December 2021 - openSUSE Security Announce

openSUSE-SU-2021:1554-1: important: Security update for glib-networking
by opensuse-security＠opensuse.org 10 Dec '21

10 Dec '21

openSUSE Security Update: Security update for glib-networking ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1554-1 Rating: important References: #1172460 Cross-References: CVE-2020-13645 CVSS scores: CVE-2020-13645 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2020-13645 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for glib-networking fixes the following issues: Update to version 2.62.4: - CVE-2020-13645: Fixed a connection failure when the server identity is unset (bsc#1172460). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1554=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): glib-networking-2.62.4-lp152.2.3.1 glib-networking-debuginfo-2.62.4-lp152.2.3.1 glib-networking-debugsource-2.62.4-lp152.2.3.1 - openSUSE Leap 15.2 (noarch): glib-networking-lang-2.62.4-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): glib-networking-32bit-2.62.4-lp152.2.3.1 glib-networking-32bit-debuginfo-2.62.4-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-13645.html https://bugzilla.suse.com/1172460

1 0

openSUSE-SU-2021:1557-1: important: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 10 Dec '21

10 Dec '21

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1557-1 Rating: important References: #1192063 Cross-References: CVE-2021-30846 CVE-2021-30851 CVSS scores: CVE-2021-30846 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30846 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30851 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30851 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for webkit2gtk3 fixes the following issues: - CVE-2021-30846: Fixed memory corruption issue that could lead to arbitrary code execution when processing maliciously crafted web content (bsc#1192063). - CVE-2021-30851: Fixed memory corruption vulnerability that could lead to arbitrary code execution when processing maliciously crafted web content (bsc#1192063). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1557=1 Package List: - openSUSE Leap 15.2 (x86_64): libjavascriptcoregtk-4_0-18-2.34.1-lp152.2.25.3 libjavascriptcoregtk-4_0-18-debuginfo-2.34.1-lp152.2.25.3 libwebkit2gtk-4_0-37-2.34.1-lp152.2.25.3 libwebkit2gtk-4_0-37-debuginfo-2.34.1-lp152.2.25.3 typelib-1_0-JavaScriptCore-4_0-2.34.1-lp152.2.25.3 typelib-1_0-WebKit2-4_0-2.34.1-lp152.2.25.3 typelib-1_0-WebKit2WebExtension-4_0-2.34.1-lp152.2.25.3 webkit-jsc-4-2.34.1-lp152.2.25.3 webkit-jsc-4-debuginfo-2.34.1-lp152.2.25.3 webkit2gtk-4_0-injected-bundles-2.34.1-lp152.2.25.3 webkit2gtk-4_0-injected-bundles-debuginfo-2.34.1-lp152.2.25.3 webkit2gtk3-debugsource-2.34.1-lp152.2.25.3 webkit2gtk3-devel-2.34.1-lp152.2.25.3 webkit2gtk3-minibrowser-2.34.1-lp152.2.25.3 webkit2gtk3-minibrowser-debuginfo-2.34.1-lp152.2.25.3 - openSUSE Leap 15.2 (noarch): libwebkit2gtk3-lang-2.34.1-lp152.2.25.3 References: https://www.suse.com/security/cve/CVE-2021-30846.html https://www.suse.com/security/cve/CVE-2021-30851.html https://bugzilla.suse.com/1192063

1 0

openSUSE-SU-2021:1550-1: moderate: Security update for hiredis
by opensuse-security＠opensuse.org 09 Dec '21

09 Dec '21

openSUSE Security Update: Security update for hiredis ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1550-1 Rating: moderate References: #1191331 Cross-References: CVE-2021-32765 CVSS scores: CVE-2021-32765 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for hiredis fixes the following issues: - CVE-2021-32765: Fix integer/buffer (boo#1191331) This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1550=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): hiredis-0.13.3-bp152.4.3.1 hiredis-devel-0.13.3-bp152.4.3.1 libhiredis0_13-0.13.3-bp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2021-32765.html https://bugzilla.suse.com/1191331

1 0

openSUSE-SU-2021:3968-1: moderate: Security update for xen
by opensuse-security＠opensuse.org 07 Dec '21

07 Dec '21

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3968-1 Rating: moderate References: #1027519 #1191363 #1192554 #1192557 #1192559 Cross-References: CVE-2021-28702 CVE-2021-28704 CVE-2021-28705 CVE-2021-28706 CVE-2021-28707 CVE-2021-28708 CVE-2021-28709 CVSS scores: CVE-2021-28702 (NVD) : 7.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVE-2021-28704 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-28705 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-28705 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-28706 (NVD) : 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H CVE-2021-28706 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-28707 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-28708 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-28709 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for xen fixes the following issues: - CVE-2021-28702: Fixed PCI devices with RMRRs not deassigned correctly (XSA-386) (bsc#1191363). - CVE-2021-28704, CVE-2021-28707, CVE-2021-28708: Fixed PoD operations on misaligned GFNs (XSA-388) (bsc#1192557). - CVE-2021-28705, CVE-2021-28709: Fixed issues with partially successful P2M updates on x86 (XSA-389) (bsc#1192559). - CVE-2021-28706: Fixed guests may exceed their designated memory limit (XSA-385) (bsc#1192554). - Update to Xen 4.14.3 bug fix release (bsc#1027519). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3968=1 Package List: - openSUSE Leap 15.3 (aarch64 x86_64): xen-4.14.3_04-3.15.1 xen-debugsource-4.14.3_04-3.15.1 xen-devel-4.14.3_04-3.15.1 xen-doc-html-4.14.3_04-3.15.1 xen-libs-4.14.3_04-3.15.1 xen-libs-debuginfo-4.14.3_04-3.15.1 xen-tools-4.14.3_04-3.15.1 xen-tools-debuginfo-4.14.3_04-3.15.1 xen-tools-domU-4.14.3_04-3.15.1 xen-tools-domU-debuginfo-4.14.3_04-3.15.1 - openSUSE Leap 15.3 (x86_64): xen-libs-32bit-4.14.3_04-3.15.1 xen-libs-32bit-debuginfo-4.14.3_04-3.15.1 - openSUSE Leap 15.3 (noarch): xen-tools-xendomains-wait-disk-4.14.3_04-3.15.1 References: https://www.suse.com/security/cve/CVE-2021-28702.html https://www.suse.com/security/cve/CVE-2021-28704.html https://www.suse.com/security/cve/CVE-2021-28705.html https://www.suse.com/security/cve/CVE-2021-28706.html https://www.suse.com/security/cve/CVE-2021-28707.html https://www.suse.com/security/cve/CVE-2021-28708.html https://www.suse.com/security/cve/CVE-2021-28709.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1191363 https://bugzilla.suse.com/1192554 https://bugzilla.suse.com/1192557 https://bugzilla.suse.com/1192559

1 0

openSUSE-SU-2021:3964-1: important: Security update for nodejs14
by opensuse-security＠opensuse.org 07 Dec '21

07 Dec '21

openSUSE Security Update: Security update for nodejs14 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3964-1 Rating: important References: #1190053 #1190054 #1190055 #1190056 #1190057 #1191601 #1191602 Cross-References: CVE-2021-22959 CVE-2021-22960 CVE-2021-37701 CVE-2021-37712 CVE-2021-37713 CVE-2021-39134 CVE-2021-39135 CVSS scores: CVE-2021-22959 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2021-22959 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-22960 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-37701 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVE-2021-37701 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-37712 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVE-2021-37712 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-39134 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVE-2021-39134 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-39135 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for nodejs14 fixes the following issues: nodejs14 was updated to 14.18.1: * deps: update llhttp to 2.1.4 - HTTP Request Smuggling due to spaced in headers (bsc#1191601, CVE-2021-22959) - HTTP Request Smuggling when parsing the body (bsc#1191602, CVE-2021-22960) Changes in 14.18.0: * buffer: + introduce Blob + add base64url encoding option * child_process: + allow options.cwd receive a URL + add timeout to spawn and fork + allow promisified exec to be cancel + add 'overlapped' stdio flag * dns: add "tries" option to Resolve options * fs: + allow empty string for temp directory prefix + allow no-params fsPromises fileHandle read + add support for async iterators to fsPromises.writeFile * http2: add support for sensitive headers * process: add 'worker' event * tls: allow reading data into a static buffer * worker: add setEnvironmentData/getEnvironmentData Changes in 14.17.6 * deps: upgrade npm to 6.14.15 which fixes a number of security issues (bsc#1190057, CVE-2021-37701, bsc#1190056, CVE-2021-37712, bsc#1190055, CVE-2021-37713, bsc#1190054, CVE-2021-39134, bsc#1190053, CVE-2021-39135) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3964=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): nodejs14-14.18.1-15.21.2 nodejs14-debuginfo-14.18.1-15.21.2 nodejs14-debugsource-14.18.1-15.21.2 nodejs14-devel-14.18.1-15.21.2 npm14-14.18.1-15.21.2 - openSUSE Leap 15.3 (noarch): nodejs14-docs-14.18.1-15.21.2 References: https://www.suse.com/security/cve/CVE-2021-22959.html https://www.suse.com/security/cve/CVE-2021-22960.html https://www.suse.com/security/cve/CVE-2021-37701.html https://www.suse.com/security/cve/CVE-2021-37712.html https://www.suse.com/security/cve/CVE-2021-37713.html https://www.suse.com/security/cve/CVE-2021-39134.html https://www.suse.com/security/cve/CVE-2021-39135.html https://bugzilla.suse.com/1190053 https://bugzilla.suse.com/1190054 https://bugzilla.suse.com/1190055 https://bugzilla.suse.com/1190056 https://bugzilla.suse.com/1190057 https://bugzilla.suse.com/1191601 https://bugzilla.suse.com/1191602

1 0

Discontinuation notice of openSUSE Leap 15.2
by Marcus Meissner 07 Dec '21

07 Dec '21

Hi folks, This is the discontinuation notice for openSUSE Leap 15.2. On December 31st 2021 openSUSE Leap 15.2 will reach its end of support after 1.5 years of lifetime (it was released June 2020). openSUSE Leap 15.2 will receive no further maintenance or security updates after that date. It is recommended for openSUSE Leap users to upgrade to the current release openSUSE Leap 15.3. The next release openSUSE Leap 15.4 is scheduled for mid 2022. (I tried sending it our earlier, but I used the old list addresses.) Ciao, Marcus, for SUSE Security and openSUSE Maintenance

1 0

openSUSE-SU-2021:1543-1: moderate: Security update for xen
by opensuse-security＠opensuse.org 06 Dec '21

06 Dec '21

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1543-1 Rating: moderate References: #1027519 #1191363 #1192554 #1192557 #1192559 Cross-References: CVE-2021-28702 CVE-2021-28704 CVE-2021-28705 CVE-2021-28706 CVE-2021-28707 CVE-2021-28708 CVE-2021-28709 CVSS scores: CVE-2021-28702 (NVD) : 7.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVE-2021-28704 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-28705 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-28706 (NVD) : 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H CVE-2021-28706 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-28707 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-28708 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-28709 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for xen fixes the following issues: - CVE-2021-28702: Fixed PCI devices with RMRRs not deassigned correctly (XSA-386) (bsc#1191363). - CVE-2021-28704, CVE-2021-28707, CVE-2021-28708: Fixed PoD operations on misaligned GFNs (XSA-388) (bsc#1192557). - CVE-2021-28705, CVE-2021-28709: Fixed issues with partially successful P2M updates on x86 (XSA-389) (bsc#1192559). - CVE-2021-28706: Fixed guests may exceed their designated memory limit (XSA-385) (bsc#1192554). - Update to Xen 4.13.4 bug fix release (bsc#1027519). This update was imported from the SUSE:SLE-15-SP2:Update update project. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1543=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): xen-debugsource-4.13.4_02-lp152.2.33.1 xen-devel-4.13.4_02-lp152.2.33.1 xen-libs-4.13.4_02-lp152.2.33.1 xen-libs-debuginfo-4.13.4_02-lp152.2.33.1 xen-tools-domU-4.13.4_02-lp152.2.33.1 xen-tools-domU-debuginfo-4.13.4_02-lp152.2.33.1 - openSUSE Leap 15.2 (x86_64): xen-4.13.4_02-lp152.2.33.1 xen-doc-html-4.13.4_02-lp152.2.33.1 xen-libs-32bit-4.13.4_02-lp152.2.33.1 xen-libs-32bit-debuginfo-4.13.4_02-lp152.2.33.1 xen-tools-4.13.4_02-lp152.2.33.1 xen-tools-debuginfo-4.13.4_02-lp152.2.33.1 - openSUSE Leap 15.2 (noarch): xen-tools-xendomains-wait-disk-4.13.4_02-lp152.2.33.1 References: https://www.suse.com/security/cve/CVE-2021-28702.html https://www.suse.com/security/cve/CVE-2021-28704.html https://www.suse.com/security/cve/CVE-2021-28705.html https://www.suse.com/security/cve/CVE-2021-28706.html https://www.suse.com/security/cve/CVE-2021-28707.html https://www.suse.com/security/cve/CVE-2021-28708.html https://www.suse.com/security/cve/CVE-2021-28709.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1191363 https://bugzilla.suse.com/1192554 https://bugzilla.suse.com/1192557 https://bugzilla.suse.com/1192559

1 0

openSUSE-SU-2021:3946-1: moderate: Security update for gmp
by opensuse-security＠opensuse.org 06 Dec '21

06 Dec '21

openSUSE Security Update: Security update for gmp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3946-1 Rating: moderate References: #1192717 Cross-References: CVE-2021-43618 CVSS scores: CVE-2021-43618 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-43618 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gmp fixes the following issues: - CVE-2021-43618: Fixed buffer overflow via crafted input in mpz/inp_raw.c (bsc#1192717). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3946=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): gmp-debugsource-6.1.2-4.9.1 gmp-devel-6.1.2-4.9.1 libgmp10-6.1.2-4.9.1 libgmp10-debuginfo-6.1.2-4.9.1 libgmpxx4-6.1.2-4.9.1 libgmpxx4-debuginfo-6.1.2-4.9.1 - openSUSE Leap 15.3 (x86_64): gmp-devel-32bit-6.1.2-4.9.1 libgmp10-32bit-6.1.2-4.9.1 libgmp10-32bit-debuginfo-6.1.2-4.9.1 libgmpxx4-32bit-6.1.2-4.9.1 libgmpxx4-32bit-debuginfo-6.1.2-4.9.1 References: https://www.suse.com/security/cve/CVE-2021-43618.html https://bugzilla.suse.com/1192717

1 0

openSUSE-SU-2021:1544-1: moderate: Security update for aaa_base
by opensuse-security＠opensuse.org 06 Dec '21

06 Dec '21

openSUSE Security Update: Security update for aaa_base ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1544-1 Rating: moderate References: #1162581 #1174504 #1191563 #1192248 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for aaa_base fixes the following issues: - Allowed ping and ICMP commands without CAP_NET_RAW (bsc#1174504). - Add $HOME/.local/bin to PATH, if it exists (bsc#1192248). - Fixed get_kernel_version.c to work also for recent kernels on the s390/X platform (bsc#1191563). - Support xz compressed kernel (bsc#1162581) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1544=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): aaa_base-84.87+git20180409.04c9dae-lp152.14.10.1 aaa_base-debuginfo-84.87+git20180409.04c9dae-lp152.14.10.1 aaa_base-debugsource-84.87+git20180409.04c9dae-lp152.14.10.1 aaa_base-extras-84.87+git20180409.04c9dae-lp152.14.10.1 aaa_base-malloccheck-84.87+git20180409.04c9dae-lp152.14.10.1 aaa_base-wsl-84.87+git20180409.04c9dae-lp152.14.10.1 References: https://bugzilla.suse.com/1162581 https://bugzilla.suse.com/1174504 https://bugzilla.suse.com/1191563 https://bugzilla.suse.com/1192248

1 0

openSUSE-SU-2021:3940-1: important: Security update for nodejs12
by opensuse-security＠opensuse.org 06 Dec '21

06 Dec '21

openSUSE Security Update: Security update for nodejs12 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3940-1 Rating: important References: #1190053 #1190054 #1190055 #1190056 #1190057 #1191601 #1191602 Cross-References: CVE-2021-22959 CVE-2021-22960 CVE-2021-37701 CVE-2021-37712 CVE-2021-37713 CVE-2021-39134 CVE-2021-39135 CVSS scores: CVE-2021-22959 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2021-22959 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-22960 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-37701 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVE-2021-37701 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-37712 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVE-2021-37712 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-39134 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVE-2021-39134 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-39135 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for nodejs12 fixes the following issues: - CVE-2021-22959: Fixed HTTP Request Smuggling due to spaced in headers (bsc#1191601). - CVE-2021-22960: Fixed HTTP Request Smuggling when parsing the body (bsc#1191602). - CVE-2021-37701: Fixed arbitrary file creation and overwrite in nodejs-tar (bsc#1190057). - CVE-2021-37712: Fixed arbitrary file creation and overwrite in nodejs-tar (bsc#1190056). - CVE-2021-37713: Fixed arbitrary code execution and file creation and overwrite in nodejs-tar (bsc#1190055). - CVE-2021-39134: Fixed symling following vulnerability in nodejs-arborist (bsc#1190054). - CVE-2021-39135: Fixed symling following vulnerability in nodejs-arborist (bsc#1190053). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3940=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): nodejs12-12.22.7-4.22.1 nodejs12-debuginfo-12.22.7-4.22.1 nodejs12-debugsource-12.22.7-4.22.1 nodejs12-devel-12.22.7-4.22.1 npm12-12.22.7-4.22.1 - openSUSE Leap 15.3 (noarch): nodejs12-docs-12.22.7-4.22.1 References: https://www.suse.com/security/cve/CVE-2021-22959.html https://www.suse.com/security/cve/CVE-2021-22960.html https://www.suse.com/security/cve/CVE-2021-37701.html https://www.suse.com/security/cve/CVE-2021-37712.html https://www.suse.com/security/cve/CVE-2021-37713.html https://www.suse.com/security/cve/CVE-2021-39134.html https://www.suse.com/security/cve/CVE-2021-39135.html https://bugzilla.suse.com/1190053 https://bugzilla.suse.com/1190054 https://bugzilla.suse.com/1190055 https://bugzilla.suse.com/1190056 https://bugzilla.suse.com/1190057 https://bugzilla.suse.com/1191601 https://bugzilla.suse.com/1191602

1 0