April 2022 - openSUSE Security Announce

SUSE-SU-2022:1477-1: moderate: Security update for python-Twisted
by opensuse-security＠opensuse.org 29 Apr '22

29 Apr '22

SUSE Security Update: Security update for python-Twisted ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1477-1 Rating: moderate References: #1198086 Cross-References: CVE-2022-24801 CVSS scores: CVE-2022-24801 (NVD) : 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-24801 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 SUSE Linux Enterprise Module for Server Applications 15-SP3 SUSE Linux Enterprise Realtime Extension 15-SP2 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-Twisted fixes the following issues: - CVE-2022-24801: Fixed to not be as lenient as earlier HTTP/1.1 RFCs to prevent HTTP request smuggling. (bsc#1198086) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1477=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1477=1 - SUSE Linux Enterprise Realtime Extension 15-SP2: zypper in -t patch SUSE-SLE-Product-RT-15-SP2-2022-1477=1 - SUSE Linux Enterprise Module for Server Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP3-2022-1477=1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3: zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP3-2022-1477=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): python-Twisted-debuginfo-19.10.0-150200.3.9.1 python-Twisted-debugsource-19.10.0-150200.3.9.1 python2-Twisted-19.10.0-150200.3.9.1 python2-Twisted-debuginfo-19.10.0-150200.3.9.1 python3-Twisted-debuginfo-19.10.0-150200.3.9.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): python-Twisted-debuginfo-19.10.0-150200.3.9.1 python-Twisted-debugsource-19.10.0-150200.3.9.1 python-Twisted-doc-19.10.0-150200.3.9.1 python2-Twisted-19.10.0-150200.3.9.1 python2-Twisted-debuginfo-19.10.0-150200.3.9.1 python3-Twisted-19.10.0-150200.3.9.1 python3-Twisted-debuginfo-19.10.0-150200.3.9.1 - SUSE Linux Enterprise Realtime Extension 15-SP2 (x86_64): python3-Twisted-19.10.0-150200.3.9.1 python3-Twisted-debuginfo-19.10.0-150200.3.9.1 - SUSE Linux Enterprise Module for Server Applications 15-SP3 (aarch64 ppc64le s390x x86_64): python-Twisted-debuginfo-19.10.0-150200.3.9.1 python-Twisted-debugsource-19.10.0-150200.3.9.1 python3-Twisted-19.10.0-150200.3.9.1 python3-Twisted-debuginfo-19.10.0-150200.3.9.1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (aarch64 ppc64le s390x x86_64): python-Twisted-debugsource-19.10.0-150200.3.9.1 python3-Twisted-19.10.0-150200.3.9.1 python3-Twisted-debuginfo-19.10.0-150200.3.9.1 References: https://www.suse.com/security/cve/CVE-2022-24801.html https://bugzilla.suse.com/1198086

1 0

SUSE-SU-2022:1479-1: moderate: Security update for jasper
by opensuse-security＠opensuse.org 29 Apr '22

29 Apr '22

SUSE Security Update: Security update for jasper ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1479-1 Rating: moderate References: #1182104 #1182105 #1184757 #1184798 Cross-References: CVE-2021-26926 CVE-2021-26927 CVE-2021-3443 CVE-2021-3467 CVSS scores: CVE-2021-26926 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H CVE-2021-26926 (SUSE): 5.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L CVE-2021-26927 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-26927 (SUSE): 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-3443 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-3443 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-3467 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-3467 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Module for Desktop Applications 15-SP3 SUSE Linux Enterprise Module for Desktop Applications 15-SP4 SUSE Linux Enterprise Realtime Extension 15-SP2 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for jasper fixes the following issues: - CVE-2021-3467: Fixed NULL pointer deref in jp2_decode() (bsc#1184757). - CVE-2021-3443: Fixed NULL pointer deref in jp2_decode() (bsc#1184798). - CVE-2021-26927: Fixed NULL pointer deref in jp2_decode() (bsc#1182104). - CVE-2021-26926: Fixed an out of bounds read in jp2_decode() (bsc#1182105). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1479=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1479=1 - SUSE Linux Enterprise Realtime Extension 15-SP2: zypper in -t patch SUSE-SLE-Product-RT-15-SP2-2022-1479=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP4-2022-1479=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP3-2022-1479=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-1479=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-1479=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): jasper-2.0.14-150000.3.25.1 jasper-debuginfo-2.0.14-150000.3.25.1 jasper-debugsource-2.0.14-150000.3.25.1 libjasper-devel-2.0.14-150000.3.25.1 libjasper4-2.0.14-150000.3.25.1 libjasper4-debuginfo-2.0.14-150000.3.25.1 - openSUSE Leap 15.4 (x86_64): libjasper4-32bit-2.0.14-150000.3.25.1 libjasper4-32bit-debuginfo-2.0.14-150000.3.25.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): jasper-2.0.14-150000.3.25.1 jasper-debuginfo-2.0.14-150000.3.25.1 jasper-debugsource-2.0.14-150000.3.25.1 libjasper-devel-2.0.14-150000.3.25.1 libjasper4-2.0.14-150000.3.25.1 libjasper4-debuginfo-2.0.14-150000.3.25.1 - openSUSE Leap 15.3 (x86_64): libjasper4-32bit-2.0.14-150000.3.25.1 libjasper4-32bit-debuginfo-2.0.14-150000.3.25.1 - SUSE Linux Enterprise Realtime Extension 15-SP2 (x86_64): jasper-debuginfo-2.0.14-150000.3.25.1 jasper-debugsource-2.0.14-150000.3.25.1 libjasper-devel-2.0.14-150000.3.25.1 libjasper4-2.0.14-150000.3.25.1 libjasper4-debuginfo-2.0.14-150000.3.25.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4 (aarch64 ppc64le s390x x86_64): jasper-debuginfo-2.0.14-150000.3.25.1 jasper-debugsource-2.0.14-150000.3.25.1 libjasper-devel-2.0.14-150000.3.25.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (aarch64 ppc64le s390x x86_64): jasper-debuginfo-2.0.14-150000.3.25.1 jasper-debugsource-2.0.14-150000.3.25.1 libjasper-devel-2.0.14-150000.3.25.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): jasper-debuginfo-2.0.14-150000.3.25.1 jasper-debugsource-2.0.14-150000.3.25.1 libjasper4-2.0.14-150000.3.25.1 libjasper4-debuginfo-2.0.14-150000.3.25.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): jasper-debuginfo-2.0.14-150000.3.25.1 jasper-debugsource-2.0.14-150000.3.25.1 libjasper4-2.0.14-150000.3.25.1 libjasper4-debuginfo-2.0.14-150000.3.25.1 References: https://www.suse.com/security/cve/CVE-2021-26926.html https://www.suse.com/security/cve/CVE-2021-26927.html https://www.suse.com/security/cve/CVE-2021-3443.html https://www.suse.com/security/cve/CVE-2021-3467.html https://bugzilla.suse.com/1182104 https://bugzilla.suse.com/1182105 https://bugzilla.suse.com/1184757 https://bugzilla.suse.com/1184798

1 0

SUSE-SU-2022:1476-1: moderate: Security update for libcaca
by opensuse-security＠opensuse.org 29 Apr '22

29 Apr '22

SUSE Security Update: Security update for libcaca ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1476-1 Rating: moderate References: #1197028 Cross-References: CVE-2022-0856 CVSS scores: CVE-2022-0856 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-0856 (SUSE): 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Realtime Extension 15-SP2 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libcaca fixes the following issues: - CVE-2022-0856: Fixed a divide by zero issue which could be exploited to cause an application crash (bsc#1197028). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1476=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1476=1 - SUSE Linux Enterprise Realtime Extension 15-SP2: zypper in -t patch SUSE-SLE-Product-RT-15-SP2-2022-1476=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-1476=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-1476=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): caca-utils-0.99.beta19.git20171003-150200.11.6.1 caca-utils-debuginfo-0.99.beta19.git20171003-150200.11.6.1 libcaca-debugsource-0.99.beta19.git20171003-150200.11.6.1 libcaca-devel-0.99.beta19.git20171003-150200.11.6.1 libcaca-ruby-0.99.beta19.git20171003-150200.11.6.1 libcaca-ruby-debuginfo-0.99.beta19.git20171003-150200.11.6.1 libcaca0-0.99.beta19.git20171003-150200.11.6.1 libcaca0-debuginfo-0.99.beta19.git20171003-150200.11.6.1 libcaca0-plugins-0.99.beta19.git20171003-150200.11.6.1 libcaca0-plugins-debuginfo-0.99.beta19.git20171003-150200.11.6.1 - openSUSE Leap 15.4 (x86_64): libcaca0-32bit-0.99.beta19.git20171003-150200.11.6.1 libcaca0-32bit-debuginfo-0.99.beta19.git20171003-150200.11.6.1 libcaca0-plugins-32bit-0.99.beta19.git20171003-150200.11.6.1 libcaca0-plugins-32bit-debuginfo-0.99.beta19.git20171003-150200.11.6.1 - openSUSE Leap 15.4 (noarch): python3-caca-0.99.beta19.git20171003-150200.11.6.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): caca-utils-0.99.beta19.git20171003-150200.11.6.1 caca-utils-debuginfo-0.99.beta19.git20171003-150200.11.6.1 libcaca-debugsource-0.99.beta19.git20171003-150200.11.6.1 libcaca-devel-0.99.beta19.git20171003-150200.11.6.1 libcaca-ruby-0.99.beta19.git20171003-150200.11.6.1 libcaca-ruby-debuginfo-0.99.beta19.git20171003-150200.11.6.1 libcaca0-0.99.beta19.git20171003-150200.11.6.1 libcaca0-debuginfo-0.99.beta19.git20171003-150200.11.6.1 libcaca0-plugins-0.99.beta19.git20171003-150200.11.6.1 libcaca0-plugins-debuginfo-0.99.beta19.git20171003-150200.11.6.1 - openSUSE Leap 15.3 (noarch): python3-caca-0.99.beta19.git20171003-150200.11.6.1 - openSUSE Leap 15.3 (x86_64): libcaca0-32bit-0.99.beta19.git20171003-150200.11.6.1 libcaca0-32bit-debuginfo-0.99.beta19.git20171003-150200.11.6.1 libcaca0-plugins-32bit-0.99.beta19.git20171003-150200.11.6.1 libcaca0-plugins-32bit-debuginfo-0.99.beta19.git20171003-150200.11.6.1 - SUSE Linux Enterprise Realtime Extension 15-SP2 (x86_64): libcaca-debugsource-0.99.beta19.git20171003-150200.11.6.1 libcaca-devel-0.99.beta19.git20171003-150200.11.6.1 libcaca0-0.99.beta19.git20171003-150200.11.6.1 libcaca0-debuginfo-0.99.beta19.git20171003-150200.11.6.1 libcaca0-plugins-0.99.beta19.git20171003-150200.11.6.1 libcaca0-plugins-debuginfo-0.99.beta19.git20171003-150200.11.6.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): libcaca-debugsource-0.99.beta19.git20171003-150200.11.6.1 libcaca-devel-0.99.beta19.git20171003-150200.11.6.1 libcaca0-0.99.beta19.git20171003-150200.11.6.1 libcaca0-debuginfo-0.99.beta19.git20171003-150200.11.6.1 libcaca0-plugins-0.99.beta19.git20171003-150200.11.6.1 libcaca0-plugins-debuginfo-0.99.beta19.git20171003-150200.11.6.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): libcaca-debugsource-0.99.beta19.git20171003-150200.11.6.1 libcaca-devel-0.99.beta19.git20171003-150200.11.6.1 libcaca0-0.99.beta19.git20171003-150200.11.6.1 libcaca0-debuginfo-0.99.beta19.git20171003-150200.11.6.1 libcaca0-plugins-0.99.beta19.git20171003-150200.11.6.1 libcaca0-plugins-debuginfo-0.99.beta19.git20171003-150200.11.6.1 References: https://www.suse.com/security/cve/CVE-2022-0856.html https://bugzilla.suse.com/1197028

1 0

SUSE-SU-2022:0731-2: important: Security update for mariadb
by opensuse-security＠opensuse.org 29 Apr '22

29 Apr '22

SUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:0731-2 Rating: important References: #1195325 #1195334 #1195339 #1196016 SLE-22245 Cross-References: CVE-2021-46657 CVE-2021-46658 CVE-2021-46659 CVE-2021-46661 CVE-2021-46663 CVE-2021-46664 CVE-2021-46665 CVE-2021-46668 CVE-2022-24048 CVE-2022-24050 CVE-2022-24051 CVE-2022-24052 CVSS scores: CVE-2021-46657 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-46657 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-46658 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-46658 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-46659 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-46659 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-46661 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-46661 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-46663 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-46663 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-46664 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-46665 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-46668 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-24048 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-24050 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-24051 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-24052 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes 12 vulnerabilities, contains one feature is now available. Description: This update for mariadb fixes the following issues: - Update to 10.5.15 (bsc#1196016): * 10.5.15: CVE-2021-46665 CVE-2021-46664 CVE-2021-46661 CVE-2021-46668 CVE-2021-46663 * 10.5.14: CVE-2022-24052 CVE-2022-24051 CVE-2022-24050 CVE-2022-24048 CVE-2021-46659, bsc#1195339 - The following issues have already been fixed in this package but weren't previously mentioned in the changes file: CVE-2021-46658, bsc#1195334 CVE-2021-46657, bsc#1195325 Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-731=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): mariadb-galera-10.5.15-150300.3.15.1 References: https://www.suse.com/security/cve/CVE-2021-46657.html https://www.suse.com/security/cve/CVE-2021-46658.html https://www.suse.com/security/cve/CVE-2021-46659.html https://www.suse.com/security/cve/CVE-2021-46661.html https://www.suse.com/security/cve/CVE-2021-46663.html https://www.suse.com/security/cve/CVE-2021-46664.html https://www.suse.com/security/cve/CVE-2021-46665.html https://www.suse.com/security/cve/CVE-2021-46668.html https://www.suse.com/security/cve/CVE-2022-24048.html https://www.suse.com/security/cve/CVE-2022-24050.html https://www.suse.com/security/cve/CVE-2022-24051.html https://www.suse.com/security/cve/CVE-2022-24052.html https://bugzilla.suse.com/1195325 https://bugzilla.suse.com/1195334 https://bugzilla.suse.com/1195339 https://bugzilla.suse.com/1196016

1 0

SUSE-SU-2022:1465-1: important: Security update for libslirp
by opensuse-security＠opensuse.org 29 Apr '22

29 Apr '22

SUSE Security Update: Security update for libslirp ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1465-1 Rating: important References: #1187364 #1187366 #1187367 #1198773 Cross-References: CVE-2021-3592 CVE-2021-3594 CVE-2021-3595 CVSS scores: CVE-2021-3592 (NVD) : 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N CVE-2021-3592 (SUSE): 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N CVE-2021-3594 (NVD) : 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N CVE-2021-3594 (SUSE): 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N CVE-2021-3595 (NVD) : 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N CVE-2021-3595 (SUSE): 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Module for Server Applications 15-SP3 SUSE Linux Enterprise Module for Server Applications 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for libslirp fixes the following issues: - CVE-2021-3592: Fixed invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364). - CVE-2021-3594: Fixed invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367). - CVE-2021-3595: Fixed invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366). - Fix a dhcp regression [bsc#1198773] Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1465=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1465=1 - SUSE Linux Enterprise Module for Server Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2022-1465=1 - SUSE Linux Enterprise Module for Server Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP3-2022-1465=1 - SUSE Linux Enterprise Micro 5.2: zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-1465=1 - SUSE Linux Enterprise Micro 5.1: zypper in -t patch SUSE-SUSE-MicroOS-5.1-2022-1465=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libslirp-debugsource-4.3.1-150300.2.7.1 libslirp-devel-4.3.1-150300.2.7.1 libslirp0-4.3.1-150300.2.7.1 libslirp0-debuginfo-4.3.1-150300.2.7.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libslirp-debugsource-4.3.1-150300.2.7.1 libslirp-devel-4.3.1-150300.2.7.1 libslirp0-4.3.1-150300.2.7.1 libslirp0-debuginfo-4.3.1-150300.2.7.1 - SUSE Linux Enterprise Module for Server Applications 15-SP4 (aarch64 ppc64le s390x x86_64): libslirp-debugsource-4.3.1-150300.2.7.1 libslirp-devel-4.3.1-150300.2.7.1 libslirp0-4.3.1-150300.2.7.1 libslirp0-debuginfo-4.3.1-150300.2.7.1 - SUSE Linux Enterprise Module for Server Applications 15-SP3 (aarch64 ppc64le s390x x86_64): libslirp-debugsource-4.3.1-150300.2.7.1 libslirp-devel-4.3.1-150300.2.7.1 libslirp0-4.3.1-150300.2.7.1 libslirp0-debuginfo-4.3.1-150300.2.7.1 - SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64): libslirp-debugsource-4.3.1-150300.2.7.1 libslirp0-4.3.1-150300.2.7.1 libslirp0-debuginfo-4.3.1-150300.2.7.1 - SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64): libslirp-debugsource-4.3.1-150300.2.7.1 libslirp0-4.3.1-150300.2.7.1 libslirp0-debuginfo-4.3.1-150300.2.7.1 References: https://www.suse.com/security/cve/CVE-2021-3592.html https://www.suse.com/security/cve/CVE-2021-3594.html https://www.suse.com/security/cve/CVE-2021-3595.html https://bugzilla.suse.com/1187364 https://bugzilla.suse.com/1187366 https://bugzilla.suse.com/1187367 https://bugzilla.suse.com/1198773

1 0

SUSE-SU-2022:1461-1: important: Security update for nodejs12
by opensuse-security＠opensuse.org 28 Apr '22

28 Apr '22

SUSE Security Update: Security update for nodejs12 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1461-1 Rating: important References: #1194819 #1196877 #1197283 #1198247 Cross-References: CVE-2021-44906 CVE-2021-44907 CVE-2022-0235 CVE-2022-0778 CVSS scores: CVE-2021-44906 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-44906 (SUSE): 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L CVE-2021-44907 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-44907 (SUSE): 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N CVE-2022-0235 (SUSE): 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N CVE-2022-0778 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-0778 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: SUSE Enterprise Storage 7 SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Web Scripting 15-SP3 SUSE Linux Enterprise Server 15-SP2-BCL SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.1 SUSE Manager Server 4.1 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for nodejs12 fixes the following issues: - CVE-2022-0778: Fixed a infinite loop in BN_mod_sqrt() reachable when parsing certificates (bsc#1196877). - CVE-2021-44906: Fixed a prototype pollution in node-minimist (bsc#1198247). - CVE-2021-44907: Fixed a potential Denial of Service vulnerability in node-qs (bsc#1197283). - CVE-2022-0235: Fixed an exposure of sensitive information to an unauthorized actor in node-fetch (bsc#1194819). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1461=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1461=1 - SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-1461=1 - SUSE Manager Retail Branch Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-1461=1 - SUSE Manager Proxy 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-1461=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-1461=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-1461=1 - SUSE Linux Enterprise Server 15-SP2-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-1461=1 - SUSE Linux Enterprise Module for Web Scripting 15-SP3: zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP3-2022-1461=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-1461=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-1461=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2022-1461=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): nodejs12-12.22.12-150200.4.32.1 nodejs12-debuginfo-12.22.12-150200.4.32.1 nodejs12-debugsource-12.22.12-150200.4.32.1 nodejs12-devel-12.22.12-150200.4.32.1 npm12-12.22.12-150200.4.32.1 - openSUSE Leap 15.4 (noarch): nodejs12-docs-12.22.12-150200.4.32.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): nodejs12-12.22.12-150200.4.32.1 nodejs12-debuginfo-12.22.12-150200.4.32.1 nodejs12-debugsource-12.22.12-150200.4.32.1 nodejs12-devel-12.22.12-150200.4.32.1 npm12-12.22.12-150200.4.32.1 - openSUSE Leap 15.3 (noarch): nodejs12-docs-12.22.12-150200.4.32.1 - SUSE Manager Server 4.1 (ppc64le s390x x86_64): nodejs12-12.22.12-150200.4.32.1 nodejs12-debuginfo-12.22.12-150200.4.32.1 nodejs12-debugsource-12.22.12-150200.4.32.1 nodejs12-devel-12.22.12-150200.4.32.1 npm12-12.22.12-150200.4.32.1 - SUSE Manager Server 4.1 (noarch): nodejs12-docs-12.22.12-150200.4.32.1 - SUSE Manager Retail Branch Server 4.1 (x86_64): nodejs12-12.22.12-150200.4.32.1 nodejs12-debuginfo-12.22.12-150200.4.32.1 nodejs12-debugsource-12.22.12-150200.4.32.1 nodejs12-devel-12.22.12-150200.4.32.1 npm12-12.22.12-150200.4.32.1 - SUSE Manager Retail Branch Server 4.1 (noarch): nodejs12-docs-12.22.12-150200.4.32.1 - SUSE Manager Proxy 4.1 (x86_64): nodejs12-12.22.12-150200.4.32.1 nodejs12-debuginfo-12.22.12-150200.4.32.1 nodejs12-debugsource-12.22.12-150200.4.32.1 nodejs12-devel-12.22.12-150200.4.32.1 npm12-12.22.12-150200.4.32.1 - SUSE Manager Proxy 4.1 (noarch): nodejs12-docs-12.22.12-150200.4.32.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): nodejs12-12.22.12-150200.4.32.1 nodejs12-debuginfo-12.22.12-150200.4.32.1 nodejs12-debugsource-12.22.12-150200.4.32.1 nodejs12-devel-12.22.12-150200.4.32.1 npm12-12.22.12-150200.4.32.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (noarch): nodejs12-docs-12.22.12-150200.4.32.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): nodejs12-12.22.12-150200.4.32.1 nodejs12-debuginfo-12.22.12-150200.4.32.1 nodejs12-debugsource-12.22.12-150200.4.32.1 nodejs12-devel-12.22.12-150200.4.32.1 npm12-12.22.12-150200.4.32.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (noarch): nodejs12-docs-12.22.12-150200.4.32.1 - SUSE Linux Enterprise Server 15-SP2-BCL (noarch): nodejs12-docs-12.22.12-150200.4.32.1 - SUSE Linux Enterprise Server 15-SP2-BCL (x86_64): nodejs12-12.22.12-150200.4.32.1 nodejs12-debuginfo-12.22.12-150200.4.32.1 nodejs12-debugsource-12.22.12-150200.4.32.1 nodejs12-devel-12.22.12-150200.4.32.1 npm12-12.22.12-150200.4.32.1 - SUSE Linux Enterprise Module for Web Scripting 15-SP3 (aarch64 ppc64le s390x x86_64): nodejs12-12.22.12-150200.4.32.1 nodejs12-debuginfo-12.22.12-150200.4.32.1 nodejs12-debugsource-12.22.12-150200.4.32.1 nodejs12-devel-12.22.12-150200.4.32.1 npm12-12.22.12-150200.4.32.1 - SUSE Linux Enterprise Module for Web Scripting 15-SP3 (noarch): nodejs12-docs-12.22.12-150200.4.32.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64): nodejs12-12.22.12-150200.4.32.1 nodejs12-debuginfo-12.22.12-150200.4.32.1 nodejs12-debugsource-12.22.12-150200.4.32.1 nodejs12-devel-12.22.12-150200.4.32.1 npm12-12.22.12-150200.4.32.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (noarch): nodejs12-docs-12.22.12-150200.4.32.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64): nodejs12-12.22.12-150200.4.32.1 nodejs12-debuginfo-12.22.12-150200.4.32.1 nodejs12-debugsource-12.22.12-150200.4.32.1 nodejs12-devel-12.22.12-150200.4.32.1 npm12-12.22.12-150200.4.32.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (noarch): nodejs12-docs-12.22.12-150200.4.32.1 - SUSE Enterprise Storage 7 (aarch64 x86_64): nodejs12-12.22.12-150200.4.32.1 nodejs12-debuginfo-12.22.12-150200.4.32.1 nodejs12-debugsource-12.22.12-150200.4.32.1 nodejs12-devel-12.22.12-150200.4.32.1 npm12-12.22.12-150200.4.32.1 - SUSE Enterprise Storage 7 (noarch): nodejs12-docs-12.22.12-150200.4.32.1 References: https://www.suse.com/security/cve/CVE-2021-44906.html https://www.suse.com/security/cve/CVE-2021-44907.html https://www.suse.com/security/cve/CVE-2022-0235.html https://www.suse.com/security/cve/CVE-2022-0778.html https://bugzilla.suse.com/1194819 https://bugzilla.suse.com/1196877 https://bugzilla.suse.com/1197283 https://bugzilla.suse.com/1198247

1 0

SUSE-SU-2022:1462-1: important: Security update for nodejs14
by opensuse-security＠opensuse.org 28 Apr '22

28 Apr '22

SUSE Security Update: Security update for nodejs14 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1462-1 Rating: important References: #1194819 #1196877 #1197283 #1198247 Cross-References: CVE-2021-44906 CVE-2021-44907 CVE-2022-0235 CVE-2022-0778 CVSS scores: CVE-2021-44906 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-44906 (SUSE): 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L CVE-2021-44907 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-44907 (SUSE): 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N CVE-2022-0235 (SUSE): 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N CVE-2022-0778 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-0778 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: SUSE Enterprise Storage 7 SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Web Scripting 15-SP3 SUSE Linux Enterprise Server 15-SP2-BCL SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.1 SUSE Manager Server 4.1 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for nodejs14 fixes the following issues: - CVE-2022-0778: Fixed a infinite loop in BN_mod_sqrt() reachable when parsing certificates (bsc#1196877). - CVE-2021-44906: Fixed a prototype pollution in node-minimist (bsc#1198247). - CVE-2021-44907: Fixed a potential Denial of Service vulnerability in node-qs (bsc#1197283). - CVE-2022-0235: Fixed an exposure of sensitive information to an unauthorized actor in node-fetch (bsc#1194819). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1462=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1462=1 - SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-1462=1 - SUSE Manager Retail Branch Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-1462=1 - SUSE Manager Proxy 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-1462=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-1462=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-1462=1 - SUSE Linux Enterprise Server 15-SP2-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-1462=1 - SUSE Linux Enterprise Module for Web Scripting 15-SP3: zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP3-2022-1462=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-1462=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-1462=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2022-1462=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): corepack14-14.19.1-150200.15.31.1 nodejs14-14.19.1-150200.15.31.1 nodejs14-debuginfo-14.19.1-150200.15.31.1 nodejs14-debugsource-14.19.1-150200.15.31.1 nodejs14-devel-14.19.1-150200.15.31.1 npm14-14.19.1-150200.15.31.1 - openSUSE Leap 15.4 (noarch): nodejs14-docs-14.19.1-150200.15.31.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): nodejs14-14.19.1-150200.15.31.1 nodejs14-debuginfo-14.19.1-150200.15.31.1 nodejs14-debugsource-14.19.1-150200.15.31.1 nodejs14-devel-14.19.1-150200.15.31.1 npm14-14.19.1-150200.15.31.1 - openSUSE Leap 15.3 (noarch): nodejs14-docs-14.19.1-150200.15.31.1 - SUSE Manager Server 4.1 (ppc64le s390x x86_64): nodejs14-14.19.1-150200.15.31.1 nodejs14-debuginfo-14.19.1-150200.15.31.1 nodejs14-debugsource-14.19.1-150200.15.31.1 nodejs14-devel-14.19.1-150200.15.31.1 npm14-14.19.1-150200.15.31.1 - SUSE Manager Server 4.1 (noarch): nodejs14-docs-14.19.1-150200.15.31.1 - SUSE Manager Retail Branch Server 4.1 (noarch): nodejs14-docs-14.19.1-150200.15.31.1 - SUSE Manager Retail Branch Server 4.1 (x86_64): nodejs14-14.19.1-150200.15.31.1 nodejs14-debuginfo-14.19.1-150200.15.31.1 nodejs14-debugsource-14.19.1-150200.15.31.1 nodejs14-devel-14.19.1-150200.15.31.1 npm14-14.19.1-150200.15.31.1 - SUSE Manager Proxy 4.1 (noarch): nodejs14-docs-14.19.1-150200.15.31.1 - SUSE Manager Proxy 4.1 (x86_64): nodejs14-14.19.1-150200.15.31.1 nodejs14-debuginfo-14.19.1-150200.15.31.1 nodejs14-debugsource-14.19.1-150200.15.31.1 nodejs14-devel-14.19.1-150200.15.31.1 npm14-14.19.1-150200.15.31.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): nodejs14-14.19.1-150200.15.31.1 nodejs14-debuginfo-14.19.1-150200.15.31.1 nodejs14-debugsource-14.19.1-150200.15.31.1 nodejs14-devel-14.19.1-150200.15.31.1 npm14-14.19.1-150200.15.31.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (noarch): nodejs14-docs-14.19.1-150200.15.31.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): nodejs14-14.19.1-150200.15.31.1 nodejs14-debuginfo-14.19.1-150200.15.31.1 nodejs14-debugsource-14.19.1-150200.15.31.1 nodejs14-devel-14.19.1-150200.15.31.1 npm14-14.19.1-150200.15.31.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (noarch): nodejs14-docs-14.19.1-150200.15.31.1 - SUSE Linux Enterprise Server 15-SP2-BCL (noarch): nodejs14-docs-14.19.1-150200.15.31.1 - SUSE Linux Enterprise Server 15-SP2-BCL (x86_64): nodejs14-14.19.1-150200.15.31.1 nodejs14-debuginfo-14.19.1-150200.15.31.1 nodejs14-debugsource-14.19.1-150200.15.31.1 nodejs14-devel-14.19.1-150200.15.31.1 npm14-14.19.1-150200.15.31.1 - SUSE Linux Enterprise Module for Web Scripting 15-SP3 (aarch64 ppc64le s390x x86_64): nodejs14-14.19.1-150200.15.31.1 nodejs14-debuginfo-14.19.1-150200.15.31.1 nodejs14-debugsource-14.19.1-150200.15.31.1 nodejs14-devel-14.19.1-150200.15.31.1 npm14-14.19.1-150200.15.31.1 - SUSE Linux Enterprise Module for Web Scripting 15-SP3 (noarch): nodejs14-docs-14.19.1-150200.15.31.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64): nodejs14-14.19.1-150200.15.31.1 nodejs14-debuginfo-14.19.1-150200.15.31.1 nodejs14-debugsource-14.19.1-150200.15.31.1 nodejs14-devel-14.19.1-150200.15.31.1 npm14-14.19.1-150200.15.31.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (noarch): nodejs14-docs-14.19.1-150200.15.31.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64): nodejs14-14.19.1-150200.15.31.1 nodejs14-debuginfo-14.19.1-150200.15.31.1 nodejs14-debugsource-14.19.1-150200.15.31.1 nodejs14-devel-14.19.1-150200.15.31.1 npm14-14.19.1-150200.15.31.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (noarch): nodejs14-docs-14.19.1-150200.15.31.1 - SUSE Enterprise Storage 7 (aarch64 x86_64): nodejs14-14.19.1-150200.15.31.1 nodejs14-debuginfo-14.19.1-150200.15.31.1 nodejs14-debugsource-14.19.1-150200.15.31.1 nodejs14-devel-14.19.1-150200.15.31.1 npm14-14.19.1-150200.15.31.1 - SUSE Enterprise Storage 7 (noarch): nodejs14-docs-14.19.1-150200.15.31.1 References: https://www.suse.com/security/cve/CVE-2021-44906.html https://www.suse.com/security/cve/CVE-2021-44907.html https://www.suse.com/security/cve/CVE-2022-0235.html https://www.suse.com/security/cve/CVE-2022-0778.html https://bugzilla.suse.com/1194819 https://bugzilla.suse.com/1196877 https://bugzilla.suse.com/1197283 https://bugzilla.suse.com/1198247

1 0

SUSE-SU-2022:1454-1: moderate: Security update for python-pip
by opensuse-security＠opensuse.org 28 Apr '22

28 Apr '22

SUSE Security Update: Security update for python-pip ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1454-1 Rating: moderate References: #1176262 #1195831 SLE-18038 Cross-References: CVE-2019-20916 CVSS scores: CVE-2019-20916 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2019-20916 (SUSE): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Python2 15-SP3 SUSE Linux Enterprise Realtime Extension 15-SP2 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves one vulnerability, contains one feature and has one errata is now available. Description: This update for python-pip fixes the following issues: - Add wheel subpackage with the generated wheel for this package (bsc#1176262, CVE-2019-20916). - Make wheel a separate build run to avoid the setuptools/wheel build cycle. - Switch this package to use update-alternatives for all files in %{_bindir} so it doesn't collide with the versions on "the latest" versions of Python interpreter (jsc#SLE-18038, bsc#1195831). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1454=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1454=1 - SUSE Linux Enterprise Realtime Extension 15-SP2: zypper in -t patch SUSE-SLE-Product-RT-15-SP2-2022-1454=1 - SUSE Linux Enterprise Module for Python2 15-SP3: zypper in -t patch SUSE-SLE-Module-Python2-15-SP3-2022-1454=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-1454=1 Package List: - openSUSE Leap 15.4 (noarch): python2-pip-20.0.2-150100.6.18.1 - openSUSE Leap 15.3 (noarch): python2-pip-20.0.2-150100.6.18.1 python3-pip-20.0.2-150100.6.18.1 - SUSE Linux Enterprise Realtime Extension 15-SP2 (noarch): python3-pip-20.0.2-150100.6.18.1 - SUSE Linux Enterprise Module for Python2 15-SP3 (noarch): python2-pip-20.0.2-150100.6.18.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (noarch): python3-pip-20.0.2-150100.6.18.1 References: https://www.suse.com/security/cve/CVE-2019-20916.html https://bugzilla.suse.com/1176262 https://bugzilla.suse.com/1195831

1 0

SUSE-SU-2022:1446-1: moderate: Security update for python-paramiko
by opensuse-security＠opensuse.org 28 Apr '22

28 Apr '22

SUSE Security Update: Security update for python-paramiko ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1446-1 Rating: moderate References: #1197279 Cross-References: CVE-2022-24302 CVSS scores: CVE-2022-24302 (NVD) : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2022-24302 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Module for Python2 15-SP3 SUSE Linux Enterprise Realtime Extension 15-SP2 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-paramiko fixes the following issues: - CVE-2022-24302: Fixed a race condition between creation and chmod when writing private keys. (bsc#1197279) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1446=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1446=1 - SUSE Linux Enterprise Realtime Extension 15-SP2: zypper in -t patch SUSE-SLE-Product-RT-15-SP2-2022-1446=1 - SUSE Linux Enterprise Module for Python2 15-SP3: zypper in -t patch SUSE-SLE-Module-Python2-15-SP3-2022-1446=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-1446=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-1446=1 Package List: - openSUSE Leap 15.4 (noarch): python-paramiko-doc-2.4.2-150100.6.12.1 python2-paramiko-2.4.2-150100.6.12.1 python3-paramiko-2.4.2-150100.6.12.1 - openSUSE Leap 15.3 (noarch): python-paramiko-doc-2.4.2-150100.6.12.1 python2-paramiko-2.4.2-150100.6.12.1 python3-paramiko-2.4.2-150100.6.12.1 - SUSE Linux Enterprise Realtime Extension 15-SP2 (noarch): python3-paramiko-2.4.2-150100.6.12.1 - SUSE Linux Enterprise Module for Python2 15-SP3 (noarch): python2-paramiko-2.4.2-150100.6.12.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (noarch): python3-paramiko-2.4.2-150100.6.12.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (noarch): python3-paramiko-2.4.2-150100.6.12.1 References: https://www.suse.com/security/cve/CVE-2022-24302.html https://bugzilla.suse.com/1197279

1 0

SUSE-SU-2022:1455-1: Security update for glib2
by opensuse-security＠opensuse.org 28 Apr '22

28 Apr '22

SUSE Security Update: Security update for glib2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1455-1 Rating: low References: #1183533 Cross-References: CVE-2021-28153 CVSS scores: CVE-2021-28153 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2021-28153 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Micro 5.0 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Realtime Extension 15-SP2 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for glib2 fixes the following issues: - CVE-2021-28153: Fixed an issue where symlink targets would be incorrectly created as empty files (bsc#1183533). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1455=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1455=1 - SUSE Linux Enterprise Realtime Extension 15-SP2: zypper in -t patch SUSE-SLE-Product-RT-15-SP2-2022-1455=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-1455=1 - SUSE Linux Enterprise Micro 5.2: zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-1455=1 - SUSE Linux Enterprise Micro 5.1: zypper in -t patch SUSE-SUSE-MicroOS-5.1-2022-1455=1 - SUSE Linux Enterprise Micro 5.0: zypper in -t patch SUSE-SUSE-MicroOS-5.0-2022-1455=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): glib2-tests-2.62.6-150200.3.9.1 glib2-tests-debuginfo-2.62.6-150200.3.9.1 libgio-fam-2.62.6-150200.3.9.1 libgio-fam-debuginfo-2.62.6-150200.3.9.1 - openSUSE Leap 15.4 (x86_64): libgio-fam-32bit-2.62.6-150200.3.9.1 libgio-fam-32bit-debuginfo-2.62.6-150200.3.9.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): glib2-debugsource-2.62.6-150200.3.9.1 glib2-devel-2.62.6-150200.3.9.1 glib2-devel-debuginfo-2.62.6-150200.3.9.1 glib2-devel-static-2.62.6-150200.3.9.1 glib2-tests-2.62.6-150200.3.9.1 glib2-tests-debuginfo-2.62.6-150200.3.9.1 glib2-tools-2.62.6-150200.3.9.1 glib2-tools-debuginfo-2.62.6-150200.3.9.1 libgio-2_0-0-2.62.6-150200.3.9.1 libgio-2_0-0-debuginfo-2.62.6-150200.3.9.1 libgio-fam-2.62.6-150200.3.9.1 libgio-fam-debuginfo-2.62.6-150200.3.9.1 libglib-2_0-0-2.62.6-150200.3.9.1 libglib-2_0-0-debuginfo-2.62.6-150200.3.9.1 libgmodule-2_0-0-2.62.6-150200.3.9.1 libgmodule-2_0-0-debuginfo-2.62.6-150200.3.9.1 libgobject-2_0-0-2.62.6-150200.3.9.1 libgobject-2_0-0-debuginfo-2.62.6-150200.3.9.1 libgthread-2_0-0-2.62.6-150200.3.9.1 libgthread-2_0-0-debuginfo-2.62.6-150200.3.9.1 - openSUSE Leap 15.3 (x86_64): glib2-devel-32bit-2.62.6-150200.3.9.1 glib2-devel-32bit-debuginfo-2.62.6-150200.3.9.1 glib2-tools-32bit-2.62.6-150200.3.9.1 glib2-tools-32bit-debuginfo-2.62.6-150200.3.9.1 libgio-2_0-0-32bit-2.62.6-150200.3.9.1 libgio-2_0-0-32bit-debuginfo-2.62.6-150200.3.9.1 libgio-fam-32bit-2.62.6-150200.3.9.1 libgio-fam-32bit-debuginfo-2.62.6-150200.3.9.1 libglib-2_0-0-32bit-2.62.6-150200.3.9.1 libglib-2_0-0-32bit-debuginfo-2.62.6-150200.3.9.1 libgmodule-2_0-0-32bit-2.62.6-150200.3.9.1 libgmodule-2_0-0-32bit-debuginfo-2.62.6-150200.3.9.1 libgobject-2_0-0-32bit-2.62.6-150200.3.9.1 libgobject-2_0-0-32bit-debuginfo-2.62.6-150200.3.9.1 libgthread-2_0-0-32bit-2.62.6-150200.3.9.1 libgthread-2_0-0-32bit-debuginfo-2.62.6-150200.3.9.1 - openSUSE Leap 15.3 (noarch): gio-branding-upstream-2.62.6-150200.3.9.1 glib2-lang-2.62.6-150200.3.9.1 - SUSE Linux Enterprise Realtime Extension 15-SP2 (noarch): glib2-lang-2.62.6-150200.3.9.1 - SUSE Linux Enterprise Realtime Extension 15-SP2 (x86_64): glib2-debugsource-2.62.6-150200.3.9.1 glib2-devel-2.62.6-150200.3.9.1 glib2-devel-debuginfo-2.62.6-150200.3.9.1 glib2-tools-2.62.6-150200.3.9.1 glib2-tools-debuginfo-2.62.6-150200.3.9.1 libgio-2_0-0-2.62.6-150200.3.9.1 libgio-2_0-0-32bit-2.62.6-150200.3.9.1 libgio-2_0-0-32bit-debuginfo-2.62.6-150200.3.9.1 libgio-2_0-0-debuginfo-2.62.6-150200.3.9.1 libglib-2_0-0-2.62.6-150200.3.9.1 libglib-2_0-0-32bit-2.62.6-150200.3.9.1 libglib-2_0-0-32bit-debuginfo-2.62.6-150200.3.9.1 libglib-2_0-0-debuginfo-2.62.6-150200.3.9.1 libgmodule-2_0-0-2.62.6-150200.3.9.1 libgmodule-2_0-0-32bit-2.62.6-150200.3.9.1 libgmodule-2_0-0-32bit-debuginfo-2.62.6-150200.3.9.1 libgmodule-2_0-0-debuginfo-2.62.6-150200.3.9.1 libgobject-2_0-0-2.62.6-150200.3.9.1 libgobject-2_0-0-32bit-2.62.6-150200.3.9.1 libgobject-2_0-0-32bit-debuginfo-2.62.6-150200.3.9.1 libgobject-2_0-0-debuginfo-2.62.6-150200.3.9.1 libgthread-2_0-0-2.62.6-150200.3.9.1 libgthread-2_0-0-debuginfo-2.62.6-150200.3.9.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): glib2-debugsource-2.62.6-150200.3.9.1 glib2-devel-2.62.6-150200.3.9.1 glib2-devel-debuginfo-2.62.6-150200.3.9.1 glib2-tools-2.62.6-150200.3.9.1 glib2-tools-debuginfo-2.62.6-150200.3.9.1 libgio-2_0-0-2.62.6-150200.3.9.1 libgio-2_0-0-debuginfo-2.62.6-150200.3.9.1 libglib-2_0-0-2.62.6-150200.3.9.1 libglib-2_0-0-debuginfo-2.62.6-150200.3.9.1 libgmodule-2_0-0-2.62.6-150200.3.9.1 libgmodule-2_0-0-debuginfo-2.62.6-150200.3.9.1 libgobject-2_0-0-2.62.6-150200.3.9.1 libgobject-2_0-0-debuginfo-2.62.6-150200.3.9.1 libgthread-2_0-0-2.62.6-150200.3.9.1 libgthread-2_0-0-debuginfo-2.62.6-150200.3.9.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (x86_64): libgio-2_0-0-32bit-2.62.6-150200.3.9.1 libgio-2_0-0-32bit-debuginfo-2.62.6-150200.3.9.1 libglib-2_0-0-32bit-2.62.6-150200.3.9.1 libglib-2_0-0-32bit-debuginfo-2.62.6-150200.3.9.1 libgmodule-2_0-0-32bit-2.62.6-150200.3.9.1 libgmodule-2_0-0-32bit-debuginfo-2.62.6-150200.3.9.1 libgobject-2_0-0-32bit-2.62.6-150200.3.9.1 libgobject-2_0-0-32bit-debuginfo-2.62.6-150200.3.9.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (noarch): glib2-lang-2.62.6-150200.3.9.1 - SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64): glib2-debugsource-2.62.6-150200.3.9.1 glib2-tools-2.62.6-150200.3.9.1 glib2-tools-debuginfo-2.62.6-150200.3.9.1 libgio-2_0-0-2.62.6-150200.3.9.1 libgio-2_0-0-debuginfo-2.62.6-150200.3.9.1 libglib-2_0-0-2.62.6-150200.3.9.1 libglib-2_0-0-debuginfo-2.62.6-150200.3.9.1 libgmodule-2_0-0-2.62.6-150200.3.9.1 libgmodule-2_0-0-debuginfo-2.62.6-150200.3.9.1 libgobject-2_0-0-2.62.6-150200.3.9.1 libgobject-2_0-0-debuginfo-2.62.6-150200.3.9.1 - SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64): glib2-debugsource-2.62.6-150200.3.9.1 glib2-tools-2.62.6-150200.3.9.1 glib2-tools-debuginfo-2.62.6-150200.3.9.1 libgio-2_0-0-2.62.6-150200.3.9.1 libgio-2_0-0-debuginfo-2.62.6-150200.3.9.1 libglib-2_0-0-2.62.6-150200.3.9.1 libglib-2_0-0-debuginfo-2.62.6-150200.3.9.1 libgmodule-2_0-0-2.62.6-150200.3.9.1 libgmodule-2_0-0-debuginfo-2.62.6-150200.3.9.1 libgobject-2_0-0-2.62.6-150200.3.9.1 libgobject-2_0-0-debuginfo-2.62.6-150200.3.9.1 - SUSE Linux Enterprise Micro 5.0 (aarch64 x86_64): glib2-debugsource-2.62.6-150200.3.9.1 glib2-tools-2.62.6-150200.3.9.1 glib2-tools-debuginfo-2.62.6-150200.3.9.1 libgio-2_0-0-2.62.6-150200.3.9.1 libgio-2_0-0-debuginfo-2.62.6-150200.3.9.1 libglib-2_0-0-2.62.6-150200.3.9.1 libglib-2_0-0-debuginfo-2.62.6-150200.3.9.1 libgmodule-2_0-0-2.62.6-150200.3.9.1 libgmodule-2_0-0-debuginfo-2.62.6-150200.3.9.1 libgobject-2_0-0-2.62.6-150200.3.9.1 libgobject-2_0-0-debuginfo-2.62.6-150200.3.9.1 References: https://www.suse.com/security/cve/CVE-2021-28153.html https://bugzilla.suse.com/1183533

1 0