July 2021 - openSUSE Security Announce

openSUSE-SU-2021:2575-1: moderate: Security update for php7
by opensuse-security＠opensuse.org 30 Jul '21

30 Jul '21

openSUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2575-1 Rating: moderate References: #1188037 Cross-References: CVE-2021-21705 CVSS scores: CVE-2021-21705 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for php7 fixes the following issues: - CVE-2021-21705 [bsc#1188037]: SSRF bypass in FILTER_VALIDATE_URL Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2575=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): php7-wddx-7.2.5-4.76.5 php7-wddx-debuginfo-7.2.5-4.76.5 - openSUSE Leap 15.3 (noarch): php7-pear-Archive_Tar-7.2.5-4.76.5 References: https://www.suse.com/security/cve/CVE-2021-21705.html https://bugzilla.suse.com/1188037

1 0

openSUSE-SU-2021:2565-1: Security update for fastjar
by opensuse-security＠opensuse.org 29 Jul '21

29 Jul '21

openSUSE Security Update: Security update for fastjar ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2565-1 Rating: low References: #1188517 Cross-References: CVE-2010-2322 CVSS scores: CVE-2010-2322 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for fastjar fixes the following issues: - CVE-2010-2322: Fixed a directory traversal vulnerabilities. (bsc#1188517) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2565=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): fastjar-0.98-3.6.2 fastjar-debuginfo-0.98-3.6.2 fastjar-debugsource-0.98-3.6.2 References: https://www.suse.com/security/cve/CVE-2010-2322.html https://bugzilla.suse.com/1188517

1 0

openSUSE-SU-2021:2555-1: moderate: Security update for git
by opensuse-security＠opensuse.org 29 Jul '21

29 Jul '21

openSUSE Security Update: Security update for git ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2555-1 Rating: moderate References: #1168930 #1183026 #1183580 SLE-17838 SLE-18152 Cross-References: CVE-2021-21300 CVSS scores: CVE-2021-21300 (NVD) : 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21300 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves one vulnerability, contains two features and has two fixes is now available. Description: This update for git fixes the following issues: Update from version 2.26.2 to version 2.31.1 (jsc#SLE-18152) Security fixes: - CVE-2021-21300: On case-insensitive file systems with support for symbolic links, if Git is configured globally to apply delay-capable clean/smudge filters (such as Git LFS), Git could run remote code during a clone. (bsc#1183026) Non security changes: - Add `sysusers` file to create `git-daemon` user. - Remove `perl-base` and `openssh-server` dependency on `git-core`and provide a `perl-Git` package. (jsc#SLE-17838) - `fsmonitor` bug fixes - Fix `git bisect` to take an annotated tag as a good/bad endpoint - Fix a corner case in `git mv` on case insensitive systems - Require only `openssh-clients` where possible (like Tumbleweed or SUSE Linux Enterprise >= 15 SP3). (bsc#1183580) - Drop `rsync` requirement, not necessary anymore. - Use of `pack-redundant` command is discouraged and will trigger a warning. The replacement is `repack -d`. - The `--format=%(trailers)` mechanism gets enhanced to make it easier to design output for machine consumption. - No longer give message to choose between rebase or merge upon pull if the history `fast-forwards`. - The configuration variable `core.abbrev` can be set to `no` to force no abbreviation regardless of the hash algorithm - `git rev-parse` can be explicitly told to give output as absolute or relative path with the `--path-format=(absolute|relative)` option. - Bash completion update to make it easier for end-users to add completion for their custom `git` subcommands. - `git maintenance` learned to drive scheduled maintenance on platforms whose native scheduling methods are not 'cron'. - After expiring a reflog and making a single commit, the reflog for the branch would record a single entry that knows both `@{0}` and `@{1}`, but we failed to answer "what commit were we on?", i.e. `@{1}` - `git bundle` learns `--stdin` option to read its refs from the standard input. Also, it now does not lose refs when they point at the same object. - `git log` learned a new `--diff-merges=<how>` option. - `git ls-files` can and does show multiple entries when the index is unmerged, which is a source for confusion unless `-s/-u` option is in use. A new option `--deduplicate` has been introduced. - `git worktree list` now annotates worktrees as prunable, shows locked and prunable attributes in `--porcelain mode`, and gained a `--verbose` option. - `git clone` tries to locally check out the branch pointed at by HEAD of the remote repository after it is done, but the protocol did not convey the information necessary to do so when copying an empty repository. The protocol v2 learned how to do so. - There are other ways than `..` for a single token to denote a `commit range", namely `<rev>^!` and `<rev>^-<n>`, but `git range-diff` did not understand them. - The `git range-diff` command learned `--(left|right)-only` option to show only one side of the compared range. - `git mergetool` feeds three versions (base, local and remote) of a conflicted path unmodified. The command learned to optionally prepare these files with unconflicted parts already resolved. - The `.mailmap` is documented to be read only from the root level of a working tree, but a stray file in a bare repository also was read by accident, which has been corrected. - `git maintenance` tool learned a new `pack-refs` maintenance task. - Improved error message given when a configuration variable that is expected to have a boolean value. - Signed commits and tags now allow verification of objects, whose two object names (one in SHA-1, the other in SHA-256) are both signed. - `git rev-list` command learned `--disk-usage` option. - `git diff`, `git log` `--{skip,rotate}-to=<path>` allows the user to discard diff output for early paths or move them to the end of the output. - `git difftool` learned `--skip-to=<path>` option to restart an interrupted session from an arbitrary path. - `git grep` has been tweaked to be limited to the sparse checkout paths. - `git rebase --[no-]fork-point` gained a configuration variable `rebase.forkPoint` so that users do not have to keep specifying a non-default setting. - `git stash` did not work well in a sparsely checked out working tree. - Newline characters in the host and path part of `git://` URL are now forbidden. - `Userdiff` updates for PHP, Rust, CSS - Avoid administrator error leading to data loss with `git push --force-with-lease[=<ref>]` by introducing `--force-if-includes` - only pull `asciidoctor` for the default ruby version - The `--committer-date-is-author-date` option of `rebase` and `am` subcommands lost the e-mail address by mistake in 2.29 - The transport protocol v2 has become the default again - `git worktree` gained a `repair` subcommand, `git init --separate-git-dir` no longer corrupts administrative data related to linked worktrees - `git maintenance` introduced for repository maintenance tasks - `fetch.writeCommitGraph` is deemed to be still a bit too risky and is no longer part of the `feature.experimental` set. - The commands in the `diff` family honors the `diff.relative` configuration variable. - `git diff-files` has been taught to say paths that are marked as `intent-to-add` are new files, not modified from an empty blob. - `git gui` now allows opening work trees from the start-up dialog. - `git bugreport` reports what shell is in use. - Some repositories have commits that record wrong committer timezone; `git fast-import` has an option to pass these timestamps intact to allow recreating existing repositories as-is. - `git describe` will always use the `long` version when giving its output based misplaced tags - `git pull` issues a warning message until the `pull.rebase` configuration variable is explicitly given Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2555=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): git-2.31.1-10.3.1 git-arch-2.31.1-10.3.1 git-core-2.31.1-10.3.1 git-core-debuginfo-2.31.1-10.3.1 git-credential-gnome-keyring-2.31.1-10.3.1 git-credential-gnome-keyring-debuginfo-2.31.1-10.3.1 git-credential-libsecret-2.31.1-10.3.1 git-credential-libsecret-debuginfo-2.31.1-10.3.1 git-cvs-2.31.1-10.3.1 git-daemon-2.31.1-10.3.1 git-daemon-debuginfo-2.31.1-10.3.1 git-debuginfo-2.31.1-10.3.1 git-debugsource-2.31.1-10.3.1 git-email-2.31.1-10.3.1 git-gui-2.31.1-10.3.1 git-p4-2.31.1-10.3.1 git-svn-2.31.1-10.3.1 git-web-2.31.1-10.3.1 gitk-2.31.1-10.3.1 perl-Git-2.31.1-10.3.1 - openSUSE Leap 15.3 (noarch): git-doc-2.31.1-10.3.1 References: https://www.suse.com/security/cve/CVE-2021-21300.html https://bugzilla.suse.com/1168930 https://bugzilla.suse.com/1183026 https://bugzilla.suse.com/1183580

1 0

openSUSE-SU-2021:1863-1: important: Security update for umoci
by opensuse-security＠opensuse.org 27 Jul '21

27 Jul '21

openSUSE Security Update: Security update for umoci ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1863-1 Rating: important References: #1184147 Cross-References: CVE-2021-29136 CVSS scores: CVE-2021-29136 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVE-2021-29136 (SUSE): 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for umoci fixes the following issues: Update to v0.4.7 (bsc#1184147). - CVE-2021-29136: Fixed overwriting of host files via malicious layer (bsc#1184147). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1863=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): umoci-0.4.7-3.12.1 References: https://www.suse.com/security/cve/CVE-2021-29136.html https://bugzilla.suse.com/1184147

1 0

openSUSE-SU-2021:2474-1: important: Security update for qemu
by opensuse-security＠opensuse.org 27 Jul '21

27 Jul '21

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2474-1 Rating: important References: #1187364 #1187365 #1187366 #1187367 #1187499 #1187529 #1187538 #1187539 Cross-References: CVE-2021-3582 CVE-2021-3592 CVE-2021-3593 CVE-2021-3594 CVE-2021-3595 CVE-2021-3607 CVE-2021-3608 CVE-2021-3611 CVSS scores: CVE-2021-3582 (SUSE): 3.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L CVE-2021-3592 (NVD) : 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N CVE-2021-3592 (SUSE): 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N CVE-2021-3593 (NVD) : 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N CVE-2021-3593 (SUSE): 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N CVE-2021-3594 (NVD) : 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N CVE-2021-3594 (SUSE): 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N CVE-2021-3595 (NVD) : 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N CVE-2021-3595 (SUSE): 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N CVE-2021-3607 (SUSE): 3.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L CVE-2021-3608 (SUSE): 3.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L CVE-2021-3611 (SUSE): 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for qemu fixes the following issues: Security issues fixed: - CVE-2021-3595: Fixed slirp: invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366) - CVE-2021-3592: Fix for slirp: invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364) - CVE-2021-3594: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367) - CVE-2021-3593: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp6) (bsc#1187365) - CVE-2021-3582: Fix possible mremap overflow in the pvrdma (bsc#1187499) - CVE-2021-3607: Ensure correct input on ring init (bsc#1187539) - CVE-2021-3608: Fix the ring init error flow (bsc#1187538) - CVE-2021-3611: Fix intel-hda segmentation fault due to stack overflow (bsc#1187529) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2474=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): qemu-s390-4.2.1-11.25.2 qemu-s390-debuginfo-4.2.1-11.25.2 References: https://www.suse.com/security/cve/CVE-2021-3582.html https://www.suse.com/security/cve/CVE-2021-3592.html https://www.suse.com/security/cve/CVE-2021-3593.html https://www.suse.com/security/cve/CVE-2021-3594.html https://www.suse.com/security/cve/CVE-2021-3595.html https://www.suse.com/security/cve/CVE-2021-3607.html https://www.suse.com/security/cve/CVE-2021-3608.html https://www.suse.com/security/cve/CVE-2021-3611.html https://bugzilla.suse.com/1187364 https://bugzilla.suse.com/1187365 https://bugzilla.suse.com/1187366 https://bugzilla.suse.com/1187367 https://bugzilla.suse.com/1187499 https://bugzilla.suse.com/1187529 https://bugzilla.suse.com/1187538 https://bugzilla.suse.com/1187539

1 0

openSUSE-SU-2021:1089-1: moderate: Security update for icinga2
by opensuse-security＠opensuse.org 24 Jul '21

24 Jul '21

openSUSE Security Update: Security update for icinga2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1089-1 Rating: moderate References: Cross-References: CVE-2020-29663 CVE-2021-32739 CVE-2021-32743 CVSS scores: CVE-2020-29663 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2020-29663 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affected Products: openSUSE Leap 15.2 openSUSE Backports SLE-15-SP3 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for icinga2 fixes the following issues: icinga2 was updated to 2.12.5: Version 2.12.5 fixes two security vulnerabilities that may lead to privilege escalation for authenticated API users. Other improvements include several bugfixes related to downtimes, downtime notifications, and more reliable connection handling. * Security - Don't expose the PKI ticket salt via the API. This may lead to privilege escalation for authenticated API users by them being able to request certificates for other identities (CVE-2021-32739) - Don't expose IdoMysqlConnection, IdoPgsqlConnection, and ElasticsearchWriter passwords via the API (CVE-2021-32743) Depending on your setup, manual intervention beyond installing the new versions may be required, so please read the more detailed information in the release blog post carefully. * Bugfixes - Don't send downtime end notification if downtime hasn't started #8878 - Don't let a failed downtime creation block the others #8871 - Support downtimes and comments for checkables with long names #8870 - Trigger fixed downtimes immediately if the current time matches (instead of waiting for the timer) #8891 - Add configurable timeout for full connection handshake #8872 * Enhancements - Replace existing downtimes on ScheduledDowntime change #8880 - Improve crashlog #8869 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1089=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1089=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1089=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-1089=1 Package List: - openSUSE Leap 15.2 (x86_64): icinga2-2.12.5-lp152.3.9.1 icinga2-bin-2.12.5-lp152.3.9.1 icinga2-bin-debuginfo-2.12.5-lp152.3.9.1 icinga2-common-2.12.5-lp152.3.9.1 icinga2-debuginfo-2.12.5-lp152.3.9.1 icinga2-debugsource-2.12.5-lp152.3.9.1 icinga2-doc-2.12.5-lp152.3.9.1 icinga2-ido-mysql-2.12.5-lp152.3.9.1 icinga2-ido-mysql-debuginfo-2.12.5-lp152.3.9.1 icinga2-ido-pgsql-2.12.5-lp152.3.9.1 icinga2-ido-pgsql-debuginfo-2.12.5-lp152.3.9.1 nano-icinga2-2.12.5-lp152.3.9.1 vim-icinga2-2.12.5-lp152.3.9.1 - openSUSE Backports SLE-15-SP3 (aarch64 ppc64le x86_64): icinga2-2.12.5-bp153.2.5.1 icinga2-bin-2.12.5-bp153.2.5.1 icinga2-bin-debuginfo-2.12.5-bp153.2.5.1 icinga2-common-2.12.5-bp153.2.5.1 icinga2-debuginfo-2.12.5-bp153.2.5.1 icinga2-debugsource-2.12.5-bp153.2.5.1 icinga2-doc-2.12.5-bp153.2.5.1 icinga2-ido-mysql-2.12.5-bp153.2.5.1 icinga2-ido-mysql-debuginfo-2.12.5-bp153.2.5.1 icinga2-ido-pgsql-2.12.5-bp153.2.5.1 icinga2-ido-pgsql-debuginfo-2.12.5-bp153.2.5.1 nano-icinga2-2.12.5-bp153.2.5.1 vim-icinga2-2.12.5-bp153.2.5.1 - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le x86_64): icinga2-2.12.5-bp152.4.9.2 icinga2-bin-2.12.5-bp152.4.9.2 icinga2-bin-debuginfo-2.12.5-bp152.4.9.2 icinga2-common-2.12.5-bp152.4.9.2 icinga2-debuginfo-2.12.5-bp152.4.9.2 icinga2-debugsource-2.12.5-bp152.4.9.2 icinga2-doc-2.12.5-bp152.4.9.2 icinga2-ido-mysql-2.12.5-bp152.4.9.2 icinga2-ido-mysql-debuginfo-2.12.5-bp152.4.9.2 icinga2-ido-pgsql-2.12.5-bp152.4.9.2 icinga2-ido-pgsql-debuginfo-2.12.5-bp152.4.9.2 nano-icinga2-2.12.5-bp152.4.9.2 vim-icinga2-2.12.5-bp152.4.9.2 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le x86_64): icinga2-2.12.5-bp151.3.9.1 icinga2-bin-2.12.5-bp151.3.9.1 icinga2-common-2.12.5-bp151.3.9.1 icinga2-doc-2.12.5-bp151.3.9.1 icinga2-ido-mysql-2.12.5-bp151.3.9.1 icinga2-ido-pgsql-2.12.5-bp151.3.9.1 nano-icinga2-2.12.5-bp151.3.9.1 vim-icinga2-2.12.5-bp151.3.9.1 References: https://www.suse.com/security/cve/CVE-2020-29663.html https://www.suse.com/security/cve/CVE-2021-32739.html https://www.suse.com/security/cve/CVE-2021-32743.html

1 0

openSUSE-SU-2021:1087-1: moderate: Security update for crmsh
by opensuse-security＠opensuse.org 24 Jul '21

24 Jul '21

openSUSE Security Update: Security update for crmsh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1087-1 Rating: moderate References: #1163460 #1175982 #1179999 #1184465 #1185423 #1187553 SLE-17979 Cross-References: CVE-2020-35459 CVSS scores: CVE-2020-35459 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2020-35459 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability, contains one feature and has 5 fixes is now available. Description: This update for crmsh fixes the following issues: Update to version 4.3.1+20210624.67223df2: - Fix: ocfs2: Skip verifying UUID for ocfs2 device on top of raid or lvm on the join node (bsc#1187553) - Fix: history: use Path.mkdir instead of mkdir command(bsc#1179999, CVE-2020-35459) - Dev: crash_test: Add big warnings to have users' attention to potential failover(jsc#SLE-17979) - Dev: crash_test: rename preflight_check as crash_test(jsc#SLE-17979) - Fix: bootstrap: update sbd watchdog timeout when using diskless SBD with qdevice(bsc#1184465) - Dev: utils: allow configure link-local ipv6 address(bsc#1163460) - Fix: parse: shouldn't allow property setting with an empty value(bsc#1185423) - Fix: help: show help message from argparse(bsc#1175982) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1087=1 Package List: - openSUSE Leap 15.2 (noarch): crmsh-4.3.1+20210702.4e0ee8fb-lp152.4.59.1 crmsh-scripts-4.3.1+20210702.4e0ee8fb-lp152.4.59.1 crmsh-test-4.3.1+20210702.4e0ee8fb-lp152.4.59.1 References: https://www.suse.com/security/cve/CVE-2020-35459.html https://bugzilla.suse.com/1163460 https://bugzilla.suse.com/1175982 https://bugzilla.suse.com/1179999 https://bugzilla.suse.com/1184465 https://bugzilla.suse.com/1185423 https://bugzilla.suse.com/1187553

1 0

openSUSE-SU-2021:1088-1: moderate: Security update for curl
by opensuse-security＠opensuse.org 24 Jul '21

24 Jul '21

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1088-1 Rating: moderate References: #1188217 #1188218 #1188219 #1188220 Cross-References: CVE-2021-22922 CVE-2021-22923 CVE-2021-22924 CVE-2021-22925 CVSS scores: CVE-2021-22922 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVE-2021-22923 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2021-22924 (SUSE): 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVE-2021-22925 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for curl fixes the following issues: - CVE-2021-22925: TELNET stack contents disclosure again. (bsc#1188220) - CVE-2021-22924: Bad connection reuse due to flawed path name checks. (bsc#1188219) - CVE-2021-22923: Insufficiently Protected Credentials. (bsc#1188218) - CVE-2021-22922: Wrong content via metalink not discarded. (bsc#1188217) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1088=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): curl-7.66.0-lp152.3.21.1 curl-debuginfo-7.66.0-lp152.3.21.1 curl-debugsource-7.66.0-lp152.3.21.1 curl-mini-7.66.0-lp152.3.21.1 curl-mini-debuginfo-7.66.0-lp152.3.21.1 curl-mini-debugsource-7.66.0-lp152.3.21.1 libcurl-devel-7.66.0-lp152.3.21.1 libcurl-mini-devel-7.66.0-lp152.3.21.1 libcurl4-7.66.0-lp152.3.21.1 libcurl4-debuginfo-7.66.0-lp152.3.21.1 libcurl4-mini-7.66.0-lp152.3.21.1 libcurl4-mini-debuginfo-7.66.0-lp152.3.21.1 - openSUSE Leap 15.2 (x86_64): libcurl-devel-32bit-7.66.0-lp152.3.21.1 libcurl4-32bit-7.66.0-lp152.3.21.1 libcurl4-32bit-debuginfo-7.66.0-lp152.3.21.1 References: https://www.suse.com/security/cve/CVE-2021-22922.html https://www.suse.com/security/cve/CVE-2021-22923.html https://www.suse.com/security/cve/CVE-2021-22924.html https://www.suse.com/security/cve/CVE-2021-22925.html https://bugzilla.suse.com/1188217 https://bugzilla.suse.com/1188218 https://bugzilla.suse.com/1188219 https://bugzilla.suse.com/1188220

1 0

openSUSE-SU-2021:1082-1: moderate: Security update for systemd
by opensuse-security＠opensuse.org 24 Jul '21

24 Jul '21

openSUSE Security Update: Security update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1082-1 Rating: moderate References: #1184994 #1188063 Cross-References: CVE-2021-33910 CVSS scores: CVE-2021-33910 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for systemd fixes the following issues: - CVE-2021-33910: Fixed a denial of service in systemd via unit_name_path_escape() (bsc#1188063) - Skip udev rules if 'elevator=' is used (bsc#1184994) This update was imported from the SUSE:SLE-15:Update update project. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1082=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libsystemd0-234-lp152.31.31.1 libsystemd0-debuginfo-234-lp152.31.31.1 libsystemd0-mini-234-lp152.31.31.1 libsystemd0-mini-debuginfo-234-lp152.31.31.1 libudev-devel-234-lp152.31.31.1 libudev-mini-devel-234-lp152.31.31.1 libudev-mini1-234-lp152.31.31.1 libudev-mini1-debuginfo-234-lp152.31.31.1 libudev1-234-lp152.31.31.1 libudev1-debuginfo-234-lp152.31.31.1 nss-myhostname-234-lp152.31.31.1 nss-myhostname-debuginfo-234-lp152.31.31.1 nss-mymachines-234-lp152.31.31.1 nss-mymachines-debuginfo-234-lp152.31.31.1 nss-systemd-234-lp152.31.31.1 nss-systemd-debuginfo-234-lp152.31.31.1 systemd-234-lp152.31.31.1 systemd-container-234-lp152.31.31.1 systemd-container-debuginfo-234-lp152.31.31.1 systemd-coredump-234-lp152.31.31.1 systemd-coredump-debuginfo-234-lp152.31.31.1 systemd-debuginfo-234-lp152.31.31.1 systemd-debugsource-234-lp152.31.31.1 systemd-devel-234-lp152.31.31.1 systemd-journal-remote-234-lp152.31.31.1 systemd-journal-remote-debuginfo-234-lp152.31.31.1 systemd-logger-234-lp152.31.31.1 systemd-mini-234-lp152.31.31.1 systemd-mini-container-mini-234-lp152.31.31.1 systemd-mini-container-mini-debuginfo-234-lp152.31.31.1 systemd-mini-coredump-mini-234-lp152.31.31.1 systemd-mini-coredump-mini-debuginfo-234-lp152.31.31.1 systemd-mini-debuginfo-234-lp152.31.31.1 systemd-mini-debugsource-234-lp152.31.31.1 systemd-mini-devel-234-lp152.31.31.1 systemd-mini-sysvinit-234-lp152.31.31.1 systemd-network-234-lp152.31.31.1 systemd-network-debuginfo-234-lp152.31.31.1 systemd-sysvinit-234-lp152.31.31.1 udev-234-lp152.31.31.1 udev-debuginfo-234-lp152.31.31.1 udev-mini-234-lp152.31.31.1 udev-mini-debuginfo-234-lp152.31.31.1 - openSUSE Leap 15.2 (noarch): systemd-bash-completion-234-lp152.31.31.1 systemd-mini-bash-completion-234-lp152.31.31.1 - openSUSE Leap 15.2 (x86_64): libsystemd0-32bit-234-lp152.31.31.1 libsystemd0-32bit-debuginfo-234-lp152.31.31.1 libudev-devel-32bit-234-lp152.31.31.1 libudev1-32bit-234-lp152.31.31.1 libudev1-32bit-debuginfo-234-lp152.31.31.1 nss-myhostname-32bit-234-lp152.31.31.1 nss-myhostname-32bit-debuginfo-234-lp152.31.31.1 nss-mymachines-32bit-234-lp152.31.31.1 nss-mymachines-32bit-debuginfo-234-lp152.31.31.1 systemd-32bit-234-lp152.31.31.1 systemd-32bit-debuginfo-234-lp152.31.31.1 References: https://www.suse.com/security/cve/CVE-2021-33910.html https://bugzilla.suse.com/1184994 https://bugzilla.suse.com/1188063

1 0

openSUSE-SU-2021:1081-1: moderate: Security update for containerd
by opensuse-security＠opensuse.org 23 Jul '21

23 Jul '21

openSUSE Security Update: Security update for containerd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1081-1 Rating: moderate References: #1188282 Cross-References: CVE-2021-32760 CVSS scores: CVE-2021-32760 (SUSE): 3 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for containerd fixes the following issues: - CVE-2021-32760: Fixed a bug which allows untrusted container images to change permissions in the host's filesystem. (bsc#1188282) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1081=1 Package List: - openSUSE Leap 15.2 (x86_64): containerd-1.4.4-lp152.2.9.1 containerd-ctr-1.4.4-lp152.2.9.1 References: https://www.suse.com/security/cve/CVE-2021-32760.html https://bugzilla.suse.com/1188282

1 0