February 2021 - openSUSE Security Announce

openSUSE-SU-2021:0356-1: important: Security update for nodejs14
by opensuse-security＠opensuse.org 28 Feb '21

28 Feb '21

openSUSE Security Update: Security update for nodejs14 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0356-1 Rating: important References: #1182619 #1182620 Cross-References: CVE-2021-22883 CVE-2021-22884 CVSS scores: CVE-2021-22883 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-22884 (SUSE): 5.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for nodejs14 fixes the following issues: - New upstream LTS version 14.16.0: * CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion (bsc#1182619) * CVE-2021-22884: DNS rebinding in --inspect (bsc#1182620) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-356=1 Package List: - openSUSE Leap 15.2 (noarch): nodejs14-docs-14.16.0-lp152.8.1 - openSUSE Leap 15.2 (x86_64): nodejs14-14.16.0-lp152.8.1 nodejs14-debuginfo-14.16.0-lp152.8.1 nodejs14-debugsource-14.16.0-lp152.8.1 nodejs14-devel-14.16.0-lp152.8.1 npm14-14.16.0-lp152.8.1 References: https://www.suse.com/security/cve/CVE-2021-22883.html https://www.suse.com/security/cve/CVE-2021-22884.html https://bugzilla.suse.com/1182619 https://bugzilla.suse.com/1182620

1 0

openSUSE-SU-2021:0357-1: important: Security update for nodejs12
by opensuse-security＠opensuse.org 28 Feb '21

28 Feb '21

openSUSE Security Update: Security update for nodejs12 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0357-1 Rating: important References: #1182333 #1182619 #1182620 Cross-References: CVE-2021-22883 CVE-2021-22884 CVE-2021-23840 CVSS scores: CVE-2021-22883 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-22884 (SUSE): 5.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L CVE-2021-23840 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-23840 (SUSE): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for nodejs12 fixes the following issues: New upstream LTS version 12.21.0: - CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion (bsc#1182619) - CVE-2021-22884: DNS rebinding in --inspect (bsc#1182620) - CVE-2021-23840: OpenSSL - Integer overflow in CipherUpdate (bsc#1182333) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-357=1 Package List: - openSUSE Leap 15.2 (noarch): nodejs12-docs-12.21.0-lp152.3.12.1 - openSUSE Leap 15.2 (x86_64): nodejs12-12.21.0-lp152.3.12.1 nodejs12-debuginfo-12.21.0-lp152.3.12.1 nodejs12-debugsource-12.21.0-lp152.3.12.1 nodejs12-devel-12.21.0-lp152.3.12.1 npm12-12.21.0-lp152.3.12.1 References: https://www.suse.com/security/cve/CVE-2021-22883.html https://www.suse.com/security/cve/CVE-2021-22884.html https://www.suse.com/security/cve/CVE-2021-23840.html https://bugzilla.suse.com/1182333 https://bugzilla.suse.com/1182619 https://bugzilla.suse.com/1182620

1 0

openSUSE-SU-2021:0358-1: important: Security update for glibc
by opensuse-security＠opensuse.org 28 Feb '21

28 Feb '21

openSUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0358-1 Rating: important References: #1178386 #1179694 #1179721 #1180038 #1181505 #1182117 Cross-References: CVE-2019-25013 CVE-2020-27618 CVE-2020-29562 CVE-2020-29573 CVE-2021-3326 CVSS scores: CVE-2019-25013 (NVD) : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-25013 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-27618 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2020-29562 (NVD) : 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H CVE-2020-29562 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2020-29573 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-29573 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-3326 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-3326 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has one errata is now available. Description: This update for glibc fixes the following issues: - Fix buffer overrun in EUC-KR conversion module (CVE-2019-25013, bsc#1182117, BZ #24973) - x86: Harden printf against non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649) - gconv: Fix assertion failure in ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256) - iconv: Accept redundant shift sequences in IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224) - iconv: Fix incorrect UCS4 inner loop bounds (CVE-2020-29562, bsc#1179694, BZ #26923) - Fix parsing of /sys/devices/system/cpu/online (bsc#1180038, BZ #25859) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-358=1 Package List: - openSUSE Leap 15.2 (i586 i686 x86_64): glibc-2.26-lp152.26.6.1 glibc-debuginfo-2.26-lp152.26.6.1 glibc-debugsource-2.26-lp152.26.6.1 glibc-devel-2.26-lp152.26.6.1 glibc-devel-debuginfo-2.26-lp152.26.6.1 glibc-devel-static-2.26-lp152.26.6.1 glibc-locale-2.26-lp152.26.6.1 glibc-locale-base-2.26-lp152.26.6.1 glibc-locale-base-debuginfo-2.26-lp152.26.6.1 glibc-profile-2.26-lp152.26.6.1 - openSUSE Leap 15.2 (i586 x86_64): glibc-extra-2.26-lp152.26.6.1 glibc-extra-debuginfo-2.26-lp152.26.6.1 glibc-utils-2.26-lp152.26.6.1 glibc-utils-debuginfo-2.26-lp152.26.6.1 glibc-utils-src-debugsource-2.26-lp152.26.6.1 nscd-2.26-lp152.26.6.1 nscd-debuginfo-2.26-lp152.26.6.1 - openSUSE Leap 15.2 (x86_64): glibc-32bit-2.26-lp152.26.6.1 glibc-32bit-debuginfo-2.26-lp152.26.6.1 glibc-devel-32bit-2.26-lp152.26.6.1 glibc-devel-32bit-debuginfo-2.26-lp152.26.6.1 glibc-devel-static-32bit-2.26-lp152.26.6.1 glibc-locale-base-32bit-2.26-lp152.26.6.1 glibc-locale-base-32bit-debuginfo-2.26-lp152.26.6.1 glibc-profile-32bit-2.26-lp152.26.6.1 glibc-utils-32bit-2.26-lp152.26.6.1 glibc-utils-32bit-debuginfo-2.26-lp152.26.6.1 - openSUSE Leap 15.2 (noarch): glibc-html-2.26-lp152.26.6.1 glibc-i18ndata-2.26-lp152.26.6.1 glibc-info-2.26-lp152.26.6.1 References: https://www.suse.com/security/cve/CVE-2019-25013.html https://www.suse.com/security/cve/CVE-2020-27618.html https://www.suse.com/security/cve/CVE-2020-29562.html https://www.suse.com/security/cve/CVE-2020-29573.html https://www.suse.com/security/cve/CVE-2021-3326.html https://bugzilla.suse.com/1178386 https://bugzilla.suse.com/1179694 https://bugzilla.suse.com/1179721 https://bugzilla.suse.com/1180038 https://bugzilla.suse.com/1181505 https://bugzilla.suse.com/1182117

1 0

openSUSE-SU-2021:0349-1: important: Security update for python-cryptography
by opensuse-security＠opensuse.org 26 Feb '21

26 Feb '21

openSUSE Security Update: Security update for python-cryptography ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0349-1 Rating: important References: #1182066 Cross-References: CVE-2020-36242 CVSS scores: CVE-2020-36242 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVE-2020-36242 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-cryptography fixes the following issues: - CVE-2020-36242: Using the Fernet class to symmetrically encrypt multi gigabyte values could result in an integer overflow and buffer overflow (bsc#1182066). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-349=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): python-cryptography-debuginfo-2.8-lp152.2.6.1 python-cryptography-debugsource-2.8-lp152.2.6.1 python2-cryptography-2.8-lp152.2.6.1 python2-cryptography-debuginfo-2.8-lp152.2.6.1 python3-cryptography-2.8-lp152.2.6.1 python3-cryptography-debuginfo-2.8-lp152.2.6.1 References: https://www.suse.com/security/cve/CVE-2020-36242.html https://bugzilla.suse.com/1182066

1 0

openSUSE-SU-2021:0348-1: moderate: Security update for pcp
by opensuse-security＠opensuse.org 26 Feb '21

26 Feb '21

openSUSE Security Update: Security update for pcp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0348-1 Rating: moderate References: #1152533 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for pcp fixes the following issues: - Drop unnecessary %pre/%post recursive chown calls (bsc#1152533) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-348=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libpcp-devel-4.3.1-lp152.5.3.1 libpcp3-4.3.1-lp152.5.3.1 libpcp3-debuginfo-4.3.1-lp152.5.3.1 libpcp_gui2-4.3.1-lp152.5.3.1 libpcp_gui2-debuginfo-4.3.1-lp152.5.3.1 libpcp_import1-4.3.1-lp152.5.3.1 libpcp_import1-debuginfo-4.3.1-lp152.5.3.1 libpcp_mmv1-4.3.1-lp152.5.3.1 libpcp_mmv1-debuginfo-4.3.1-lp152.5.3.1 libpcp_trace2-4.3.1-lp152.5.3.1 libpcp_trace2-debuginfo-4.3.1-lp152.5.3.1 libpcp_web1-4.3.1-lp152.5.3.1 libpcp_web1-debuginfo-4.3.1-lp152.5.3.1 pcp-4.3.1-lp152.5.3.1 pcp-conf-4.3.1-lp152.5.3.1 pcp-debuginfo-4.3.1-lp152.5.3.1 pcp-debugsource-4.3.1-lp152.5.3.1 pcp-devel-4.3.1-lp152.5.3.1 pcp-devel-debuginfo-4.3.1-lp152.5.3.1 pcp-export-pcp2elasticsearch-4.3.1-lp152.5.3.1 pcp-export-pcp2graphite-4.3.1-lp152.5.3.1 pcp-export-pcp2influxdb-4.3.1-lp152.5.3.1 pcp-export-pcp2json-4.3.1-lp152.5.3.1 pcp-export-pcp2spark-4.3.1-lp152.5.3.1 pcp-export-pcp2xml-4.3.1-lp152.5.3.1 pcp-export-pcp2zabbix-4.3.1-lp152.5.3.1 pcp-export-zabbix-agent-4.3.1-lp152.5.3.1 pcp-export-zabbix-agent-debuginfo-4.3.1-lp152.5.3.1 pcp-gui-4.3.1-lp152.5.3.1 pcp-gui-debuginfo-4.3.1-lp152.5.3.1 pcp-import-collectl2pcp-4.3.1-lp152.5.3.1 pcp-import-collectl2pcp-debuginfo-4.3.1-lp152.5.3.1 pcp-import-ganglia2pcp-4.3.1-lp152.5.3.1 pcp-import-iostat2pcp-4.3.1-lp152.5.3.1 pcp-import-mrtg2pcp-4.3.1-lp152.5.3.1 pcp-import-sar2pcp-4.3.1-lp152.5.3.1 pcp-manager-4.3.1-lp152.5.3.1 pcp-manager-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-activemq-4.3.1-lp152.5.3.1 pcp-pmda-apache-4.3.1-lp152.5.3.1 pcp-pmda-apache-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-bash-4.3.1-lp152.5.3.1 pcp-pmda-bash-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-bind2-4.3.1-lp152.5.3.1 pcp-pmda-bonding-4.3.1-lp152.5.3.1 pcp-pmda-cifs-4.3.1-lp152.5.3.1 pcp-pmda-cifs-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-cisco-4.3.1-lp152.5.3.1 pcp-pmda-cisco-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-dbping-4.3.1-lp152.5.3.1 pcp-pmda-dm-4.3.1-lp152.5.3.1 pcp-pmda-dm-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-docker-4.3.1-lp152.5.3.1 pcp-pmda-docker-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-ds389-4.3.1-lp152.5.3.1 pcp-pmda-ds389log-4.3.1-lp152.5.3.1 pcp-pmda-elasticsearch-4.3.1-lp152.5.3.1 pcp-pmda-gfs2-4.3.1-lp152.5.3.1 pcp-pmda-gfs2-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-gluster-4.3.1-lp152.5.3.1 pcp-pmda-gpfs-4.3.1-lp152.5.3.1 pcp-pmda-gpsd-4.3.1-lp152.5.3.1 pcp-pmda-haproxy-4.3.1-lp152.5.3.1 pcp-pmda-infiniband-4.3.1-lp152.5.3.1 pcp-pmda-infiniband-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-json-4.3.1-lp152.5.3.1 pcp-pmda-lmsensors-4.3.1-lp152.5.3.1 pcp-pmda-logger-4.3.1-lp152.5.3.1 pcp-pmda-logger-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-lustre-4.3.1-lp152.5.3.1 pcp-pmda-lustrecomm-4.3.1-lp152.5.3.1 pcp-pmda-lustrecomm-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-mailq-4.3.1-lp152.5.3.1 pcp-pmda-mailq-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-memcache-4.3.1-lp152.5.3.1 pcp-pmda-mic-4.3.1-lp152.5.3.1 pcp-pmda-mounts-4.3.1-lp152.5.3.1 pcp-pmda-mounts-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-mysql-4.3.1-lp152.5.3.1 pcp-pmda-named-4.3.1-lp152.5.3.1 pcp-pmda-netfilter-4.3.1-lp152.5.3.1 pcp-pmda-news-4.3.1-lp152.5.3.1 pcp-pmda-nfsclient-4.3.1-lp152.5.3.1 pcp-pmda-nginx-4.3.1-lp152.5.3.1 pcp-pmda-nutcracker-4.3.1-lp152.5.3.1 pcp-pmda-nvidia-gpu-4.3.1-lp152.5.3.1 pcp-pmda-nvidia-gpu-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-oracle-4.3.1-lp152.5.3.1 pcp-pmda-papi-4.3.1-lp152.5.3.1 pcp-pmda-papi-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-pdns-4.3.1-lp152.5.3.1 pcp-pmda-perfevent-4.3.1-lp152.5.3.1 pcp-pmda-perfevent-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-postfix-4.3.1-lp152.5.3.1 pcp-pmda-prometheus-4.3.1-lp152.5.3.1 pcp-pmda-redis-4.3.1-lp152.5.3.1 pcp-pmda-roomtemp-4.3.1-lp152.5.3.1 pcp-pmda-roomtemp-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-rpm-4.3.1-lp152.5.3.1 pcp-pmda-rpm-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-rsyslog-4.3.1-lp152.5.3.1 pcp-pmda-samba-4.3.1-lp152.5.3.1 pcp-pmda-sendmail-4.3.1-lp152.5.3.1 pcp-pmda-sendmail-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-shping-4.3.1-lp152.5.3.1 pcp-pmda-shping-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-slurm-4.3.1-lp152.5.3.1 pcp-pmda-smart-4.3.1-lp152.5.3.1 pcp-pmda-smart-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-snmp-4.3.1-lp152.5.3.1 pcp-pmda-summary-4.3.1-lp152.5.3.1 pcp-pmda-summary-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-systemd-4.3.1-lp152.5.3.1 pcp-pmda-systemd-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-trace-4.3.1-lp152.5.3.1 pcp-pmda-trace-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-unbound-4.3.1-lp152.5.3.1 pcp-pmda-vmware-4.3.1-lp152.5.3.1 pcp-pmda-weblog-4.3.1-lp152.5.3.1 pcp-pmda-weblog-debuginfo-4.3.1-lp152.5.3.1 pcp-pmda-zimbra-4.3.1-lp152.5.3.1 pcp-pmda-zswap-4.3.1-lp152.5.3.1 pcp-system-tools-4.3.1-lp152.5.3.1 pcp-system-tools-debuginfo-4.3.1-lp152.5.3.1 pcp-testsuite-4.3.1-lp152.5.3.1 pcp-testsuite-debuginfo-4.3.1-lp152.5.3.1 pcp-webapi-4.3.1-lp152.5.3.1 pcp-webapi-debuginfo-4.3.1-lp152.5.3.1 pcp-zeroconf-4.3.1-lp152.5.3.1 perl-PCP-LogImport-4.3.1-lp152.5.3.1 perl-PCP-LogImport-debuginfo-4.3.1-lp152.5.3.1 perl-PCP-LogSummary-4.3.1-lp152.5.3.1 perl-PCP-MMV-4.3.1-lp152.5.3.1 perl-PCP-MMV-debuginfo-4.3.1-lp152.5.3.1 perl-PCP-PMDA-4.3.1-lp152.5.3.1 perl-PCP-PMDA-debuginfo-4.3.1-lp152.5.3.1 python3-pcp-4.3.1-lp152.5.3.1 python3-pcp-debuginfo-4.3.1-lp152.5.3.1 - openSUSE Leap 15.2 (noarch): pcp-doc-4.3.1-lp152.5.3.1 References: https://bugzilla.suse.com/1152533

1 0

openSUSE-SU-2021:0347-1: critical: Security update for salt
by opensuse-security＠opensuse.org 26 Feb '21

26 Feb '21

openSUSE Security Update: Security update for salt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0347-1 Rating: critical References: #1181550 #1181556 #1181557 #1181558 #1181559 #1181560 #1181561 #1181562 #1181563 #1181564 #1181565 #1182740 Cross-References: CVE-2020-28243 CVE-2020-28972 CVE-2020-35662 CVE-2021-25281 CVE-2021-25282 CVE-2021-25283 CVE-2021-25284 CVE-2021-3144 CVE-2021-3148 CVE-2021-3197 CVSS scores: CVE-2020-28243 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2020-28972 (SUSE): 7.3 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVE-2020-35662 (SUSE): 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L CVE-2021-25281 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-25282 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-25283 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-25284 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-3144 (SUSE): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2021-3148 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-3197 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves 10 vulnerabilities and has two fixes is now available. Description: This update for salt fixes the following issues: - Fix regression on cmd.run when passing tuples as cmd (bsc#1182740) - Allow `extra_filerefs` as sanitized `kwargs` for SSH client - Fix errors with virt.update - Fix for multiple for security issues (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144) (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197) (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560) (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565) - virt: search for `grub.xen` path - Xen spicevmc, DNS SRV records backports: - Fix virtual network generated DNS XML for SRV records - Don't add spicevmc channel to xen VMs - virt UEFI fix: virt.update when `efi=True` This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-347=1 Package List: - openSUSE Leap 15.2 (noarch): salt-bash-completion-3000-lp152.3.27.1 salt-fish-completion-3000-lp152.3.27.1 salt-zsh-completion-3000-lp152.3.27.1 - openSUSE Leap 15.2 (x86_64): python2-salt-3000-lp152.3.27.1 python3-salt-3000-lp152.3.27.1 salt-3000-lp152.3.27.1 salt-api-3000-lp152.3.27.1 salt-cloud-3000-lp152.3.27.1 salt-doc-3000-lp152.3.27.1 salt-master-3000-lp152.3.27.1 salt-minion-3000-lp152.3.27.1 salt-proxy-3000-lp152.3.27.1 salt-ssh-3000-lp152.3.27.1 salt-standalone-formulas-configuration-3000-lp152.3.27.1 salt-syndic-3000-lp152.3.27.1 References: https://www.suse.com/security/cve/CVE-2020-28243.html https://www.suse.com/security/cve/CVE-2020-28972.html https://www.suse.com/security/cve/CVE-2020-35662.html https://www.suse.com/security/cve/CVE-2021-25281.html https://www.suse.com/security/cve/CVE-2021-25282.html https://www.suse.com/security/cve/CVE-2021-25283.html https://www.suse.com/security/cve/CVE-2021-25284.html https://www.suse.com/security/cve/CVE-2021-3144.html https://www.suse.com/security/cve/CVE-2021-3148.html https://www.suse.com/security/cve/CVE-2021-3197.html https://bugzilla.suse.com/1181550 https://bugzilla.suse.com/1181556 https://bugzilla.suse.com/1181557 https://bugzilla.suse.com/1181558 https://bugzilla.suse.com/1181559 https://bugzilla.suse.com/1181560 https://bugzilla.suse.com/1181561 https://bugzilla.suse.com/1181562 https://bugzilla.suse.com/1181563 https://bugzilla.suse.com/1181564 https://bugzilla.suse.com/1181565 https://bugzilla.suse.com/1182740

1 0

openSUSE-SU-2021:0345-1: moderate: Security update for gnuplot
by opensuse-security＠opensuse.org 26 Feb '21

26 Feb '21

openSUSE Security Update: Security update for gnuplot ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0345-1 Rating: moderate References: #1176689 Cross-References: CVE-2020-25559 CVSS scores: CVE-2020-25559 (SUSE): 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gnuplot fixes the following issues: - CVE-2020-25559: Fixed double free when executing print_set_output() (bsc#1176689). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-345=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): gnuplot-5.2.2-lp152.6.3.1 gnuplot-debuginfo-5.2.2-lp152.6.3.1 gnuplot-debugsource-5.2.2-lp152.6.3.1 - openSUSE Leap 15.2 (noarch): gnuplot-doc-5.2.2-lp152.6.3.1 References: https://www.suse.com/security/cve/CVE-2020-25559.html https://bugzilla.suse.com/1176689

1 0

openSUSE-SU-2021:0341-1: moderate: Security update for nghttp2
by opensuse-security＠opensuse.org 25 Feb '21

25 Feb '21

openSUSE Security Update: Security update for nghttp2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0341-1 Rating: moderate References: #1159003 #1166481 Cross-References: CVE-2019-18802 CVSS scores: CVE-2019-18802 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-18802 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for nghttp2 fixes the following issues: nghttp2 was update to version 1.40.0 (bsc#1166481) - lib: Add nghttp2_check_authority as public API - lib: Fix the bug that stream is closed with wrong error code - lib: Faster huffman encoding and decoding - build: Avoid filename collision of static and dynamic lib - build: Add new flag ENABLE_STATIC_CRT for Windows - build: cmake: Support building nghttpx with systemd - third-party: Update neverbleed to fix memory leak - nghttpx: Fix bug that mruby is incorrectly shared between backends - nghttpx: Reconnect h1 backend if it lost connection before sending headers - nghttpx: Returns 408 if backend timed out before sending headers - nghttpx: Fix request stal This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-341=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libnghttp2-14-1.40.0-lp152.2.3.1 libnghttp2-14-debuginfo-1.40.0-lp152.2.3.1 libnghttp2-devel-1.40.0-lp152.2.3.1 libnghttp2_asio-devel-1.40.0-lp152.2.3.1 libnghttp2_asio1-1.40.0-lp152.2.3.1 libnghttp2_asio1-debuginfo-1.40.0-lp152.2.3.1 nghttp2-1.40.0-lp152.2.3.1 nghttp2-debuginfo-1.40.0-lp152.2.3.1 nghttp2-debugsource-1.40.0-lp152.2.3.1 nghttp2-python-debugsource-1.40.0-lp152.2.3.1 python3-nghttp2-1.40.0-lp152.2.3.1 python3-nghttp2-debuginfo-1.40.0-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): libnghttp2-14-32bit-1.40.0-lp152.2.3.1 libnghttp2-14-32bit-debuginfo-1.40.0-lp152.2.3.1 libnghttp2_asio1-32bit-1.40.0-lp152.2.3.1 libnghttp2_asio1-32bit-debuginfo-1.40.0-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-18802.html https://bugzilla.suse.com/1159003 https://bugzilla.suse.com/1166481

1 0

openSUSE-SU-2021:0338-1: important: Security update for python-djangorestframework
by opensuse-security＠opensuse.org 25 Feb '21

25 Feb '21

openSUSE Security Update: Security update for python-djangorestframework ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0338-1 Rating: important References: #1177205 Cross-References: CVE-2020-25626 CVSS scores: CVE-2020-25626 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2020-25626 (SUSE): 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-djangorestframework fixes the following issues: Update to 3.11.2 * Security: Drop urlize_quoted_links template tag in favour of Django's built-in urlize. Removes a XSS vulnerability for some kinds of content in the browsable API. (boo#1177205, CVE-2020-25626) * update Django for APIs book to 3.0 edition * decode base64 credentials as utf8; adjust tests * Remove compat urls for Django < 2.0 This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-338=1 Package List: - openSUSE Backports SLE-15-SP2 (noarch): python3-djangorestframework-3.11.2-bp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-25626.html https://bugzilla.suse.com/1177205

1 0

openSUSE-SU-2021:0337-1: moderate: Security update for postgresql, postgresql13
by opensuse-security＠opensuse.org 24 Feb '21

24 Feb '21

openSUSE Security Update: Security update for postgresql, postgresql13 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0337-1 Rating: moderate References: #1178666 #1178667 #1178668 #1178961 Cross-References: CVE-2020-25694 CVE-2020-25695 CVE-2020-25696 CVSS scores: CVE-2020-25694 (NVD) : 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2020-25694 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2020-25695 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2020-25695 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2020-25696 (NVD) : 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-25696 (SUSE): 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for postgresql, postgresql13 fixes the following issues: This update ships postgresql13. Upgrade to version 13.1: * CVE-2020-25695, bsc#1178666: Block DECLARE CURSOR ... WITH HOLD and firing of deferred triggers within index expressions and materialized view queries. * CVE-2020-25694, bsc#1178667: a) Fix usage of complex connection-string parameters in pg_dump, pg_restore, clusterdb, reindexdb, and vacuumdb. b) When psql's \connect command re-uses connection parameters, ensure that all non-overridden parameters from a previous connection string are re-used. * CVE-2020-25696, bsc#1178668: Prevent psql's \gset command from modifying specially-treated variables. * Fix recently-added timetz test case so it works when the USA is not observing daylight savings time. (obsoletes postgresql-timetz.patch) * https://www.postgresql.org/about/news/2111/ * https://www.postgresql.org/docs/13/release-13-1.html Initial packaging of PostgreSQL 13: * https://www.postgresql.org/about/news/2077/ * https://www.postgresql.org/docs/13/release-13.html - bsc#1178961: %ghost the symlinks to pg_config and ecpg. Changes in postgresql wrapper package: - Bump major version to 13. - We also transfer PostgreSQL 9.4.26 to the new package layout in SLE12-SP2 and newer. Reflect this in the conflict with postgresql94. - Also conflict with PostgreSQL versions before 9. - Conflicting with older versions is not limited to SLE. This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-337=1 Package List: - openSUSE Leap 15.2 (noarch): postgresql-13-lp152.3.6.1 postgresql-contrib-13-lp152.3.6.1 postgresql-devel-13-lp152.3.6.1 postgresql-docs-13-lp152.3.6.1 postgresql-llvmjit-13-lp152.3.6.1 postgresql-plperl-13-lp152.3.6.1 postgresql-plpython-13-lp152.3.6.1 postgresql-pltcl-13-lp152.3.6.1 postgresql-server-13-lp152.3.6.1 postgresql-server-devel-13-lp152.3.6.1 postgresql-test-13-lp152.3.6.1 References: https://www.suse.com/security/cve/CVE-2020-25694.html https://www.suse.com/security/cve/CVE-2020-25695.html https://www.suse.com/security/cve/CVE-2020-25696.html https://bugzilla.suse.com/1178666 https://bugzilla.suse.com/1178667 https://bugzilla.suse.com/1178668 https://bugzilla.suse.com/1178961

1 0

openSUSE-SU-2021:0335-1: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 24 Feb '21

24 Feb '21

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0335-1 Rating: low References: #1181848 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 78.7.1 ESR (bsc#1181848) - Fixed: Prevent access to NTFS special paths that could lead to filesystem corruption. - Buffer overflow in depth pitch calculations for compressed textures Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-335=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaFirefox-78.7.1-lp152.2.46.1 MozillaFirefox-branding-upstream-78.7.1-lp152.2.46.1 MozillaFirefox-buildsymbols-78.7.1-lp152.2.46.1 MozillaFirefox-debuginfo-78.7.1-lp152.2.46.1 MozillaFirefox-debugsource-78.7.1-lp152.2.46.1 MozillaFirefox-devel-78.7.1-lp152.2.46.1 MozillaFirefox-translations-common-78.7.1-lp152.2.46.1 MozillaFirefox-translations-other-78.7.1-lp152.2.46.1 References: https://bugzilla.suse.com/1181848

1 0

openSUSE-SU-2021:0334-1: moderate: Security update for tor
by opensuse-security＠opensuse.org 23 Feb '21

23 Feb '21

openSUSE Security Update: Security update for tor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0334-1 Rating: moderate References: #1178741 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for tor fixes the following issues: tor was updated to 0.4.5.6: * https://lists.torproject.org/pipermail/tor-announce/2021-February/000214.ht ml * Introduce a new MetricsPort HTTP interface * Support IPv6 in the torrc Address option * Add event-tracing library support for USDT and LTTng-UST * Try to read N of N bytes on a TLS connection tor was updated to 0.4.4.7: * https://blog.torproject.org/node/1990 * Stop requiring a live consensus for v3 clients and services * Re-entry into the network is now denied at the Exit level * Fix undefined behavior on our Keccak library * Strip '\r' characters when reading text files on Unix platforms * Handle partial SOCKS5 messages correctly * Check channels+circuits on relays more thoroughly (TROVE-2020-005, boo#1178741) This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-334=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): tor-0.4.5.6-bp152.2.6.1 References: https://bugzilla.suse.com/1178741

1 0

openSUSE-SU-2021:0331-1: moderate: Security update for python3
by opensuse-security＠opensuse.org 23 Feb '21

23 Feb '21

openSUSE Security Update: Security update for python3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0331-1 Rating: moderate References: #1176262 #1179756 #1180686 #1181126 Cross-References: CVE-2019-20916 CVE-2021-3177 CVSS scores: CVE-2019-20916 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2019-20916 (SUSE): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N CVE-2021-3177 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-3177 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for python3 fixes the following issues: - CVE-2021-3177: Fixed buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution (bsc#1181126). - Provide the newest setuptools wheel (bsc#1176262, CVE-2019-20916) in their correct form (bsc#1180686). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-331=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libpython3_6m1_0-3.6.12-lp152.4.17.1 libpython3_6m1_0-debuginfo-3.6.12-lp152.4.17.1 python3-3.6.12-lp152.4.17.1 python3-base-3.6.12-lp152.4.17.1 python3-base-debuginfo-3.6.12-lp152.4.17.1 python3-core-debugsource-3.6.12-lp152.4.17.1 python3-curses-3.6.12-lp152.4.17.1 python3-curses-debuginfo-3.6.12-lp152.4.17.1 python3-dbm-3.6.12-lp152.4.17.1 python3-dbm-debuginfo-3.6.12-lp152.4.17.1 python3-debuginfo-3.6.12-lp152.4.17.1 python3-debugsource-3.6.12-lp152.4.17.1 python3-devel-3.6.12-lp152.4.17.1 python3-devel-debuginfo-3.6.12-lp152.4.17.1 python3-doc-3.6.12-lp152.4.17.1 python3-doc-devhelp-3.6.12-lp152.4.17.1 python3-idle-3.6.12-lp152.4.17.1 python3-testsuite-3.6.12-lp152.4.17.1 python3-testsuite-debuginfo-3.6.12-lp152.4.17.1 python3-tk-3.6.12-lp152.4.17.1 python3-tk-debuginfo-3.6.12-lp152.4.17.1 python3-tools-3.6.12-lp152.4.17.1 - openSUSE Leap 15.2 (x86_64): libpython3_6m1_0-32bit-3.6.12-lp152.4.17.1 libpython3_6m1_0-32bit-debuginfo-3.6.12-lp152.4.17.1 python3-32bit-3.6.12-lp152.4.17.1 python3-32bit-debuginfo-3.6.12-lp152.4.17.1 python3-base-32bit-3.6.12-lp152.4.17.1 python3-base-32bit-debuginfo-3.6.12-lp152.4.17.1 References: https://www.suse.com/security/cve/CVE-2019-20916.html https://www.suse.com/security/cve/CVE-2021-3177.html https://bugzilla.suse.com/1176262 https://bugzilla.suse.com/1179756 https://bugzilla.suse.com/1180686 https://bugzilla.suse.com/1181126

1 0

openSUSE-SU-2021:0330-1: moderate: Security update for tomcat
by opensuse-security＠opensuse.org 22 Feb '21

22 Feb '21

openSUSE Security Update: Security update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0330-1 Rating: moderate References: #1180947 Cross-References: CVE-2021-24122 CVSS scores: CVE-2021-24122 (NVD) : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2021-24122 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tomcat fixes the following issues: - CVE-2021-24122: Fixed an information disclosure if resources are served from the NTFS file system (bsc#1180947). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-330=1 Package List: - openSUSE Leap 15.2 (noarch): tomcat-9.0.36-lp152.2.19.1 tomcat-admin-webapps-9.0.36-lp152.2.19.1 tomcat-docs-webapp-9.0.36-lp152.2.19.1 tomcat-el-3_0-api-9.0.36-lp152.2.19.1 tomcat-embed-9.0.36-lp152.2.19.1 tomcat-javadoc-9.0.36-lp152.2.19.1 tomcat-jsp-2_3-api-9.0.36-lp152.2.19.1 tomcat-jsvc-9.0.36-lp152.2.19.1 tomcat-lib-9.0.36-lp152.2.19.1 tomcat-servlet-4_0-api-9.0.36-lp152.2.19.1 tomcat-webapps-9.0.36-lp152.2.19.1 References: https://www.suse.com/security/cve/CVE-2021-24122.html https://bugzilla.suse.com/1180947

1 0

openSUSE-SU-2021:0322-1: important: Security update for python-djangorestframework
by opensuse-security＠opensuse.org 22 Feb '21

22 Feb '21

openSUSE Security Update: Security update for python-djangorestframework ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0322-1 Rating: important References: #1177205 Cross-References: CVE-2020-25626 CVSS scores: CVE-2020-25626 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2020-25626 (SUSE): 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-djangorestframework fixes the following issues: Update to 3.11.2 * Security: Drop urlize_quoted_links template tag in favour of Django's built-in urlize. Removes a XSS vulnerability for some kinds of content in the browsable API. (boo#1177205, CVE-2020-25626) * update Django for APIs book to 3.0 edition * decode base64 credentials as utf8; adjust tests * Remove compat urls for Django < 2.0 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-322=1 Package List: - openSUSE Leap 15.2 (noarch): python3-djangorestframework-3.11.2-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-25626.html https://bugzilla.suse.com/1177205

1 0

openSUSE-SU-2021:0316-1: moderate: Security update for tor
by opensuse-security＠opensuse.org 20 Feb '21

20 Feb '21

openSUSE Security Update: Security update for tor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0316-1 Rating: moderate References: #1178741 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for tor fixes the following issues: tor was updated to 0.4.5.6: * https://lists.torproject.org/pipermail/tor-announce/2021-February/000214.ht ml * Introduce a new MetricsPort HTTP interface * Support IPv6 in the torrc Address option * Add event-tracing library support for USDT and LTTng-UST * Try to read N of N bytes on a TLS connection tor was updated to 0.4.4.7: * https://blog.torproject.org/node/1990 * Stop requiring a live consensus for v3 clients and services * Re-entry into the network is now denied at the Exit level * Fix undefined behavior on our Keccak library * Strip '\r' characters when reading text files on Unix platforms * Handle partial SOCKS5 messages correctly * Check channels+circuits on relays more thoroughly (TROVE-2020-005, boo#1178741) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-316=1 Package List: - openSUSE Leap 15.2 (x86_64): tor-0.4.5.6-lp152.2.6.1 tor-debuginfo-0.4.5.6-lp152.2.6.1 tor-debugsource-0.4.5.6-lp152.2.6.1 References: https://bugzilla.suse.com/1178741

1 0

openSUSE-SU-2021:0312-1: moderate: Security update for mumble
by opensuse-security＠opensuse.org 19 Feb '21

19 Feb '21

openSUSE Security Update: Security update for mumble ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0312-1 Rating: moderate References: #1180068 #1182123 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for mumble fixes the following issues: mumble was updated to 1.3.4: * Fix use of outdated (non-existent) notification icon names * Fix Security vulnerability caused by allowing non http/https URL schemes in public server list (boo#1182123) * Server: Fix Exit status for actions like --version or --supw * Fix packet loss & audio artifacts caused by OCB2 XEX* mitigation - update apparmor profiles to get warning free again on 15.2 - use abstractions for ssl files - allow inet dgram sockets as mumble can also work via udp - allow netlink socket (probably for dbus) - properly allow lsb_release again - add support for optional local include - start murmurd directly as user mumble-server it gets rid of the dac_override/setgid/setuid/chown permissions Update to upstream version 1.3.3 Client: * Fixed: Chatbox invisble (zero height) (#4388) * Fixed: Handling of invalid packet sizes (#4394) * Fixed: Race-condition leading to loss of shortcuts (#4430) * Fixed: Link in About dialog is now clickable again (#4454) * Fixed: Sizing issues in ACL-Editor (#4455) * Improved: PulseAudio now always samples at 48 kHz (#4449) Server: * Fixed: Crash due to problems when using PostgreSQL (#4370) * Fixed: Handling of invalid package sizes (#4392) This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-312=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): mumble-1.3.4-bp152.2.6.1 mumble-server-1.3.4-bp152.2.6.1 - openSUSE Backports SLE-15-SP2 (aarch64_ilp32): mumble-64bit-1.3.4-bp152.2.6.1 References: https://bugzilla.suse.com/1180068 https://bugzilla.suse.com/1182123

1 0

openSUSE-SU-2021:0310-1: moderate: Security update for buildah, libcontainers-common, podman
by opensuse-security＠opensuse.org 19 Feb '21

19 Feb '21

openSUSE Security Update: Security update for buildah, libcontainers-common, podman ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0310-1 Rating: moderate References: #1144065 #1165184 Cross-References: CVE-2019-10214 CVE-2020-10696 CVSS scores: CVE-2019-10214 (NVD) : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2019-10214 (SUSE): 9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H CVE-2020-10696 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-10696 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for buildah, libcontainers-common, podman fixes the following issues: Changes in libcontainers-common: - Update common to 0.33.0 - Update image to 5.9.0 - Update podman to 2.2.1 - Update storage to 1.24.5 - Switch to seccomp profile provided by common instead of podman - Update containers.conf to match latest version Changes in buildah: Update to version 1.19.2: * Update vendor of containers/storage and containers/common * Buildah inspect should be able to inspect manifests * Make buildah push support pushing manifests lists and digests * Fix handling of TMPDIR environment variable * Add support for --manifest flags * Upper directory should match mode of destination directory * Only grab the OS, Arch if the user actually specified them * Use --arch and --os and --variant options to select architecture and os * Cirrus: Track libseccomp and golang version * copier.PutOptions: add an "IgnoreDevices" flag * fix: `rmi --prune` when parent image is in store. * build(deps): bump github.com/containers/storage from 1.24.3 to 1.24.4 * build(deps): bump github.com/containers/common from 0.31.1 to 0.31.2 * Allow users to specify stdin into containers * Drop log message on failure to mount on /sys file systems to info * Spelling * SELinux no longer requires a tag. * build(deps): bump github.com/opencontainers/selinux from 1.6.0 to 1.8.0 * build(deps): bump github.com/containers/common from 0.31.0 to 0.31.1 * Update nix pin with `make nixpkgs` * Switch references of /var/run -> /run * Allow FROM to be overriden with from option * copier: don't assume we can chroot() on Unixy systems * copier: add PutOptions.NoOverwriteDirNonDir, Get/PutOptions.Rename * copier: handle replacing directories with not-directories * copier: Put: skip entries with zero-length names * build(deps): bump github.com/containers/storage from 1.24.2 to 1.24.3 * Add U volume flag to chown source volumes * Turn off PRIOR_UBUNTU Test until vm is updated * pkg, cli: rootless uses correct isolation * build(deps): bump github.com/onsi/gomega from 1.10.3 to 1.10.4 * update installation doc to reflect current status * Move away from using docker.io * enable short-name aliasing * build(deps): bump github.com/containers/storage from 1.24.1 to 1.24.2 * build(deps): bump github.com/containers/common from 0.30.0 to 0.31.0 * Throw errors when using bogus --network flags * pkg/supplemented test: replace our null blobinfocache * build(deps): bump github.com/containers/common from 0.29.0 to 0.30.0 * inserts forgotten quotation mark * Not prefer use local image create/add manifest * Add container information to .containerenv * Add --ignorefile flag to use alternate .dockerignore flags * Add a source debug build * Fix crash on invalid filter commands * build(deps): bump github.com/containers/common from 0.27.0 to 0.29.0 * Switch to using containers/common pkg's * fix: non-portable shebang #2812 * Remove copy/paste errors that leaked `Podman` into man pages. * Add suggests cpp to spec file * Apply suggestions from code review * update docs for debian testing and unstable * imagebuildah: disable pseudo-terminals for RUN * Compute diffID for mapped-layer at creating image source * intermediateImageExists: ignore images whose history we can't read * Bump to v1.19.0-dev * build(deps): bump github.com/containers/common from 0.26.3 to 0.27.0 * Fix testing error caused by simultanious merge * Vendor in containers/storage v1.24.0 * short-names aliasing * Add --policy flag to buildah pull * Stop overwrapping and stuttering * copier.Get(): ignore ENOTSUP/ENOSYS when listing xattrs * Run: don't forcibly disable UTS namespaces in rootless mode * test: ensure non-directory in a Dockerfile path is handled correctly * Add a few tests for `pull` command * Fix buildah config --cmd to handle array * build(deps): bump github.com/containers/storage from 1.23.8 to 1.23.9 * Fix NPE when Dockerfile path contains non-directory entries * Update buildah bud man page from podman build man page * Move declaration of decryption-keys to common cli * Run: correctly call copier.Mkdir * util: digging UID/GID out of os.FileInfo should work on Unix * imagebuildah.getImageTypeAndHistoryAndDiffIDs: cache results * Verify userns-uid-map and userns-gid-map input * Use CPP, CC and flags in dep check scripts * Avoid overriding LDFLAGS in Makefile * ADD: handle --chown on URLs * Update nix pin with `make nixpkgs` * (*Builder).Run: MkdirAll: handle EEXIST error * copier: try to force loading of nsswitch modules before chroot() * fix MkdirAll usage * build(deps): bump github.com/containers/common from 0.26.2 to 0.26.3 * build(deps): bump github.com/containers/storage from 1.23.7 to 1.23.8 * Use osusergo build tag for static build * imagebuildah: cache should take image format into account * Bump to v1.18.0-dev Update to version 1.17.1: * copier.Get(): ignore ENOTSUP/ENOSYS when listing xattrs * copier: try to force loading of nsswitch modules before chroot() * ADD: handle --chown on URLs * imagebuildah: cache should take image format into account * Update CI configuration for the release-1.17 branch added cni to requires as its needed for buildah to run Update to v1.17.0 (boo#1165184) * Handle cases where other tools mount/unmount containers * overlay.MountReadOnly: support RO overlay mounts * overlay: use fusermount for rootless umounts * overlay: fix umount * Switch default log level of Buildah to Warn. Users need to see these messages * Drop error messages about OCI/Docker format to Warning level * build(deps): bump github.com/containers/common from 0.26.0 to 0.26.2 * tests/testreport: adjust for API break in storage v1.23.6 * build(deps): bump github.com/containers/storage from 1.23.5 to 1.23.7 * build(deps): bump github.com/fsouza/go-dockerclient from 1.6.5 to 1.6.6 * copier: put: ignore Typeflag="g" * Use curl to get repo file (fix #2714) * build(deps): bump github.com/containers/common from 0.25.0 to 0.26.0 * build(deps): bump github.com/spf13/cobra from 1.0.0 to 1.1.1 * Remove docs that refer to bors, since we're not using it * Buildah bud should not use stdin by default * bump containerd, docker, and golang.org/x/sys * Makefile: cross: remove windows.386 target * copier.copierHandlerPut: don't check length when there are errors * Stop excessive wrapping * CI: require that conformance tests pass * bump(github.com/openshift/imagebuilder) to v1.1.8 * Skip tlsVerify insecure BUILD_REGISTRY_SOURCES * Fix build path wrong containers/podman#7993 * refactor pullpolicy to avoid deps * build(deps): bump github.com/containers/common from 0.24.0 to 0.25.0 * CI: run gating tasks with a lot more memory * ADD and COPY: descend into excluded directories, sometimes * copier: add more context to a couple of error messages * copier: check an error earlier * copier: log stderr output as debug on success * Update nix pin with make nixpkgs * Set directory ownership when copied with ID mapping * build(deps): bump github.com/sirupsen/logrus from 1.6.0 to 1.7.0 * build(deps): bump github.com/containers/common from 0.23.0 to 0.24.0 * Cirrus: Remove bors artifacts * Sort build flag definitions alphabetically * ADD: only expand archives at the right time * Remove configuration for bors * Shell Completion for podman build flags * Bump c/common to v0.24.0 * New CI check: xref --help vs man pages * CI: re-enable several linters * Move --userns-uid-map/--userns-gid-map description into buildah man page * add: preserve ownerships and permissions on ADDed archives * Makefile: tweak the cross-compile target * Bump containers/common to v0.23.0 * chroot: create bind mount targets 0755 instead of 0700 * Change call to Split() to safer SplitN() * chroot: fix handling of errno seccomp rules * build(deps): bump github.com/containers/image/v5 from 5.5.2 to 5.6.0 * Add In Progress section to contributing * integration tests: make sure tests run in ${topdir}/tests * Run(): ignore containers.conf's environment configuration * Warn when setting healthcheck in OCI format * Cirrus: Skip git-validate on branches * tools: update git-validation to the latest commit * tools: update golangci-lint to v1.18.0 * Add a few tests of push command * Add(): fix handling of relative paths with no ContextDir * build(deps): bump github.com/containers/common from 0.21.0 to 0.22.0 * Lint: Use same linters as podman * Validate: reference HEAD * Fix buildah mount to display container names not ids * Update nix pin with make nixpkgs * Add missing --format option in buildah from man page * Fix up code based on codespell * build(deps): bump github.com/openshift/imagebuilder from 1.1.6 to 1.1.7 * build(deps): bump github.com/containers/storage from 1.23.4 to 1.23.5 * Improve buildah completions * Cirrus: Fix validate commit epoch * Fix bash completion of manifest flags * Uniform some man pages * Update Buildah Tutorial to address BZ1867426 * Update bash completion of manifest add sub command * copier.Get(): hard link targets shouldn't be relative paths * build(deps): bump github.com/onsi/gomega from 1.10.1 to 1.10.2 * Pass timestamp down to history lines * Timestamp gets updated everytime you inspect an image * bud.bats: use absolute paths in newly-added tests * contrib/cirrus/lib.sh: don't use CN for the hostname * tests: Add some tests * Update manifest add man page * Extend flags of manifest add * build(deps): bump github.com/containers/storage from 1.23.3 to 1.23.4 * build(deps): bump github.com/onsi/ginkgo from 1.14.0 to 1.14.1 * Bump to v1.17.0-dev * CI: expand cross-compile checks - SLE: Remove unneeded patch: CVE-2019-10214.patch Update to v1.16.2 * fix build on 32bit arches * containerImageRef.NewImageSource(): don't always force timestamps * Add fuse module warning to image readme * Heed our retry delay option values when retrying commit/pull/push * Switch to containers/common for seccomp * Use --timestamp rather then --omit-timestamp * docs: remove outdated notice * docs: remove outdated notice * build-using-dockerfile: add a hidden --log-rusage flag * build(deps): bump github.com/containers/image/v5 from 5.5.1 to 5.5.2 * Discard ReportWriter if user sets options.Quiet * build(deps): bump github.com/containers/common from 0.19.0 to 0.20.3 * Fix ownership of content copied using COPY --from * newTarDigester: zero out timestamps in tar headers * Update nix pin with `make nixpkgs` * bud.bats: correct .dockerignore integration tests * Use pipes for copying * run: include stdout in error message * run: use the correct error for errors.Wrapf * copier: un-export internal types * copier: add Mkdir() * in_podman: don't get tripped up by $CIRRUS_CHANGE_TITLE * docs/buildah-commit.md: tweak some wording, add a --rm example * imagebuildah: don��t blank out destination names when COPYing * Replace retry functions with common/pkg/retry * StageExecutor.historyMatches: compare timestamps using .Equal * Update vendor of containers/common * Fix errors found in coverity scan * Change namespace handling flags to better match podman commands * conformance testing: ignore buildah.BuilderIdentityAnnotation labels * Vendor in containers/storage v1.23.0 * Add buildah.IsContainer interface * Avoid feeding run_buildah to pipe * fix(buildahimage): add xz dependency in buildah image * Bump github.com/containers/common from 0.15.2 to 0.18.0 * Howto for rootless image building from OpenShift * Add --omit-timestamp flag to buildah bud * Update nix pin with `make nixpkgs` * Shutdown storage on failures * Handle COPY --from when an argument is used * Bump github.com/seccomp/containers-golang from 0.5.0 to 0.6.0 * Cirrus: Use newly built VM images * Bump github.com/opencontainers/runc from 1.0.0-rc91 to 1.0.0-rc92 * Enhance the .dockerignore man pages * conformance: add a test for COPY from subdirectory * fix bug manifest inspct * Add documentation for .dockerignore * Add BuilderIdentityAnnotation to identify buildah version * DOC: Add quay.io/containers/buildah image to README.md * Update buildahimages readme * fix spelling mistake in "info" command result display * Don't bind /etc/host and /etc/resolv.conf if network is not present * blobcache: avoid an unnecessary NewImage() * Build static binary with `buildGoModule` * copier: split StripSetidBits into StripSetuidBit/StripSetgidBit/StripStickyBit * tarFilterer: handle multiple archives * Fix a race we hit during conformance tests * Rework conformance testing * Update 02-registries-repositories.md * test-unit: invoke cmd/buildah tests with --flags * parse: fix a type mismatch in a test * Fix compilation of tests/testreport/testreport * build.sh: log the version of Go that we're using * test-unit: increase the test timeout to 40/45 minutes * Add the "copier" package * Fix & add notes regarding problematic language in codebase * Add dependency on github.com/stretchr/testify/require * CompositeDigester: add the ability to filter tar streams * BATS tests: make more robust * vendor golang.org/x/text@v0.3.3 * Switch golang 1.12 to golang 1.13 * imagebuildah: wait for stages that might not have even started yet * chroot, run: not fail on bind mounts from /sys * chroot: do not use setgroups if it is blocked * Set engine env from containers.conf * imagebuildah: return the right stage's image as the "final" image * Fix a help string * Deduplicate environment variables * switch containers/libpod to containers/podman * Bump github.com/containers/ocicrypt from 1.0.2 to 1.0.3 * Bump github.com/opencontainers/selinux from 1.5.2 to 1.6.0 * Mask out /sys/dev to prevent information leak * linux: skip errors from the runtime kill * Mask over the /sys/fs/selinux in mask branch * Add VFS additional image store to container * tests: add auth tests * Allow "readonly" as alias to "ro" in mount options * Ignore OS X specific consistency mount option * Bump github.com/onsi/ginkgo from 1.13.0 to 1.14.0 * Bump github.com/containers/common from 0.14.0 to 0.15.2 * Rootless Buildah should default to IsolationOCIRootless * imagebuildah: fix inheriting multi-stage builds * Make imagebuildah.BuildOptions.Architecture/OS optional * Make imagebuildah.BuildOptions.Jobs optional * Resolve a possible race in imagebuildah.Executor.startStage() * Switch scripts to use containers.conf * Bump openshift/imagebuilder to v1.1.6 * Bump go.etcd.io/bbolt from 1.3.4 to 1.3.5 * buildah, bud: support --jobs=N for parallel execution * executor: refactor build code inside new function * Add bud regression tests * Cirrus: Fix missing htpasswd in registry img * docs: clarify the 'triples' format * CHANGELOG.md: Fix markdown formatting * Add nix derivation for static builds Update to v1.15.1 * Mask over the /sys/fs/selinux in mask branch * chroot: do not use setgroups if it is blocked * chroot, run: not fail on bind mounts from /sys * Allow "readonly" as alias to "ro" in mount options * Add VFS additional image store to container * vendor golang.org/x/text@v0.3.3 * Make imagebuildah.BuildOptions.Architecture/OS optional Update to v1.15.0 * Add CVE-2020-10696 to CHANGELOG.md and changelog.txt * fix lighttpd example * remove dependency on openshift struct * Warn on unset build arguments * vendor: update seccomp/containers-golang to v0.4.1 * Updated docs * clean up comments * update exit code for tests * Implement commit for encryption * implementation of encrypt/decrypt push/pull/bud/from * fix resolve docker image name as transport * Add preliminary profiling support to the CLI * Evaluate symlinks in build context directory * fix error info about get signatures for containerImageSource * Add Security Policy * Cirrus: Fixes from review feedback * imagebuildah: stages shouldn't count as their base images * Update containers/common v0.10.0 * Add registry to buildahimage Dockerfiles * Cirrus: Use pre-installed VM packages + F32 * Cirrus: Re-enable all distro versions * Cirrus: Update to F31 + Use cache images * golangci-lint: Disable gosimple * Lower number of golangci-lint threads * Fix permissions on containers.conf * Don't force tests to use runc * Return exit code from failed containers * cgroup_manager should be under [engine] * Use c/common/pkg/auth in login/logout * Cirrus: Temporarily disable Ubuntu 19 testing * Add containers.conf to stablebyhand build * Update gitignore to exclude test Dockerfiles * Remove warning for systemd inside of container - Add patch for CVE-2019-10214. boo#1144065 + CVE-2019-10214.patch Changes in podman: Update to v2.2.1 * Changes - Due to a conflict with a previously-removed field, we were forced to modify the way image volumes (mounting images into containers using --mount type=image) were handled in the database. As a result, containers created in Podman 2.2.0 with image volume will not have them in v2.2.1, and these containers will need to be re-created. * Bugfixes - Fixed a bug where rootless Podman would, on systems without the XDG_RUNTIME_DIR environment variable defined, use an incorrect path for the PID file of the Podman pause process, causing Podman to fail to start (#8539). - Fixed a bug where containers created using Podman v1.7 and earlier were unusable in Podman due to JSON decode errors (#8613). - Fixed a bug where Podman could retrieve invalid cgroup paths, instead of erroring, for containers that were not running. - Fixed a bug where the podman system reset command would print a warning about a duplicate shutdown handler being registered. - Fixed a bug where rootless Podman would attempt to mount sysfs in circumstances where it was not allowed; some OCI runtimes (notably crun) would fall back to alternatives and not fail, but others (notably runc) would fail to run containers. - Fixed a bug where the podman run and podman create commands would fail to create containers from untagged images (#8558). - Fixed a bug where remote Podman would prompt for a password even when the server did not support password authentication (#8498). - Fixed a bug where the podman exec command did not move the Conmon process for the exec session into the correct cgroup. - Fixed a bug where shell completion for the ancestor option to podman ps --filter did not work correctly. - Fixed a bug where detached containers would not properly clean themselves up (or remove themselves if --rm was set) if the Podman command that created them was invoked with --log-level=debug. * API - Fixed a bug where the Compat Create endpoint for Containers did not properly handle the Binds and Mounts parameters in HostConfig. - Fixed a bug where the Compat Create endpoint for Containers ignored the Name query parameter. - Fixed a bug where the Compat Create endpoint for Containers did not properly handle the "default" value for NetworkMode (this value is used extensively by docker-compose) (#8544). - Fixed a bug where the Compat Build endpoint for Images would sometimes incorrectly use the target query parameter as the image's tag. * Misc - Podman v2.2.0 vendored a non-released, custom version of the github.com/spf13/cobra package; this has been reverted to the latest upstream release to aid in packaging. - Updated the containers/image library to v5.9.0 Update to v2.2.0 * Features - Experimental support for shortname aliasing has been added. This is not enabled by default, but can be turned on by setting the environment variable CONTAINERS_SHORT_NAME_ALIASING to on. Documentation is available here and here. - Initial support has been added for the podman network connect and podman network disconnect commands, which allow existing containers to modify what networks they are connected to. At present, these commands can only be used on running containers that did not specify --network=none when they were created. - The podman run command now supports the --network-alias option to set network aliases (additional names the container can be accessed at from other containers via DNS if the dnsname CNI plugin is in use). Aliases can also be added and removed using the new podman network connect and podman network disconnect commands. Please note that this requires a new release (v1.1.0) of the dnsname plugin, and will only work on newly-created CNI networks. - The podman generate kube command now features support for exporting container's memory and CPU limits (#7855). - The podman play kube command now features support for setting CPU and Memory limits for containers (#7742). - The podman play kube command now supports persistent volumes claims using Podman named volumes. - The podman play kube command now supports Kubernetes configmaps via the --configmap option (#7567). - The podman play kube command now supports a --log-driver option to set the log driver for created containers. - The podman play kube command now supports a --start option, enabled by default, to start the pod after creating it. This allows for podman play kube to be more easily used in systemd unitfiles. - The podman network create command now supports the --ipv6 option to enable dual-stack IPv6 networking for created networks (#7302). - The podman inspect command can now inspect pods, networks, and volumes, in addition to containers and images (#6757). - The --mount option for podman run and podman create now supports a new type, image, to mount the contents of an image into the container at a given location. - The Bash and ZSH completions have been completely reworked and have received significant enhancements! Additionally, support for Fish completions and completions for the podman-remote executable have been added. - The --log-opt option for podman create and podman run now supports the max-size option to set the maximum size for a container's logs (#7434). - The --network option to the podman pod create command now allows pods to be configured to use slirp4netns networking, even when run as root (#6097). - The podman pod stop, podman pod pause, podman pod unpause, and podman pod kill commands now work on multiple containers in parallel and should be significantly faster. - The podman search command now supports a --list-tags option to list all available tags for a single image in a single repository. - The podman search command can now output JSON using the --format=json option. - The podman diff and podman mount commands now work with all containers in the storage library, including those not created by Podman. This allows them to be used with Buildah and CRI-O containers. - The podman container exists command now features a --external option to check if a container exists not just in Podman, but also in the storage library. This will allow Podman to identify Buildah and CRI-O containers. - The --tls-verify and --authfile options have been enabled for use with remote Podman. - The /etc/hosts file now includes the container's name and hostname (both pointing to localhost) when the container is run with --net=none (#8095). - The podman events command now supports filtering events based on the labels of the container they occurred on using the --filter label=key=value option. - The podman volume ls command now supports filtering volumes based on their labels using the --filter label=key=value option. - The --volume and --mount options to podman run and podman create now support two new mount propagation options, unbindable and runbindable. - The name and id filters for podman pod ps now match based on a regular expression, instead of requiring an exact match. - The podman pod ps command now supports a new filter status, that matches pods in a certain state. * Changes - The podman network rm --force command will now also remove pods that are using the network (#7791). - The podman volume rm, podman network rm, and podman pod rm commands now return exit code 1 if the object specified for removal does not exist, and exit code 2 if the object is in use and the --force option was not given. - If /dev/fuse is passed into Podman containers as a device, Podman will open it before starting the container to ensure that the kernel module is loaded on the host and the device is usable in the container. - Global Podman options that were not supported with remote operation have been removed from podman-remote (e.g. --cgroup-manager, --storage-driver). - Many errors have been changed to remove repetition and be more clear as to what has gone wrong. - The --storage option to podman rm is now enabled by default, with slightly changed semantics. If the given container does not exist in Podman but does exist in the storage library, it will be removed even without the --storage option. If the container exists in Podman it will be removed normally. The --storage option for podman rm is now deprecated and will be removed in a future release. - The --storage option to podman ps has been renamed to --external. An alias has been added so the old form of the option will continue to work. - Podman now delays the SIGTERM and SIGINT signals during container creation to ensure that Podman is not stopped midway through creating a container resulting in potential resource leakage (#7941). - The podman save command now strips signatures from images it is exporting, as the formats we export to do not support signatures (#7659). - A new Degraded state has been added to pods. Pods that have some, but not all, of their containers running are now considered to be Degraded instead of Running. - Podman will now print a warning when conflicting network options related to port forwarding (e.g. --publish and --net=host) are specified when creating a container. - The --restart on-failure and --rm options for containers no longer conflict. When both are specified, the container will be restarted if it exits with a non-zero error code, and removed if it exits cleanly (#7906). - Remote Podman will no longer use settings from the client's containers.conf; defaults will instead be provided by the server's containers.conf (#7657). - The podman network rm command now has a new alias, podman network remove (#8402). * Bugfixes - Fixed a bug where podman load on the remote client did not error when attempting to load a directory, which is not yet supported for remote use. - Fixed a bug where rootless Podman could hang when the newuidmap binary was not installed (#7776). - Fixed a bug where the --pull option to podman run, podman create, and podman build did not match Docker's behavior. - Fixed a bug where sysctl settings from the containers.conf configuration file were applied, even if the container did not join the namespace associated with a sysctl. - Fixed a bug where Podman would not return the text of errors encounted when trying to run a healthcheck for a container. - Fixed a bug where Podman was accidentally setting the containers environment variable in addition to the expected container environment variable. - Fixed a bug where rootless Podman using CNI networking did not properly clean up DNS entries for removed containers (#7789). - Fixed a bug where the podman untag --all command was not supported with remote Podman. - Fixed a bug where the podman system service command could time out even if active attach connections were present (#7826). - Fixed a bug where the podman system service command would sometimes never time out despite no active connections being present. - Fixed a bug where Podman's handling of capabilities, specifically inheritable, did not match Docker's. - Fixed a bug where podman run would fail if the image specified was a manifest list and had already been pulled (#7798). - Fixed a bug where Podman did not take search registries into account when looking up images locally (#6381). - Fixed a bug where the podman manifest inspect command would fail for images that had already been pulled (#7726). - Fixed a bug where rootless Podman would not add supplemental GIDs to containers when when a user, but not a group, was set via the --user option to podman create and podman run and sufficient GIDs were available to add the groups (#7782). - Fixed a bug where remote Podman commands did not properly handle cases where the user gave a name that could also be a short ID for a pod or container (#7837). - Fixed a bug where podman image prune could leave images ready to be pruned after podman image prune was run (#7872). - Fixed a bug where the podman logs command with the journald log driver would not read all available logs (#7476). - Fixed a bug where the --rm and --restart options to podman create and podman run did not conflict when a restart policy that is not on-failure was chosen (#7878). - Fixed a bug where the --format "table {{ .Field }}" option to numerous Podman commands ceased to function on Podman v2.0 and up. - Fixed a bug where pods did not properly share an SELinux label between their containers, resulting in containers being unable to see the processes of other containers when the pod shared a PID namespace (#7886). - Fixed a bug where the --namespace option to podman ps did not work with the remote client (#7903). - Fixed a bug where rootless Podman incorrectly calculated the number of UIDs available in the container if multiple different ranges of UIDs were specified. - Fixed a bug where the /etc/hosts file would not be correctly populated for containers in a user namespace (#7490). - Fixed a bug where the podman network create and podman network remove commands could race when run in parallel, with unpredictable results (#7807). - Fixed a bug where the -p option to podman run, podman create, and podman pod create would, when given only a single number (e.g. -p 80), assign the same port for both host and container, instead of generating a random host port (#7947). - Fixed a bug where Podman containers did not properly store the cgroup manager they were created with, causing them to stop functioning after the cgroup manager was changed in containers.conf or with the --cgroup-manager option (#7830). - Fixed a bug where the podman inspect command did not include information on the CNI networks a container was connected to if it was not running. - Fixed a bug where the podman attach command would not print a newline after detaching from the container (#7751). - Fixed a bug where the HOME environment variable was not set properly in containers when the --userns=keep-id option was set (#8004). - Fixed a bug where the podman container restore command could panic when the container in question was in a pod (#8026). - Fixed a bug where the output of the podman image trust show --raw command was not properly formatted. - Fixed a bug where the podman runlabel command could panic if a label to run was not given (#8038). - Fixed a bug where the podman run and podman start --attach commands would exit with an error when the user detached manually using the detach keys on remote Podman (#7979). - Fixed a bug where rootless CNI networking did not use the dnsname CNI plugin if it was not available on the host, despite it always being available in the container used for rootless networking (#8040). - Fixed a bug where Podman did not properly handle cases where an OCI runtime is specified by its full path, and could revert to using another OCI runtime with the same binary path that existed in the system $PATH on subsequent invocations. - Fixed a bug where the --net=host option to podman create and podman run would cause the /etc/hosts file to be incorrectly populated (#8054). - Fixed a bug where the podman inspect command did not include container network information when the container shared its network namespace (IE, joined a pod or another container's network namespace via --net=container:...) (#8073). - Fixed a bug where the podman ps command did not include information on all ports a container was publishing. - Fixed a bug where the podman build command incorrectly forwarded STDIN into build containers from RUN instructions. - Fixed a bug where the podman wait command's --interval option did not work when units were not specified for the duration (#8088). - Fixed a bug where the --detach-keys and --detach options could be passed to podman create despite having no effect (and not making sense in that context). - Fixed a bug where Podman could not start containers if running on a system without a /etc/resolv.conf file (which occurs on some WSL2 images) (#8089). - Fixed a bug where the --extract option to podman cp was nonfunctional. - Fixed a bug where the --cidfile option to podman run would, when the container was not run with --detach, only create the file after the container exited (#8091). - Fixed a bug where the podman images and podman images -a commands could panic and not list any images when certain improperly-formatted images were present in storage (#8148). - Fixed a bug where the podman events command could, when the journald events backend was in use, become nonfunctional when a badly-formatted event or a log message that container certain string was present in the journal (#8125). - Fixed a bug where remote Podman would, when using SSH transport, not authenticate to the server using hostkeys when connecting on a port other than 22 (#8139). - Fixed a bug where the podman attach command would not exit when containers stopped (#8154). - Fixed a bug where Podman did not properly clean paths before verifying them, resulting in Podman refusing to start if the root or temporary directories were specified with extra trailing / characters (#8160). - Fixed a bug where remote Podman did not support hashed hostnames in the known_hosts file on the host for establishing connections (#8159). - Fixed a bug where the podman image exists command would return non-zero (false) when multiple potential matches for the given name existed. - Fixed a bug where the podman manifest inspect command on images that are not manifest lists would error instead of inspecting the image (#8023). - Fixed a bug where the podman system service command would fail if the directory the Unix socket was to be created inside did not exist (#8184). - Fixed a bug where pods that shared the IPC namespace (which is done by default) did not share a /dev/shm filesystem between all containers in the pod (#8181). - Fixed a bug where filters passed to podman volume list were not inclusive (#6765). - Fixed a bug where the podman volume create command would fail when the volume's data directory already existed (as might occur when a volume was not completely removed) (#8253). - Fixed a bug where the podman run and podman create commands would deadlock when trying to create a container that mounted the same named volume at multiple locations (e.g. podman run -v testvol:/test1 -v testvol:/test2) (#8221). - Fixed a bug where the parsing of the --net option to podman build was incorrect (#8322). - Fixed a bug where the podman build command would print the ID of the built image twice when using remote Podman (#8332). - Fixed a bug where the podman stats command did not show memory limits for containers (#8265). - Fixed a bug where the podman pod inspect command printed the static MAC address of the pod in a non-human-readable format (#8386). - Fixed a bug where the --tls-verify option of the podman play kube command had its logic inverted (false would enforce the use of TLS, true would disable it). - Fixed a bug where the podman network rm command would error when trying to remove macvlan networks and rootless CNI networks (#8491). - Fixed a bug where Podman was not setting sane defaults for missing XDG_ environment variables. - Fixed a bug where remote Podman would check if volume paths to be mounted in the container existed on the host, not the server (#8473). - Fixed a bug where the podman manifest create and podman manifest add commands on local images would drop any images in the manifest not pulled by the host. - Fixed a bug where networks made by podman network create did not include the tuning plugin, and as such did not support setting custom MAC addresses (#8385). - Fixed a bug where container healthchecks did not use $PATH when searching for the Podman executable to run the healthcheck. - Fixed a bug where the --ip-range option to podman network create did not properly handle non-classful subnets when calculating the last usable IP for DHCP assignment (#8448). - Fixed a bug where the podman container ps alias for podman ps was missing (#8445). * API - The Compat Create endpoint for Container has received a major refactor to share more code with the Libpod Create endpoint, and should be significantly more stable. - A Compat endpoint for exporting multiple images at once, GET /images/get, has been added (#7950). - The Compat Network Connect and Network Disconnect endpoints have been added. - Endpoints that deal with image registries now support a X-Registry-Config header to specify registry authentication configuration. - The Compat Create endpoint for images now properly supports specifying images by digest. - The Libpod Build endpoint for images now supports an httpproxy query parameter which, if set to true, will forward the server's HTTP proxy settings into the build container for RUN instructions. - The Libpod Untag endpoint for images will now remove all tags for the given image if no repository and tag are specified for removal. - Fixed a bug where the Ping endpoint misspelled a header name (Libpod-Buildha-Version instead of Libpod-Buildah-Version). - Fixed a bug where the Ping endpoint sent an extra newline at the end of its response where Docker did not. - Fixed a bug where the Compat Logs endpoint for containers did not send a newline character after each log line. - Fixed a bug where the Compat Logs endpoint for containers would mangle line endings to change newline characters to add a preceding carriage return (#7942). - Fixed a bug where the Compat Inspect endpoint for Containers did not properly list the container's stop signal (#7917). - Fixed a bug where the Compat Inspect endpoint for Containers formatted the container's create time incorrectly (#7860). - Fixed a bug where the Compat Inspect endpoint for Containers did not include the container's Path, Args, and Restart Count. - Fixed a bug where the Compat Inspect endpoint for Containers prefixed added and dropped capabilities with CAP_ (Docker does not do so). - Fixed a bug where the Compat Info endpoint for the Engine did not include configured registries. - Fixed a bug where the server could panic if a client closed a connection midway through an image pull (#7896). - Fixed a bug where the Compat Create endpoint for volumes returned an error when a volume with the same name already existed, instead of succeeding with a 201 code (#7740). - Fixed a bug where a client disconnecting from the Libpod or Compat events endpoints could result in the server using 100% CPU (#7946). - Fixed a bug where the "no such image" error message sent by the Compat Inspect endpoint for Images returned a 404 status code with an error that was improperly formatted for Docker compatibility. - Fixed a bug where the Compat Create endpoint for networks did not properly set a default for the driver parameter if it was not provided by the client. - Fixed a bug where the Compat Inspect endpoint for images did not populate the RootFS field of the response. - Fixed a bug where the Compat Inspect endpoint for images would omit the ParentId field if the image had no parent, and the Created field if the image did not have a creation time. - Fixed a bug where the Compat Remove endpoint for Networks did not support the Force query parameter. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-310=1 Package List: - openSUSE Leap 15.2 (noarch): libcontainers-common-20210112-lp152.2.6.1 podman-cni-config-2.2.1-lp152.4.9.1 - openSUSE Leap 15.2 (x86_64): buildah-1.19.2-lp152.2.3.1 podman-2.2.1-lp152.4.9.1 References: https://www.suse.com/security/cve/CVE-2019-10214.html https://www.suse.com/security/cve/CVE-2020-10696.html https://bugzilla.suse.com/1144065 https://bugzilla.suse.com/1165184

1 0

openSUSE-SU-2021:0304-1: important: Security update for screen
by opensuse-security＠opensuse.org 18 Feb '21

18 Feb '21

openSUSE Security Update: Security update for screen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0304-1 Rating: important References: #1182092 Cross-References: CVE-2021-26937 CVSS scores: CVE-2021-26937 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for screen fixes the following issues: - CVE-2021-26937: Fixed double width combining char handling that could lead to a denial of service or code execution (bsc#1182092). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-304=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): screen-4.6.2-lp152.6.3.1 screen-debuginfo-4.6.2-lp152.6.3.1 screen-debugsource-4.6.2-lp152.6.3.1 References: https://www.suse.com/security/cve/CVE-2021-26937.html https://bugzilla.suse.com/1182092

1 0

openSUSE-SU-2021:0305-1: important: Security update for php7
by opensuse-security＠opensuse.org 18 Feb '21

18 Feb '21

openSUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0305-1 Rating: important References: #1182049 Cross-References: CVE-2021-21702 CVSS scores: CVE-2021-21702 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for php7 fixes the following issues: - CVE-2021-21702 [bsc#1182049]: NULL pointer dereference in SoapClient This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-305=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): apache2-mod_php7-7.4.6-lp152.2.15.1 apache2-mod_php7-debuginfo-7.4.6-lp152.2.15.1 php7-7.4.6-lp152.2.15.1 php7-bcmath-7.4.6-lp152.2.15.1 php7-bcmath-debuginfo-7.4.6-lp152.2.15.1 php7-bz2-7.4.6-lp152.2.15.1 php7-bz2-debuginfo-7.4.6-lp152.2.15.1 php7-calendar-7.4.6-lp152.2.15.1 php7-calendar-debuginfo-7.4.6-lp152.2.15.1 php7-ctype-7.4.6-lp152.2.15.1 php7-ctype-debuginfo-7.4.6-lp152.2.15.1 php7-curl-7.4.6-lp152.2.15.1 php7-curl-debuginfo-7.4.6-lp152.2.15.1 php7-dba-7.4.6-lp152.2.15.1 php7-dba-debuginfo-7.4.6-lp152.2.15.1 php7-debuginfo-7.4.6-lp152.2.15.1 php7-debugsource-7.4.6-lp152.2.15.1 php7-devel-7.4.6-lp152.2.15.1 php7-dom-7.4.6-lp152.2.15.1 php7-dom-debuginfo-7.4.6-lp152.2.15.1 php7-embed-7.4.6-lp152.2.15.1 php7-embed-debuginfo-7.4.6-lp152.2.15.1 php7-enchant-7.4.6-lp152.2.15.1 php7-enchant-debuginfo-7.4.6-lp152.2.15.1 php7-exif-7.4.6-lp152.2.15.1 php7-exif-debuginfo-7.4.6-lp152.2.15.1 php7-fastcgi-7.4.6-lp152.2.15.1 php7-fastcgi-debuginfo-7.4.6-lp152.2.15.1 php7-fileinfo-7.4.6-lp152.2.15.1 php7-fileinfo-debuginfo-7.4.6-lp152.2.15.1 php7-firebird-7.4.6-lp152.2.15.1 php7-firebird-debuginfo-7.4.6-lp152.2.15.1 php7-fpm-7.4.6-lp152.2.15.1 php7-fpm-debuginfo-7.4.6-lp152.2.15.1 php7-ftp-7.4.6-lp152.2.15.1 php7-ftp-debuginfo-7.4.6-lp152.2.15.1 php7-gd-7.4.6-lp152.2.15.1 php7-gd-debuginfo-7.4.6-lp152.2.15.1 php7-gettext-7.4.6-lp152.2.15.1 php7-gettext-debuginfo-7.4.6-lp152.2.15.1 php7-gmp-7.4.6-lp152.2.15.1 php7-gmp-debuginfo-7.4.6-lp152.2.15.1 php7-iconv-7.4.6-lp152.2.15.1 php7-iconv-debuginfo-7.4.6-lp152.2.15.1 php7-intl-7.4.6-lp152.2.15.1 php7-intl-debuginfo-7.4.6-lp152.2.15.1 php7-json-7.4.6-lp152.2.15.1 php7-json-debuginfo-7.4.6-lp152.2.15.1 php7-ldap-7.4.6-lp152.2.15.1 php7-ldap-debuginfo-7.4.6-lp152.2.15.1 php7-mbstring-7.4.6-lp152.2.15.1 php7-mbstring-debuginfo-7.4.6-lp152.2.15.1 php7-mysql-7.4.6-lp152.2.15.1 php7-mysql-debuginfo-7.4.6-lp152.2.15.1 php7-odbc-7.4.6-lp152.2.15.1 php7-odbc-debuginfo-7.4.6-lp152.2.15.1 php7-opcache-7.4.6-lp152.2.15.1 php7-opcache-debuginfo-7.4.6-lp152.2.15.1 php7-openssl-7.4.6-lp152.2.15.1 php7-openssl-debuginfo-7.4.6-lp152.2.15.1 php7-pcntl-7.4.6-lp152.2.15.1 php7-pcntl-debuginfo-7.4.6-lp152.2.15.1 php7-pdo-7.4.6-lp152.2.15.1 php7-pdo-debuginfo-7.4.6-lp152.2.15.1 php7-pgsql-7.4.6-lp152.2.15.1 php7-pgsql-debuginfo-7.4.6-lp152.2.15.1 php7-phar-7.4.6-lp152.2.15.1 php7-phar-debuginfo-7.4.6-lp152.2.15.1 php7-posix-7.4.6-lp152.2.15.1 php7-posix-debuginfo-7.4.6-lp152.2.15.1 php7-readline-7.4.6-lp152.2.15.1 php7-readline-debuginfo-7.4.6-lp152.2.15.1 php7-shmop-7.4.6-lp152.2.15.1 php7-shmop-debuginfo-7.4.6-lp152.2.15.1 php7-snmp-7.4.6-lp152.2.15.1 php7-snmp-debuginfo-7.4.6-lp152.2.15.1 php7-soap-7.4.6-lp152.2.15.1 php7-soap-debuginfo-7.4.6-lp152.2.15.1 php7-sockets-7.4.6-lp152.2.15.1 php7-sockets-debuginfo-7.4.6-lp152.2.15.1 php7-sodium-7.4.6-lp152.2.15.1 php7-sodium-debuginfo-7.4.6-lp152.2.15.1 php7-sqlite-7.4.6-lp152.2.15.1 php7-sqlite-debuginfo-7.4.6-lp152.2.15.1 php7-sysvmsg-7.4.6-lp152.2.15.1 php7-sysvmsg-debuginfo-7.4.6-lp152.2.15.1 php7-sysvsem-7.4.6-lp152.2.15.1 php7-sysvsem-debuginfo-7.4.6-lp152.2.15.1 php7-sysvshm-7.4.6-lp152.2.15.1 php7-sysvshm-debuginfo-7.4.6-lp152.2.15.1 php7-test-7.4.6-lp152.2.15.1 php7-tidy-7.4.6-lp152.2.15.1 php7-tidy-debuginfo-7.4.6-lp152.2.15.1 php7-tokenizer-7.4.6-lp152.2.15.1 php7-tokenizer-debuginfo-7.4.6-lp152.2.15.1 php7-xmlreader-7.4.6-lp152.2.15.1 php7-xmlreader-debuginfo-7.4.6-lp152.2.15.1 php7-xmlrpc-7.4.6-lp152.2.15.1 php7-xmlrpc-debuginfo-7.4.6-lp152.2.15.1 php7-xmlwriter-7.4.6-lp152.2.15.1 php7-xmlwriter-debuginfo-7.4.6-lp152.2.15.1 php7-xsl-7.4.6-lp152.2.15.1 php7-xsl-debuginfo-7.4.6-lp152.2.15.1 php7-zip-7.4.6-lp152.2.15.1 php7-zip-debuginfo-7.4.6-lp152.2.15.1 php7-zlib-7.4.6-lp152.2.15.1 php7-zlib-debuginfo-7.4.6-lp152.2.15.1 References: https://www.suse.com/security/cve/CVE-2021-21702.html https://bugzilla.suse.com/1182049

1 0

openSUSE-SU-2021:0303-1: important: Security update for jasper
by opensuse-security＠opensuse.org 18 Feb '21

18 Feb '21

openSUSE Security Update: Security update for jasper ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0303-1 Rating: important References: #1179748 #1181483 Cross-References: CVE-2020-27828 CVE-2021-3272 CVSS scores: CVE-2020-27828 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-27828 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-3272 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-3272 (SUSE): 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for jasper fixes the following issues: - bsc#1179748 CVE-2020-27828: Fix heap overflow by checking maxrlvls - bsc#1181483 CVE-2021-3272: Fix buffer over-read in jp2_decode This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-303=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): jasper-2.0.14-lp152.7.6.1 jasper-debuginfo-2.0.14-lp152.7.6.1 jasper-debugsource-2.0.14-lp152.7.6.1 libjasper-devel-2.0.14-lp152.7.6.1 libjasper4-2.0.14-lp152.7.6.1 libjasper4-debuginfo-2.0.14-lp152.7.6.1 - openSUSE Leap 15.2 (x86_64): libjasper4-32bit-2.0.14-lp152.7.6.1 libjasper4-32bit-debuginfo-2.0.14-lp152.7.6.1 References: https://www.suse.com/security/cve/CVE-2020-27828.html https://www.suse.com/security/cve/CVE-2021-3272.html https://bugzilla.suse.com/1179748 https://bugzilla.suse.com/1181483

1 0

openSUSE-SU-2021:0302-1: important: Security update for python-bottle
by opensuse-security＠opensuse.org 16 Feb '21

16 Feb '21

openSUSE Security Update: Security update for python-bottle ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0302-1 Rating: important References: #1182181 Cross-References: CVE-2020-28473 CVSS scores: CVE-2020-28473 (NVD) : 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2020-28473 (SUSE): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-bottle fixes the following issues: - CVE-2020-28473: Fixed Web Cache Poisoning vulnerability using parameter cloaking (bsc#1182181). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-302=1 Package List: - openSUSE Leap 15.2 (noarch): python-bottle-doc-0.12.13-lp152.4.3.1 python2-bottle-0.12.13-lp152.4.3.1 python3-bottle-0.12.13-lp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2020-28473.html https://bugzilla.suse.com/1182181

1 0

openSUSE-SU-2021:0300-1: moderate: Security update for mumble
by opensuse-security＠opensuse.org 16 Feb '21

16 Feb '21

openSUSE Security Update: Security update for mumble ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0300-1 Rating: moderate References: #1180068 #1182123 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for mumble fixes the following issues: mumble was updated to 1.3.4: * Fix use of outdated (non-existent) notification icon names * Fix Security vulnerability caused by allowing non http/https URL schemes in public server list (boo#1182123) * Server: Fix Exit status for actions like --version or --supw * Fix packet loss & audio artifacts caused by OCB2 XEX* mitigation - update apparmor profiles to get warning free again on 15.2 - use abstractions for ssl files - allow inet dgram sockets as mumble can also work via udp - allow netlink socket (probably for dbus) - properly allow lsb_release again - add support for optional local include - start murmurd directly as user mumble-server it gets rid of the dac_override/setgid/setuid/chown permissions Update to upstream version 1.3.3 Client: * Fixed: Chatbox invisble (zero height) (#4388) * Fixed: Handling of invalid packet sizes (#4394) * Fixed: Race-condition leading to loss of shortcuts (#4430) * Fixed: Link in About dialog is now clickable again (#4454) * Fixed: Sizing issues in ACL-Editor (#4455) * Improved: PulseAudio now always samples at 48 kHz (#4449) Server: * Fixed: Crash due to problems when using PostgreSQL (#4370) * Fixed: Handling of invalid package sizes (#4392) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-300=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): mumble-1.3.4-lp152.2.6.1 mumble-debuginfo-1.3.4-lp152.2.6.1 mumble-debugsource-1.3.4-lp152.2.6.1 mumble-server-1.3.4-lp152.2.6.1 mumble-server-debuginfo-1.3.4-lp152.2.6.1 - openSUSE Leap 15.2 (x86_64): mumble-32bit-1.3.4-lp152.2.6.1 mumble-32bit-debuginfo-1.3.4-lp152.2.6.1 References: https://bugzilla.suse.com/1180068 https://bugzilla.suse.com/1182123

1 0

openSUSE-SU-2021:0296-1: important: Security update for opera
by opensuse-security＠opensuse.org 15 Feb '21

15 Feb '21

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0296-1 Rating: important References: #1181827 Cross-References: CVE-2021-21148 Affected Products: openSUSE Leap 15.2:NonFree ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for opera fixes the following issues: - Update to version 74.0.3911.107 - CHR-8311 Update chromium on desktop-stable-88-3911 to 88.0.4324.150 - DNA-90329 Implement client_capabilities negotiation for Flow / Sync - DNA-90560 [Search Tabs] Open Tabs On Top - DNA-90620 Add opauto tests for tab snoozing - DNA-90628 Update opauto tests after design changes - DNA-90818 Only 3 recently closed tabs are shown in a search mode - DNA-90911 Enable search-tabs-open-tabs-on-top on developer - DNA-90990 Crash at opera::AddressBarView::NotifyBoundsChanged() - DNA-90991 Opera doesn��t show version and ��Relaunch�� button despite update is ready - DNA-91097 Crash at extensions::BrowserSidebarPrivateGetPremium ExtensionsInfoFunction::Run() - DNA-91163 [Win] ��URL navigation filters�� subpage doesn��t react on actions - DNA-91196 [Flow] Device capabilities is not properly saved in Local State - DNA-91276 Sidebar setup wont open - The update to chromium 88.0.4324.150 fixes following issues: - CVE-2021-21148 (1181827) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2:NonFree: zypper in -t patch openSUSE-2021-296=1 Package List: - openSUSE Leap 15.2:NonFree (x86_64): opera-74.0.3911.107-lp152.2.34.1 References: https://www.suse.com/security/cve/CVE-2021-21148.html https://bugzilla.suse.com/1181827

1 0

openSUSE-SU-2021:0295-1: important: Security update for librepo
by opensuse-security＠opensuse.org 15 Feb '21

15 Feb '21

openSUSE Security Update: Security update for librepo ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0295-1 Rating: important References: #1175475 Cross-References: CVE-2020-14352 CVSS scores: CVE-2020-14352 (NVD) : 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVE-2020-14352 (SUSE): 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for librepo fixes the following issues: - Upgrade to 1.12.1 + Validate path read from repomd.xml (bsc#1175475, CVE-2020-14352) - Changes from 1.12.0 + Prefer mirrorlist/metalink over baseurl (rh#1775184) + Decode package URL when using for local filename (rh#1817130) + Fix memory leak in lr_download_metadata() and lr_yum_download_remote() + Download sources work when at least one of specified is working (rh#1775184) This update was imported from the SUSE:SLE-15-SP2:Update update project. This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-295=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): librepo-devel-1.12.1-bp152.2.6.1 librepo0-1.12.1-bp152.2.6.1 python3-librepo-1.12.1-bp152.2.6.1 References: https://www.suse.com/security/cve/CVE-2020-14352.html https://bugzilla.suse.com/1175475

1 0