March 2021 - openSUSE Security Announce

openSUSE-SU-2021:0423-1: moderate: Security update for postgresql12
by opensuse-security＠opensuse.org 16 Mar '21

16 Mar '21

openSUSE Security Update: Security update for postgresql12 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0423-1 Rating: moderate References: #1179765 #1182040 Cross-References: CVE-2021-3393 CVSS scores: CVE-2021-3393 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for postgresql12 fixes the following issues: Upgrade to version 12.6: - Reindexing might be needed after applying this update. - CVE-2021-3393, bsc#1182040: Fix information leakage in constraint-violation error messages. This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-423=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libecpg6-12.6-lp152.3.16.1 libecpg6-debuginfo-12.6-lp152.3.16.1 libpq5-12.6-lp152.3.16.1 libpq5-debuginfo-12.6-lp152.3.16.1 postgresql12-12.6-lp152.3.16.1 postgresql12-contrib-12.6-lp152.3.16.1 postgresql12-contrib-debuginfo-12.6-lp152.3.16.1 postgresql12-debuginfo-12.6-lp152.3.16.1 postgresql12-debugsource-12.6-lp152.3.16.1 postgresql12-devel-12.6-lp152.3.16.1 postgresql12-devel-debuginfo-12.6-lp152.3.16.1 postgresql12-llvmjit-12.6-lp152.3.16.1 postgresql12-llvmjit-debuginfo-12.6-lp152.3.16.1 postgresql12-plperl-12.6-lp152.3.16.1 postgresql12-plperl-debuginfo-12.6-lp152.3.16.1 postgresql12-plpython-12.6-lp152.3.16.1 postgresql12-plpython-debuginfo-12.6-lp152.3.16.1 postgresql12-pltcl-12.6-lp152.3.16.1 postgresql12-pltcl-debuginfo-12.6-lp152.3.16.1 postgresql12-server-12.6-lp152.3.16.1 postgresql12-server-debuginfo-12.6-lp152.3.16.1 postgresql12-server-devel-12.6-lp152.3.16.1 postgresql12-server-devel-debuginfo-12.6-lp152.3.16.1 postgresql12-test-12.6-lp152.3.16.1 - openSUSE Leap 15.2 (noarch): postgresql12-docs-12.6-lp152.3.16.1 - openSUSE Leap 15.2 (x86_64): libecpg6-32bit-12.6-lp152.3.16.1 libecpg6-32bit-debuginfo-12.6-lp152.3.16.1 libpq5-32bit-12.6-lp152.3.16.1 libpq5-32bit-debuginfo-12.6-lp152.3.16.1 References: https://www.suse.com/security/cve/CVE-2021-3393.html https://bugzilla.suse.com/1179765 https://bugzilla.suse.com/1182040

1 0

openSUSE-SU-2021:0429-1: moderate: Security update for python-markdown2
by opensuse-security＠opensuse.org 16 Mar '21

16 Mar '21

openSUSE Security Update: Security update for python-markdown2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0429-1 Rating: moderate References: #1171379 #1181270 #1183171 Cross-References: CVE-2021-26813 CVSS scores: CVE-2021-26813 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for python-markdown2 fixes the following issues: Update to 2.4.0 (boo#1181270): - [pull #377] Fixed bug breaking strings elements in metadata lists - [pull #380] When rendering fenced code blocks, also add the language-LANG class - [pull #387] Regex DoS fixes (CVE-2021-26813, boo#1183171) - Switch off failing tests (gh#trentm/python-markdown2#388), ignore failing test suite. update to 2.3.9: - [pull #335] Added header support for wiki tables - [pull #336] Reset _toc when convert is run - [pull #353] XSS fix - [pull #350] XSS fix - Add patch to fix unsanitized input for cross-site scripting (boo#1171379) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-429=1 Package List: - openSUSE Leap 15.2 (noarch): python2-markdown2-2.4.0-lp152.2.3.1 python3-markdown2-2.4.0-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-26813.html https://bugzilla.suse.com/1171379 https://bugzilla.suse.com/1181270 https://bugzilla.suse.com/1183171

1 0

openSUSE-SU-2021:0416-1: moderate: Security update for connman
by opensuse-security＠opensuse.org 16 Mar '21

16 Mar '21

openSUSE Security Update: Security update for connman ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0416-1 Rating: moderate References: #1181751 Cross-References: CVE-2021-26675 CVE-2021-26676 CVSS scores: CVE-2021-26675 (NVD) : 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-26676 (NVD) : 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for connman fixes the following issues: Update to 1.39 (boo#1181751): * Fix issue with scanning state synchronization and iwd. * Fix issue with invalid key with 4-way handshake offloading. * Fix issue with DNS proxy length checks to prevent buffer overflow. (CVE-2021-26675) * Fix issue with DHCP leaking stack data via uninitialized variable. (CVE-2021-26676) Update to 1.38: * Fix issue with online check on IP address update. * Fix issue with OpenVPN and encrypted private keys. * Fix issue with finishing of VPN connections. * Add support for updated stable iwd APIs. * Add support for WireGuard networks. Update to 1.37: * Fix issue with handling invalid gateway addresses. * Fix issue with handling updates of default gateway. * Fix issue with DHCP servers that require broadcast flag. * Add support for option to use gateways as time servers. * Add support for option to select default technology. * Add support for Address Conflict Detection (ACD). * Add support for IPv6 iptables management. Change in 1.36: * Fix issue with DNS short response on error handling. * Fix issue with handling incoming DNS requests. * Fix issue with handling empty timeserver list. * Fix issue with incorrect DHCP byte order. * Fix issue with AllowDomainnameUpdates handling. * Fix issue with IPv4 link-local IP conflict error. * Fix issue with handling WISPr over TLS connections. * Fix issue with WiFi background scanning handling. * Fix issue with WiFi disconnect+connect race condition. * Fix issue with WiFi scanning and tethering operation. * Fix issue with WiFi security change handling. * Fix issue with missing signal for WPS changes. * Fix issue with online check retry handling. * Add support for systemd-resolved backend. * Add support for mDNS configuration setup. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-416=1 Package List: - openSUSE Leap 15.2 (x86_64): connman-1.39-lp152.3.3.1 connman-client-1.39-lp152.3.3.1 connman-client-debuginfo-1.39-lp152.3.3.1 connman-debuginfo-1.39-lp152.3.3.1 connman-debugsource-1.39-lp152.3.3.1 connman-devel-1.39-lp152.3.3.1 connman-doc-1.39-lp152.3.3.1 connman-nmcompat-1.39-lp152.3.3.1 connman-plugin-hh2serial-gps-1.39-lp152.3.3.1 connman-plugin-hh2serial-gps-debuginfo-1.39-lp152.3.3.1 connman-plugin-iospm-1.39-lp152.3.3.1 connman-plugin-iospm-debuginfo-1.39-lp152.3.3.1 connman-plugin-l2tp-1.39-lp152.3.3.1 connman-plugin-l2tp-debuginfo-1.39-lp152.3.3.1 connman-plugin-openconnect-1.39-lp152.3.3.1 connman-plugin-openconnect-debuginfo-1.39-lp152.3.3.1 connman-plugin-openvpn-1.39-lp152.3.3.1 connman-plugin-openvpn-debuginfo-1.39-lp152.3.3.1 connman-plugin-polkit-1.39-lp152.3.3.1 connman-plugin-pptp-1.39-lp152.3.3.1 connman-plugin-pptp-debuginfo-1.39-lp152.3.3.1 connman-plugin-tist-1.39-lp152.3.3.1 connman-plugin-tist-debuginfo-1.39-lp152.3.3.1 connman-plugin-vpnc-1.39-lp152.3.3.1 connman-plugin-vpnc-debuginfo-1.39-lp152.3.3.1 connman-plugin-wireguard-1.39-lp152.3.3.1 connman-plugin-wireguard-debuginfo-1.39-lp152.3.3.1 connman-test-1.39-lp152.3.3.1 References: https://www.suse.com/security/cve/CVE-2021-26675.html https://www.suse.com/security/cve/CVE-2021-26676.html https://bugzilla.suse.com/1181751

1 0

openSUSE-SU-2021:0428-1: Security update for freeradius-server
by opensuse-security＠opensuse.org 16 Mar '21

16 Mar '21

openSUSE Security Update: Security update for freeradius-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0428-1 Rating: low References: #1180525 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for freeradius-server fixes the following issues: - move logrotate options into specific parts for each log as "global" options will persist past and clobber global options in the main logrotate config (bsc#1180525) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-428=1 Package List: - openSUSE Leap 15.2 (x86_64): freeradius-server-3.0.21-lp152.2.6.1 freeradius-server-debuginfo-3.0.21-lp152.2.6.1 freeradius-server-debugsource-3.0.21-lp152.2.6.1 freeradius-server-devel-3.0.21-lp152.2.6.1 freeradius-server-doc-3.0.21-lp152.2.6.1 freeradius-server-krb5-3.0.21-lp152.2.6.1 freeradius-server-krb5-debuginfo-3.0.21-lp152.2.6.1 freeradius-server-ldap-3.0.21-lp152.2.6.1 freeradius-server-ldap-debuginfo-3.0.21-lp152.2.6.1 freeradius-server-libs-3.0.21-lp152.2.6.1 freeradius-server-libs-debuginfo-3.0.21-lp152.2.6.1 freeradius-server-mysql-3.0.21-lp152.2.6.1 freeradius-server-mysql-debuginfo-3.0.21-lp152.2.6.1 freeradius-server-perl-3.0.21-lp152.2.6.1 freeradius-server-perl-debuginfo-3.0.21-lp152.2.6.1 freeradius-server-postgresql-3.0.21-lp152.2.6.1 freeradius-server-postgresql-debuginfo-3.0.21-lp152.2.6.1 freeradius-server-python3-3.0.21-lp152.2.6.1 freeradius-server-python3-debuginfo-3.0.21-lp152.2.6.1 freeradius-server-sqlite-3.0.21-lp152.2.6.1 freeradius-server-sqlite-debuginfo-3.0.21-lp152.2.6.1 freeradius-server-utils-3.0.21-lp152.2.6.1 freeradius-server-utils-debuginfo-3.0.21-lp152.2.6.1 References: https://bugzilla.suse.com/1180525

1 0

openSUSE-SU-2021:0415-1: moderate: Security update for froxlor
by opensuse-security＠opensuse.org 16 Mar '21

16 Mar '21

openSUSE Security Update: Security update for froxlor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0415-1 Rating: moderate References: #1025193 #1082318 #846355 #958100 Cross-References: CVE-2016-5100 CVSS scores: CVE-2016-5100 (NVD) : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update for froxlor fixes the following issues: - Upstream upgrade to version 0.10.23 (boo#846355) - Upstream upgrade to version 0.10.22 (boo#846355) - BuildRequire cron as this contains now the cron directories - Use %license for COPYING file instead of %doc [boo#1082318] Upstream upgrade to version 0.9.40.1 (boo#846355) new features besides API that found their way in: - 2FA / TwoFactor Authentication for accounts - MySQL8 compatibility - new implementation of Let's Encrypt (acme.sh) - customizable error/access log handling for webserver (format, level, pipe-to-script, etc.) - lots and lots of bugfixes and small enhancements Upstream upgrade to version 0.9.39.5 (boo#846355) - PHP rand function for random number generation fixed in previous version (boo#1025193) CVE-2016-5100 - upstream upgrade to version 0.9.39 (boo#846355) - Add and change of froxlor config files and manual - Change Requires to enable use with php7 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-415=1 Package List: - openSUSE Leap 15.2 (noarch): froxlor-0.10.23-lp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2016-5100.html https://bugzilla.suse.com/1025193 https://bugzilla.suse.com/1082318 https://bugzilla.suse.com/846355 https://bugzilla.suse.com/958100

1 0

openSUSE-SU-2021:0413-1: important: Security update for opera
by opensuse-security＠opensuse.org 15 Mar '21

15 Mar '21

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0413-1 Rating: important References: #1182358 Cross-References: CVE-2021-21148 CVE-2021-21149 CVE-2021-21150 CVE-2021-21151 CVE-2021-21152 CVE-2021-21153 CVE-2021-21154 CVE-2021-21155 CVE-2021-21156 CVE-2021-21157 CVSS scores: CVE-2021-21148 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2:NonFree ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for opera fixes the following issues: - Update to version 74.0.3911.203 - CHR-8324 Update chromium on desktop-stable-88-3911 to 88.0.4324.182(boo#1182358) - DNA-90762 Replace ��Don��t show again�� with ��Discard�� - DNA-90974 Crash at opera::PersistentRecentlyClosedWindows::GetEntryType(SessionID) - DNA-91289 [Search tabs] Wrong tab stays highlighted after removing another tab - DNA-91476 Invalid memory dereference PlayerServiceBrowsertest - DNA-91502 Change system name on opera://about page for MacOS - DNA-91740 Missing title in Extensions Toolbar Menu - The update to chromium 88.0.4324.182 fixes following issues: CVE-2021-21149, CVE-2021-21150, CVE-2021-21151, CVE-2021-21152, CVE-2021-21153, CVE-2021-21154, CVE-2021-21155, CVE-2021-21156, CVE-2021-21157 - Update to version 74.0.3911.160 - DNA-90409 Cleanup Javascript dialogs: app modal & tab modal - DNA-90720 [Search Tabs] Allow discarding recently closed items - DNA-90802 [Windows] Debug fails on linking - DNA-91130 heap-use-after-free in CashbackBackendServiceTest.AutoUpdateSchedule - DNA-91152 Allow reading agent variables in trigger conditions - DNA-91225 [Search tabs] The webpage doesn��t move from ��Open tabs�� to ��Recently closed�� section - DNA-91243 Add Rich Hint support for the cashback badge and popup - DNA-91483 component_unittests are timing out - DNA-91516 Sidebar setup opens only with cashback enabled - DNA-91601 No text in 1st line of address bar dropdown suggestions - DNA-91603 Jumbo build problem on desktop-stable-88-3911 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2:NonFree: zypper in -t patch openSUSE-2021-413=1 Package List: - openSUSE Leap 15.2:NonFree (x86_64): opera-74.0.3911.203-lp152.2.37.1 References: https://www.suse.com/security/cve/CVE-2021-21148.html https://www.suse.com/security/cve/CVE-2021-21149.html https://www.suse.com/security/cve/CVE-2021-21150.html https://www.suse.com/security/cve/CVE-2021-21151.html https://www.suse.com/security/cve/CVE-2021-21152.html https://www.suse.com/security/cve/CVE-2021-21153.html https://www.suse.com/security/cve/CVE-2021-21154.html https://www.suse.com/security/cve/CVE-2021-21155.html https://www.suse.com/security/cve/CVE-2021-21156.html https://www.suse.com/security/cve/CVE-2021-21157.html https://bugzilla.suse.com/1182358

1 0

openSUSE-SU-2021:0408-1: important: Security update for openldap2
by opensuse-security＠opensuse.org 14 Mar '21

14 Mar '21

openSUSE Security Update: Security update for openldap2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0408-1 Rating: important References: #1182279 #1182408 #1182411 #1182412 #1182413 #1182415 #1182416 #1182417 #1182418 #1182419 #1182420 Cross-References: CVE-2020-36221 CVE-2020-36222 CVE-2020-36223 CVE-2020-36224 CVE-2020-36225 CVE-2020-36226 CVE-2020-36227 CVE-2020-36228 CVE-2020-36229 CVE-2020-36230 CVE-2021-27212 CVSS scores: CVE-2020-36221 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-36221 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-36222 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-36222 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-36223 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-36223 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-36224 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-36224 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-36225 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-36225 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-36226 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-36226 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-36227 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-36227 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-36228 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-36228 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-36229 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-36229 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-36230 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-36230 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-27212 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-27212 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update for openldap2 fixes the following issues: - bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the X.509 DN parsing in decode.c ber_next_element, resulting in denial of service. - bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN parsing in ad_keystring, resulting in denial of service. - bsc#1182412 CVE-2020-36228 - integer underflow leading to crash in the Certificate List Exact Assertion processing, resulting in denial of service. - bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of service. - bsc#1182416 CVE-2020-36225 - double free and slapd crash in the saslAuthzTo processing, resulting in denial of service. - bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash in the saslAuthzTo processing, resulting in denial of service. - bsc#1182415 CVE-2020-36226 - memch->bv_len miscalculation and slapd crash in the saslAuthzTo processing, resulting in denial of service. - bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the saslAuthzTo validation, resulting in denial of service. - bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact Assertion processing, resulting in denial of service (schema_init.c serialNumberAndIssuerCheck). - bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter control handling, resulting in denial of service (double free and out-of-bounds read). - bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function via a crafted packet, resulting in a denial of service (daemon exit) via a short timestamp. This is related to schema_init.c and checkTime. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-408=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libldap-2_4-2-2.4.46-lp152.14.18.1 libldap-2_4-2-debuginfo-2.4.46-lp152.14.18.1 openldap2-2.4.46-lp152.14.18.1 openldap2-back-meta-2.4.46-lp152.14.18.1 openldap2-back-meta-debuginfo-2.4.46-lp152.14.18.1 openldap2-back-perl-2.4.46-lp152.14.18.1 openldap2-back-perl-debuginfo-2.4.46-lp152.14.18.1 openldap2-back-sock-2.4.46-lp152.14.18.1 openldap2-back-sock-debuginfo-2.4.46-lp152.14.18.1 openldap2-back-sql-2.4.46-lp152.14.18.1 openldap2-back-sql-debuginfo-2.4.46-lp152.14.18.1 openldap2-client-2.4.46-lp152.14.18.1 openldap2-client-debuginfo-2.4.46-lp152.14.18.1 openldap2-contrib-2.4.46-lp152.14.18.1 openldap2-contrib-debuginfo-2.4.46-lp152.14.18.1 openldap2-debuginfo-2.4.46-lp152.14.18.1 openldap2-debugsource-2.4.46-lp152.14.18.1 openldap2-devel-2.4.46-lp152.14.18.1 openldap2-devel-static-2.4.46-lp152.14.18.1 openldap2-ppolicy-check-password-1.2-lp152.14.18.1 openldap2-ppolicy-check-password-debuginfo-1.2-lp152.14.18.1 - openSUSE Leap 15.2 (noarch): libldap-data-2.4.46-lp152.14.18.1 openldap2-doc-2.4.46-lp152.14.18.1 - openSUSE Leap 15.2 (x86_64): libldap-2_4-2-32bit-2.4.46-lp152.14.18.1 libldap-2_4-2-32bit-debuginfo-2.4.46-lp152.14.18.1 openldap2-devel-32bit-2.4.46-lp152.14.18.1 References: https://www.suse.com/security/cve/CVE-2020-36221.html https://www.suse.com/security/cve/CVE-2020-36222.html https://www.suse.com/security/cve/CVE-2020-36223.html https://www.suse.com/security/cve/CVE-2020-36224.html https://www.suse.com/security/cve/CVE-2020-36225.html https://www.suse.com/security/cve/CVE-2020-36226.html https://www.suse.com/security/cve/CVE-2020-36227.html https://www.suse.com/security/cve/CVE-2020-36228.html https://www.suse.com/security/cve/CVE-2020-36229.html https://www.suse.com/security/cve/CVE-2020-36230.html https://www.suse.com/security/cve/CVE-2021-27212.html https://bugzilla.suse.com/1182279 https://bugzilla.suse.com/1182408 https://bugzilla.suse.com/1182411 https://bugzilla.suse.com/1182412 https://bugzilla.suse.com/1182413 https://bugzilla.suse.com/1182415 https://bugzilla.suse.com/1182416 https://bugzilla.suse.com/1182417 https://bugzilla.suse.com/1182418 https://bugzilla.suse.com/1182419 https://bugzilla.suse.com/1182420

1 0

openSUSE-SU-2021:0410-1: important: Security update for crmsh
by opensuse-security＠opensuse.org 14 Mar '21

14 Mar '21

openSUSE Security Update: Security update for crmsh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0410-1 Rating: important References: #1154927 #1178454 #1178869 #1179999 #1180126 #1180137 #1180571 #1180688 #1181415 Cross-References: CVE-2020-35459 CVE-2021-3020 CVSS scores: CVE-2020-35459 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2020-35459 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-3020 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has 7 fixes is now available. Description: This update for crmsh fixes the following issues: - Update to version 4.3.0+20210305.9db5c9a8: * Fix: bootstrap: Adjust qdevice configure/remove process to avoid race condition due to quorum lost(bsc#1181415) * Dev: cibconfig: remove related code about detecting crm_diff support --no-verion * Fix: ui_configure: raise error when params not exist(bsc#1180126) * Dev: doc: remove doc for crm node status * Dev: ui_node: remove status subcommand - Update to version 4.3.0+20210219.5d1bf034: * Fix: hb_report: walk through hb_report process under hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571) * Fix: bootstrap: setup authorized ssh access for hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571) * Dev: analyze: Add analyze sublevel and put preflight_check in it(jsc#ECO-1658) * Dev: utils: change default file mod as 644 for str2file function * Dev: hb_report: Detect if any ocfs2 partitions exist * Dev: lock: give more specific error message when raise ClaimLockError * Fix: Replace mktemp() to mkstemp() for security * Fix: Remove the duplicate --cov-report html in tox. * Fix: fix some lint issues. * Fix: Replace utils.msg_info to task.info * Fix: Solve a circular import error of utils.py * Fix: hb_report: run lsof with specific ocfs2 device(bsc#1180688) * Dev: corosync: change the permission of corosync.conf to 644 * Fix: preflight_check: task: raise error when report_path isn't a directory * Fix: bootstrap: Use class Watchdog to simplify watchdog config(bsc#1154927, bsc#1178869) * Dev: Polish the sbd feature. * Dev: Replace -f with -c and run check when no parameter provide. * Fix: Fix the yes option not working * Fix: Remove useless import and show help when no input. * Dev: Correct SBD device id inconsistenc during ASR * Fix: completers: return complete start/stop resource id list correctly(bsc#1180137) * Dev: Makefile.am: change makefile to integrate preflight_check * Medium: integrate preflight_check into crmsh(jsc#ECO-1658) * Fix: bootstrap: make sure sbd device UUID was the same between nodes(bsc#1178454) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-410=1 Package List: - openSUSE Leap 15.2 (noarch): crmsh-4.3.0+20210305.9db5c9a8-lp152.4.47.1 crmsh-scripts-4.3.0+20210305.9db5c9a8-lp152.4.47.1 crmsh-test-4.3.0+20210305.9db5c9a8-lp152.4.47.1 References: https://www.suse.com/security/cve/CVE-2020-35459.html https://www.suse.com/security/cve/CVE-2021-3020.html https://bugzilla.suse.com/1154927 https://bugzilla.suse.com/1178454 https://bugzilla.suse.com/1178869 https://bugzilla.suse.com/1179999 https://bugzilla.suse.com/1180126 https://bugzilla.suse.com/1180137 https://bugzilla.suse.com/1180571 https://bugzilla.suse.com/1180688 https://bugzilla.suse.com/1181415

1 0

openSUSE-SU-2021:0407-1: important: Security update for kernel-firmware
by opensuse-security＠opensuse.org 14 Mar '21

14 Mar '21

openSUSE Security Update: Security update for kernel-firmware ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0407-1 Rating: important References: #1181720 #1181735 #1181736 #1181738 Cross-References: CVE-2020-12362 CVE-2020-12363 CVE-2020-12364 CVE-2020-12373 CVSS scores: CVE-2020-12362 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2020-12362 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2020-12363 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2020-12363 (SUSE): 1.9 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L CVE-2020-12364 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2020-12364 (SUSE): 1.9 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L CVE-2020-12373 (NVD) : 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2020-12373 (SUSE): 1.9 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for kernel-firmware fixes the following issues: - CVE-2020-12373: Fixed an expired pointer dereference may lead to DOS (bsc#1181738). - CVE-2020-12364: Fixed a null pointer reference may lead to DOS (bsc#1181736). - CVE-2020-12362: Fixed an integer overflow which could have led to privilege escalation (bsc#1181720). - CVE-2020-12363: Fixed an improper input validation which may have led to DOS (bsc#1181735). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-407=1 Package List: - openSUSE Leap 15.2 (noarch): kernel-firmware-20200107-lp152.2.6.1 ucode-amd-20200107-lp152.2.6.1 References: https://www.suse.com/security/cve/CVE-2020-12362.html https://www.suse.com/security/cve/CVE-2020-12363.html https://www.suse.com/security/cve/CVE-2020-12364.html https://www.suse.com/security/cve/CVE-2020-12373.html https://bugzilla.suse.com/1181720 https://bugzilla.suse.com/1181735 https://bugzilla.suse.com/1181736 https://bugzilla.suse.com/1181738

1 0

openSUSE-SU-2021:0405-1: important: Security update for git
by opensuse-security＠opensuse.org 14 Mar '21

14 Mar '21

openSUSE Security Update: Security update for git ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0405-1 Rating: important References: #1183026 Cross-References: CVE-2021-21300 CVSS scores: CVE-2021-21300 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for git fixes the following issues: - On case-insensitive filesystems, with support for symbolic links, if Git is configured globally to apply delay-capable clean/smudge filters (such as Git LFS), Git could be fooled into running remote code during a clone. (bsc#1183026, CVE-2021-21300) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-405=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): git-2.26.2-lp152.2.6.1 git-arch-2.26.2-lp152.2.6.1 git-core-2.26.2-lp152.2.6.1 git-core-debuginfo-2.26.2-lp152.2.6.1 git-credential-gnome-keyring-2.26.2-lp152.2.6.1 git-credential-gnome-keyring-debuginfo-2.26.2-lp152.2.6.1 git-credential-libsecret-2.26.2-lp152.2.6.1 git-credential-libsecret-debuginfo-2.26.2-lp152.2.6.1 git-cvs-2.26.2-lp152.2.6.1 git-daemon-2.26.2-lp152.2.6.1 git-daemon-debuginfo-2.26.2-lp152.2.6.1 git-debuginfo-2.26.2-lp152.2.6.1 git-debugsource-2.26.2-lp152.2.6.1 git-email-2.26.2-lp152.2.6.1 git-gui-2.26.2-lp152.2.6.1 git-p4-2.26.2-lp152.2.6.1 git-svn-2.26.2-lp152.2.6.1 git-svn-debuginfo-2.26.2-lp152.2.6.1 git-web-2.26.2-lp152.2.6.1 gitk-2.26.2-lp152.2.6.1 - openSUSE Leap 15.2 (noarch): git-doc-2.26.2-lp152.2.6.1 References: https://www.suse.com/security/cve/CVE-2021-21300.html https://bugzilla.suse.com/1183026

1 0