July 2021 - openSUSE Security Announce

openSUSE-SU-2021:2143-1: important: Security update for libnettle
by opensuse-security＠opensuse.org 11 Jul '21

11 Jul '21

openSUSE Security Update: Security update for libnettle ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2143-1 Rating: important References: #1187060 Cross-References: CVE-2021-3580 CVSS scores: CVE-2021-3580 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libnettle fixes the following issues: - CVE-2021-3580: Fixed a remote denial of service in the RSA decryption via manipulated ciphertext (bsc#1187060). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2143=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libhogweed4-3.4.1-4.18.1 libhogweed4-debuginfo-3.4.1-4.18.1 libnettle-debugsource-3.4.1-4.18.1 libnettle-devel-3.4.1-4.18.1 libnettle6-3.4.1-4.18.1 libnettle6-debuginfo-3.4.1-4.18.1 nettle-3.4.1-4.18.1 nettle-debuginfo-3.4.1-4.18.1 - openSUSE Leap 15.3 (x86_64): libhogweed4-32bit-3.4.1-4.18.1 libhogweed4-32bit-debuginfo-3.4.1-4.18.1 libnettle-devel-32bit-3.4.1-4.18.1 libnettle6-32bit-3.4.1-4.18.1 libnettle6-32bit-debuginfo-3.4.1-4.18.1 References: https://www.suse.com/security/cve/CVE-2021-3580.html https://bugzilla.suse.com/1187060

1 0

openSUSE-SU-2021:2274-1: moderate: Security update for kubevirt
by opensuse-security＠opensuse.org 11 Jul '21

11 Jul '21

openSUSE Security Update: Security update for kubevirt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2274-1 Rating: moderate References: ECO-2415 ECO-3633 SLE-11089 Cross-References: CVE-2021-20286 CVSS scores: CVE-2021-20286 (NVD) : 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability, contains three features is now available. Description: This update for kubevirt fixes the following issues: General: - Updated kubevirt to version 0.40.0 - Fixed an issue when calling `virsh-domcapabilities` - Fixed the the wrong registry path for containers. Security fixes: - CVE-2021-20286: A flaw was found in libnbd 1.7.3. An assertion failure in nbd_unlocked_opt_go in ilb/opt.c may lead to denial of service. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2274=1 Package List: - openSUSE Leap 15.3 (x86_64): kubevirt-container-disk-0.40.0-5.11.2 kubevirt-container-disk-debuginfo-0.40.0-5.11.2 kubevirt-manifests-0.40.0-5.11.2 kubevirt-tests-0.40.0-5.11.2 kubevirt-tests-debuginfo-0.40.0-5.11.2 kubevirt-virt-api-0.40.0-5.11.2 kubevirt-virt-api-debuginfo-0.40.0-5.11.2 kubevirt-virt-controller-0.40.0-5.11.2 kubevirt-virt-controller-debuginfo-0.40.0-5.11.2 kubevirt-virt-handler-0.40.0-5.11.2 kubevirt-virt-handler-debuginfo-0.40.0-5.11.2 kubevirt-virt-launcher-0.40.0-5.11.2 kubevirt-virt-launcher-debuginfo-0.40.0-5.11.2 kubevirt-virt-operator-0.40.0-5.11.2 kubevirt-virt-operator-debuginfo-0.40.0-5.11.2 kubevirt-virtctl-0.40.0-5.11.2 kubevirt-virtctl-debuginfo-0.40.0-5.11.2 References: https://www.suse.com/security/cve/CVE-2021-20286.html

1 0

openSUSE-SU-2021:1841-1: important: Security update for dhcp
by opensuse-security＠opensuse.org 11 Jul '21

11 Jul '21

openSUSE Security Update: Security update for dhcp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1841-1 Rating: important References: #1186382 Cross-References: CVE-2021-25217 CVSS scores: CVE-2021-25217 (SUSE): 7.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for dhcp fixes the following issues: - CVE-2021-25217: A buffer overrun in lease file parsing code can be used to exploit a common vulnerability shared by dhcpd and dhclient (bsc#1186382) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1841=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): dhcp-4.3.6.P1-6.11.1 dhcp-client-4.3.6.P1-6.11.1 dhcp-client-debuginfo-4.3.6.P1-6.11.1 dhcp-debuginfo-4.3.6.P1-6.11.1 dhcp-debugsource-4.3.6.P1-6.11.1 dhcp-devel-4.3.6.P1-6.11.1 dhcp-doc-4.3.6.P1-6.11.1 dhcp-relay-4.3.6.P1-6.11.1 dhcp-relay-debuginfo-4.3.6.P1-6.11.1 dhcp-server-4.3.6.P1-6.11.1 dhcp-server-debuginfo-4.3.6.P1-6.11.1 References: https://www.suse.com/security/cve/CVE-2021-25217.html https://bugzilla.suse.com/1186382

1 0

openSUSE-SU-2021:1948-1: important: Security update for djvulibre
by opensuse-security＠opensuse.org 11 Jul '21

11 Jul '21

openSUSE Security Update: Security update for djvulibre ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1948-1 Rating: important References: #1186253 Cross-References: CVE-2021-3500 CVSS scores: CVE-2021-3500 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-3500 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for djvulibre fixes the following issues: - CVE-2021-3500: Stack overflow in function DJVU:DjVuDocument:get_djvu_file() via crafted djvu file (bsc#1186253) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1948=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): djvulibre-3.5.27-11.6.1 djvulibre-debuginfo-3.5.27-11.6.1 djvulibre-debugsource-3.5.27-11.6.1 libdjvulibre-devel-3.5.27-11.6.1 libdjvulibre21-3.5.27-11.6.1 libdjvulibre21-debuginfo-3.5.27-11.6.1 - openSUSE Leap 15.3 (noarch): djvulibre-doc-3.5.27-11.6.1 References: https://www.suse.com/security/cve/CVE-2021-3500.html https://bugzilla.suse.com/1186253

1 0

openSUSE-SU-2021:2177-1: important: Security update for arpwatch
by opensuse-security＠opensuse.org 11 Jul '21

11 Jul '21

openSUSE Security Update: Security update for arpwatch ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2177-1 Rating: important References: #1186240 Cross-References: CVE-2021-25321 CVSS scores: CVE-2021-25321 (SUSE): 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for arpwatch fixes the following issues: - CVE-2021-25321: Fixed local privilege escalation from runtime user to root (bsc#1186240). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2177=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): arpwatch-2.1a15-5.12.1 arpwatch-debuginfo-2.1a15-5.12.1 arpwatch-debugsource-2.1a15-5.12.1 arpwatch-ethercodes-build-2.1a15-5.12.1 References: https://www.suse.com/security/cve/CVE-2021-25321.html https://bugzilla.suse.com/1186240

1 0

openSUSE-SU-2021:1845-1: important: Security update for avahi
by opensuse-security＠opensuse.org 11 Jul '21

11 Jul '21

openSUSE Security Update: Security update for avahi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1845-1 Rating: important References: #1180827 #1184521 Cross-References: CVE-2021-26720 CVE-2021-3468 CVSS scores: CVE-2021-26720 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-26720 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-3468 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-3468 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for avahi fixes the following issues: - CVE-2021-3468: avoid infinite loop by handling HUP event in client_work (bsc#1184521). - CVE-2021-26720: drop privileges when invoking avahi-daemon-check-dns.sh (bsc#1180827) - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Add sudo to requires: used to drop privileges. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1845=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): python-avahi-0.6.32-5.13.1 python-avahi-gtk-0.6.32-5.13.1 References: https://www.suse.com/security/cve/CVE-2021-26720.html https://www.suse.com/security/cve/CVE-2021-3468.html https://bugzilla.suse.com/1180827 https://bugzilla.suse.com/1184521

1 0

openSUSE-SU-2021:1641-1: important: Security update for djvulibre
by opensuse-security＠opensuse.org 11 Jul '21

11 Jul '21

openSUSE Security Update: Security update for djvulibre ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1641-1 Rating: important References: #1185895 #1185900 #1185904 #1185905 Cross-References: CVE-2021-32490 CVE-2021-32491 CVE-2021-32492 CVE-2021-32493 CVSS scores: CVE-2021-32490 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-32490 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-32491 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-32491 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-32492 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-32492 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-32493 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-32493 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for djvulibre fixes the following issues: - CVE-2021-32490 [bsc#1185895]: Out of bounds write in function DJVU:filter_bv() via crafted djvu file - CVE-2021-32491 [bsc#1185900]: Integer overflow in function render() in tools/ddjvu via crafted djvu file - CVE-2021-32492 [bsc#1185904]: Out of bounds read in function DJVU:DataPool:has_data() via crafted djvu file - CVE-2021-32493 [bsc#1185905]: Heap buffer overflow in function DJVU:GBitmap:decode() via crafted djvu file Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1641=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): djvulibre-3.5.27-11.3.1 djvulibre-debuginfo-3.5.27-11.3.1 djvulibre-debugsource-3.5.27-11.3.1 libdjvulibre-devel-3.5.27-11.3.1 libdjvulibre21-3.5.27-11.3.1 libdjvulibre21-debuginfo-3.5.27-11.3.1 - openSUSE Leap 15.3 (noarch): djvulibre-doc-3.5.27-11.3.1 References: https://www.suse.com/security/cve/CVE-2021-32490.html https://www.suse.com/security/cve/CVE-2021-32491.html https://www.suse.com/security/cve/CVE-2021-32492.html https://www.suse.com/security/cve/CVE-2021-32493.html https://bugzilla.suse.com/1185895 https://bugzilla.suse.com/1185900 https://bugzilla.suse.com/1185904 https://bugzilla.suse.com/1185905

1 0

openSUSE-SU-2021:1024-1: moderate: Security update for openscad
by opensuse-security＠opensuse.org 11 Jul '21

11 Jul '21

openSUSE Security Update: Security update for openscad ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1024-1 Rating: moderate References: #1185975 Cross-References: CVE-2020-28600 CVSS scores: CVE-2020-28600 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openscad fixes the following issues: - CVE-2020-28600: A specially crafted STL file could lead to code execution via out-of-bounds write in import_stl.cc:import_stl() (bsc#1185975) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1024=1 Package List: - openSUSE Leap 15.2 (x86_64): openscad-2019.05-lp152.2.3.1 openscad-debuginfo-2019.05-lp152.2.3.1 openscad-debugsource-2019.05-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-28600.html https://bugzilla.suse.com/1185975

1 0

openSUSE-SU-2021:1762-1: moderate: Security update for curl
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1762-1 Rating: moderate References: #1186114 SLE-17956 Cross-References: CVE-2021-22898 CVSS scores: CVE-2021-22898 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2021-22898 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability, contains one feature is now available. Description: This update for curl fixes the following issues: - CVE-2021-22898: Fixed curl TELNET stack contents disclosure (bsc#1186114). - Allow partial chain verification [jsc#SLE-17956] * Have intermediate certificates in the trust store be treated as trust-anchors, in the same way as self-signed root CA certificates are. This allows users to verify servers using the intermediate cert only, instead of needing the whole chain. * Set FLAG_TRUSTED_FIRST unconditionally. * Do not check partial chains with CRL check. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1762=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): curl-7.66.0-4.17.1 curl-debuginfo-7.66.0-4.17.1 curl-debugsource-7.66.0-4.17.1 curl-mini-7.66.0-4.17.1 curl-mini-debuginfo-7.66.0-4.17.1 curl-mini-debugsource-7.66.0-4.17.1 libcurl-devel-7.66.0-4.17.1 libcurl-mini-devel-7.66.0-4.17.1 libcurl4-7.66.0-4.17.1 libcurl4-debuginfo-7.66.0-4.17.1 libcurl4-mini-7.66.0-4.17.1 libcurl4-mini-debuginfo-7.66.0-4.17.1 - openSUSE Leap 15.3 (x86_64): libcurl-devel-32bit-7.66.0-4.17.1 libcurl4-32bit-7.66.0-4.17.1 libcurl4-32bit-debuginfo-7.66.0-4.17.1 References: https://www.suse.com/security/cve/CVE-2021-22898.html https://bugzilla.suse.com/1186114

1 0

openSUSE-SU-2021:1815-1: important: Security update for nginx
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for nginx ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1815-1 Rating: important References: #1186126 Cross-References: CVE-2021-23017 CVSS scores: CVE-2021-23017 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-23017 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nginx fixes the following issues: - CVE-2021-23017: nginx DNS resolver off-by-one heap write (bsc#1186126) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1815=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): nginx-1.19.8-3.3.1 nginx-debuginfo-1.19.8-3.3.1 nginx-debugsource-1.19.8-3.3.1 - openSUSE Leap 15.3 (noarch): nginx-source-1.19.8-3.3.1 vim-plugin-nginx-1.19.8-3.3.1 References: https://www.suse.com/security/cve/CVE-2021-23017.html https://bugzilla.suse.com/1186126

1 0