May 2021 - openSUSE Security Announce - openSUSE Mailing Lists

openSUSE-SU-2021:0706-1: important: Security update for monitoring-plugins-smart
by opensuse-security＠opensuse.org 10 May '21

10 May '21

openSUSE Security Update: Security update for monitoring-plugins-smart ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0706-1 Rating: important References: #1183057 Affected Products: openSUSE Leap 15.2 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for monitoring-plugins-smart fixes the following issues: monitoring-plugins-smart was updated to 6.9.1: This is a security-release (boo#1183057) + Fixes the regular expression for pseudo-devices under the /dev/bus/N path. from 6.9.0 + Allows using PCI device paths as device name(s) (#64) + Introduce new optional parameter -l/--ssd-lifetime) which additionally checks SMART attribute "Percent_Lifetime_Remain" (available on some SSD drives). (#66 #67) from 6.8.0 + Allow skip self-assessment check (--skip-self-assessment) + Add Command_Timeout to default raw list from 6.7.1 + Bugfix to make --warn work (issue #54) from 6.7.0 + Added support for NVMe drives from 6.6.1 + Fix 'deprecation warning on regex with curly brackets' (6.6.1) from 6.6.0 + The feature was requested in #30 . This PR adds the possibility to use 3ware,N and cciss,N drives in combination with the global -g parameter. + Furthermore this PR adjusts the output of the plugin when the -g is used in combination with hardware raid controllers. Instead of showing the logical device name (/dev/sda for example), the plugin will now show the controller with drive number from 6.5.0: + Add Reported_Uncorrect and Reallocated_Event_Count to default raw list. + As of 6.5 the following SMART attributes are by default checked and may result in alert when threshold (default 0 is reached): 'Current_Pending_Sector,Reallocated_Sector_Ct,Program_Fail_Cnt_Total, Uncorrectable_Error_Cnt,Offline_Uncorrectable,Runtime_Bad_Block, Reported_Uncorrect,Reallocated_Event_Count' - Update to version 6.4 - Allow detection of more than 26 devices / issue #5 (rev 5.3) - Different ATA vs. SCSI lookup (rev 5.4) - Allow script to run outside of nagios plugins dir / wiki url update (rev 5.5) - Change syntax of -g parameter (regex is now awaited from input) (rev 5.6) - Fix Use of uninitialized value $device (rev 5.7) - Allow multiple devices for interface type megaraid, e.g. "megaraid,[1-5]" (rev 5.8) - allow type "auto" (rev 5.9) - Check selftest log for errors using new parameter -s (rev 5.10) - Add exclude list (-e) to ignore certain attributes (5.11) - Fix 'Use of uninitialized value' warnings (5.11.1) - Add raw check list (-r) and warning thresholds (-w) (6.0) - Allow using pseudo bus device /dev/bus/N (6.1) - Add device model and serial number in output (6.2) - Allow exclusion from perfdata as well (-E) and by attribute number (6.3) - Remove dependency on utils.pm, add quiet parameter (6.4) - Drop not longer needed patch: * enable_auto_interface.patch (obsolete, type auto was added upstream in v5.9). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-706=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-706=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-706=1 Package List: - openSUSE Leap 15.2 (noarch): monitoring-plugins-smart-6.9.1-lp152.4.3.1 - openSUSE Backports SLE-15-SP2 (noarch): monitoring-plugins-smart-6.9.1-bp152.4.3.1 - openSUSE Backports SLE-15-SP1 (noarch): monitoring-plugins-smart-6.9.1-bp151.4.3.1 References: https://bugzilla.suse.com/1183057

1 0

openSUSE-SU-2021:0695-1: moderate: Security update for alpine
by opensuse-security＠opensuse.org 09 May '21

09 May '21

openSUSE Security Update: Security update for alpine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0695-1 Rating: moderate References: #1173281 Cross-References: CVE-2020-14929 CVSS scores: CVE-2020-14929 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2020-14929 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for alpine fixes the following issues: Update to release 2.24 * A few crash fixes * Implementation of XOAUTH2 for Yahoo! Mail. Update to release 2.23.2 * Expansion of the configuration screen for XOAUTH2 to include username, and tenant. * Alpine uses the domain in the From: header of a message to generate a message-id and suppresses all information about Alpine, version, revision, and time of generation of the message-id from this header. * Alpine does not generate Sender or X-X-Sender by default by enabling [X] Disable Sender as the default. * Alpine does not disclose User Agent by default by enabling [X] Suppress User Agent by default. * When messages are selected, pressing the ';' command to broaden or narrow a search, now offers the possibility to completely replace the search, and is almost equivalent to being a shortcut to "unselect all messages, and select again". Update to release 2.23 * Fixes boo#1173281, CVE-2020-14929: Alpine silently proceeds to use an insecure connection after a /tls is sent in certain circumstances. * Implementation of XOAUTH2 authentication support for Outlook. * Add support for the OAUTHBEARER authentication method in Gmail. * Support for the SASL-IR IMAP extension. * Alpine can pass an HTML message to an external web browser, by using the "External" command in the ATTACHMENT INDEX screen. Update to release 2.22 * Support for XOAUTH2 authentication method in Gmail. * NTLM authentication support with the ntlm library. * Added the "/tls1_3" flag for servers that support it. * Add the "g" option to the select command that works in IMAP servers that implement the X-GM-EXT-1 capability (such as the one offered by Gmail). * Added "/auth=XYZ" to the way to define a server. This allows users to select the method to authenticate to an IMAP, SMTP or POP3 server. Examples are /auth=plain, or /auth=gssapi, etc. * When a message is of type multipart/mixed, and its first part is multipart/signed, Alpine will include the text of the original message in a reply message, instead of including a multipart attachment. * Added backward search in the index screen. * pico: Add -dict option to Pico, which allows users to choose a dictionary when spelling. - Drop /usr/bin/mailutil, it is not built by default anymore. * Added Quota subcommands for printing, forwarding, saving, etc. This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-695=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): alpine-2.24-bp152.4.3.1 pico-5.07-bp152.4.3.1 pilot-2.99-bp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2020-14929.html https://bugzilla.suse.com/1173281

1 0

openSUSE-SU-2021:0694-1: moderate: Security update for avahi
by opensuse-security＠opensuse.org 09 May '21

09 May '21

openSUSE Security Update: Security update for avahi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0694-1 Rating: moderate References: #1184521 Cross-References: CVE-2021-3468 CVSS scores: CVE-2021-3468 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for avahi fixes the following issues: - CVE-2021-3468: avoid infinite loop by handling HUP event in client_work (bsc#1184521). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-694=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): avahi-0.7-lp152.3.9.1 avahi-autoipd-0.7-lp152.3.9.1 avahi-autoipd-debuginfo-0.7-lp152.3.9.1 avahi-compat-howl-devel-0.7-lp152.3.9.1 avahi-compat-mDNSResponder-devel-0.7-lp152.3.9.1 avahi-debuginfo-0.7-lp152.3.9.1 avahi-debugsource-0.7-lp152.3.9.1 avahi-glib2-debugsource-0.7-lp152.3.9.1 avahi-utils-0.7-lp152.3.9.1 avahi-utils-debuginfo-0.7-lp152.3.9.1 avahi-utils-gtk-0.7-lp152.3.9.1 avahi-utils-gtk-debuginfo-0.7-lp152.3.9.1 libavahi-client3-0.7-lp152.3.9.1 libavahi-client3-debuginfo-0.7-lp152.3.9.1 libavahi-common3-0.7-lp152.3.9.1 libavahi-common3-debuginfo-0.7-lp152.3.9.1 libavahi-core7-0.7-lp152.3.9.1 libavahi-core7-debuginfo-0.7-lp152.3.9.1 libavahi-devel-0.7-lp152.3.9.1 libavahi-glib-devel-0.7-lp152.3.9.1 libavahi-glib1-0.7-lp152.3.9.1 libavahi-glib1-debuginfo-0.7-lp152.3.9.1 libavahi-gobject-devel-0.7-lp152.3.9.1 libavahi-gobject0-0.7-lp152.3.9.1 libavahi-gobject0-debuginfo-0.7-lp152.3.9.1 libavahi-ui-gtk3-0-0.7-lp152.3.9.1 libavahi-ui-gtk3-0-debuginfo-0.7-lp152.3.9.1 libavahi-ui0-0.7-lp152.3.9.1 libavahi-ui0-debuginfo-0.7-lp152.3.9.1 libdns_sd-0.7-lp152.3.9.1 libdns_sd-debuginfo-0.7-lp152.3.9.1 libhowl0-0.7-lp152.3.9.1 libhowl0-debuginfo-0.7-lp152.3.9.1 python3-avahi-0.7-lp152.3.9.1 python3-avahi-gtk-0.7-lp152.3.9.1 typelib-1_0-Avahi-0_6-0.7-lp152.3.9.1 - openSUSE Leap 15.2 (x86_64): avahi-32bit-debuginfo-0.7-lp152.3.9.1 avahi-mono-0.7-lp152.3.9.1 avahi-qt4-debugsource-0.7-lp152.3.9.1 libavahi-client3-32bit-0.7-lp152.3.9.1 libavahi-client3-32bit-debuginfo-0.7-lp152.3.9.1 libavahi-common3-32bit-0.7-lp152.3.9.1 libavahi-common3-32bit-debuginfo-0.7-lp152.3.9.1 libavahi-glib1-32bit-0.7-lp152.3.9.1 libavahi-glib1-32bit-debuginfo-0.7-lp152.3.9.1 libavahi-qt4-1-0.7-lp152.3.9.1 libavahi-qt4-1-debuginfo-0.7-lp152.3.9.1 libavahi-qt4-devel-0.7-lp152.3.9.1 libdns_sd-32bit-0.7-lp152.3.9.1 libdns_sd-32bit-debuginfo-0.7-lp152.3.9.1 - openSUSE Leap 15.2 (noarch): avahi-lang-0.7-lp152.3.9.1 References: https://www.suse.com/security/cve/CVE-2021-3468.html https://bugzilla.suse.com/1184521

1 0

openSUSE-SU-2021:0692-1: moderate: Security update for libxml2
by opensuse-security＠opensuse.org 09 May '21

09 May '21

openSUSE Security Update: Security update for libxml2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0692-1 Rating: moderate References: #1185408 #1185409 #1185410 Cross-References: CVE-2021-3516 CVE-2021-3517 CVE-2021-3518 CVSS scores: CVE-2021-3516 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-3517 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-3518 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for libxml2 fixes the following issues: - CVE-2021-3518: Fixed a use after free in xinclude.c:xmlXIncludeDoProcess (bsc#1185408). - CVE-2021-3517: Fixed a heap based buffer overflow in entities.c:xmlEncodeEntitiesInternal (bsc#1185410). - CVE-2021-3516: Fixed a use after free in entities.c:xmlEncodeEntitiesInternal (bsc#1185409). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-692=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libxml2-2-2.9.7-lp152.10.9.1 libxml2-2-debuginfo-2.9.7-lp152.10.9.1 libxml2-debugsource-2.9.7-lp152.10.9.1 libxml2-devel-2.9.7-lp152.10.9.1 libxml2-tools-2.9.7-lp152.10.9.1 libxml2-tools-debuginfo-2.9.7-lp152.10.9.1 python-libxml2-python-debugsource-2.9.7-lp152.10.9.1 python2-libxml2-python-2.9.7-lp152.10.9.1 python2-libxml2-python-debuginfo-2.9.7-lp152.10.9.1 python3-libxml2-python-2.9.7-lp152.10.9.1 python3-libxml2-python-debuginfo-2.9.7-lp152.10.9.1 - openSUSE Leap 15.2 (x86_64): libxml2-2-32bit-2.9.7-lp152.10.9.1 libxml2-2-32bit-debuginfo-2.9.7-lp152.10.9.1 libxml2-devel-32bit-2.9.7-lp152.10.9.1 - openSUSE Leap 15.2 (noarch): libxml2-doc-2.9.7-lp152.10.9.1 References: https://www.suse.com/security/cve/CVE-2021-3516.html https://www.suse.com/security/cve/CVE-2021-3517.html https://www.suse.com/security/cve/CVE-2021-3518.html https://bugzilla.suse.com/1185408 https://bugzilla.suse.com/1185409 https://bugzilla.suse.com/1185410

1 0

openSUSE-SU-2021:0691-1: moderate: Security update for vlc
by opensuse-security＠opensuse.org 09 May '21

09 May '21

openSUSE Security Update: Security update for vlc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0691-1 Rating: moderate References: #1181918 Cross-References: CVE-2020-26664 CVSS scores: CVE-2020-26664 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for vlc fixes the following issues: Update to version 3.0.13: + Demux: - Adaptive: fix artefacts in HLS streams with wrong profiles/levels - Fix regression on some MP4 files for the audio track - Fix MPGA and ADTS probing in TS files - Fix Flac inside AVI files - Fix VP9/Webm artefacts when seeking + Codec: - Support SSA text scaling - Fix rotation on Android rotation - Fix WebVTT subtitles that start at 00:00 + Access: - Update libnfs to support NFSv4 - Improve SMB2 integration - Fix Blu-ray files using Unicode names on Windows - Disable mcast lookups on Android for RTSP playback + Video Output: Rework the D3D11 rendering wait, to fix choppiness on display + Interfaces: - Fix VLC getting stuck on close on X11 (#21875) - Improve RTL on preferences on macOS - Add mousewheel horizontal axis control - Fix crash on exit on macOS - Fix sizing of the fullscreen controls on macOS + Misc: - Improve MIDI fonts search on Linux - Update Soundcloud, Youtube, liveleak - Fix compilation with GCC11 - Fix input-slave option for subtitles + Updated translations. Update to version 3.0.12: + Access: Add new RIST access module compliant with simple profile (VSF_TR-06-1). + Access Output: Add new RIST access output module compliant with simple profile (VSF_TR-06-1). + Demux: Fixed adaptive's handling of resolution settings. + Audio output: Fix audio distortion on macOS during start of playback. + Video Output: Direct3D11: Fix some potential crashes when using video filters. + Misc: - Several fixes in the web interface, including privacy and security improvements - Update YouTube and Vocaroo scripts. + Updated translations. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-691=1 Package List: - openSUSE Leap 15.2 (noarch): vlc-lang-3.0.13-lp152.2.12.1 - openSUSE Leap 15.2 (x86_64): libvlc5-3.0.13-lp152.2.12.1 libvlc5-debuginfo-3.0.13-lp152.2.12.1 libvlccore9-3.0.13-lp152.2.12.1 libvlccore9-debuginfo-3.0.13-lp152.2.12.1 vlc-3.0.13-lp152.2.12.1 vlc-codec-gstreamer-3.0.13-lp152.2.12.1 vlc-codec-gstreamer-debuginfo-3.0.13-lp152.2.12.1 vlc-debuginfo-3.0.13-lp152.2.12.1 vlc-debugsource-3.0.13-lp152.2.12.1 vlc-devel-3.0.13-lp152.2.12.1 vlc-jack-3.0.13-lp152.2.12.1 vlc-jack-debuginfo-3.0.13-lp152.2.12.1 vlc-noX-3.0.13-lp152.2.12.1 vlc-noX-debuginfo-3.0.13-lp152.2.12.1 vlc-opencv-3.0.13-lp152.2.12.1 vlc-opencv-debuginfo-3.0.13-lp152.2.12.1 vlc-qt-3.0.13-lp152.2.12.1 vlc-qt-debuginfo-3.0.13-lp152.2.12.1 vlc-vdpau-3.0.13-lp152.2.12.1 vlc-vdpau-debuginfo-3.0.13-lp152.2.12.1 References: https://www.suse.com/security/cve/CVE-2020-26664.html https://bugzilla.suse.com/1181918

1 0

openSUSE-SU-2021:0688-1: moderate: Security update for syncthing
by opensuse-security＠opensuse.org 08 May '21

08 May '21

openSUSE Security Update: Security update for syncthing ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0688-1 Rating: moderate References: #1184428 Cross-References: CVE-2021-21404 CVSS scores: CVE-2021-21404 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for syncthing fixes the following issues: Update to 1.15.0/1.15.1 * This release fixes a vulnerability where Syncthing and the relay server can crash due to malformed relay protocol messages (CVE-2021-21404); see GHSA-x462-89pf-6r5h. (boo#1184428) * This release updates the CLI to use subcommands and adds the subcommands cli (previously standalone stcli utility) and decrypt (for offline verifying and decrypting encrypted folders). * With this release we invite everyone to test the "untrusted (encrypted) devices" feature. You should not use it yet on important production data. Thus UI controls are hidden behind a feature flag. For more information, visit: https://forum.syncthing.net/t/testing-untrusted-encrypted-devices/16470 Update to 1.14.0 * This release adds configurable device and folder defaults. * The output format of the /rest/db/browse endpoint has changed. update to 1.13.1: * This release adds configuration options for min/max connections (see https://docs.syncthing.net/advanced/option-connection-limits.html) and moves the storage of pending devices/folders from the config to the database (see https://docs.syncthing.net/dev/rest.html#cluster-endpoints). * Bugfixes * Official builds of v1.13.0 come with the Tech Ui, which is impossible to switch back from update to 1.12.1: * Invalid names are allowed and "auto accepted" in folder root path on Windows * Sometimes indexes for some folders aren't sent after starting Syncthing * [Untrusted] Remove Unexpected Items leaves things behind * Wrong theme on selection * Quic spamming address resolving * Deleted locally changed items still shown as locally changed * Allow specifying remote expected web UI port which would generate a href somewhere * Ignore fsync errors when saving ignore files Update to 1.12.0 - The 1.12.0 release - adds a new config REST API. - The 1.11.0 release - adds the sendFullIndexOnUpgrade option to control whether all index data is resent when an upgrade is detected, equivalent to starting Syncthing with --reset-deltas. This (sendFullIndexOnUpgrade=true) used to be the behavior in previous versions, but is mainly useful as a troubleshooting step and causes high database churn. The new default is false. - Update to 1.10.0 - This release adds the config option announceLANAddresses to enable (the default) or disable announcing private (RFC1918) LAN IP addresses to global discovery. - Update to 1.9.0 - This release adds the advanced folder option caseSensitiveFS (https://docs.syncthing.net/advanced/folder-caseSensitiveFS.html) to disable the new safe handling of case insensitive filesystems. - Fix Leap build by requiring at least Go 1.14 - Prevent the build system to download Go modules which would require an internet connection during the build - Update to 1.8.0 - The 1.8.0 release - adds the experimental copyRangeMethod config on folders, for use on filesystems with copy-on-write support. Please see https://docs.syncthing.net/advanced/folder-copyrangemethod.html for details. - adds TCP hole punching, used to establish high performance TCP connections in certain NAT scenarios where only relay or QUIC connections could be used previously. - adds a configuration to file versioning for how often to run cleanup. This defaults to once an hour, but is configurable from very frequently to never. - The 1.7.0 release performs a database migration to optimize for clusters with many devices. - The 1.6.0 release performs a database schema migration, and adds the BlockPullOrder, DisableFsync and MaxConcurrentWrites folder options to the configuration schema. The LocalChangeDetected event no longer has the action set to added for new files, instead showing modified for all local file changes. - The 1.5.0 release changes the default location for the index database under some circumstances. Two new flags can also be used to affect the location of the configuration (-config) and database (-data) separately. The old -home flag is equivalent to setting both of these to the same directory. When no flags are given the following logic is used to determine the data location: If a database exists in the old default location, that location is still used. This means existing installations are not affected by this change. If $XDG_DATA_HOME is set, use $XDG_DATA_HOME/syncthing. If ~/.local/share/syncthing exists, use that location. Use the old default location. - Update to 1.4.2: - Bugfixes: - #6499: panic: nil pointer dereference in usage reporting - Other issues: - revert a change to the upgrade code that puts unnecessary load on the upgrade server - Update to 1.4.1: - Bugfixes: - #6289: "general SOCKS server failure" since syncthing 1.3.3 - #6365: Connection errors not shown in GUI - #6415: Loop in database migration "folder db index missing" after upgrade to v1.4.0 - #6422: "fatal error: runtime: out of memory" during database migration on QNAP NAS - Enhancements: - #5380: gui: Display folder/device name in modal - #5979: UNIX socket permission bits - #6384: Do auto upgrades early and synchronously on startup - Other issues: - #6249: Remove unnecessary RAM/CPU stats from GUI - Update to 1.4.0: - Important changes: - New config option maxConcurrentIncomingRequestKiB - Replace config option maxConcurrentScans with maxFolderConcurrency - Improve database schema - Bugfixes: - #4774: Doesn't react to Ctrl-C when run in a subshell with -no-restart (Linux) - #5952: panic: Should never get a deleted file as needed when we don't have it - #6281: Progress emitter uses 100% CPU - #6300: lib/ignore: panic: runtime error: index out of range [0] with length 0 - #6304: Syncing issues, database missing sequence entries - #6335: Crash or hard shutdown can case database inconsistency, out of sync - Enhancements: - #5786: Consider always running the monitor process - #5898: Database performance: reduce duplication - #5914: Limit folder concurrency to improve performance - #6302: Avoid thundering herd issue by global request limiter - Change the Go build requirement to a more flexible "golang(API) >= 1.12". Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-688=1 Package List: - openSUSE Leap 15.2 (x86_64): syncthing-1.15.1-lp152.2.3.1 syncthing-relaysrv-1.15.1-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-21404.html https://bugzilla.suse.com/1184428

1 0

openSUSE-SU-2021:0684-1: moderate: Security update for p7zip
by opensuse-security＠opensuse.org 08 May '21

08 May '21

openSUSE Security Update: Security update for p7zip ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0684-1 Rating: moderate References: #1184699 Cross-References: CVE-2021-3465 CVSS scores: CVE-2021-3465 (SUSE): 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for p7zip fixes the following issues: - CVE-2021-3465: Fixed a NULL pointer dereference in NCompress:CCopyCoder:Code (bsc#1184699) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-684=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): p7zip-16.02-lp152.8.3.1 p7zip-debugsource-16.02-lp152.8.3.1 p7zip-full-16.02-lp152.8.3.1 p7zip-full-debuginfo-16.02-lp152.8.3.1 - openSUSE Leap 15.2 (noarch): p7zip-doc-16.02-lp152.8.3.1 References: https://www.suse.com/security/cve/CVE-2021-3465.html https://bugzilla.suse.com/1184699

1 0

openSUSE-SU-2021:0682-1: important: Security update for redis
by opensuse-security＠opensuse.org 07 May '21

07 May '21

openSUSE Security Update: Security update for redis ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0682-1 Rating: important References: #1178205 #1182657 #1185729 #1185730 ECO-2417 ECO-2867 PM-1547 PM-1615 PM-1622 PM-1681 SLE-11578 SLE-12821 Cross-References: CVE-2021-21309 CVE-2021-29477 CVE-2021-29478 CVSS scores: CVE-2021-21309 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-21309 (SUSE): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H CVE-2021-29477 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-29478 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves three vulnerabilities, contains 8 features and has one errata is now available. Description: This update for redis fixes the following issues: redis 6.0.13 * CVE-2021-29477: Integer overflow in STRALGO LCS command (boo#1185729) * CVE-2021-29478: Integer overflow in COPY command for large intsets (boo#1185730) * Cluster: Skip unnecessary check which may prevent failure detection * Fix performance regression in BRPOP on Redis 6.0 * Fix edge-case when a module client is unblocked redis 6.0.12: * Fix compilation error on non-glibc systems if jemalloc is not used redis 6.0.11: * CVE-2021-21309: Avoid 32-bit overflows when proto-max-bulk-len is set high (boo#1182657) * Fix handling of threaded IO and CLIENT PAUSE (failover), could lead to data loss or a crash * Fix the selection of a random element from large hash tables * Fix broken protocol in client tracking tracking-redir-broken message * XINFO able to access expired keys on a replica * Fix broken protocol in redis-benchmark when used with -a or --dbnum * Avoid assertions (on older kernels) when testing arm64 CoW bug * CONFIG REWRITE should honor umask settings * Fix firstkey,lastkey,step in COMMAND command for some commands * RM_ZsetRem: Delete key if empty, the bug could leave empty zset keys redis 6.0.10: Command behavior changes: * SWAPDB invalidates WATCHed keys (#8239) * SORT command behaves differently when used on a writable replica (#8283) * EXISTS should not alter LRU (#8016) In Redis 5.0 and 6.0 it would have touched the LRU/LFU of the key. * OBJECT should not reveal logically expired keys (#8016) Will now behave the same TYPE or any other non-DEBUG command. * GEORADIUS[BYMEMBER] can fail with -OOM if Redis is over the memory limit (#8107) Other behavior changes: * Sentinel: Fix missing updates to the config file after SENTINEL SET command (#8229) * CONFIG REWRITE is atomic and safer, but requires write access to the config file's folder (#7824, #8051) This change was already present in 6.0.9, but was missing from the release notes. Bug fixes with compatibility implications (bugs introduced in Redis 6.0): * Fix RDB CRC64 checksum on big-endian systems (#8270) If you're using big-endian please consider the compatibility implications with RESTORE, replication and persistence. * Fix wrong order of key/value in Lua's map response (#8266) If your scripts use redis.setresp() or return a map (new in Redis 6.0), please consider the implications. Bug fixes: * Fix an issue where a forked process deletes the parent's pidfile (#8231) * Fix crashes when enabling io-threads-do-reads (#8230) * Fix a crash in redis-cli after executing cluster backup (#8267) * Handle output buffer limits for module blocked clients (#8141) Could result in a module sending reply to a blocked client to go beyond the limit. * Fix setproctitle related crashes. (#8150, #8088) Caused various crashes on startup, mainly on Apple M1 chips or under instrumentation. * Backup/restore cluster mode keys to slots map for repl-diskless-load=swapdb (#8108) In cluster mode with repl-diskless-load, when loading failed, slot map wouldn't have been restored. * Fix oom-score-adj-values range, and bug when used in config file (#8046) Enabling setting this in the config file in a line after enabling it, would have been buggy. * Reset average ttl when empty databases (#8106) Just causing misleading metric in INFO * Disable rehash when Redis has child process (#8007) This could have caused excessive CoW during BGSAVE, replication or AOFRW. * Further improved ACL algorithm for picking categories (#7966) Output of ACL GETUSER is now more similar to the one provided by ACL SETUSER. * Fix bug with module GIL being released prematurely (#8061) Could in theory (and rarely) cause multi-threaded modules to corrupt memory. * Reduce effect of client tracking causing feedback loop in key eviction (#8100) * Fix cluster access to unaligned memory (SIGBUS on old ARM) (#7958) * Fix saving of strings larger than 2GB into RDB files (#8306) Additional improvements: * Avoid wasteful transient memory allocation in certain cases (#8286, #5954) Platform / toolchain support related improvements: * Fix crash log registers output on ARM. (#8020) * Add a check for an ARM64 Linux kernel bug (#8224) Due to the potential severity of this issue, Redis will print log warning on startup. * Raspberry build fix. (#8095) New configuration options: * oom-score-adj-values config can now take absolute values (besides relative ones) (#8046) Module related fixes: * Moved RMAPI_FUNC_SUPPORTED so that it's usable (#8037) * Improve timer accuracy (#7987) * Allow '\0' inside of result of RM_CreateStringPrintf (#6260) redis 6.0.9: * potential heap overflow when using a heap allocator other than jemalloc or glibc's malloc. Does not affect the openSUSE package - boo#1178205 * Memory reporting of clients argv * Add redis-cli control on raw format line delimiter * Add redis-cli support for rediss:// -u prefix * WATCH no longer ignores keys which have expired for MULTI/EXEC * Correct OBJECT ENCODING response for stream type * Allow blocked XREAD on a cluster replica * TLS: Do not require CA config if not used * multiple bug fixes * Additions to modules API redis 6.0.8 (jsc#PM-1615, jsc#PM-1622, jsc#PM-1681, jsc#ECO-2417, jsc#ECO-2867, jsc#PM-1547, jsc#CAPS-56, jsc#SLE-11578, jsc#SLE-12821): * bug fixes when using with Sentinel * bug fixes when using CONFIG REWRITE * Remove THP warning when set to madvise * Allow EXEC with read commands on readonly replica in cluster * Add masters/replicas options to redis-cli --cluster call command - includes changes from 6.0.7: * CONFIG SET could hung the client when arrives during RDB/ROF loading * LPOS command when RANK is greater than matches responded with broken protocol * Add oom-score-adj configuration option to control Linux OOM killer * Show IO threads statistics and status in INFO output * Add optional tls verification mode (see tls-auth-clients) redis 6.0.6: * Fix crash when enabling CLIENT TRACKING with prefix * EXEC always fails with EXECABORT and multi-state is cleared * RESTORE ABSTTL won't store expired keys into the db * redis-cli better handling of non-pritable key names * TLS: Ignore client cert when tls-auth-clients off * Tracking: fix invalidation message on flush * Notify systemd on Sentinel startup * Fix crash on a misuse of STRALGO * Few fixes in module API * Fix a few rare leaks (STRALGO error misuse, Sentinel) * Fix a possible invalid access in defrag of scripts * Add LPOS command to search in a list * Use user+pass for MIGRATE in redis-cli and redis-benchmark in cluster mode * redis-cli support TLS for --pipe, --rdb and --replica options * TLS: Session caching configuration support redis 6.0.5: * Fix handling of speical chars in ACL LOAD * Make Redis Cluster more robust about operation errors that may lead to two clusters to mix together * Revert the sendfile() implementation of RDB transfer * Fix TLS certificate loading for chained certificates * Fix AOF rewirting of KEEPTTL SET option * Fix MULTI/EXEC behavior during -BUSY script errors Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-682=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): redis-6.0.13-lp152.2.3.1 redis-debuginfo-6.0.13-lp152.2.3.1 redis-debugsource-6.0.13-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-21309.html https://www.suse.com/security/cve/CVE-2021-29477.html https://www.suse.com/security/cve/CVE-2021-29478.html https://bugzilla.suse.com/1178205 https://bugzilla.suse.com/1182657 https://bugzilla.suse.com/1185729 https://bugzilla.suse.com/1185730

1 0

openSUSE-SU-2021:0677-1: critical: Security update for exim
by opensuse-security＠opensuse.org 07 May '21

07 May '21

openSUSE Security Update: Security update for exim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0677-1 Rating: critical References: #1079832 #1171490 #1171877 #1173693 #1185631 Cross-References: CVE-2017-1000369 CVE-2017-16943 CVE-2017-16944 CVE-2018-6789 CVE-2019-16928 CVE-2020-12783 CVE-2020-28007 CVE-2020-28008 CVE-2020-28009 CVE-2020-28010 CVE-2020-28011 CVE-2020-28012 CVE-2020-28013 CVE-2020-28014 CVE-2020-28015 CVE-2020-28016 CVE-2020-28017 CVE-2020-28018 CVE-2020-28019 CVE-2020-28020 CVE-2020-28021 CVE-2020-28022 CVE-2020-28023 CVE-2020-28024 CVE-2020-28025 CVE-2020-28026 CVSS scores: CVE-2017-1000369 (NVD) : 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2017-16943 (NVD) : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2017-16944 (NVD) : 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2018-6789 (NVD) : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-16928 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2020-12783 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 26 vulnerabilities is now available. Description: This update for exim fixes the following issues: Exim was updated to exim-4.94.2 security update (boo#1185631) * CVE-2020-28007: Link attack in Exim's log directory * CVE-2020-28008: Assorted attacks in Exim's spool directory * CVE-2020-28014: Arbitrary PID file creation * CVE-2020-28011: Heap buffer overflow in queue_run() * CVE-2020-28010: Heap out-of-bounds write in main() * CVE-2020-28013: Heap buffer overflow in parse_fix_phrase() * CVE-2020-28016: Heap out-of-bounds write in parse_fix_phrase() * CVE-2020-28015: New-line injection into spool header file (local) * CVE-2020-28012: Missing close-on-exec flag for privileged pipe * CVE-2020-28009: Integer overflow in get_stdinput() * CVE-2020-28017: Integer overflow in receive_add_recipient() * CVE-2020-28020: Integer overflow in receive_msg() * CVE-2020-28023: Out-of-bounds read in smtp_setup_msg() * CVE-2020-28021: New-line injection into spool header file (remote) * CVE-2020-28022: Heap out-of-bounds read and write in extract_option() * CVE-2020-28026: Line truncation and injection in spool_read_header() * CVE-2020-28019: Failure to reset function pointer after BDAT error * CVE-2020-28024: Heap buffer underflow in smtp_ungetc() * CVE-2020-28018: Use-after-free in tls-openssl.c * CVE-2020-28025: Heap out-of-bounds read in pdkim_finish_bodyhash() update to exim-4.94.1 * Fix security issue in BDAT state confusion. Ensure we reset known-good where we know we need to not be reading BDAT data, as a general case fix, and move the places where we switch to BDAT mode until after various protocol state checks. Fixes CVE-2020-BDATA reported by Qualys. * Fix security issue in SMTP verb option parsing (CVE-2020-EXOPT) * Fix security issue with too many recipients on a message (to remove a known security problem if someone does set recipients_max to unlimited, or if local additions add to the recipient list). Fixes CVE-2020-RCPTL reported by Qualys. * Fix CVE-2020-28016 (PFPZA): Heap out-of-bounds write in parse_fix_phrase() * Fix security issue CVE-2020-PFPSN and guard against cmdline invoker providing a particularly obnoxious sender full name. * Fix Linux security issue CVE-2020-SLCWD and guard against PATH_MAX better. - bring back missing exim_db.8 manual page (fixes boo#1173693) - bring in changes from current +fixes (lots of taint check fixes) * Bug 1329: Fix format of Maildir-format filenames to match other mail- related applications. Previously an "H" was used where available info says that "M" should be, so change to match. * Bug 2587: Fix pam expansion condition. Tainted values are commonly used as arguments, so an implementation trying to copy these into a local buffer was taking a taint-enforcement trap. Fix by using dynamically created buffers. * Bug 2586: Fix listcount expansion operator. Using tainted arguments is reasonable, eg. to count headers. Fix by using dynamically created buffers rather than a local. Do similar fixes for ACL actions "dcc", "log_reject_target", "malware" and "spam"; the arguments are expanded so could be handling tainted values. * Bug 2590: Fix -bi (newaliases). A previous code rearrangement had broken the (no-op) support for this sendmail command. Restore it to doing nothing, silently, and returning good status. - update to exim 4.94 * some transports now refuse to use tainted data in constructing their delivery location this WILL BREAK configurations which are not updated accordingly. In particular: any Transport use of $local_user which has been relying upon check_local_user far away in the Router to make it safe, should be updated to replace $local_user with $local_part_data. * Attempting to remove, in router or transport, a header name that ends with an asterisk (which is a standards-legal name) will now result in all headers named starting with the string before the asterisk being removed. - switch pretrans to use lua (fixes boo#1171877) - bring changes from current in +fixes branch (patch-exim-fixes-ee83de04d3087efaf808d1f2235a988275c2ee94) * fixes CVE-2020-12783 (boo#1171490) * Regard command-line recipients as tainted. * Bug 2489: Fix crash in the "pam" expansion condition. * Use tainted buffers for the transport smtp context. * Bug 2493: Harden ARC verify against Outlook, which has been seen to mix the ordering of its ARC headers. This caused a crash. * Bug 2492: Use tainted memory for retry record when needed. Previously when a new record was being constructed with information from the peer, a trap was taken. * Bug 2494: Unset the default for dmarc_tld_file. * Fix an uninitialised flag in early-pipelining. Previously connections could, depending on the platform, hang at the STARTTLS response. * Bug 2498: Reset a counter used for ARC verify before handling another message on a connection. Previously if one message had ARC headers and the following one did not, a crash could result when adding an Authentication-Results: header. * Bug 2500: Rewind some of the common-coding in string handling between the Exim main code and Exim-related utities. * Fix the variables set by the gsasl authenticator. * Bug 2507: Modules: on handling a dynamic-module (lookups) open failure, only retrieve the errormessage once. * Bug 2501: Fix init call in the heimdal authenticator. Previously it adjusted the size of a major service buffer; this failed because the buffer was in use at the time. Change to a compile-time increase in the buffer size, when this authenticator is compiled into exim. - update to exim 4.93.0.4 (+fixes release) * Avoid costly startup code when not strictly needed. This reduces time for some exim process initialisations. It does mean that the logging of TLS configuration problems is only done for the daemon startup. * Early-pipelining support code is now included unless disabled in Makefile. * DKIM verification defaults no long accept sha1 hashes, to conform to RFC 8301. They can still be enabled, using the dkim_verify_hashes main option. * Support CHUNKING from an smtp transport using a transport_filter, when DKIM signing is being done. Previously a transport_filter would always disable CHUNKING, falling back to traditional DATA. * Regard command-line receipients as tainted. * Bug 340: Remove the daemon pid file on exit, whe due to SIGTERM. * Bug 2489: Fix crash in the "pam" expansion condition. It seems that the PAM library frees one of the arguments given to it, despite the documentation. Therefore a plain malloc must be used. * Bug 2491: Use tainted buffers for the transport smtp context. Previously on-stack buffers were used, resulting in a taint trap when DSN information copied from a received message was written into the buffer. * Bug 2493: Harden ARC verify against Outlook, whick has been seen to mix the ordering of its ARC headers. This caused a crash. * Bug 2492: Use tainted memory for retry record when needed. Previously when a new record was being constructed with information from the peer, a trap was taken. * Bug 2494: Unset the default for dmarc_tld_file. Previously a naiive installation would get error messages from DMARC verify, when it hit the nonexistent file indicated by the default. Distros wanting DMARC enabled should both provide the file and set the option. Also enforce no DMARC verification for command-line sourced messages. * Fix an uninitialised flag in early-pipelining. Previously connections could, depending on the platform, hang at the STARTTLS response. * Bug 2498: Reset a counter used for ARC verify before handling another message on a connection. Previously if one message had ARC headers and the following one did not, a crash could result when adding an Authentication-Results: header. * Bug 2500: Rewind some of the common-coding in string handling between the Exim main code and Exim-related utities. The introduction of taint tracking also did many adjustments to string handling. Since then, eximon frequently terminated with an assert failure. * When PIPELINING, synch after every hundred or so RCPT commands sent and check for 452 responses. This slightly helps the inefficieny of doing a large alias-expansion into a recipient-limited target. The max_rcpt transport option still applies (and at the current default, will override the new feature). The check is done for either cause of synch, and forces a fast-retry of all 452'd recipients using a new MAIL FROM on the same connection. The new facility is not tunable at this time. * Fix the variables set by the gsasl authenticator. Previously a pointer to library live data was being used, so the results became garbage. Make copies while it is still usable. * Logging: when the deliver_time selector ise set, include the DT= field on delivery deferred (==) and failed (**) lines (if a delivery was attemtped). Previously it was only on completion (=>) lines. * Authentication: the gsasl driver not provides the $authN variables in time for the expansion of the server_scram_iter and server_scram_salt options. spec file cleanup to make update work - add docdir to spec - update to exim 4.93 * SUPPORT_DMARC replaces EXPERIMENTAL_DMARC * DISABLE_TLS replaces SUPPORT_TLS * Bump the version for the local_scan API. * smtp transport option hosts_try_fastopen defaults to "*". * DNSSec is requested (not required) for all queries. (This seemes to ask for trouble if your resolver is a systemd-resolved.) * Generic router option retry_use_local_part defaults to "true" under specific pre-conditions. * Introduce a tainting mechanism for values read from untrusted sources. * Use longer file names for temporary spool files (this avoids name conflicts with spool on a shared file system). * Use dsn_from main config option (was ignored previously). - update to exim 4.92.3 * CVE-2019-16928: fix against Heap-based buffer overflow in string_vformat, remote code execution seems to be possible - update to exim 4.92.2 * CVE-2019-15846: fix against remote attackers executing arbitrary code as root via a trailing backslash - update to exim 4.92.1 * CVE-2019-13917: Fixed an issue with ${sort} expansion which could allow remote attackers to execute other programs with root privileges (boo#1142207) - spec file cleanup * fix DANE inclusion guard condition * re-enable i18n and remove misleading comment * EXPERIMENTAL_SPF is now SUPPORT_SPF * DANE is now SUPPORT_DANE - update to exim 4.92 * ${l_header:<name>} expansion * ${readsocket} now supports TLS * "utf8_downconvert" option (if built with SUPPORT_I18N) * "pipelining" log_selector * JSON variants for ${extract } expansion * "noutf8" debug option * TCP Fast Open support on MacOS * CVE-2019-10149: Fixed a Remote Command Execution (boo#1136587) - add workaround patch for compile time error on missing printf format annotation (gnu_printf.patch) - update to 4.91 * DEFER rather than ERROR on redis cluster MOVED response. * Catch and remove uninitialized value warning in exiqsumm * Disallow '/' characters in queue names specified for the "queue=" ACL modifier. This matches the restriction on the commandline. * Fix pgsql lookup for multiple result-tuples with a single column. Previously only the last row was returned. * Bug 2217: Tighten up the parsing of DKIM signature headers. * Bug 2215: Fix crash associated with dnsdb lookup done from DKIM ACL. * Fix issue with continued-connections when the DNS shifts unreliably. * Bug 2214: Fix SMTP responses resulting from non-accept result of MIME ACL. * The "support for" informational output now, which built with Content Scanning support, has a line for the malware scanner interfaces compiled in. Interface can be individually included or not at build time. * The "aveserver", "kavdaemon" and "mksd" interfaces are now not included by the template makefile "src/EDITME". The "STREAM" support for an older ClamAV interface method is removed. * Bug 2223: Fix mysql lookup returns for the no-data case (when the number of rows affected is given instead). * The runtime Berkeley DB library version is now additionally output by "exim -d -bV". Previously only the compile-time version was shown. * Bug 2230: Fix cutthrough routing for nonfirst messages in an initiating SMTP connection. * Bug 2229: Fix cutthrough routing for nonstandard port numbers defined by routers. * Bug 2174: A timeout on connect for a callout was also erroneously seen as a timeout on read on a GnuTLS initiating connection, resulting in the initiating connection being dropped. * Relax results from ACL control request to enable cutthrough, in unsupported situations, from error to silently (except under debug) ignoring. * Fix Buffer overflow in base64d() (CVE-2018-6789) * Fix bug in DKIM verify: a buffer overflow could corrupt the malloc metadata, resulting in a crash in free(). * Fix broken Heimdal GSSAPI authenticator integration. * Bug 2113: Fix conversation closedown with the Avast malware scanner. * Bug 2239: Enforce non-usability of control=utf8_downconvert in the mail ACL. * Speed up macro lookups during configuration file read, by skipping non- macro text after a replacement (previously it was only once per line) and by skipping builtin macros when searching for an uppercase lead character. * DANE support moved from Experimental to mainline. The Makefile control for the build is renamed. * Fix memory leak during multi-message connections using STARTTLS. * Bug 2236: When a DKIM verification result is overridden by ACL, DMARC reported the original. Fix to report (as far as possible) the ACL result replacing the original. * Fix memory leak during multi-message connections using STARTTLS under OpenSSL * Bug 2242: Fix exim_dbmbuild to permit directoryless filenames. * Fix utf8_downconvert propagation through a redirect router. * Bug 2253: For logging delivery lines under PRDR, append the overall DATA response info to the (existing) per-recipient response info for the "C=" log element. * Bug 2251: Fix ldap lookups that return a single attribute having zero- length value. * Support Avast multiline protocol, this allows passing flags to newer versions of the scanner. * Ensure that variables possibly set during message acceptance are marked dead before release of memory in the daemon loop. * Bug 2250: Fix a longstanding bug in heavily-pipelined SMTP input (such as a multi-recipient message from a mailinglist manager). * The (EXPERIMENTAL_DMARC) variable $dmarc_ar_header is withdrawn, being replaced by the ${authresults } expansion. * Bug 2257: Fix pipe transport to not use a socket-only syscall. * Set a handler for SIGTERM and call exit(3) if running as PID 1. This allows proper process termination in container environments. * Bug 2258: Fix spool_wireformat in combination with LMTP transport. Previously the "final dot" had a newline after it; ensure it is CR,LF. * SPF: remove support for the "spf" ACL condition outcome values "err_temp" and "err_perm", deprecated since 4.83 when the RFC-defined words " temperror" and "permerror" were introduced. * Re-introduce enforcement of no cutthrough delivery on transports having transport-filters or DKIM-signing. * Cutthrough: for a final-dot response timeout (and nonunderstood responses) in defer=pass mode supply a 450 to the initiator. Previously the message would be spooled. * DANE: add dane_require_tls_ciphers SMTP Transport option; if unset, tls_require_ciphers is used as before. * Malware Avast: Better match the Avast multiline protocol. * Fix reinitialisation of DKIM logging variable between messages. * Bug 2255: Revert the disable of the OpenSSL session caching. * Add util/renew-opendmarc-tlds.sh script for safe renewal of public suffix list. * DKIM: accept Ed25519 pubkeys in SubjectPublicKeyInfo-wrapped form, since the IETF WG has not yet settled on that versus the original "bare" representation. * Fix syslog logging for syslog_timestamp=no and log_selector +millisec. Previously the millisecond value corrupted the output. Fix also for syslog_pid=no and log_selector +pid, for which the pid corrupted the output. - Replace xorg-x11-devel by individual pkgconfig() buildrequires. - update to 4.90.1 * Allow PKG_CONFIG_PATH to be set in Local/Makefile and use it correctly during configuration. Wildcards are allowed and expanded. * Shorten the log line for daemon startup by collapsing adjacent sets of identical IP addresses on different listening ports. Will also affect "exiwhat" output. * Tighten up the checking in isip4 (et al): dotted-quad components larger than 255 are no longer allowed. * Default openssl_options to include +no_ticket, to reduce load on peers. Disable the session-cache too, which might reduce our load. Since we currrectly use a new context for every connection, both as server and client, there is no benefit for these. * Add $SOURCE_DATE_EPOCH support for reproducible builds, per spec at <https://reproducible-builds.org/specs/source-date-epoch/>. * Fix smtp transport use of limited max_rcpt under mua_wrapper. Previously the check for any unsuccessful recipients did not notice the limit, and erroneously found still-pending ones. * Pipeline CHUNKING command and data together, on kernels that support MSG_MORE. Only in-clear (not on TLS connections). * Avoid using a temporary file during transport using dkim. Unless a transport-filter is involved we can buffer the headers in memory for creating the signature, and read the spool data file once for the signature and again for transmission. * Enable use of sendfile in Linux builds as default. It was disabled in 4.77 as the kernel support then wasn't solid, having issues in 64bit mode. Now, it's been long enough. Add support for FreeBSD also. * Add commandline_checks_require_admin option. * Do pipelining under TLS. * For the "sock" variant of the malware scanner interface, accept an empty cmdline element to get the documented default one. Previously it was inaccessible. * Prevent repeated use of -p/-oMr * DKIM: enforce the DNS pubkey record "h" permitted-hashes optional field, if present. * DKIM: when a message has multiple signatures matching an identity given in dkim_verify_signers, run the dkim acl once for each. * Support IDNA2008. * The path option on a pipe transport is now expanded before use * Have the EHLO response advertise VRFY, if there is a vrfy ACL defined. - Several bug fixes - Fix for buffer overflow in base64decode() (boo#1079832 CVE-2018-6789) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-677=1 Package List: - openSUSE Leap 15.2 (x86_64): exim-4.94.2-lp152.8.3.1 exim-debuginfo-4.94.2-lp152.8.3.1 exim-debugsource-4.94.2-lp152.8.3.1 eximon-4.94.2-lp152.8.3.1 eximon-debuginfo-4.94.2-lp152.8.3.1 eximstats-html-4.94.2-lp152.8.3.1 References: https://www.suse.com/security/cve/CVE-2017-1000369.html https://www.suse.com/security/cve/CVE-2017-16943.html https://www.suse.com/security/cve/CVE-2017-16944.html https://www.suse.com/security/cve/CVE-2018-6789.html https://www.suse.com/security/cve/CVE-2019-16928.html https://www.suse.com/security/cve/CVE-2020-12783.html https://www.suse.com/security/cve/CVE-2020-28007.html https://www.suse.com/security/cve/CVE-2020-28008.html https://www.suse.com/security/cve/CVE-2020-28009.html https://www.suse.com/security/cve/CVE-2020-28010.html https://www.suse.com/security/cve/CVE-2020-28011.html https://www.suse.com/security/cve/CVE-2020-28012.html https://www.suse.com/security/cve/CVE-2020-28013.html https://www.suse.com/security/cve/CVE-2020-28014.html https://www.suse.com/security/cve/CVE-2020-28015.html https://www.suse.com/security/cve/CVE-2020-28016.html https://www.suse.com/security/cve/CVE-2020-28017.html https://www.suse.com/security/cve/CVE-2020-28018.html https://www.suse.com/security/cve/CVE-2020-28019.html https://www.suse.com/security/cve/CVE-2020-28020.html https://www.suse.com/security/cve/CVE-2020-28021.html https://www.suse.com/security/cve/CVE-2020-28022.html https://www.suse.com/security/cve/CVE-2020-28023.html https://www.suse.com/security/cve/CVE-2020-28024.html https://www.suse.com/security/cve/CVE-2020-28025.html https://www.suse.com/security/cve/CVE-2020-28026.html https://bugzilla.suse.com/1079832 https://bugzilla.suse.com/1171490 https://bugzilla.suse.com/1171877 https://bugzilla.suse.com/1173693 https://bugzilla.suse.com/1185631

1 0

openSUSE-SU-2021:0675-1: moderate: Security update for alpine
by opensuse-security＠opensuse.org 06 May '21

06 May '21

openSUSE Security Update: Security update for alpine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0675-1 Rating: moderate References: #1173281 Cross-References: CVE-2020-14929 CVSS scores: CVE-2020-14929 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2020-14929 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for alpine fixes the following issues: Update to release 2.24 * A few crash fixes * Implementation of XOAUTH2 for Yahoo! Mail. Update to release 2.23.2 * Expansion of the configuration screen for XOAUTH2 to include username, and tenant. * Alpine uses the domain in the From: header of a message to generate a message-id and suppresses all information about Alpine, version, revision, and time of generation of the message-id from this header. * Alpine does not generate Sender or X-X-Sender by default by enabling [X] Disable Sender as the default. * Alpine does not disclose User Agent by default by enabling [X] Suppress User Agent by default. * When messages are selected, pressing the ';' command to broaden or narrow a search, now offers the possibility to completely replace the search, and is almost equivalent to being a shortcut to "unselect all messages, and select again". Update to release 2.23 * Fixes boo#1173281, CVE-2020-14929: Alpine silently proceeds to use an insecure connection after a /tls is sent in certain circumstances. * Implementation of XOAUTH2 authentication support for Outlook. * Add support for the OAUTHBEARER authentication method in Gmail. * Support for the SASL-IR IMAP extension. * Alpine can pass an HTML message to an external web browser, by using the "External" command in the ATTACHMENT INDEX screen. Update to release 2.22 * Support for XOAUTH2 authentication method in Gmail. * NTLM authentication support with the ntlm library. * Added the "/tls1_3" flag for servers that support it. * Add the "g" option to the select command that works in IMAP servers that implement the X-GM-EXT-1 capability (such as the one offered by Gmail). * Added "/auth=XYZ" to the way to define a server. This allows users to select the method to authenticate to an IMAP, SMTP or POP3 server. Examples are /auth=plain, or /auth=gssapi, etc. * When a message is of type multipart/mixed, and its first part is multipart/signed, Alpine will include the text of the original message in a reply message, instead of including a multipart attachment. * Added backward search in the index screen. * pico: Add -dict option to Pico, which allows users to choose a dictionary when spelling. - Drop /usr/bin/mailutil, it is not built by default anymore. * Added Quota subcommands for printing, forwarding, saving, etc. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-675=1 Package List: - openSUSE Leap 15.2 (x86_64): alpine-2.24-lp152.5.3.1 alpine-debuginfo-2.24-lp152.5.3.1 alpine-debugsource-2.24-lp152.5.3.1 pico-5.07-lp152.5.3.1 pico-debuginfo-5.07-lp152.5.3.1 pilot-2.99-lp152.5.3.1 pilot-debuginfo-2.99-lp152.5.3.1 References: https://www.suse.com/security/cve/CVE-2020-14929.html https://bugzilla.suse.com/1173281

1 0