001 * Fixed a memory leak in the show-status CGI handler when no action files are configured OVE-20201118-0002 * Fixed a memory leak in the show-status CGI handler when no filter files are configured OVE-20201118-0003 * Fixes a memory leak when client tags are active OVE-20201118-0004 * Fixed a memory leak if multiple filters are executed and the last one is skipped due to a pcre error OVE-20201118-0005 * Prevent an unlikely dereference of a NULL-pointer that could result in a crash if accept-intercepted-requests was enabled, Privoxy failed to get the request destination from the Host header and a memory allocation failed. OVE-20201118-0006 * Fixed memory leaks in the client-tags CGI handler when client tags are configured and memory allocations fail. OVE-20201118-0007 * Fixed memory leaks in the show-status CGI handler when memory allocations fail OVE-20201118-0008 * Add experimental https inspection support * Use JIT compilation for static filtering for speedup * Add support for Brotli decompression, add 'no-brotli-accepted' filter which prevents the use of Brotli compression * Add feature to gather exended statistics * Use IP_FREEBIND socket option to help with failover * Allow to use extended host patterns and vanilla host patterns at the same time by prefixing extended host patterns with "PCRE-HOST-PATTERN:" * Added "Cross-origin resource sharing" (CORS) support * Add SOCKS5 username/password support * Bump the maximum number of action and filter files to 100 each * Fixed handling of filters with "split-large-forms 1" when using the CGI editor. * Better detect a mismatch of connection details when figuring out whether or not a connection can be reused * Don't send a "Connection failure" message instead of the "DNS failure" message * Let LOG_LEVEL_REQUEST log all requests * Improvements to default Action file License changed to GPLv3. - remove packaging vulnerability boo#1157449 This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-17=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): privoxy-3.0.29-bp152.4.3.1 - openSUSE Backports SLE-15-SP2 (noarch): privoxy-doc-3.0.29-bp152.4.3.1 References: https://bugzilla.suse.com/1157449

1 0

openSUSE-SU-2021:0012-1: moderate: Security update for jetty-minimal
by opensuse-security＠opensuse.org 04 Jan '21

04 Jan '21

openSUSE Security Update: Security update for jetty-minimal ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0012-1 Rating: moderate References: #1179727 Cross-References: CVE-2020-27218 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for jetty-minimal fixes the following issues: - jetty-minimal was upgraded to version 9.4.35.v20201120 - CVE-2020-27218: Fixed an issue where buffer not correctly recycled in Gzip Request inflation (bsc#1179727). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-12=1 Package List: - openSUSE Leap 15.2 (noarch): jetty-annotations-9.4.35-lp152.2.3.1 jetty-client-9.4.35-lp152.2.3.1 jetty-continuation-9.4.35-lp152.2.3.1 jetty-http-9.4.35-lp152.2.3.1 jetty-io-9.4.35-lp152.2.3.1 jetty-jaas-9.4.35-lp152.2.3.1 jetty-javax-websocket-client-impl-9.4.35-lp152.2.3.1 jetty-javax-websocket-server-impl-9.4.35-lp152.2.3.1 jetty-jmx-9.4.35-lp152.2.3.1 jetty-jndi-9.4.35-lp152.2.3.1 jetty-jsp-9.4.35-lp152.2.3.1 jetty-minimal-javadoc-9.4.35-lp152.2.3.1 jetty-openid-9.4.35-lp152.2.3.1 jetty-plus-9.4.35-lp152.2.3.1 jetty-proxy-9.4.35-lp152.2.3.1 jetty-security-9.4.35-lp152.2.3.1 jetty-server-9.4.35-lp152.2.3.1 jetty-servlet-9.4.35-lp152.2.3.1 jetty-util-9.4.35-lp152.2.3.1 jetty-util-ajax-9.4.35-lp152.2.3.1 jetty-webapp-9.4.35-lp152.2.3.1 jetty-websocket-api-9.4.35-lp152.2.3.1 jetty-websocket-client-9.4.35-lp152.2.3.1 jetty-websocket-common-9.4.35-lp152.2.3.1 jetty-websocket-javadoc-9.4.35-lp152.2.3.1 jetty-websocket-server-9.4.35-lp152.2.3.1 jetty-websocket-servlet-9.4.35-lp152.2.3.1 jetty-xml-9.4.35-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-27218.html https://bugzilla.suse.com/1179727

1 0

openSUSE-SU-2021:0006-1: moderate: Security update for privoxy
by opensuse-security＠opensuse.org 01 Jan '21

01 Jan '21

openSUSE Security Update: Security update for privoxy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0006-1 Rating: moderate References: #1157449 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for privoxy fixes the following issues: privoxy was updated to 3.0.29: * Fixed memory leaks when a response is buffered and the buffer limit is reached or Privoxy is running out of memory. OVE-20201118-0001 * Fixed a memory leak in the show-status CGI handler when no action files are configured OVE-20201118-0002 * Fixed a memory leak in the show-status CGI handler when no filter files are configured OVE-20201118-0003 * Fixes a memory leak when client tags are active OVE-20201118-0004 * Fixed a memory leak if multiple filters are executed and the last one is skipped due to a pcre error OVE-20201118-0005 * Prevent an unlikely dereference of a NULL-pointer that could result in a crash if accept-intercepted-requests was enabled, Privoxy failed to get the request destination from the Host header and a memory allocation failed. OVE-20201118-0006 * Fixed memory leaks in the client-tags CGI handler when client tags are configured and memory allocations fail. OVE-20201118-0007 * Fixed memory leaks in the show-status CGI handler when memory allocations fail OVE-20201118-0008 * Add experimental https inspection support * Use JIT compilation for static filtering for speedup * Add support for Brotli decompression, add 'no-brotli-accepted' filter which prevents the use of Brotli compression * Add feature to gather exended statistics * Use IP_FREEBIND socket option to help with failover * Allow to use extended host patterns and vanilla host patterns at the same time by prefixing extended host patterns with "PCRE-HOST-PATTERN:" * Added "Cross-origin resource sharing" (CORS) support * Add SOCKS5 username/password support * Bump the maximum number of action and filter files to 100 each * Fixed handling of filters with "split-large-forms 1" when using the CGI editor. * Better detect a mismatch of connection details when figuring out whether or not a connection can be reused * Don't send a "Connection failure" message instead of the "DNS failure" message * Let LOG_LEVEL_REQUEST log all requests * Improvements to default Action file License changed to GPLv3. - remove packaging vulnerability boo#1157449 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-6=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2021-6=1 Package List: - openSUSE Leap 15.2 (noarch): privoxy-doc-3.0.29-lp152.3.3.1 - openSUSE Leap 15.2 (x86_64): privoxy-3.0.29-lp152.3.3.1 privoxy-debuginfo-3.0.29-lp152.3.3.1 privoxy-debugsource-3.0.29-lp152.3.3.1 - openSUSE Leap 15.1 (noarch): privoxy-doc-3.0.29-lp151.2.3.1 - openSUSE Leap 15.1 (x86_64): privoxy-3.0.29-lp151.2.3.1 privoxy-debuginfo-3.0.29-lp151.2.3.1 privoxy-debugsource-3.0.29-lp151.2.3.1 References: https://bugzilla.suse.com/1157449

1 0