November 2022 - openSUSE Security Announce

SUSE-SU-2022:4054-1: Security update for go1.19
by opensuse-security＠opensuse.org 17 Nov '22

17 Nov '22

SUSE Security Update: Security update for go1.19 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4054-1 Rating: low References: #1200441 #1204941 Cross-References: CVE-2022-41716 CVSS scores: CVE-2022-41716 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2022-41716 (SUSE): 0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Development Tools 15-SP3 SUSE Linux Enterprise Module for Development Tools 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for go1.19 fixes the following issues: Update to go 1.19.3 (released 2022-11-01) (bsc#1200441): Security fixes: - CVE-2022-41716: Fixed unsanitized NUL in environment variables in syscalls, os/exec (go#56327) (bsc#1204941). Bugfixes: - runtime: lock count" fatal error when cgo is enabled (go#56308). - cmd/compile: libFuzzer instrumentation fakePC overflow on 386 arch (go#56168). - internal/fuzz: array literal initialization causes ICE "unhandled stmt ASOP" while fuzzing (go#56106). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4054=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4054=1 - SUSE Linux Enterprise Module for Development Tools 15-SP4: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2022-4054=1 - SUSE Linux Enterprise Module for Development Tools 15-SP3: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP3-2022-4054=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): go1.19-1.19.3-150000.1.15.1 go1.19-doc-1.19.3-150000.1.15.1 - openSUSE Leap 15.4 (aarch64 x86_64): go1.19-race-1.19.3-150000.1.15.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): go1.19-1.19.3-150000.1.15.1 go1.19-doc-1.19.3-150000.1.15.1 - openSUSE Leap 15.3 (aarch64 x86_64): go1.19-race-1.19.3-150000.1.15.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 ppc64le s390x x86_64): go1.19-1.19.3-150000.1.15.1 go1.19-doc-1.19.3-150000.1.15.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 x86_64): go1.19-race-1.19.3-150000.1.15.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 ppc64le s390x x86_64): go1.19-1.19.3-150000.1.15.1 go1.19-doc-1.19.3-150000.1.15.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 x86_64): go1.19-race-1.19.3-150000.1.15.1 References: https://www.suse.com/security/cve/CVE-2022-41716.html https://bugzilla.suse.com/1200441 https://bugzilla.suse.com/1204941

1 0

SUSE-SU-2022:4044-1: important: Security update for python-cryptography, python-cryptography-vectors
by opensuse-security＠opensuse.org 17 Nov '22

17 Nov '22

SUSE Security Update: Security update for python-cryptography, python-cryptography-vectors ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4044-1 Rating: important References: #1101820 #1149792 #1176785 #1177083 ECO-3105 PM-2352 PM-2730 SLE-18312 Cross-References: CVE-2018-10903 CVSS scores: CVE-2018-10903 (NVD) : 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2018-10903 (SUSE): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affected Products: SUSE Enterprise Storage 7 SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Python2 15-SP3 SUSE Linux Enterprise Server 15-SP2-BCL SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.1 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.1 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap Micro 5.2 ______________________________________________________________________________ An update that solves one vulnerability, contains four features and has three fixes is now available. Description: This update for python-cryptography, python-cryptography-vectors fixes the following issues: - Update in SLE-15 (bsc#1177083, jsc#PM-2730, jsc#SLE-18312) - Refresh patches for new version - Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352) - update to 2.9.2 * 2.9.2 - 2020-04-22 - Updated the macOS wheel to fix an issue where it would not run on macOS versions older than 10.15. * 2.9.1 - 2020-04-21 - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1g. * 2.9 - 2020-04-02 - BACKWARDS INCOMPATIBLE: Support for Python 3.4 has been removed due to low usage and maintenance burden. - BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.0.1 has been removed. Users on older version of OpenSSL will need to upgrade. - BACKWARDS INCOMPATIBLE: Support for LibreSSL 2.6.x has been removed. - Removed support for calling public_bytes() with no arguments, as per our deprecation policy. You must now pass encoding and format. - BACKWARDS INCOMPATIBLE: Reversed the order in which rfc4514_string() returns the RDNs as required by RFC 4514. - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1f. - Added support for parsing single_extensions in an OCSP response. - NameAttribute values can now be empty strings. - Add openSSL_111d.patch to make this version of the package compatible with OpenSSL 1.1.1d, thus fixing bsc#1149792. - bsc#1101820 CVE-2018-10903 GCM tag forgery via truncated tag in finalize_with_tag API - Update in SLE-15 (bsc#1177083, jsc#PM-2730, jsc#SLE-18312) - Include in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352) - update to 2.9.2: * updated vectors for the cryptography 2.9.2 testing Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap Micro 5.2: zypper in -t patch openSUSE-Leap-Micro-5.2-2022-4044=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4044=1 - SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-4044=1 - SUSE Manager Retail Branch Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-4044=1 - SUSE Manager Proxy 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-4044=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-4044=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-4044=1 - SUSE Linux Enterprise Server 15-SP2-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-4044=1 - SUSE Linux Enterprise Module for Python2 15-SP3: zypper in -t patch SUSE-SLE-Module-Python2-15-SP3-2022-4044=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-4044=1 - SUSE Linux Enterprise Micro 5.2: zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-4044=1 - SUSE Linux Enterprise Micro 5.1: zypper in -t patch SUSE-SUSE-MicroOS-5.1-2022-4044=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-4044=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-4044=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2022-4044=1 Package List: - openSUSE Leap Micro 5.2 (aarch64 x86_64): python-cryptography-debuginfo-2.9.2-150200.13.1 python-cryptography-debugsource-2.9.2-150200.13.1 python3-cryptography-2.9.2-150200.13.1 python3-cryptography-debuginfo-2.9.2-150200.13.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): python-cryptography-debuginfo-2.9.2-150200.13.1 python-cryptography-debugsource-2.9.2-150200.13.1 python2-cryptography-2.9.2-150200.13.1 python2-cryptography-debuginfo-2.9.2-150200.13.1 python3-cryptography-2.9.2-150200.13.1 python3-cryptography-debuginfo-2.9.2-150200.13.1 - openSUSE Leap 15.3 (noarch): python2-cryptography-vectors-2.9.2-150200.3.3.1 python3-cryptography-vectors-2.9.2-150200.3.3.1 - SUSE Manager Server 4.1 (ppc64le s390x x86_64): python-cryptography-debuginfo-2.9.2-150200.13.1 python-cryptography-debugsource-2.9.2-150200.13.1 python2-cryptography-2.9.2-150200.13.1 python2-cryptography-debuginfo-2.9.2-150200.13.1 python3-cryptography-2.9.2-150200.13.1 python3-cryptography-debuginfo-2.9.2-150200.13.1 - SUSE Manager Retail Branch Server 4.1 (x86_64): python-cryptography-debuginfo-2.9.2-150200.13.1 python-cryptography-debugsource-2.9.2-150200.13.1 python2-cryptography-2.9.2-150200.13.1 python2-cryptography-debuginfo-2.9.2-150200.13.1 python3-cryptography-2.9.2-150200.13.1 python3-cryptography-debuginfo-2.9.2-150200.13.1 - SUSE Manager Proxy 4.1 (x86_64): python-cryptography-debuginfo-2.9.2-150200.13.1 python-cryptography-debugsource-2.9.2-150200.13.1 python2-cryptography-2.9.2-150200.13.1 python2-cryptography-debuginfo-2.9.2-150200.13.1 python3-cryptography-2.9.2-150200.13.1 python3-cryptography-debuginfo-2.9.2-150200.13.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): python-cryptography-debuginfo-2.9.2-150200.13.1 python-cryptography-debugsource-2.9.2-150200.13.1 python2-cryptography-2.9.2-150200.13.1 python2-cryptography-debuginfo-2.9.2-150200.13.1 python3-cryptography-2.9.2-150200.13.1 python3-cryptography-debuginfo-2.9.2-150200.13.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): python-cryptography-debuginfo-2.9.2-150200.13.1 python-cryptography-debugsource-2.9.2-150200.13.1 python2-cryptography-2.9.2-150200.13.1 python2-cryptography-debuginfo-2.9.2-150200.13.1 python3-cryptography-2.9.2-150200.13.1 python3-cryptography-debuginfo-2.9.2-150200.13.1 - SUSE Linux Enterprise Server 15-SP2-BCL (x86_64): python-cryptography-debuginfo-2.9.2-150200.13.1 python-cryptography-debugsource-2.9.2-150200.13.1 python3-cryptography-2.9.2-150200.13.1 python3-cryptography-debuginfo-2.9.2-150200.13.1 - SUSE Linux Enterprise Module for Python2 15-SP3 (aarch64 ppc64le s390x x86_64): python-cryptography-debuginfo-2.9.2-150200.13.1 python-cryptography-debugsource-2.9.2-150200.13.1 python2-cryptography-2.9.2-150200.13.1 python2-cryptography-debuginfo-2.9.2-150200.13.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): python-cryptography-debuginfo-2.9.2-150200.13.1 python-cryptography-debugsource-2.9.2-150200.13.1 python3-cryptography-2.9.2-150200.13.1 python3-cryptography-debuginfo-2.9.2-150200.13.1 - SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64): python-cryptography-debuginfo-2.9.2-150200.13.1 python-cryptography-debugsource-2.9.2-150200.13.1 python3-cryptography-2.9.2-150200.13.1 python3-cryptography-debuginfo-2.9.2-150200.13.1 - SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64): python-cryptography-debuginfo-2.9.2-150200.13.1 python-cryptography-debugsource-2.9.2-150200.13.1 python3-cryptography-2.9.2-150200.13.1 python3-cryptography-debuginfo-2.9.2-150200.13.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64): python-cryptography-debuginfo-2.9.2-150200.13.1 python-cryptography-debugsource-2.9.2-150200.13.1 python2-cryptography-2.9.2-150200.13.1 python2-cryptography-debuginfo-2.9.2-150200.13.1 python3-cryptography-2.9.2-150200.13.1 python3-cryptography-debuginfo-2.9.2-150200.13.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64): python-cryptography-debuginfo-2.9.2-150200.13.1 python-cryptography-debugsource-2.9.2-150200.13.1 python2-cryptography-2.9.2-150200.13.1 python2-cryptography-debuginfo-2.9.2-150200.13.1 python3-cryptography-2.9.2-150200.13.1 python3-cryptography-debuginfo-2.9.2-150200.13.1 - SUSE Enterprise Storage 7 (aarch64 x86_64): python-cryptography-debuginfo-2.9.2-150200.13.1 python-cryptography-debugsource-2.9.2-150200.13.1 python2-cryptography-2.9.2-150200.13.1 python2-cryptography-debuginfo-2.9.2-150200.13.1 python3-cryptography-2.9.2-150200.13.1 python3-cryptography-debuginfo-2.9.2-150200.13.1 References: https://www.suse.com/security/cve/CVE-2018-10903.html https://bugzilla.suse.com/1101820 https://bugzilla.suse.com/1149792 https://bugzilla.suse.com/1176785 https://bugzilla.suse.com/1177083

1 0

SUSE-SU-2022:4016-1: important: Security update for rubygem-nokogiri
by opensuse-security＠opensuse.org 16 Nov '22

16 Nov '22

SUSE Security Update: Security update for rubygem-nokogiri ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4016-1 Rating: important References: #1198408 #1199782 Cross-References: CVE-2022-24836 CVE-2022-29181 CVSS scores: CVE-2022-24836 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-24836 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-29181 (NVD) : 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H CVE-2022-29181 (SUSE): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for rubygem-nokogiri fixes the following issues: - CVE-2022-24836: Fixes possibility to DoS because of inefficient RE in HTML encoding. (bsc#1198408) - CVE-2022-29181: Fixes Improper Handling of Unexpected Data Typesi. (bsc#1199782) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4016=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-4016=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-nokogiri-1.8.5-150400.14.3.1 ruby2.5-rubygem-nokogiri-debuginfo-1.8.5-150400.14.3.1 ruby2.5-rubygem-nokogiri-doc-1.8.5-150400.14.3.1 ruby2.5-rubygem-nokogiri-testsuite-1.8.5-150400.14.3.1 rubygem-nokogiri-debugsource-1.8.5-150400.14.3.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-nokogiri-1.8.5-150400.14.3.1 ruby2.5-rubygem-nokogiri-debuginfo-1.8.5-150400.14.3.1 rubygem-nokogiri-debugsource-1.8.5-150400.14.3.1 References: https://www.suse.com/security/cve/CVE-2022-24836.html https://www.suse.com/security/cve/CVE-2022-29181.html https://bugzilla.suse.com/1198408 https://bugzilla.suse.com/1199782

1 0

SUSE-SU-2022:4015-1: important: Security update for rubygem-nokogiri
by opensuse-security＠opensuse.org 16 Nov '22

16 Nov '22

SUSE Security Update: Security update for rubygem-nokogiri ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4015-1 Rating: important References: #1198408 #1199782 Cross-References: CVE-2022-24836 CVE-2022-29181 CVSS scores: CVE-2022-24836 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-24836 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-29181 (NVD) : 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H CVE-2022-29181 (SUSE): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H Affected Products: SUSE Enterprise Storage 6 SUSE Enterprise Storage 7 SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Availability 15 SUSE Linux Enterprise High Availability 15-SP1 SUSE Linux Enterprise High Availability 15-SP2 SUSE Linux Enterprise High Performance Computing 15 SUSE Linux Enterprise High Performance Computing 15-SP1 SUSE Linux Enterprise High Performance Computing 15-SP2 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Server 15 SUSE Linux Enterprise Server 15-SP1 SUSE Linux Enterprise Server 15-SP2 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15 SUSE Linux Enterprise Server for SAP Applications 15-SP1 SUSE Linux Enterprise Server for SAP Applications 15-SP2 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.0 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.0 SUSE Manager Retail Branch Server 4.1 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.0 SUSE Manager Server 4.1 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for rubygem-nokogiri fixes the following issues: - CVE-2022-24836: Fixes possibility to DoS because of inefficient RE in HTML encoding. (bsc#1198408) - CVE-2022-29181: Fixes Improper Handling of Unexpected Data Typesi. (bsc#1199782) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4015=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-4015=1 - SUSE Linux Enterprise High Availability 15-SP2: zypper in -t patch SUSE-SLE-Product-HA-15-SP2-2022-4015=1 - SUSE Linux Enterprise High Availability 15-SP1: zypper in -t patch SUSE-SLE-Product-HA-15-SP1-2022-4015=1 - SUSE Linux Enterprise High Availability 15: zypper in -t patch SUSE-SLE-Product-HA-15-2022-4015=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-nokogiri-1.8.5-150000.3.9.1 ruby2.5-rubygem-nokogiri-debuginfo-1.8.5-150000.3.9.1 ruby2.5-rubygem-nokogiri-doc-1.8.5-150000.3.9.1 ruby2.5-rubygem-nokogiri-testsuite-1.8.5-150000.3.9.1 rubygem-nokogiri-debugsource-1.8.5-150000.3.9.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-nokogiri-1.8.5-150000.3.9.1 ruby2.5-rubygem-nokogiri-debuginfo-1.8.5-150000.3.9.1 rubygem-nokogiri-debugsource-1.8.5-150000.3.9.1 - SUSE Linux Enterprise High Availability 15-SP2 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-nokogiri-1.8.5-150000.3.9.1 ruby2.5-rubygem-nokogiri-debuginfo-1.8.5-150000.3.9.1 - SUSE Linux Enterprise High Availability 15-SP1 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-nokogiri-1.8.5-150000.3.9.1 ruby2.5-rubygem-nokogiri-debuginfo-1.8.5-150000.3.9.1 - SUSE Linux Enterprise High Availability 15 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-nokogiri-1.8.5-150000.3.9.1 ruby2.5-rubygem-nokogiri-debuginfo-1.8.5-150000.3.9.1 References: https://www.suse.com/security/cve/CVE-2022-24836.html https://www.suse.com/security/cve/CVE-2022-29181.html https://bugzilla.suse.com/1198408 https://bugzilla.suse.com/1199782

1 0

SUSE-SU-2022:4011-1: moderate: Security update for jsoup
by opensuse-security＠opensuse.org 16 Nov '22

16 Nov '22

SUSE Security Update: Security update for jsoup ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4011-1 Rating: moderate References: #1203459 Cross-References: CVE-2022-36033 CVSS scores: CVE-2022-36033 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2022-36033 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Development Tools 15-SP3 SUSE Linux Enterprise Module for Development Tools 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for jsoup fixes the following issues: Updated to version 1.15.3: - CVE-2022-36033: Fixed incorrect sanitization of user input in SafeList.preserveRelativeLinks (bsc#1203459). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4011=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4011=1 - SUSE Linux Enterprise Module for Development Tools 15-SP4: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2022-4011=1 - SUSE Linux Enterprise Module for Development Tools 15-SP3: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP3-2022-4011=1 Package List: - openSUSE Leap 15.4 (noarch): jsoup-1.15.3-150200.3.6.1 jsoup-javadoc-1.15.3-150200.3.6.1 - openSUSE Leap 15.3 (noarch): jsoup-1.15.3-150200.3.6.1 jsoup-javadoc-1.15.3-150200.3.6.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (noarch): jsoup-1.15.3-150200.3.6.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (noarch): jsoup-1.15.3-150200.3.6.1 References: https://www.suse.com/security/cve/CVE-2022-36033.html https://bugzilla.suse.com/1203459

1 0

SUSE-SU-2022:4010-1: moderate: Security update for apache2-mod_wsgi
by opensuse-security＠opensuse.org 16 Nov '22

16 Nov '22

SUSE Security Update: Security update for apache2-mod_wsgi ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4010-1 Rating: moderate References: #1201634 Cross-References: CVE-2022-2255 CVSS scores: CVE-2022-2255 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2022-2255 (SUSE): 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Public Cloud 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for apache2-mod_wsgi fixes the following issues: - CVE-2022-2255: Hardened the trusted proxy header filter to avoid bypass. (bsc#1201634) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4010=1 - SUSE Linux Enterprise Module for Public Cloud 15-SP4: zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP4-2022-4010=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): apache2-mod_wsgi-4.7.1-150400.3.3.1 apache2-mod_wsgi-debuginfo-4.7.1-150400.3.3.1 apache2-mod_wsgi-debugsource-4.7.1-150400.3.3.1 - SUSE Linux Enterprise Module for Public Cloud 15-SP4 (aarch64 ppc64le s390x x86_64): apache2-mod_wsgi-4.7.1-150400.3.3.1 apache2-mod_wsgi-debuginfo-4.7.1-150400.3.3.1 apache2-mod_wsgi-debugsource-4.7.1-150400.3.3.1 References: https://www.suse.com/security/cve/CVE-2022-2255.html https://bugzilla.suse.com/1201634

1 0

SUSE-SU-2022:4007-1: important: Security update for xen
by opensuse-security＠opensuse.org 16 Nov '22

16 Nov '22

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4007-1 Rating: important References: #1027519 #1193923 #1203806 #1203807 #1204482 #1204483 #1204485 #1204487 #1204488 #1204489 #1204490 #1204494 #1204496 Cross-References: CVE-2022-33746 CVE-2022-33747 CVE-2022-33748 CVE-2022-42309 CVE-2022-42310 CVE-2022-42311 CVE-2022-42312 CVE-2022-42313 CVE-2022-42314 CVE-2022-42315 CVE-2022-42316 CVE-2022-42317 CVE-2022-42318 CVE-2022-42319 CVE-2022-42320 CVE-2022-42321 CVE-2022-42322 CVE-2022-42323 CVE-2022-42325 CVE-2022-42326 CVE-2022-42327 CVSS scores: CVE-2022-33746 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2022-33746 (SUSE): 5.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2022-33747 (NVD) : 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L CVE-2022-33748 (NVD) : 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2022-33748 (SUSE): 5.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2022-42309 (NVD) : 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2022-42309 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2022-42310 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-42310 (SUSE): 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2022-42311 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-42311 (SUSE): 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2022-42312 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2022-42312 (SUSE): 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2022-42313 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2022-42313 (SUSE): 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2022-42314 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2022-42314 (SUSE): 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2022-42315 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2022-42315 (SUSE): 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2022-42316 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2022-42316 (SUSE): 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2022-42317 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2022-42317 (SUSE): 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2022-42318 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2022-42318 (SUSE): 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2022-42319 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2022-42319 (SUSE): 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2022-42320 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-42320 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2022-42321 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2022-42321 (SUSE): 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2022-42322 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-42322 (SUSE): 5.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2022-42323 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-42323 (SUSE): 5.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2022-42325 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-42325 (SUSE): 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2022-42326 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-42326 (SUSE): 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2022-42327 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVE-2022-42327 (SUSE): 2.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Module for Server Applications 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes 21 vulnerabilities is now available. Description: This update for xen fixes the following issues: - CVE-2022-33746: Fixed DoS due to excessively long P2M pool freeing (bsc#1203806). - CVE-2022-33748: Fixed DoS due to race in locking (bsc#1203807). - CVE-2022-42311, CVE-2022-42312, CVE-2022-42313, CVE-2022-42314, CVE-2022-42315, CVE-2022-42316, CVE-2022-42317, CVE-2022-42318: xen: Xenstore: Guests can let xenstored run out of memory (bsc#1204482) - CVE-2022-42309: xen: Xenstore: Guests can crash xenstored (bsc#1204485) - CVE-2022-42310: xen: Xenstore: Guests can create orphaned Xenstore nodes (bsc#1204487) - CVE-2022-42319: xen: Xenstore: Guests can cause Xenstore to not free temporary memory (bsc#1204488) - CVE-2022-42320: xen: Xenstore: Guests can get access to Xenstore nodes of deleted domains (bsc#1204489) - CVE-2022-42321: xen: Xenstore: Guests can crash xenstored via exhausting the stack (bsc#1204490) - CVE-2022-42322,CVE-2022-42323: xen: Xenstore: cooperating guests can create arbitrary numbers of nodes (bsc#1204494) - CVE-2022-42325,CVE-2022-42326: xen: Xenstore: Guests can create arbitrary number of nodes via transactions (bsc#1204496) - xen: Frontends vulnerable to backends (bsc#1193923). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4007=1 - SUSE Linux Enterprise Module for Server Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2022-4007=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-4007=1 - SUSE Linux Enterprise Micro 5.3: zypper in -t patch SUSE-SLE-Micro-5.3-2022-4007=1 Package List: - openSUSE Leap 15.4 (aarch64 x86_64): xen-4.16.2_08-150400.4.16.1 xen-debugsource-4.16.2_08-150400.4.16.1 xen-devel-4.16.2_08-150400.4.16.1 xen-doc-html-4.16.2_08-150400.4.16.1 xen-libs-4.16.2_08-150400.4.16.1 xen-libs-debuginfo-4.16.2_08-150400.4.16.1 xen-tools-4.16.2_08-150400.4.16.1 xen-tools-debuginfo-4.16.2_08-150400.4.16.1 xen-tools-domU-4.16.2_08-150400.4.16.1 xen-tools-domU-debuginfo-4.16.2_08-150400.4.16.1 - openSUSE Leap 15.4 (noarch): xen-tools-xendomains-wait-disk-4.16.2_08-150400.4.16.1 - openSUSE Leap 15.4 (x86_64): xen-libs-32bit-4.16.2_08-150400.4.16.1 xen-libs-32bit-debuginfo-4.16.2_08-150400.4.16.1 - SUSE Linux Enterprise Module for Server Applications 15-SP4 (x86_64): xen-4.16.2_08-150400.4.16.1 xen-debugsource-4.16.2_08-150400.4.16.1 xen-devel-4.16.2_08-150400.4.16.1 xen-tools-4.16.2_08-150400.4.16.1 xen-tools-debuginfo-4.16.2_08-150400.4.16.1 - SUSE Linux Enterprise Module for Server Applications 15-SP4 (noarch): xen-tools-xendomains-wait-disk-4.16.2_08-150400.4.16.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (x86_64): xen-debugsource-4.16.2_08-150400.4.16.1 xen-libs-4.16.2_08-150400.4.16.1 xen-libs-debuginfo-4.16.2_08-150400.4.16.1 xen-tools-domU-4.16.2_08-150400.4.16.1 xen-tools-domU-debuginfo-4.16.2_08-150400.4.16.1 - SUSE Linux Enterprise Micro 5.3 (x86_64): xen-debugsource-4.16.2_08-150400.4.16.1 xen-libs-4.16.2_08-150400.4.16.1 xen-libs-debuginfo-4.16.2_08-150400.4.16.1 References: https://www.suse.com/security/cve/CVE-2022-33746.html https://www.suse.com/security/cve/CVE-2022-33747.html https://www.suse.com/security/cve/CVE-2022-33748.html https://www.suse.com/security/cve/CVE-2022-42309.html https://www.suse.com/security/cve/CVE-2022-42310.html https://www.suse.com/security/cve/CVE-2022-42311.html https://www.suse.com/security/cve/CVE-2022-42312.html https://www.suse.com/security/cve/CVE-2022-42313.html https://www.suse.com/security/cve/CVE-2022-42314.html https://www.suse.com/security/cve/CVE-2022-42315.html https://www.suse.com/security/cve/CVE-2022-42316.html https://www.suse.com/security/cve/CVE-2022-42317.html https://www.suse.com/security/cve/CVE-2022-42318.html https://www.suse.com/security/cve/CVE-2022-42319.html https://www.suse.com/security/cve/CVE-2022-42320.html https://www.suse.com/security/cve/CVE-2022-42321.html https://www.suse.com/security/cve/CVE-2022-42322.html https://www.suse.com/security/cve/CVE-2022-42323.html https://www.suse.com/security/cve/CVE-2022-42325.html https://www.suse.com/security/cve/CVE-2022-42326.html https://www.suse.com/security/cve/CVE-2022-42327.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1193923 https://bugzilla.suse.com/1203806 https://bugzilla.suse.com/1203807 https://bugzilla.suse.com/1204482 https://bugzilla.suse.com/1204483 https://bugzilla.suse.com/1204485 https://bugzilla.suse.com/1204487 https://bugzilla.suse.com/1204488 https://bugzilla.suse.com/1204489 https://bugzilla.suse.com/1204490 https://bugzilla.suse.com/1204494 https://bugzilla.suse.com/1204496

1 0

SUSE-SU-2022:4003-1: important: Security update for nodejs16
by opensuse-security＠opensuse.org 15 Nov '22

15 Nov '22

SUSE Security Update: Security update for nodejs16 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4003-1 Rating: important References: #1205119 Cross-References: CVE-2022-43548 CVSS scores: CVE-2022-43548 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Web Scripting 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nodejs16 fixes the following issues: - Update to LTS versino 16.18.1: - CVE-2022-43548: Fixed DNS rebinding in --inspect via invalid octal IP address (bsc#1205119). - Update to LTS version 16.18.0: * http: throw error on content-length mismatch * stream: add ReadableByteStream.tee() * deps: npm updated to 8.19.2 Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4003=1 - SUSE Linux Enterprise Module for Web Scripting 15-SP4: zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP4-2022-4003=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): corepack16-16.18.1-150400.3.12.1 nodejs16-16.18.1-150400.3.12.1 nodejs16-debuginfo-16.18.1-150400.3.12.1 nodejs16-debugsource-16.18.1-150400.3.12.1 nodejs16-devel-16.18.1-150400.3.12.1 npm16-16.18.1-150400.3.12.1 - openSUSE Leap 15.4 (noarch): nodejs16-docs-16.18.1-150400.3.12.1 - SUSE Linux Enterprise Module for Web Scripting 15-SP4 (aarch64 ppc64le s390x x86_64): nodejs16-16.18.1-150400.3.12.1 nodejs16-debuginfo-16.18.1-150400.3.12.1 nodejs16-debugsource-16.18.1-150400.3.12.1 nodejs16-devel-16.18.1-150400.3.12.1 npm16-16.18.1-150400.3.12.1 - SUSE Linux Enterprise Module for Web Scripting 15-SP4 (noarch): nodejs16-docs-16.18.1-150400.3.12.1 References: https://www.suse.com/security/cve/CVE-2022-43548.html https://bugzilla.suse.com/1205119

1 0

SUSE-SU-2022:4004-1: important: Security update for python310
by opensuse-security＠opensuse.org 15 Nov '22

15 Nov '22

SUSE Security Update: Security update for python310 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4004-1 Rating: important References: #1204886 #1205244 Cross-References: CVE-2022-42919 CVE-2022-45061 CVSS scores: CVE-2022-42919 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-42919 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-45061 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-45061 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Python3 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for python310 fixes the following issues: Security fixes: - CVE-2022-42919: Fixed local privilege escalation via the multiprocessing forkserver start method (bsc#1204886). - CVE-2022-45061: Fixed a quadratic IDNA decoding time (bsc#1205244). Other fixes: - allow building of documentation with the latest Sphinx 5.3.0 (gh#python/cpython#98366). - Update to 3.10.8: - Fix multiplying a list by an integer (list *= int): detect the integer overflow when the new allocated length is close to the maximum size. - Fix a shell code injection vulnerability in the get-remote-certificate.py example script. The script no longer uses a shell to run openssl commands. (originally filed as CVE-2022-37460, later withdrawn) - Fix command line parsing: reject -X int_max_str_digits option with no value (invalid) when the PYTHONINTMAXSTRDIGITS environment variable is set to a valid limit. - When ValueError is raised if an integer is larger than the limit, mention the sys.set_int_max_str_digits() function in the error message. - The deprecated mailcap module now refuses to inject unsafe text (filenames, MIME types, parameters) into shell commands. Instead of using such text, it will warn and act as if a match was not found (or for test commands, as if the test failed). - os.sched_yield() now release the GIL while calling sched_yield(2). - Bugfix: PyFunction_GetAnnotations() should return a borrowed reference. It was returning a new reference. - Fixed a missing incref/decref pair in Exception.__setstate__(). - Fix overly-broad source position information for chained comparisons used as branching conditions. - Fix undefined behaviour in _testcapimodule.c. - At Python exit, sometimes a thread holding the GIL can wait forever for a thread (usually a daemon thread) which requested to drop the GIL, whereas the thread already exited. To fix the race condition, the thread which requested the GIL drop now resets its request before exiting. - Fix a possible assertion failure, fatal error, or SystemError if a line tracing event raises an exception while opcode tracing is enabled. - Fix undefined behaviour in C code of null pointer arithmetic. - Do not expose KeyWrapper in _functools. - When loading a file with invalid UTF-8 inside a multi-line string, a correct SyntaxError is emitted. - Disable incorrect pickling of the C implemented classmethod descriptors. - Fix AttributeError missing name and obj attributes in . object.__getattribute__() bpo-42316: Document some places . where an assignment expression needs parentheses . - Wrap network errors consistently in urllib FTP support, so the test suite doesn��t fail when a network is available but the public internet is not reachable. - Fixes AttributeError when subprocess.check_output() is used with argument input=None and either of the arguments encoding or errors are used. - Avoid spurious tracebacks from asyncio when default executor cleanup is delayed until after the event loop is closed (e.g. as the result of a keyboard interrupt). - Avoid a crash in the C version of asyncio.Future.remove_done_callback() when an evil argument is passed. - Remove tokenize.NL check from tabnanny. - Make Semaphore run faster. - Fix generation of the default name of tkinter.Checkbutton. Previously, checkbuttons in different parent widgets could have the same short name and share the same state if arguments ��name�� and ��variable�� are not specified. Now they are globally unique. - Update bundled libexpat to 2.4.9 - Fix race condition in asyncio where process_exited() called before the pipe_data_received() leading to inconsistent output. - Fixed check in multiprocessing.resource_tracker that guarantees that the length of a write to a pipe is not greater than PIPE_BUF. - Corrected type annotation for dataclass attribute pstats.FunctionProfile.ncalls to be str. - Fix the faulthandler implementation of faulthandler.register(signal, chain=True) if the sigaction() function is not available: don��t call the previous signal handler if it��s NULL. - In inspect, fix overeager replacement of ��typing.�� in formatting annotations. - Fix asyncio.streams.StreamReaderProtocol to keep a strong reference to the created task, so that it��s not garbage collected - Fix handling compiler warnings (SyntaxWarning and DeprecationWarning) in codeop.compile_command() when checking for incomplete input. Previously it emitted warnings and raised a SyntaxError. Now it always returns None for incomplete input without emitting any warnings. - Fixed flickering of the turtle window when the tracer is turned off. - Allow asyncio.StreamWriter.drain() to be awaited concurrently by multiple tasks. - Fix broken asyncio.Semaphore when acquire is cancelled. - Fix ast.unparse() when ImportFrom.level is None - Improve performance of urllib.request.getproxies_environment when there are many environment variables - Fix ! in c domain ref target syntax via a conf.py patch, so it works as intended to disable ref target resolution. - Clarified the conflicting advice given in the ast documentation about ast.literal_eval() being ��safe�� for use on untrusted input while at the same time warning that it can crash the process. The latter statement is true and is deemed unfixable without a large amount of work unsuitable for a bugfix. So we keep the warning and no longer claim that literal_eval is safe. - Update tutorial introduction output to use 3.10+ SyntaxError invalid range. Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4004=1 - SUSE Linux Enterprise Module for Python3 15-SP4: zypper in -t patch SUSE-SLE-Module-Python3-15-SP4-2022-4004=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libpython3_10-1_0-3.10.8-150400.4.15.1 libpython3_10-1_0-debuginfo-3.10.8-150400.4.15.1 python310-3.10.8-150400.4.15.1 python310-base-3.10.8-150400.4.15.1 python310-base-debuginfo-3.10.8-150400.4.15.1 python310-core-debugsource-3.10.8-150400.4.15.1 python310-curses-3.10.8-150400.4.15.1 python310-curses-debuginfo-3.10.8-150400.4.15.1 python310-dbm-3.10.8-150400.4.15.1 python310-dbm-debuginfo-3.10.8-150400.4.15.1 python310-debuginfo-3.10.8-150400.4.15.1 python310-debugsource-3.10.8-150400.4.15.1 python310-devel-3.10.8-150400.4.15.1 python310-doc-3.10.8-150400.4.15.1 python310-doc-devhelp-3.10.8-150400.4.15.1 python310-idle-3.10.8-150400.4.15.1 python310-testsuite-3.10.8-150400.4.15.1 python310-testsuite-debuginfo-3.10.8-150400.4.15.1 python310-tk-3.10.8-150400.4.15.1 python310-tk-debuginfo-3.10.8-150400.4.15.1 python310-tools-3.10.8-150400.4.15.1 - openSUSE Leap 15.4 (x86_64): libpython3_10-1_0-32bit-3.10.8-150400.4.15.1 libpython3_10-1_0-32bit-debuginfo-3.10.8-150400.4.15.1 python310-32bit-3.10.8-150400.4.15.1 python310-32bit-debuginfo-3.10.8-150400.4.15.1 python310-base-32bit-3.10.8-150400.4.15.1 python310-base-32bit-debuginfo-3.10.8-150400.4.15.1 - SUSE Linux Enterprise Module for Python3 15-SP4 (aarch64 ppc64le s390x x86_64): libpython3_10-1_0-3.10.8-150400.4.15.1 libpython3_10-1_0-debuginfo-3.10.8-150400.4.15.1 python310-3.10.8-150400.4.15.1 python310-base-3.10.8-150400.4.15.1 python310-base-debuginfo-3.10.8-150400.4.15.1 python310-core-debugsource-3.10.8-150400.4.15.1 python310-curses-3.10.8-150400.4.15.1 python310-curses-debuginfo-3.10.8-150400.4.15.1 python310-dbm-3.10.8-150400.4.15.1 python310-dbm-debuginfo-3.10.8-150400.4.15.1 python310-debuginfo-3.10.8-150400.4.15.1 python310-debugsource-3.10.8-150400.4.15.1 python310-devel-3.10.8-150400.4.15.1 python310-idle-3.10.8-150400.4.15.1 python310-tk-3.10.8-150400.4.15.1 python310-tk-debuginfo-3.10.8-150400.4.15.1 python310-tools-3.10.8-150400.4.15.1 References: https://www.suse.com/security/cve/CVE-2022-42919.html https://www.suse.com/security/cve/CVE-2022-45061.html https://bugzilla.suse.com/1204886 https://bugzilla.suse.com/1205244

1 0

SUSE-SU-2022:4001-1: important: Security update for sudo
by opensuse-security＠opensuse.org 15 Nov '22

15 Nov '22

SUSE Security Update: Security update for sudo ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4001-1 Rating: important References: #1204986 Cross-References: CVE-2022-43995 CVSS scores: CVE-2022-43995 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H CVE-2022-43995 (SUSE): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for sudo fixes the following issues: - CVE-2022-43995: Fixed a potential heap-based buffer over-read when entering a password of seven characters or fewer and using the crypt() password backend (bsc#1204986). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4001=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-4001=1 - SUSE Linux Enterprise Micro 5.3: zypper in -t patch SUSE-SLE-Micro-5.3-2022-4001=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): sudo-1.9.9-150400.4.6.1 sudo-debuginfo-1.9.9-150400.4.6.1 sudo-debugsource-1.9.9-150400.4.6.1 sudo-devel-1.9.9-150400.4.6.1 sudo-plugin-python-1.9.9-150400.4.6.1 sudo-plugin-python-debuginfo-1.9.9-150400.4.6.1 sudo-test-1.9.9-150400.4.6.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): sudo-1.9.9-150400.4.6.1 sudo-debuginfo-1.9.9-150400.4.6.1 sudo-debugsource-1.9.9-150400.4.6.1 sudo-devel-1.9.9-150400.4.6.1 sudo-plugin-python-1.9.9-150400.4.6.1 sudo-plugin-python-debuginfo-1.9.9-150400.4.6.1 - SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64): sudo-1.9.9-150400.4.6.1 sudo-debuginfo-1.9.9-150400.4.6.1 sudo-debugsource-1.9.9-150400.4.6.1 References: https://www.suse.com/security/cve/CVE-2022-43995.html https://bugzilla.suse.com/1204986

1 0