openSUSE Security Announce February 2021

security-announce@lists.opensuse.org

2 participants
53 discussions

openSUSE-SU-2021:0356-1: important: Security update for nodejs14
by opensuse-security＠opensuse.org 27 Feb '21

27 Feb '21

openSUSE Security Update: Security update for nodejs14 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0356-1 Rating: important References: #1182619 #1182620 Cross-References: CVE-2021-22883 CVE-2021-22884 CVSS scores: CVE-2021-22883 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-22884 (SUSE): 5.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for nodejs14 fixes the following issues: - New upstream LTS version 14.16.0: * CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion (bsc#1182619) * CVE-2021-22884: DNS rebinding in --inspect (bsc#1182620) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-356=1 Package List: - openSUSE Leap 15.2 (noarch): nodejs14-docs-14.16.0-lp152.8.1 - openSUSE Leap 15.2 (x86_64): nodejs14-14.16.0-lp152.8.1 nodejs14-debuginfo-14.16.0-lp152.8.1 nodejs14-debugsource-14.16.0-lp152.8.1 nodejs14-devel-14.16.0-lp152.8.1 npm14-14.16.0-lp152.8.1 References: https://www.suse.com/security/cve/CVE-2021-22883.html https://www.suse.com/security/cve/CVE-2021-22884.html https://bugzilla.suse.com/1182619 https://bugzilla.suse.com/1182620

1 0

openSUSE-SU-2021:0357-1: important: Security update for nodejs12
by opensuse-security＠opensuse.org 27 Feb '21

27 Feb '21

openSUSE Security Update: Security update for nodejs12 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0357-1 Rating: important References: #1182333 #1182619 #1182620 Cross-References: CVE-2021-22883 CVE-2021-22884 CVE-2021-23840 CVSS scores: CVE-2021-22883 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-22884 (SUSE): 5.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L CVE-2021-23840 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-23840 (SUSE): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for nodejs12 fixes the following issues: New upstream LTS version 12.21.0: - CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion (bsc#1182619) - CVE-2021-22884: DNS rebinding in --inspect (bsc#1182620) - CVE-2021-23840: OpenSSL - Integer overflow in CipherUpdate (bsc#1182333) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-357=1 Package List: - openSUSE Leap 15.2 (noarch): nodejs12-docs-12.21.0-lp152.3.12.1 - openSUSE Leap 15.2 (x86_64): nodejs12-12.21.0-lp152.3.12.1 nodejs12-debuginfo-12.21.0-lp152.3.12.1 nodejs12-debugsource-12.21.0-lp152.3.12.1 nodejs12-devel-12.21.0-lp152.3.12.1 npm12-12.21.0-lp152.3.12.1 References: https://www.suse.com/security/cve/CVE-2021-22883.html https://www.suse.com/security/cve/CVE-2021-22884.html https://www.suse.com/security/cve/CVE-2021-23840.html https://bugzilla.suse.com/1182333 https://bugzilla.suse.com/1182619 https://bugzilla.suse.com/1182620

1 0

openSUSE-SU-2021:0358-1: important: Security update for glibc
by opensuse-security＠opensuse.org 27 Feb '21

27 Feb '21

openSUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0358-1 Rating: important References: #1178386 #1179694 #1179721 #1180038 #1181505 #1182117 Cross-References: CVE-2019-25013 CVE-2020-27618 CVE-2020-29562 CVE-2020-29573 CVE-2021-3326 CVSS scores: CVE-2019-25013 (NVD) : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-25013 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-27618 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2020-29562 (NVD) : 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H CVE-2020-29562 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2020-29573 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-29573 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-3326 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-3326 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has one errata is now available. Description: This update for glibc fixes the following issues: - Fix buffer overrun in EUC-KR conversion module (CVE-2019-25013, bsc#1182117, BZ #24973) - x86: Harden printf against non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649) - gconv: Fix assertion failure in ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256) - iconv: Accept redundant shift sequences in IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224) - iconv: Fix incorrect UCS4 inner loop bounds (CVE-2020-29562, bsc#1179694, BZ #26923) - Fix parsing of /sys/devices/system/cpu/online (bsc#1180038, BZ #25859) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-358=1 Package List: - openSUSE Leap 15.2 (i586 i686 x86_64): glibc-2.26-lp152.26.6.1 glibc-debuginfo-2.26-lp152.26.6.1 glibc-debugsource-2.26-lp152.26.6.1 glibc-devel-2.26-lp152.26.6.1 glibc-devel-debuginfo-2.26-lp152.26.6.1 glibc-devel-static-2.26-lp152.26.6.1 glibc-locale-2.26-lp152.26.6.1 glibc-locale-base-2.26-lp152.26.6.1 glibc-locale-base-debuginfo-2.26-lp152.26.6.1 glibc-profile-2.26-lp152.26.6.1 - openSUSE Leap 15.2 (i586 x86_64): glibc-extra-2.26-lp152.26.6.1 glibc-extra-debuginfo-2.26-lp152.26.6.1 glibc-utils-2.26-lp152.26.6.1 glibc-utils-debuginfo-2.26-lp152.26.6.1 glibc-utils-src-debugsource-2.26-lp152.26.6.1 nscd-2.26-lp152.26.6.1 nscd-debuginfo-2.26-lp152.26.6.1 - openSUSE Leap 15.2 (x86_64): glibc-32bit-2.26-lp152.26.6.1 glibc-32bit-debuginfo-2.26-lp152.26.6.1 glibc-devel-32bit-2.26-lp152.26.6.1 glibc-devel-32bit-debuginfo-2.26-lp152.26.6.1 glibc-devel-static-32bit-2.26-lp152.26.6.1 glibc-locale-base-32bit-2.26-lp152.26.6.1 glibc-locale-base-32bit-debuginfo-2.26-lp152.26.6.1 glibc-profile-32bit-2.26-lp152.26.6.1 glibc-utils-32bit-2.26-lp152.26.6.1 glibc-utils-32bit-debuginfo-2.26-lp152.26.6.1 - openSUSE Leap 15.2 (noarch): glibc-html-2.26-lp152.26.6.1 glibc-i18ndata-2.26-lp152.26.6.1 glibc-info-2.26-lp152.26.6.1 References: https://www.suse.com/security/cve/CVE-2019-25013.html https://www.suse.com/security/cve/CVE-2020-27618.html https://www.suse.com/security/cve/CVE-2020-29562.html https://www.suse.com/security/cve/CVE-2020-29573.html https://www.suse.com/security/cve/CVE-2021-3326.html https://bugzilla.suse.com/1178386 https://bugzilla.suse.com/1179694 https://bugzilla.suse.com/1179721 https://bugzilla.suse.com/1180038 https://bugzilla.suse.com/1181505 https://bugzilla.suse.com/1182117

1 0

openSUSE-SU-2021:0349-1: important: Security update for python-cryptography
by opensuse-security＠opensuse.org 26 Feb '21

26 Feb '21

openSUSE Security Update: Security update for python-cryptography ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0349-1 Rating: important References: #1182066 Cross-References: CVE-2020-36242 CVSS scores: CVE-2020-36242 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVE-2020-36242 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-cryptography fixes the following issues: - CVE-2020-36242: Using the Fernet class to symmetrically encrypt multi gigabyte values could result in an integer overflow and buffer overflow (bsc#1182066). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-349=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): python-cryptography-debuginfo-2.8-lp152.2.6.1 python-cryptography-debugsource-2.8-lp152.2.6.1 python2-cryptography-2.8-lp152.2.6.1 python2-cryptography-debuginfo-2.8-lp152.2.6.1 python3-cryptography-2.8-lp152.2.6.1 python3-cryptography-debuginfo-2.8-lp152.2.6.1 References: https://www.suse.com/security/cve/CVE-2020-36242.html https://bugzilla.suse.com/1182066

1 0

openSUSE-SU-2021:0348-1: moderate: Security update for pcp
by opensuse-security＠opensuse.org 26 Feb '21

26 Feb '21

openSUSE Security Update: Security update for pcp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0348-1 Rating: moderate References: #1152533 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for pcp fixes the following issues: - Drop unnecessary %pre/%post recursive chown calls (bsc#1152533) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-348=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libpcp-devel-4.3.1-lp152.5.3.1 libpcp3-4.3.1-lp152.5.3.1 libpcp3-debuginfo-4.3.1-lp152.5.3.1 libpcp_gui2-4.3.1-lp152.5.3.1 libpcp_gui2-debuginfo-4.3.1-lp152.5.3.1 libpcp_import1-4.3.1-lp152.5.3.1 libpcp_import1-debuginfo-4.3.1-lp152.5.3.1 libpcp_mmv1-4.3.1-lp152.5.3.1 libpcp_mmv1-debuginfo-4.3.1-lp152.5.3.1 libpcp_trace2-4.3.1-lp152.5.3.1 libpcp_trace2-debuginfo-4.3.1-lp152.5.3.1 libpcp_web1-4.3.1-lp152.5.3.1 libpcp_web1-debuginfo-4.3.1-lp152.5.3.1 pcp-4.3.1-lp152.5.3.1 pcp-conf-4.3.1-lp152.5.3.1 pcp-debuginfo-4.3.1-lp152.5.3.1 pcp-debugsource-4.3.1-lp152.5.3.1 pcp-devel-4.3.1-lp152.5.3.1 pcp-devel-debuginfo-4.3.1-lp152.5.3.1 pcp-export-pcp2elasticsearch-4.3.1-lp152.5.3.1 pcp-export-pcp2graphite-4.3.1-lp152.5.3.1 pcp-export-pcp2influxdb-4.3.1-lp152.5.3.1 pcp-export-pcp2json-4.3.1-lp152.5.3.1 pcp-export-pcp2spark-4.3.1-lp152.5.3.1 pcp-export-pcp2xml-4.3.1-lp152.5.3.1 pcp-export-pcp2zabbix-4.3.1-lp152.5.3.1 pcp-export-zabbix-agent-4.3.1-lp152.5.3.1 pcp-export-zabbix-agent-debuginfo-4.3.1-lp152.5.3.1 pcp-gui-4.3.1-lp152.5.3.1 pcp-gui-debuginfo-4.3.1-lp152.5.3.1 pcp-import-collectl2pcp-4.3.1-lp152.5.3.1 pcp-import-collectl2pcp-debuginfo-4.3.1-lp152.5.3.1 pcp-import-ganglia2pcp-4.3.1-lp152.5.3.1 pcp-import-iostat2pcp-4.3.1-lp152.5.3.1 pcp-import-mrtg2pcp-4.3.1-lp152.5.3.1 pcp-import-sar2pcp-4.3.1-lp152.5.3.1 pcp-manager-4.3.1-lp152.5.3.1 pcp-manager-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-activemq-4.3.1-lp152.5.3.1 pcp-pmda-apache-4.3.1-lp152.5.3.1 pcp-pmda-apache-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-bash-4.3.1-lp152.5.3.1 pcp-pmda-bash-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-bind2-4.3.1-lp152.5.3.1 pcp-pmda-bonding-4.3.1-lp152.5.3.1 pcp-pmda-cifs-4.3.1-lp152.5.3.1 pcp-pmda-cifs-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-cisco-4.3.1-lp152.5.3.1 pcp-pmda-cisco-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-dbping-4.3.1-lp152.5.3.1 pcp-pmda-dm-4.3.1-lp152.5.3.1 pcp-pmda-dm-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-docker-4.3.1-lp152.5.3.1 pcp-pmda-docker-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-ds389-4.3.1-lp152.5.3.1 pcp-pmda-ds389log-4.3.1-lp152.5.3.1 pcp-pmda-elasticsearch-4.3.1-lp152.5.3.1 pcp-pmda-gfs2-4.3.1-lp152.5.3.1 pcp-pmda-gfs2-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-gluster-4.3.1-lp152.5.3.1 pcp-pmda-gpfs-4.3.1-lp152.5.3.1 pcp-pmda-gpsd-4.3.1-lp152.5.3.1 pcp-pmda-haproxy-4.3.1-lp152.5.3.1 pcp-pmda-infiniband-4.3.1-lp152.5.3.1 pcp-pmda-infiniband-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-json-4.3.1-lp152.5.3.1 pcp-pmda-lmsensors-4.3.1-lp152.5.3.1 pcp-pmda-logger-4.3.1-lp152.5.3.1 pcp-pmda-logger-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-lustre-4.3.1-lp152.5.3.1 pcp-pmda-lustrecomm-4.3.1-lp152.5.3.1 pcp-pmda-lustrecomm-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-mailq-4.3.1-lp152.5.3.1 pcp-pmda-mailq-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-memcache-4.3.1-lp152.5.3.1 pcp-pmda-mic-4.3.1-lp152.5.3.1 pcp-pmda-mounts-4.3.1-lp152.5.3.1 pcp-pmda-mounts-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-mysql-4.3.1-lp152.5.3.1 pcp-pmda-named-4.3.1-lp152.5.3.1 pcp-pmda-netfilter-4.3.1-lp152.5.3.1 pcp-pmda-news-4.3.1-lp152.5.3.1 pcp-pmda-nfsclient-4.3.1-lp152.5.3.1 pcp-pmda-nginx-4.3.1-lp152.5.3.1 pcp-pmda-nutcracker-4.3.1-lp152.5.3.1 pcp-pmda-nvidia-gpu-4.3.1-lp152.5.3.1 pcp-pmda-nvidia-gpu-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-oracle-4.3.1-lp152.5.3.1 pcp-pmda-papi-4.3.1-lp152.5.3.1 pcp-pmda-papi-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-pdns-4.3.1-lp152.5.3.1 pcp-pmda-perfevent-4.3.1-lp152.5.3.1 pcp-pmda-perfevent-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-postfix-4.3.1-lp152.5.3.1 pcp-pmda-prometheus-4.3.1-lp152.5.3.1 pcp-pmda-redis-4.3.1-lp152.5.3.1 pcp-pmda-roomtemp-4.3.1-lp152.5.3.1 pcp-pmda-roomtemp-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-rpm-4.3.1-lp152.5.3.1 pcp-pmda-rpm-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-rsyslog-4.3.1-lp152.5.3.1 pcp-pmda-samba-4.3.1-lp152.5.3.1 pcp-pmda-sendmail-4.3.1-lp152.5.3.1 pcp-pmda-sendmail-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-shping-4.3.1-lp152.5.3.1 pcp-pmda-shping-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-slurm-4.3.1-lp152.5.3.1 pcp-pmda-smart-4.3.1-lp152.5.3.1 pcp-pmda-smart-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-snmp-4.3.1-lp152.5.3.1 pcp-pmda-summary-4.3.1-lp152.5.3.1 pcp-pmda-summary-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-systemd-4.3.1-lp152.5.3.1 pcp-pmda-systemd-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-trace-4.3.1-lp152.5.3.1 pcp-pmda-trace-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-unbound-4.3.1-lp152.5.3.1 pcp-pmda-vmware-4.3.1-lp152.5.3.1 pcp-pmda-weblog-4.3.1-lp152.5.3.1 pcp-pmda-weblog-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-zimbra-4.3.1-lp152.5.3.1 pcp-pmda-zswap-4.3.1-lp152.5.3.1 pcp-system-tools-4.3.1-lp152.5.3.1 pcp-system-tools-debuginfo-4.3.1-lp152.5.3.1 pcp-testsuite-4.3.1-lp152.5.3.1 pcp-testsuite-debuginfo-4.3.1-lp152.5.3.1 pcp-webapi-4.3.1-lp152.5.3.1 pcp-webapi-debuginfo-4.3.1-lp152.5.3.1 pcp-zeroconf-4.3.1-lp152.5.3.1 perl-PCP-LogImport-4.3.1-lp152.5.3.1 perl-PCP-LogImport-debuginfo-4.3.1-lp152.5.3.1 perl-PCP-LogSummary-4.3.1-lp152.5.3.1 perl-PCP-MMV-4.3.1-lp152.5.3.1 perl-PCP-MMV-debuginfo-4.3.1-lp152.5.3.1 perl-PCP-PMDA-4.3.1-lp152.5.3.1 perl-PCP-PMDA-debuginfo-4.3.1-lp152.5.3.1 python3-pcp-4.3.1-lp152.5.3.1 python3-pcp-debuginfo-4.3.1-lp152.5.3.1 - openSUSE Leap 15.2 (noarch): pcp-doc-4.3.1-lp152.5.3.1 References: https://bugzilla.suse.com/1152533

1 0

openSUSE-SU-2021:0347-1: critical: Security update for salt
by opensuse-security＠opensuse.org 26 Feb '21

26 Feb '21

openSUSE Security Update: Security update for salt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0347-1 Rating: critical References: #1181550 #1181556 #1181557 #1181558 #1181559 #1181560 #1181561 #1181562 #1181563 #1181564 #1181565 #1182740 Cross-References: CVE-2020-28243 CVE-2020-28972 CVE-2020-35662 CVE-2021-25281 CVE-2021-25282 CVE-2021-25283 CVE-2021-25284 CVE-2021-3144 CVE-2021-3148 CVE-2021-3197 CVSS scores: CVE-2020-28243 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2020-28972 (SUSE): 7.3 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVE-2020-35662 (SUSE): 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L CVE-2021-25281 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-25282 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-25283 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-25284 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-3144 (SUSE): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2021-3148 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-3197 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves 10 vulnerabilities and has two fixes is now available. Description: This update for salt fixes the following issues: - Fix regression on cmd.run when passing tuples as cmd (bsc#1182740) - Allow `extra_filerefs` as sanitized `kwargs` for SSH client - Fix errors with virt.update - Fix for multiple for security issues (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144) (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197) (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560) (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565) - virt: search for `grub.xen` path - Xen spicevmc, DNS SRV records backports: - Fix virtual network generated DNS XML for SRV records - Don't add spicevmc channel to xen VMs - virt UEFI fix: virt.update when `efi=True` This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-347=1 Package List: - openSUSE Leap 15.2 (noarch): salt-bash-completion-3000-lp152.3.27.1 salt-fish-completion-3000-lp152.3.27.1 salt-zsh-completion-3000-lp152.3.27.1 - openSUSE Leap 15.2 (x86_64): python2-salt-3000-lp152.3.27.1 python3-salt-3000-lp152.3.27.1 salt-3000-lp152.3.27.1 salt-api-3000-lp152.3.27.1 salt-cloud-3000-lp152.3.27.1 salt-doc-3000-lp152.3.27.1 salt-master-3000-lp152.3.27.1 salt-minion-3000-lp152.3.27.1 salt-proxy-3000-lp152.3.27.1 salt-ssh-3000-lp152.3.27.1 salt-standalone-formulas-configuration-3000-lp152.3.27.1 salt-syndic-3000-lp152.3.27.1 References: https://www.suse.com/security/cve/CVE-2020-28243.html https://www.suse.com/security/cve/CVE-2020-28972.html https://www.suse.com/security/cve/CVE-2020-35662.html https://www.suse.com/security/cve/CVE-2021-25281.html https://www.suse.com/security/cve/CVE-2021-25282.html https://www.suse.com/security/cve/CVE-2021-25283.html https://www.suse.com/security/cve/CVE-2021-25284.html https://www.suse.com/security/cve/CVE-2021-3144.html https://www.suse.com/security/cve/CVE-2021-3148.html https://www.suse.com/security/cve/CVE-2021-3197.html https://bugzilla.suse.com/1181550 https://bugzilla.suse.com/1181556 https://bugzilla.suse.com/1181557 https://bugzilla.suse.com/1181558 https://bugzilla.suse.com/1181559 https://bugzilla.suse.com/1181560 https://bugzilla.suse.com/1181561 https://bugzilla.suse.com/1181562 https://bugzilla.suse.com/1181563 https://bugzilla.suse.com/1181564 https://bugzilla.suse.com/1181565 https://bugzilla.suse.com/1182740

1 0

openSUSE-SU-2021:0345-1: moderate: Security update for gnuplot
by opensuse-security＠opensuse.org 26 Feb '21

26 Feb '21

openSUSE Security Update: Security update for gnuplot ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0345-1 Rating: moderate References: #1176689 Cross-References: CVE-2020-25559 CVSS scores: CVE-2020-25559 (SUSE): 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gnuplot fixes the following issues: - CVE-2020-25559: Fixed double free when executing print_set_output() (bsc#1176689). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-345=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): gnuplot-5.2.2-lp152.6.3.1 gnuplot-debuginfo-5.2.2-lp152.6.3.1 gnuplot-debugsource-5.2.2-lp152.6.3.1 - openSUSE Leap 15.2 (noarch): gnuplot-doc-5.2.2-lp152.6.3.1 References: https://www.suse.com/security/cve/CVE-2020-25559.html https://bugzilla.suse.com/1176689

1 0

openSUSE-SU-2021:0341-1: moderate: Security update for nghttp2
by opensuse-security＠opensuse.org 25 Feb '21

25 Feb '21

openSUSE Security Update: Security update for nghttp2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0341-1 Rating: moderate References: #1159003 #1166481 Cross-References: CVE-2019-18802 CVSS scores: CVE-2019-18802 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-18802 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for nghttp2 fixes the following issues: nghttp2 was update to version 1.40.0 (bsc#1166481) - lib: Add nghttp2_check_authority as public API - lib: Fix the bug that stream is closed with wrong error code - lib: Faster huffman encoding and decoding - build: Avoid filename collision of static and dynamic lib - build: Add new flag ENABLE_STATIC_CRT for Windows - build: cmake: Support building nghttpx with systemd - third-party: Update neverbleed to fix memory leak - nghttpx: Fix bug that mruby is incorrectly shared between backends - nghttpx: Reconnect h1 backend if it lost connection before sending headers - nghttpx: Returns 408 if backend timed out before sending headers - nghttpx: Fix request stal This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-341=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libnghttp2-14-1.40.0-lp152.2.3.1 libnghttp2-14-debuginfo-1.40.0-lp152.2.3.1 libnghttp2-devel-1.40.0-lp152.2.3.1 libnghttp2_asio-devel-1.40.0-lp152.2.3.1 libnghttp2_asio1-1.40.0-lp152.2.3.1 libnghttp2_asio1-debuginfo-1.40.0-lp152.2.3.1 nghttp2-1.40.0-lp152.2.3.1 nghttp2-debuginfo-1.40.0-lp152.2.3.1 nghttp2-debugsource-1.40.0-lp152.2.3.1 nghttp2-python-debugsource-1.40.0-lp152.2.3.1 python3-nghttp2-1.40.0-lp152.2.3.1 python3-nghttp2-debuginfo-1.40.0-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): libnghttp2-14-32bit-1.40.0-lp152.2.3.1 libnghttp2-14-32bit-debuginfo-1.40.0-lp152.2.3.1 libnghttp2_asio1-32bit-1.40.0-lp152.2.3.1 libnghttp2_asio1-32bit-debuginfo-1.40.0-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-18802.html https://bugzilla.suse.com/1159003 https://bugzilla.suse.com/1166481

1 0

openSUSE-SU-2021:0338-1: important: Security update for python-djangorestframework
by opensuse-security＠opensuse.org 25 Feb '21

25 Feb '21

openSUSE Security Update: Security update for python-djangorestframework ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0338-1 Rating: important References: #1177205 Cross-References: CVE-2020-25626 CVSS scores: CVE-2020-25626 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2020-25626 (SUSE): 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-djangorestframework fixes the following issues: Update to 3.11.2 * Security: Drop urlize_quoted_links template tag in favour of Django's built-in urlize. Removes a XSS vulnerability for some kinds of content in the browsable API. (boo#1177205, CVE-2020-25626) * update Django for APIs book to 3.0 edition * decode base64 credentials as utf8; adjust tests * Remove compat urls for Django < 2.0 This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-338=1 Package List: - openSUSE Backports SLE-15-SP2 (noarch): python3-djangorestframework-3.11.2-bp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-25626.html https://bugzilla.suse.com/1177205

1 0

openSUSE-SU-2021:0337-1: moderate: Security update for postgresql, postgresql13
by opensuse-security＠opensuse.org 24 Feb '21

24 Feb '21

openSUSE Security Update: Security update for postgresql, postgresql13 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0337-1 Rating: moderate References: #1178666 #1178667 #1178668 #1178961 Cross-References: CVE-2020-25694 CVE-2020-25695 CVE-2020-25696 CVSS scores: CVE-2020-25694 (NVD) : 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2020-25694 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2020-25695 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2020-25695 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2020-25696 (NVD) : 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-25696 (SUSE): 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for postgresql, postgresql13 fixes the following issues: This update ships postgresql13. Upgrade to version 13.1: * CVE-2020-25695, bsc#1178666: Block DECLARE CURSOR ... WITH HOLD and firing of deferred triggers within index expressions and materialized view queries. * CVE-2020-25694, bsc#1178667: a) Fix usage of complex connection-string parameters in pg_dump, pg_restore, clusterdb, reindexdb, and vacuumdb. b) When psql's \connect command re-uses connection parameters, ensure that all non-overridden parameters from a previous connection string are re-used. * CVE-2020-25696, bsc#1178668: Prevent psql's \gset command from modifying specially-treated variables. * Fix recently-added timetz test case so it works when the USA is not observing daylight savings time. (obsoletes postgresql-timetz.patch) * https://www.postgresql.org/about/news/2111/ * https://www.postgresql.org/docs/13/release-13-1.html Initial packaging of PostgreSQL 13: * https://www.postgresql.org/about/news/2077/ * https://www.postgresql.org/docs/13/release-13.html - bsc#1178961: %ghost the symlinks to pg_config and ecpg. Changes in postgresql wrapper package: - Bump major version to 13. - We also transfer PostgreSQL 9.4.26 to the new package layout in SLE12-SP2 and newer. Reflect this in the conflict with postgresql94. - Also conflict with PostgreSQL versions before 9. - Conflicting with older versions is not limited to SLE. This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-337=1 Package List: - openSUSE Leap 15.2 (noarch): postgresql-13-lp152.3.6.1 postgresql-contrib-13-lp152.3.6.1 postgresql-devel-13-lp152.3.6.1 postgresql-docs-13-lp152.3.6.1 postgresql-llvmjit-13-lp152.3.6.1 postgresql-plperl-13-lp152.3.6.1 postgresql-plpython-13-lp152.3.6.1 postgresql-pltcl-13-lp152.3.6.1 postgresql-server-13-lp152.3.6.1 postgresql-server-devel-13-lp152.3.6.1 postgresql-test-13-lp152.3.6.1 References: https://www.suse.com/security/cve/CVE-2020-25694.html https://www.suse.com/security/cve/CVE-2020-25695.html https://www.suse.com/security/cve/CVE-2020-25696.html https://bugzilla.suse.com/1178666 https://bugzilla.suse.com/1178667 https://bugzilla.suse.com/1178668 https://bugzilla.suse.com/1178961

1 0

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

openSUSE Security Announce February 2021