August 2022 - openSUSE Security Announce

SUSE-SU-2022:2877-1: important: Security update for cosign
by opensuse-security＠opensuse.org 23 Aug '22

23 Aug '22

SUSE Security Update: Security update for cosign ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:2877-1 Rating: important References: #1202157 SLE-23879 Cross-References: CVE-2022-35929 CVSS scores: CVE-2022-35929 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-35929 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability, contains one feature is now available. Description: This update for cosign fixes the following issues: - Updated to 1.10.1 (jsc#SLE-23879): - CVE-2022-35929: Fixed an issue where cosign verify-attestation --type could report false positives when there was at least one attestation with a valid signature and there were no attestations of the type being verified (bsc#1202157). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-2877=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-2877=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): cosign-1.10.1-150400.3.3.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): cosign-1.10.1-150400.3.3.1 References: https://www.suse.com/security/cve/CVE-2022-35929.html https://bugzilla.suse.com/1202157

1 0

SUSE-SU-2022:2874-1: moderate: Security update for perl-HTTP-Daemon
by opensuse-security＠opensuse.org 23 Aug '22

23 Aug '22

SUSE Security Update: Security update for perl-HTTP-Daemon ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:2874-1 Rating: moderate References: #1201157 Cross-References: CVE-2022-31081 CVSS scores: CVE-2022-31081 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2022-31081 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for perl-HTTP-Daemon fixes the following issues: - CVE-2022-31081: Fixed request smuggling in HTTP::Daemon (bsc#1201157). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-2874=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-2874=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-2874=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-2874=1 Package List: - openSUSE Leap 15.4 (noarch): perl-HTTP-Daemon-6.01-150000.3.5.1 - openSUSE Leap 15.3 (noarch): perl-HTTP-Daemon-6.01-150000.3.5.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (noarch): perl-HTTP-Daemon-6.01-150000.3.5.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (noarch): perl-HTTP-Daemon-6.01-150000.3.5.1 References: https://www.suse.com/security/cve/CVE-2022-31081.html https://bugzilla.suse.com/1201157

1 0

SUSE-SU-2022:2870-1: moderate: Security update for rubygem-rails-html-sanitizer
by opensuse-security＠opensuse.org 23 Aug '22

23 Aug '22

SUSE Security Update: Security update for rubygem-rails-html-sanitizer ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:2870-1 Rating: moderate References: #1201183 Cross-References: CVE-2022-32209 CVSS scores: CVE-2022-32209 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2022-32209 (SUSE): 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N Affected Products: SUSE Linux Enterprise High Availability 15 SUSE Linux Enterprise High Availability 15-SP1 SUSE Linux Enterprise High Availability 15-SP2 SUSE Linux Enterprise High Availability 15-SP3 SUSE Linux Enterprise High Availability 15-SP4 SUSE Linux Enterprise High Performance Computing 15 SUSE Linux Enterprise High Performance Computing 15-SP1 SUSE Linux Enterprise High Performance Computing 15-SP2 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Server 15 SUSE Linux Enterprise Server 15-SP1 SUSE Linux Enterprise Server 15-SP2 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15 SUSE Linux Enterprise Server for SAP Applications 15-SP1 SUSE Linux Enterprise Server for SAP Applications 15-SP2 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 6 SUSE Linux Enterprise Storage 7 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.0 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.0 SUSE Manager Retail Branch Server 4.1 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.0 SUSE Manager Server 4.1 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rubygem-rails-html-sanitizer fixes the following issues: - CVE-2022-32209: Fixed a potential content injection under specific configurations (bsc#1201183). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-2870=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-2870=1 - SUSE Linux Enterprise High Availability 15-SP4: zypper in -t patch SUSE-SLE-Product-HA-15-SP4-2022-2870=1 - SUSE Linux Enterprise High Availability 15-SP3: zypper in -t patch SUSE-SLE-Product-HA-15-SP3-2022-2870=1 - SUSE Linux Enterprise High Availability 15-SP2: zypper in -t patch SUSE-SLE-Product-HA-15-SP2-2022-2870=1 - SUSE Linux Enterprise High Availability 15-SP1: zypper in -t patch SUSE-SLE-Product-HA-15-SP1-2022-2870=1 - SUSE Linux Enterprise High Availability 15: zypper in -t patch SUSE-SLE-Product-HA-15-2022-2870=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-rails-html-sanitizer-1.0.4-150000.4.3.1 ruby2.5-rubygem-rails-html-sanitizer-doc-1.0.4-150000.4.3.1 ruby2.5-rubygem-rails-html-sanitizer-testsuite-1.0.4-150000.4.3.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-rails-html-sanitizer-1.0.4-150000.4.3.1 ruby2.5-rubygem-rails-html-sanitizer-doc-1.0.4-150000.4.3.1 ruby2.5-rubygem-rails-html-sanitizer-testsuite-1.0.4-150000.4.3.1 - SUSE Linux Enterprise High Availability 15-SP4 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-rails-html-sanitizer-1.0.4-150000.4.3.1 - SUSE Linux Enterprise High Availability 15-SP3 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-rails-html-sanitizer-1.0.4-150000.4.3.1 - SUSE Linux Enterprise High Availability 15-SP2 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-rails-html-sanitizer-1.0.4-150000.4.3.1 - SUSE Linux Enterprise High Availability 15-SP1 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-rails-html-sanitizer-1.0.4-150000.4.3.1 - SUSE Linux Enterprise High Availability 15 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-rails-html-sanitizer-1.0.4-150000.4.3.1 References: https://www.suse.com/security/cve/CVE-2022-32209.html https://bugzilla.suse.com/1201183

1 0

SUSE-SU-2022:2866-1: moderate: Security update for systemd-presets-common-SUSE
by opensuse-security＠opensuse.org 22 Aug '22

22 Aug '22

SUSE Security Update: Security update for systemd-presets-common-SUSE ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:2866-1 Rating: moderate References: #1199524 #1200485 Cross-References: CVE-2022-1706 CVSS scores: CVE-2022-1706 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2022-1706 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for systemd-presets-common-SUSE fixes the following issues: - CVE-2022-1706: Fixed accessible configs from unprivileged containers in VMs running on VMware products (bsc#1199524). The following non-security bugs were fixed: - Modify branding-preset-states to fix systemd-presets-common-SUSE not enabling new user systemd service preset configuration just as it handles system service presets. By passing an (optional) second parameter "user", the save/apply-changes commands now work with user services instead of system ones (bsc#1200485) - Add the wireplumber user service preset to enable it by default in SLE15-SP4 where it replaced pipewire-media-session, but keep pipewire-media-session preset so we don't have to branch the systemd-presets-common-SUSE package for SP4 (bsc#1200485) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-2866=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-2866=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-2866=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-2866=1 - SUSE Linux Enterprise Micro 5.2: zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-2866=1 - SUSE Linux Enterprise Micro 5.1: zypper in -t patch SUSE-SUSE-MicroOS-5.1-2022-2866=1 Package List: - openSUSE Leap 15.4 (noarch): systemd-presets-common-SUSE-15-150100.8.17.1 - openSUSE Leap 15.3 (noarch): systemd-presets-common-SUSE-15-150100.8.17.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (noarch): systemd-presets-common-SUSE-15-150100.8.17.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (noarch): systemd-presets-common-SUSE-15-150100.8.17.1 - SUSE Linux Enterprise Micro 5.2 (noarch): systemd-presets-common-SUSE-15-150100.8.17.1 - SUSE Linux Enterprise Micro 5.1 (noarch): systemd-presets-common-SUSE-15-150100.8.17.1 References: https://www.suse.com/security/cve/CVE-2022-1706.html https://bugzilla.suse.com/1199524 https://bugzilla.suse.com/1200485

1 0

SUSE-SU-2022:2868-1: important: Security update for u-boot
by opensuse-security＠opensuse.org 22 Aug '22

22 Aug '22

SUSE Security Update: Security update for u-boot ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:2868-1 Rating: important References: #1201213 Cross-References: CVE-2022-33103 CVSS scores: CVE-2022-33103 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-33103 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for u-boot fixes the following issues: - CVE-2022-33103: Fixed a flaw in the squashfs subsystem that could lead to arbitrary code execution (bsc#1201213). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-2868=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-2868=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): u-boot-tools-2021.01-150300.7.18.1 u-boot-tools-debuginfo-2021.01-150300.7.18.1 - openSUSE Leap 15.3 (aarch64): u-boot-avnetultra96rev1-2021.01-150300.7.18.1 u-boot-avnetultra96rev1-doc-2021.01-150300.7.18.1 u-boot-bananapim64-2021.01-150300.7.18.1 u-boot-bananapim64-doc-2021.01-150300.7.18.1 u-boot-dragonboard410c-2021.01-150300.7.18.1 u-boot-dragonboard410c-doc-2021.01-150300.7.18.1 u-boot-dragonboard820c-2021.01-150300.7.18.1 u-boot-dragonboard820c-doc-2021.01-150300.7.18.1 u-boot-evb-rk3399-2021.01-150300.7.18.1 u-boot-evb-rk3399-doc-2021.01-150300.7.18.1 u-boot-firefly-rk3399-2021.01-150300.7.18.1 u-boot-firefly-rk3399-doc-2021.01-150300.7.18.1 u-boot-geekbox-2021.01-150300.7.18.1 u-boot-geekbox-doc-2021.01-150300.7.18.1 u-boot-hikey-2021.01-150300.7.18.1 u-boot-hikey-doc-2021.01-150300.7.18.1 u-boot-khadas-vim-2021.01-150300.7.18.1 u-boot-khadas-vim-doc-2021.01-150300.7.18.1 u-boot-khadas-vim2-2021.01-150300.7.18.1 u-boot-khadas-vim2-doc-2021.01-150300.7.18.1 u-boot-libretech-ac-2021.01-150300.7.18.1 u-boot-libretech-ac-doc-2021.01-150300.7.18.1 u-boot-libretech-cc-2021.01-150300.7.18.1 u-boot-libretech-cc-doc-2021.01-150300.7.18.1 u-boot-ls1012afrdmqspi-2021.01-150300.7.18.1 u-boot-ls1012afrdmqspi-doc-2021.01-150300.7.18.1 u-boot-mvebudb-88f3720-2021.01-150300.7.18.1 u-boot-mvebudb-88f3720-doc-2021.01-150300.7.18.1 u-boot-mvebudbarmada8k-2021.01-150300.7.18.1 u-boot-mvebudbarmada8k-doc-2021.01-150300.7.18.1 u-boot-mvebuespressobin-88f3720-2021.01-150300.7.18.1 u-boot-mvebuespressobin-88f3720-doc-2021.01-150300.7.18.1 u-boot-mvebumcbin-88f8040-2021.01-150300.7.18.1 u-boot-mvebumcbin-88f8040-doc-2021.01-150300.7.18.1 u-boot-nanopia64-2021.01-150300.7.18.1 u-boot-nanopia64-doc-2021.01-150300.7.18.1 u-boot-odroid-c2-2021.01-150300.7.18.1 u-boot-odroid-c2-doc-2021.01-150300.7.18.1 u-boot-odroid-c4-2021.01-150300.7.18.1 u-boot-odroid-c4-doc-2021.01-150300.7.18.1 u-boot-odroid-n2-2021.01-150300.7.18.1 u-boot-odroid-n2-doc-2021.01-150300.7.18.1 u-boot-orangepipc2-2021.01-150300.7.18.1 u-boot-orangepipc2-doc-2021.01-150300.7.18.1 u-boot-p2371-2180-2021.01-150300.7.18.1 u-boot-p2371-2180-doc-2021.01-150300.7.18.1 u-boot-p2771-0000-500-2021.01-150300.7.18.1 u-boot-p2771-0000-500-doc-2021.01-150300.7.18.1 u-boot-p3450-0000-2021.01-150300.7.18.1 u-boot-p3450-0000-doc-2021.01-150300.7.18.1 u-boot-pine64plus-2021.01-150300.7.18.1 u-boot-pine64plus-doc-2021.01-150300.7.18.1 u-boot-pinebook-2021.01-150300.7.18.1 u-boot-pinebook-doc-2021.01-150300.7.18.1 u-boot-pinebook-pro-rk3399-2021.01-150300.7.18.1 u-boot-pinebook-pro-rk3399-doc-2021.01-150300.7.18.1 u-boot-pineh64-2021.01-150300.7.18.1 u-boot-pineh64-doc-2021.01-150300.7.18.1 u-boot-pinephone-2021.01-150300.7.18.1 u-boot-pinephone-doc-2021.01-150300.7.18.1 u-boot-poplar-2021.01-150300.7.18.1 u-boot-poplar-doc-2021.01-150300.7.18.1 u-boot-rock-pi-4-rk3399-2021.01-150300.7.18.1 u-boot-rock-pi-4-rk3399-doc-2021.01-150300.7.18.1 u-boot-rock64-rk3328-2021.01-150300.7.18.1 u-boot-rock64-rk3328-doc-2021.01-150300.7.18.1 u-boot-rock960-rk3399-2021.01-150300.7.18.1 u-boot-rock960-rk3399-doc-2021.01-150300.7.18.1 u-boot-rockpro64-rk3399-2021.01-150300.7.18.1 u-boot-rockpro64-rk3399-doc-2021.01-150300.7.18.1 u-boot-rpi3-2021.01-150300.7.18.1 u-boot-rpi3-doc-2021.01-150300.7.18.1 u-boot-rpi4-2021.01-150300.7.18.1 u-boot-rpi4-doc-2021.01-150300.7.18.1 u-boot-rpiarm64-2021.01-150300.7.18.1 u-boot-rpiarm64-doc-2021.01-150300.7.18.1 u-boot-xilinxzynqmpvirt-2021.01-150300.7.18.1 u-boot-xilinxzynqmpvirt-doc-2021.01-150300.7.18.1 u-boot-xilinxzynqmpzcu102rev10-2021.01-150300.7.18.1 u-boot-xilinxzynqmpzcu102rev10-doc-2021.01-150300.7.18.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): u-boot-tools-2021.01-150300.7.18.1 u-boot-tools-debuginfo-2021.01-150300.7.18.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64): u-boot-rpiarm64-2021.01-150300.7.18.1 u-boot-rpiarm64-doc-2021.01-150300.7.18.1 References: https://www.suse.com/security/cve/CVE-2022-33103.html https://bugzilla.suse.com/1201213

1 0

SUSE-SU-2022:2869-1: important: Security update for u-boot
by opensuse-security＠opensuse.org 22 Aug '22

22 Aug '22

SUSE Security Update: Security update for u-boot ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:2869-1 Rating: important References: #1201213 Cross-References: CVE-2022-33103 CVSS scores: CVE-2022-33103 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-33103 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for u-boot fixes the following issues: - CVE-2022-33103: Fixed a flaw in the squashfs subsystem that could lead to arbitrary code execution (bsc#1201213). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-2869=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-2869=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): u-boot-tools-2021.10-150400.4.11.1 u-boot-tools-debuginfo-2021.10-150400.4.11.1 - openSUSE Leap 15.4 (aarch64): u-boot-avnetultra96rev1-2021.10-150400.4.11.1 u-boot-avnetultra96rev1-doc-2021.10-150400.4.11.1 u-boot-bananapim64-2021.10-150400.4.11.1 u-boot-bananapim64-doc-2021.10-150400.4.11.1 u-boot-dragonboard410c-2021.10-150400.4.11.1 u-boot-dragonboard410c-doc-2021.10-150400.4.11.1 u-boot-dragonboard820c-2021.10-150400.4.11.1 u-boot-dragonboard820c-doc-2021.10-150400.4.11.1 u-boot-evb-rk3399-2021.10-150400.4.11.1 u-boot-evb-rk3399-doc-2021.10-150400.4.11.1 u-boot-firefly-rk3399-2021.10-150400.4.11.1 u-boot-firefly-rk3399-doc-2021.10-150400.4.11.1 u-boot-geekbox-2021.10-150400.4.11.1 u-boot-geekbox-doc-2021.10-150400.4.11.1 u-boot-hikey-2021.10-150400.4.11.1 u-boot-hikey-doc-2021.10-150400.4.11.1 u-boot-khadas-vim-2021.10-150400.4.11.1 u-boot-khadas-vim-doc-2021.10-150400.4.11.1 u-boot-khadas-vim2-2021.10-150400.4.11.1 u-boot-khadas-vim2-doc-2021.10-150400.4.11.1 u-boot-libretech-ac-2021.10-150400.4.11.1 u-boot-libretech-ac-doc-2021.10-150400.4.11.1 u-boot-libretech-cc-2021.10-150400.4.11.1 u-boot-libretech-cc-doc-2021.10-150400.4.11.1 u-boot-ls1012afrdmqspi-2021.10-150400.4.11.1 u-boot-ls1012afrdmqspi-doc-2021.10-150400.4.11.1 u-boot-mvebudb-88f3720-2021.10-150400.4.11.1 u-boot-mvebudb-88f3720-doc-2021.10-150400.4.11.1 u-boot-mvebudbarmada8k-2021.10-150400.4.11.1 u-boot-mvebudbarmada8k-doc-2021.10-150400.4.11.1 u-boot-mvebuespressobin-88f3720-2021.10-150400.4.11.1 u-boot-mvebuespressobin-88f3720-doc-2021.10-150400.4.11.1 u-boot-mvebumcbin-88f8040-2021.10-150400.4.11.1 u-boot-mvebumcbin-88f8040-doc-2021.10-150400.4.11.1 u-boot-nanopia64-2021.10-150400.4.11.1 u-boot-nanopia64-doc-2021.10-150400.4.11.1 u-boot-odroid-c2-2021.10-150400.4.11.1 u-boot-odroid-c2-doc-2021.10-150400.4.11.1 u-boot-odroid-c4-2021.10-150400.4.11.1 u-boot-odroid-c4-doc-2021.10-150400.4.11.1 u-boot-odroid-n2-2021.10-150400.4.11.1 u-boot-odroid-n2-doc-2021.10-150400.4.11.1 u-boot-orangepipc2-2021.10-150400.4.11.1 u-boot-orangepipc2-doc-2021.10-150400.4.11.1 u-boot-p2371-2180-2021.10-150400.4.11.1 u-boot-p2371-2180-doc-2021.10-150400.4.11.1 u-boot-p2771-0000-500-2021.10-150400.4.11.1 u-boot-p2771-0000-500-doc-2021.10-150400.4.11.1 u-boot-p3450-0000-2021.10-150400.4.11.1 u-boot-p3450-0000-doc-2021.10-150400.4.11.1 u-boot-pine64plus-2021.10-150400.4.11.1 u-boot-pine64plus-doc-2021.10-150400.4.11.1 u-boot-pinebook-2021.10-150400.4.11.1 u-boot-pinebook-doc-2021.10-150400.4.11.1 u-boot-pinebook-pro-rk3399-2021.10-150400.4.11.1 u-boot-pinebook-pro-rk3399-doc-2021.10-150400.4.11.1 u-boot-pineh64-2021.10-150400.4.11.1 u-boot-pineh64-doc-2021.10-150400.4.11.1 u-boot-pinephone-2021.10-150400.4.11.1 u-boot-pinephone-doc-2021.10-150400.4.11.1 u-boot-poplar-2021.10-150400.4.11.1 u-boot-poplar-doc-2021.10-150400.4.11.1 u-boot-rock-pi-4-rk3399-2021.10-150400.4.11.1 u-boot-rock-pi-4-rk3399-doc-2021.10-150400.4.11.1 u-boot-rock-pi-n10-rk3399pro-2021.10-150400.4.11.1 u-boot-rock-pi-n10-rk3399pro-doc-2021.10-150400.4.11.1 u-boot-rock64-rk3328-2021.10-150400.4.11.1 u-boot-rock64-rk3328-doc-2021.10-150400.4.11.1 u-boot-rock960-rk3399-2021.10-150400.4.11.1 u-boot-rock960-rk3399-doc-2021.10-150400.4.11.1 u-boot-rockpro64-rk3399-2021.10-150400.4.11.1 u-boot-rockpro64-rk3399-doc-2021.10-150400.4.11.1 u-boot-rpi3-2021.10-150400.4.11.1 u-boot-rpi3-doc-2021.10-150400.4.11.1 u-boot-rpi4-2021.10-150400.4.11.1 u-boot-rpi4-doc-2021.10-150400.4.11.1 u-boot-rpiarm64-2021.10-150400.4.11.1 u-boot-rpiarm64-doc-2021.10-150400.4.11.1 u-boot-xilinxzynqmpvirt-2021.10-150400.4.11.1 u-boot-xilinxzynqmpvirt-doc-2021.10-150400.4.11.1 u-boot-xilinxzynqmpzcu102rev10-2021.10-150400.4.11.1 u-boot-xilinxzynqmpzcu102rev10-doc-2021.10-150400.4.11.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): u-boot-tools-2021.10-150400.4.11.1 u-boot-tools-debuginfo-2021.10-150400.4.11.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64): u-boot-rpiarm64-2021.10-150400.4.11.1 u-boot-rpiarm64-doc-2021.10-150400.4.11.1 References: https://www.suse.com/security/cve/CVE-2022-33103.html https://bugzilla.suse.com/1201213

1 0

openSUSE-SU-2022:10094-1: moderate: Security update for trivy
by opensuse-security＠opensuse.org 20 Aug '22

20 Aug '22

openSUSE Security Update: Security update for trivy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10094-1 Rating: moderate References: #1199760 Cross-References: CVE-2022-1996 CVE-2022-23648 CVE-2022-28946 CVSS scores: CVE-2022-1996 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2022-1996 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-23648 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2022-23648 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2022-28946 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-28946 (SUSE): 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for trivy fixes the following issues: Update to version 0.30.4: * fix: remove the first arg when running as a plugin (#2595) * fix: k8s controlplaner scanning (#2593) * fix(vuln): GitLab report template (#2578) Update to version 0.30.3: * fix(server): use a new db worker for hot updates (#2581) * docs: add trivy with download-db-only flag to Air-Gapped Environment (#2583) * docs: split commands to download db for different versions of oras (#2582) * feat(report): export exitcode for license checks (#2564) * fix: cli can use lowercase for severities (#2565) * fix: allow subcommands with TRIVY_RUN_AS_PLUGIN (#2577) * fix: add missing types in TypeOSes and TypeLanguages in analyzer (#2569) * fix: enable some features of the wasm runtime (#2575) * fix(k8s): no error logged if trivy can't get docker image in kubernetes mode (#2521) * docs(sbom): improve sbom attestation documentation (#2566) Update to version 0.30.2: * fix(report): show the summary without results (#2548) * fix(cli): replace '-' to '_' for env vars (#2561) Update to version 0.30.1: * chore: remove a test repository (#2551) * fix(license): lazy loading of classifiers (#2547) * fix: CVE-2022-1996 in Trivy (#2499) * docs(sbom): add sbom attestation (#2527) * feat(rocky): set Rocky Linux 9 EOL (#2543) * docs: add attributes to the video tag to autoplay demo videos (#2538) * fix: yaml files with non-string chart name (#2534) * fix: skip dirs (#2530) * feat(repo): add support for branch, commit, & tag (#2494) * fix: remove auto configure environment variables via viper (#2526) Update to version 0.30.0: * fix: separating multiple licenses from one line in dpkg copyright files (#2508) * fix: change a capital letter for `plugin uninstall` subcommand (#2519) * fix: k8s hide empty report when scanning resource (#2517) * refactor: fix comments (#2516) * fix: scan vendor dir (#2515) * feat: Add support for license scanning (#2418) * chore: add owners for secret scanning (#2485) * fix: remove dependency-tree flag for image subcommand (#2492) * fix(k8s): add shorthand for k8s namespace flag (#2495) * docs: add information about using multiple servers to troubleshooting (#2498) * ci: add pushing canary build images to registries (#2428) * feat(dotnet): add support for .Net core .deps.json files (#2487) * feat(amazon): add support for 2022 version (#2429) * Type correction bitnami chart (#2415) * docs: add config file and update CLI references (#2489) * feat: add support for flag groups (#2488) * refactor: move from urfave/cli to spf13/cobra (#2458) * fix: Fix secrets output not containing file/lines (#2467) * fix: clear output with modules (#2478) * docs(cbl): distroless 1.0 supported (#2473) * fix: Fix example dockerfile rego policy (#2460) * fix(config): add helm to list of config analyzers (#2457) * feat: k8s resouces scan (#2395) * feat(sbom): add cyclonedx sbom scan (#2203) * docs: remove links to removed content (#2431) * ci: added rpm build for rhel 9 (#2437) * fix(secret): remove space from asymmetric private key (#2434) * test(integration): fix golden files for debian 9 (#2435) * fix(cli): fix version string in docs link when secret scanning is enabled (#2422) * refactor: move CycloneDX marshaling (#2420) * docs(nodejs): add docs about pnpm support (#2423) * docs: improve k8s usage documentation (#2425) * feat: Make secrets scanning output consistant (#2410) * ci: create canary build after main branch changes (#1638) * fix(misconf): skip broken scans (#2396) * feat(nodejs): add pnpm support (#2414) * fix: Fix false positive for use of COS images (#2413) * eliminate nerdctl dependency (#2412) * Add EOL date for SUSE SLES 15.3, 15.4 and OpenSUSE 15.4 (#2403) * fix(go): no cast to lowercase go package names (#2401) * BREAKING(sbom): change 'trivy sbom' to scan SBOM (#2408) * fix(server): hot update the db from custom repository (#2406) * feat: added license parser for dpkg (#2381) * fix(misconf): Update defsec (v0.68.5) to fix docker rego duplicate key (#2400) * feat: extract stripe publishable and secret keys (#2392) * feat: rbac support k8s sub-command (#2339) * feat(ruby): drop platform strings from dependency versions bundled with bundler v2 (#2390) * docs: Updating README with new CLI command (#2359) * fix(misconf): Update defsec to v0.68.4 to resolve CF detection bug (#2383) * chore: add integration label and merge security label (#2316) Update to version 0.29.2: * chore: skip Visual Studio Code project folder (#2379) * fix(helm): handle charts with templated names (#2374) * docs: redirect operator docs to trivy-operator repo (#2372) * fix(secret): use secret result when determining Failed status (#2370) * try removing libdb-dev * run integration tests in fanal * use same testing images in fanal * feat(helm): add support for trivy dbRepository (#2345) * fix: Fix failing test due to deref lint issue * test: Fix broken test * fix: Fix makefile when no previous named ref is visible in a shallow clone * chore: Fix linting issues in fanal * refactor: Fix fanal import paths and remove dotfiles Update to version 0.29.1: * fix(report): add required fields to the SARIF template (#2341) * chore: fix spelling errors (#2352) * Omit Remediation if PrimaryURL is empty (#2006) * docs(repo): Link to installation documentation in readme shows 404 (#2348) * feat(alma): support for scanning of modular packages for AlmaLinux (#2347) Update to version 0.29.0: * fix(lang): fix dependency graph in client server mode (#2336) * feat: allow expiration date for .trivyignore entries (#2332) * feat(lang): add dependency origin graph (#1970) * docs: update nix installation info (#2331) * feat: add rbac scanning support (#2328) * refactor: move WordPress module to another repository (#2329) * ci: add support for ppc64le (#2281) * feat: add support for WASM modules (#2195) * feat(secret): show recommendation for slow scanning (#2051) * fix(flag): remove --clear-cache flag client mode (#2301) * fix(java): added check for looping for variable evaluation in pom file (#2322) * BREAKING(k8s): change CLI API (#2186) * feat(alpine): add Alpine Linux 3.16 (#2319) * ci: add `go mod tidy` check (#2314) * chore: run `go mod tidy` (#2313) * fix: do not exit if one resource is not found (#2311) * feat(cli): use stderr for all log messages (resolve #381) (#2289) * test: replace deprecated subcommand client in integration tests (#2308) * feat: add support for containerd (#2305) * fix(kubernetes): Support floats in manifest yaml (#2297) * docs(kubernetes): dead links (#2307) * chore: add license label (#2304) * feat(mariner): added support for CBL-Mariner Distroless v2.0 (#2293) * feat(helm): add pod annotations (#2272) * refactor: do not import defsec in fanal types package (#2292) * feat(report): Add misconfiguration support to ASFF report template (#2285) * test: use images in GHCR (#2275) * feat(helm): support pod annotations (#2265) * feat(misconf): Helm chart scanning (#2269) * docs: Update custom rego policy docs to reflect latest defsec/fanal changes (#2267) * fix: mask redis credentials when logging (#2264) * refactor: extract commands Runner interface (#2147) * docs: update operator release (#2263) * feat(redhat): added architecture check (#2172) * docs: updating links in the docs to work again (#2256) * docs: fix readme (#2251) * fix: fixed incorrect CycloneDX output format (#2255) * refactor(deps): move dependencies to package (#2189) * fix(report): change github format version to required (#2229) * docs: update readme (#2110) * docs: added information about choosing advisory database (#2212) * chore: update trivy-kubernetes (#2224) * docs: clarifying parts of the k8s docs and updating links (#2222) * fix(k8s): timeout error logging (#2179) * chore(deps): updated fanal after fix AsymmetricPrivateKeys (#2214) * feat(k8s): add --context flag (#2171) * fix(k8s): properly instantiate TableWriter (#2175) * test: fixed integration tests after updating testcontainers to v0.13.0 (#2208) * chore: update labels (#2197) * fix(report): fixed panic if all misconf reports were removed in filter (#2188) * feat(k8s): scan secrets (#2178) * feat(report): GitHub Dependency Snapshots support (#1522) * feat(db): added insecure skip tls verify to download trivy db (#2140) * fix(redhat): always use vulns with fixed version if there is one (#2165) * chore(redhat): Add support for Red Hat UBI 9. (#2183) * fix(k8s): update trivy-kubernetes (#2163) * fix misconfig start line for code quality tpl (#2181) * fix: update docker/distribution from 2.8.0 to 2.8.1 (#2176) * docs(vuln): Include GitLab 15.0 integration (#2153) * docs: fix the operator version (#2167) * fix(k8s): summary report when when only vulns exit (#2146) * chore(deps): Update fanal to get defsec v0.58.2 (fixes false positives in ksv038) (#2156) * perf(misconf): Improve performance when scanning very large files (#2152) * docs(misconf): Update examples and docs to refer to builtin/defsec instead of appshield (#2150) * chore(deps): Update fanal (for less verbose code in misconf results) (#2151) * docs: fixed installation instruction for rhel/centos (#2143) Update to version 0.28.0 (boo#1199760, CVE-2022-28946): * fix: remove Highlighted from json output (#2131) * fix: remove trivy-kubernetes replace (#2132) * docs: Add Operator docs under Kubernetes section (#2111) * fix(k8s): security-checks panic (#2127) * ci: added k8s scope (#2130) * docs: Update misconfig output in examples (#2128) * fix(misconf): Fix coloured output in Goland terminal (#2126) * docs(secret): Fix default value of --security-checks in docs (#2107) * refactor(report): move colorize function from trivy-db (#2122) * feat: k8s resource scanning (#2118) * chore: add CODEOWNERS (#2121) * feat(image): add `--server` option for remote scans (#1871) * refactor: k8s (#2116) * refactor: export useful APIs (#2108) * docs: fix k8s doc (#2114) * feat(kubernetes): Add report flag for summary (#2112) * fix: Remove problematic advanced rego policies (#2113) * feat(misconf): Add special output format for misconfigurations (#2100) * feat: add k8s subcommand (#2065) * chore: fix make lint version (#2102) * fix(java): handle relative pom modules (#2101) * fix(misconf): Add missing links for non-rego misconfig results (#2094) * feat(misconf): Added fs.FS based scanning via latest defsec (#2084) * chore(os): updated fanal version and alpine distroless test (#2086) * feat(report): add support for SPDX (#2059) * chore: app version 0.27.0 (#2046) * fix(misconf): added to skip conf files if their scanning is not enabled (#2066) * docs(secret) fix rule path in docs (#2061) * docs: change from go.sum to go.mod (#2056) Update to version 0.27.1: * refactor(fs): scanner options (#2050) * feat(secret): truncate long line (#2052) * docs: fix a broken bullets (#2042) * feat(ubuntu): add 22.04 approx eol date (#2044) * docs: update installation.md (#2027) * docs: add Containerfile (#2032) Update to version 0.27.0: * fix(go): fixed panic to scan gomod without version (#2038) * docs(mariner): confirm it works with Mariner 2.0 VM (#2036) * feat(secret): support enable rules (#2035) * chore: app version 26.0 (#2030) * docs(secret): add a demo movie (#2031) * feat: support cache TTL in Redis (#2021) * fix(go): skip system installed binaries (#2028) * fix(go): check if go.sum is nil (#2029) * feat: add secret scanning (#1901) * chore: gh publish only with push the tag release (#2025) * fix(fs): ignore permission errors (#2022) * test(mod): using correct module inside test go.mod (#2020) * feat(server): re-add proxy support for client/server communications (#1995) * fix(report): truncate a description before escaping in ASFF template (#2004) * fix(cloudformation): correct margin removal for empty lines (#2002) * fix(template): correct check of old sarif template files (#2003) Update to version 0.26.0: * feat(alpine): warn mixing versions (#2000) * Update ASFF template (#1914) * chore(deps): replace `containerd/containerd` version to fix CVE-2022-23648 (#1994) * test(go): add integration tests for gomod (#1989) * fix(python): fixed panic when scan .egg archive (#1992) * fix(go): set correct go modules type (#1990) * feat(alpine): support apk repositories (#1987) * docs: add CBL-Mariner (#1982) * docs(go): fix version (#1986) * feat(go): support go.mod in Go 1.17+ (#1985) * ci: fix URLs in the PR template (#1972) * ci: add semantic pull requests check (#1968) * docs(issue): added docs for wrong detection issues (#1961) Update to version 0.25.4: * docs: move CONTRIBUTING.md to docs (#1971) * refactor(table): use file name instead package path (#1966) * fix(sbom): add --db-repository (#1964) * feat(table): add PkgPath in table result (#1960) * fix(pom): merge multiple pom imports in a good manner (#1959) Update to version 0.25.3: * fix(downloadDB): add dbRepositoryFlag to repository and rootfs commands (#1956) * fix(misconf): update BurntSushi/toml for fix runtime error (#1948) * fix(misconf): Update fanal/defsec to resolve missing metadata issues (#1947) * feat(jar): allow setting Maven Central URL using environment variable (#1939) * chore(chart): update Trivy version in HelmChart to 0.25.0 (#1931) * chore(chart): remove version comments (#1933) Update to version 0.25.2: * fix(downloadDB): add flag to server command (#1942) Update to version 0.25.1: * fix(misconf): update defsec to resolve panics (#1935) * docs: restructure the documentation (#1887) * Add trivy horizontal logo (#1932) * feat(db): Add dbRepository flag to get advisory database from OCI registry (#1873) - Buildrequire go1.18 as upstream says in go.mod Update to version 0.25.0: * docs(filter vulnerabilities): fix link (#1880) * feat(template) Add misconfigurations to gitlab codequality report (#1756) * fix(rpc): add PkgPath field to client / server mode (#1643) * fix(vulnerabilities): fixed trivy-db vulns (#1883) * feat(cache): remove temporary cache after filesystem scanning (#1868) * feat(sbom): add a dedicated sbom command (#1799) * feat(cyclonedx): add vulnerabilities (#1832) * fix(option): hide false warning about remote options (#1865) * feat(filesystem): scan in client/server mode (#1829) * refactor(template): remove unused test (#1861) * fix(cli): json format for trivy version (#1854) * docs: change URL for tfsec-checks (#1857) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-10094=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 s390x x86_64): trivy-0.30.4-bp153.8.1 References: https://www.suse.com/security/cve/CVE-2022-1996.html https://www.suse.com/security/cve/CVE-2022-23648.html https://www.suse.com/security/cve/CVE-2022-28946.html https://bugzilla.suse.com/1199760

1 0

SUSE-SU-2022:2855-1: important: Security update for nodejs10
by opensuse-security＠opensuse.org 19 Aug '22

19 Aug '22

SUSE Security Update: Security update for nodejs10 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:2855-1 Rating: important References: #1188917 #1189368 #1191601 #1191602 #1201325 #1201326 #1201327 #1201328 Cross-References: CVE-2021-22930 CVE-2021-22940 CVE-2021-22959 CVE-2021-22960 CVE-2022-32212 CVE-2022-32213 CVE-2022-32214 CVE-2022-32215 CVSS scores: CVE-2021-22930 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-22930 (SUSE): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2021-22940 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2021-22940 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-22959 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2021-22959 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-22960 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2021-22960 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2022-32212 (NVD) : 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-32212 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-32213 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2022-32213 (SUSE): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2022-32214 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2022-32214 (SUSE): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N CVE-2022-32215 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2022-32215 (SUSE): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Affected Products: SUSE CaaS Platform 4.0 SUSE Enterprise Storage 6 SUSE Enterprise Storage 7 SUSE Linux Enterprise High Performance Computing 15-ESPOS SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server 15-SP1-BCL SUSE Linux Enterprise Server 15-SP1-LTSS SUSE Linux Enterprise Server 15-SP2-BCL SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server for SAP 15 SUSE Linux Enterprise Server for SAP 15-SP1 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Manager Proxy 4.1 SUSE Manager Retail Branch Server 4.1 SUSE Manager Server 4.1 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for nodejs10 fixes the following issues: - CVE-2021-22930, CVE-2021-22940: Fixed two memory corruption issues during HTTP/2 stream cancellation (bsc#1188917, bsc#1189368). - CVE-2022-32213, CVE-2022-32214, CVE-2022-32215, CVE-2021-22960, CVE-2021-22959: Fixed multiple HTTP request smuggling issues in the underlying HTTP parser (bsc#1201325, bsc#1201326, bsc#1201327, bsc#1191602, bsc#1191601). - CVE-2022-32212: Fixed a DNS rebinding issue caused by improper IPv4 validation (bsc#1201328). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-2855=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-2855=1 - SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-2855=1 - SUSE Manager Retail Branch Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-2855=1 - SUSE Manager Proxy 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-2855=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-2855=1 - SUSE Linux Enterprise Server for SAP 15-SP1: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2022-2855=1 - SUSE Linux Enterprise Server for SAP 15: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2022-2855=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-2855=1 - SUSE Linux Enterprise Server 15-SP2-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-2855=1 - SUSE Linux Enterprise Server 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-2855=1 - SUSE Linux Enterprise Server 15-SP1-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-BCL-2022-2855=1 - SUSE Linux Enterprise Server 15-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-2022-2855=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-2855=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-2855=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-2855=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-2855=1 - SUSE Linux Enterprise High Performance Computing 15-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-2022-2855=1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-2022-2855=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2022-2855=1 - SUSE Enterprise Storage 6: zypper in -t patch SUSE-Storage-6-2022-2855=1 - SUSE CaaS Platform 4.0: To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): nodejs10-10.24.1-150000.1.47.1 nodejs10-debuginfo-10.24.1-150000.1.47.1 nodejs10-debugsource-10.24.1-150000.1.47.1 nodejs10-devel-10.24.1-150000.1.47.1 npm10-10.24.1-150000.1.47.1 - openSUSE Leap 15.4 (noarch): nodejs10-docs-10.24.1-150000.1.47.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): nodejs10-10.24.1-150000.1.47.1 nodejs10-debuginfo-10.24.1-150000.1.47.1 nodejs10-debugsource-10.24.1-150000.1.47.1 nodejs10-devel-10.24.1-150000.1.47.1 npm10-10.24.1-150000.1.47.1 - openSUSE Leap 15.3 (noarch): nodejs10-docs-10.24.1-150000.1.47.1 - SUSE Manager Server 4.1 (ppc64le s390x x86_64): nodejs10-10.24.1-150000.1.47.1 nodejs10-debuginfo-10.24.1-150000.1.47.1 nodejs10-debugsource-10.24.1-150000.1.47.1 nodejs10-devel-10.24.1-150000.1.47.1 npm10-10.24.1-150000.1.47.1 - SUSE Manager Server 4.1 (noarch): nodejs10-docs-10.24.1-150000.1.47.1 - SUSE Manager Retail Branch Server 4.1 (noarch): nodejs10-docs-10.24.1-150000.1.47.1 - SUSE Manager Retail Branch Server 4.1 (x86_64): nodejs10-10.24.1-150000.1.47.1 nodejs10-debuginfo-10.24.1-150000.1.47.1 nodejs10-debugsource-10.24.1-150000.1.47.1 nodejs10-devel-10.24.1-150000.1.47.1 npm10-10.24.1-150000.1.47.1 - SUSE Manager Proxy 4.1 (x86_64): nodejs10-10.24.1-150000.1.47.1 nodejs10-debuginfo-10.24.1-150000.1.47.1 nodejs10-debugsource-10.24.1-150000.1.47.1 nodejs10-devel-10.24.1-150000.1.47.1 npm10-10.24.1-150000.1.47.1 - SUSE Manager Proxy 4.1 (noarch): nodejs10-docs-10.24.1-150000.1.47.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): nodejs10-10.24.1-150000.1.47.1 nodejs10-debuginfo-10.24.1-150000.1.47.1 nodejs10-debugsource-10.24.1-150000.1.47.1 nodejs10-devel-10.24.1-150000.1.47.1 npm10-10.24.1-150000.1.47.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (noarch): nodejs10-docs-10.24.1-150000.1.47.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (ppc64le x86_64): nodejs10-10.24.1-150000.1.47.1 nodejs10-debuginfo-10.24.1-150000.1.47.1 nodejs10-debugsource-10.24.1-150000.1.47.1 nodejs10-devel-10.24.1-150000.1.47.1 npm10-10.24.1-150000.1.47.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (noarch): nodejs10-docs-10.24.1-150000.1.47.1 - SUSE Linux Enterprise Server for SAP 15 (ppc64le x86_64): nodejs10-10.24.1-150000.1.47.1 nodejs10-debuginfo-10.24.1-150000.1.47.1 nodejs10-debugsource-10.24.1-150000.1.47.1 nodejs10-devel-10.24.1-150000.1.47.1 npm10-10.24.1-150000.1.47.1 - SUSE Linux Enterprise Server for SAP 15 (noarch): nodejs10-docs-10.24.1-150000.1.47.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): nodejs10-10.24.1-150000.1.47.1 nodejs10-debuginfo-10.24.1-150000.1.47.1 nodejs10-debugsource-10.24.1-150000.1.47.1 nodejs10-devel-10.24.1-150000.1.47.1 npm10-10.24.1-150000.1.47.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (noarch): nodejs10-docs-10.24.1-150000.1.47.1 - SUSE Linux Enterprise Server 15-SP2-BCL (x86_64): nodejs10-10.24.1-150000.1.47.1 nodejs10-debuginfo-10.24.1-150000.1.47.1 nodejs10-debugsource-10.24.1-150000.1.47.1 nodejs10-devel-10.24.1-150000.1.47.1 npm10-10.24.1-150000.1.47.1 - SUSE Linux Enterprise Server 15-SP2-BCL (noarch): nodejs10-docs-10.24.1-150000.1.47.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (aarch64 ppc64le s390x x86_64): nodejs10-10.24.1-150000.1.47.1 nodejs10-debuginfo-10.24.1-150000.1.47.1 nodejs10-debugsource-10.24.1-150000.1.47.1 nodejs10-devel-10.24.1-150000.1.47.1 npm10-10.24.1-150000.1.47.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (noarch): nodejs10-docs-10.24.1-150000.1.47.1 - SUSE Linux Enterprise Server 15-SP1-BCL (noarch): nodejs10-docs-10.24.1-150000.1.47.1 - SUSE Linux Enterprise Server 15-SP1-BCL (x86_64): nodejs10-10.24.1-150000.1.47.1 nodejs10-debuginfo-10.24.1-150000.1.47.1 nodejs10-debugsource-10.24.1-150000.1.47.1 nodejs10-devel-10.24.1-150000.1.47.1 npm10-10.24.1-150000.1.47.1 - SUSE Linux Enterprise Server 15-LTSS (aarch64 s390x): nodejs10-10.24.1-150000.1.47.1 nodejs10-debuginfo-10.24.1-150000.1.47.1 nodejs10-debugsource-10.24.1-150000.1.47.1 nodejs10-devel-10.24.1-150000.1.47.1 npm10-10.24.1-150000.1.47.1 - SUSE Linux Enterprise Server 15-LTSS (noarch): nodejs10-docs-10.24.1-150000.1.47.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64): nodejs10-10.24.1-150000.1.47.1 nodejs10-debuginfo-10.24.1-150000.1.47.1 nodejs10-debugsource-10.24.1-150000.1.47.1 nodejs10-devel-10.24.1-150000.1.47.1 npm10-10.24.1-150000.1.47.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (noarch): nodejs10-docs-10.24.1-150000.1.47.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64): nodejs10-10.24.1-150000.1.47.1 nodejs10-debuginfo-10.24.1-150000.1.47.1 nodejs10-debugsource-10.24.1-150000.1.47.1 nodejs10-devel-10.24.1-150000.1.47.1 npm10-10.24.1-150000.1.47.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (noarch): nodejs10-docs-10.24.1-150000.1.47.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (aarch64 x86_64): nodejs10-10.24.1-150000.1.47.1 nodejs10-debuginfo-10.24.1-150000.1.47.1 nodejs10-debugsource-10.24.1-150000.1.47.1 nodejs10-devel-10.24.1-150000.1.47.1 npm10-10.24.1-150000.1.47.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (noarch): nodejs10-docs-10.24.1-150000.1.47.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (aarch64 x86_64): nodejs10-10.24.1-150000.1.47.1 nodejs10-debuginfo-10.24.1-150000.1.47.1 nodejs10-debugsource-10.24.1-150000.1.47.1 nodejs10-devel-10.24.1-150000.1.47.1 npm10-10.24.1-150000.1.47.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (noarch): nodejs10-docs-10.24.1-150000.1.47.1 - SUSE Linux Enterprise High Performance Computing 15-LTSS (aarch64 x86_64): nodejs10-10.24.1-150000.1.47.1 nodejs10-debuginfo-10.24.1-150000.1.47.1 nodejs10-debugsource-10.24.1-150000.1.47.1 nodejs10-devel-10.24.1-150000.1.47.1 npm10-10.24.1-150000.1.47.1 - SUSE Linux Enterprise High Performance Computing 15-LTSS (noarch): nodejs10-docs-10.24.1-150000.1.47.1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS (aarch64 x86_64): nodejs10-10.24.1-150000.1.47.1 nodejs10-debuginfo-10.24.1-150000.1.47.1 nodejs10-debugsource-10.24.1-150000.1.47.1 nodejs10-devel-10.24.1-150000.1.47.1 npm10-10.24.1-150000.1.47.1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS (noarch): nodejs10-docs-10.24.1-150000.1.47.1 - SUSE Enterprise Storage 7 (aarch64 x86_64): nodejs10-10.24.1-150000.1.47.1 nodejs10-debuginfo-10.24.1-150000.1.47.1 nodejs10-debugsource-10.24.1-150000.1.47.1 nodejs10-devel-10.24.1-150000.1.47.1 npm10-10.24.1-150000.1.47.1 - SUSE Enterprise Storage 7 (noarch): nodejs10-docs-10.24.1-150000.1.47.1 - SUSE Enterprise Storage 6 (aarch64 x86_64): nodejs10-10.24.1-150000.1.47.1 nodejs10-debuginfo-10.24.1-150000.1.47.1 nodejs10-debugsource-10.24.1-150000.1.47.1 nodejs10-devel-10.24.1-150000.1.47.1 npm10-10.24.1-150000.1.47.1 - SUSE Enterprise Storage 6 (noarch): nodejs10-docs-10.24.1-150000.1.47.1 - SUSE CaaS Platform 4.0 (x86_64): nodejs10-10.24.1-150000.1.47.1 nodejs10-debuginfo-10.24.1-150000.1.47.1 nodejs10-debugsource-10.24.1-150000.1.47.1 nodejs10-devel-10.24.1-150000.1.47.1 npm10-10.24.1-150000.1.47.1 - SUSE CaaS Platform 4.0 (noarch): nodejs10-docs-10.24.1-150000.1.47.1 References: https://www.suse.com/security/cve/CVE-2021-22930.html https://www.suse.com/security/cve/CVE-2021-22940.html https://www.suse.com/security/cve/CVE-2021-22959.html https://www.suse.com/security/cve/CVE-2021-22960.html https://www.suse.com/security/cve/CVE-2022-32212.html https://www.suse.com/security/cve/CVE-2022-32213.html https://www.suse.com/security/cve/CVE-2022-32214.html https://www.suse.com/security/cve/CVE-2022-32215.html https://bugzilla.suse.com/1188917 https://bugzilla.suse.com/1189368 https://bugzilla.suse.com/1191601 https://bugzilla.suse.com/1191602 https://bugzilla.suse.com/1201325 https://bugzilla.suse.com/1201326 https://bugzilla.suse.com/1201327 https://bugzilla.suse.com/1201328

1 0

SUSE-SU-2022:2856-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 19 Aug '22

19 Aug '22

SUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:2856-1 Rating: important References: #1195163 #1201684 #1201692 #1201694 Cross-References: CVE-2022-21540 CVE-2022-21541 CVE-2022-34169 CVSS scores: CVE-2022-21540 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2022-21540 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2022-21541 (NVD) : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2022-21541 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2022-34169 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-34169 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Affected Products: SUSE CaaS Platform 4.0 SUSE Enterprise Storage 6 SUSE Enterprise Storage 7 SUSE Linux Enterprise High Performance Computing SUSE Linux Enterprise Module for Legacy Software 15-SP3 SUSE Linux Enterprise Module for Legacy Software 15-SP4 SUSE Linux Enterprise Server SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server 15-SP1-BCL SUSE Linux Enterprise Server 15-SP1-LTSS SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server for SAP 15 SUSE Linux Enterprise Server for SAP 15-SP1 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Linux Enterprise Server for SAP Applications SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.1 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.1 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for java-1_8_0-openjdk fixes the following issues: - Updated to version jdk8u345 (icedtea-3.24.0) - CVE-2022-21540: Fixed a potential Java sandbox bypass (bsc#1201694). - CVE-2022-21541: Fixed a potential Java sandbox bypass (bsc#1201692). - CVE-2022-34169: Fixed an issue where arbitrary bytecode could be executed via a malicious stylesheet (bsc#1201684). - Non-security fixes: - Allowed for customization of PKCS12 keystores (bsc#1195163). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-2856=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-2856=1 - SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-2856=1 - SUSE Manager Retail Branch Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-2856=1 - SUSE Manager Proxy 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-2856=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-2856=1 - SUSE Linux Enterprise Server for SAP 15-SP1: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2022-2856=1 - SUSE Linux Enterprise Server for SAP 15: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2022-2856=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-2856=1 - SUSE Linux Enterprise Server 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-2856=1 - SUSE Linux Enterprise Server 15-SP1-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-BCL-2022-2856=1 - SUSE Linux Enterprise Server 15-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-2022-2856=1 - SUSE Linux Enterprise Module for Legacy Software 15-SP4: zypper in -t patch SUSE-SLE-Module-Legacy-15-SP4-2022-2856=1 - SUSE Linux Enterprise Module for Legacy Software 15-SP3: zypper in -t patch SUSE-SLE-Module-Legacy-15-SP3-2022-2856=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2022-2856=1 - SUSE Enterprise Storage 6: zypper in -t patch SUSE-Storage-6-2022-2856=1 - SUSE CaaS Platform 4.0: To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): java-1_8_0-openjdk-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-accessibility-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-debugsource-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-demo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-devel-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-headless-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-src-1.8.0.345-150000.3.70.1 - openSUSE Leap 15.4 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.345-150000.3.70.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): java-1_8_0-openjdk-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-accessibility-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-debugsource-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-demo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-devel-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-headless-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-src-1.8.0.345-150000.3.70.1 - openSUSE Leap 15.3 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.345-150000.3.70.1 - SUSE Manager Server 4.1 (ppc64le s390x x86_64): java-1_8_0-openjdk-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-debugsource-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-demo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-devel-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-headless-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.345-150000.3.70.1 - SUSE Manager Retail Branch Server 4.1 (x86_64): java-1_8_0-openjdk-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-debugsource-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-demo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-devel-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-headless-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.345-150000.3.70.1 - SUSE Manager Proxy 4.1 (x86_64): java-1_8_0-openjdk-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-debugsource-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-demo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-devel-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-headless-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.345-150000.3.70.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): java-1_8_0-openjdk-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-debugsource-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-demo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-devel-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-headless-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.345-150000.3.70.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (ppc64le x86_64): java-1_8_0-openjdk-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-debugsource-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-demo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-devel-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-headless-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.345-150000.3.70.1 - SUSE Linux Enterprise Server for SAP 15 (ppc64le x86_64): java-1_8_0-openjdk-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-debugsource-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-demo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-devel-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-headless-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.345-150000.3.70.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): java-1_8_0-openjdk-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-debugsource-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-demo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-devel-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-headless-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.345-150000.3.70.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (aarch64 ppc64le s390x x86_64): java-1_8_0-openjdk-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-debugsource-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-demo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-devel-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-headless-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.345-150000.3.70.1 - SUSE Linux Enterprise Server 15-SP1-BCL (x86_64): java-1_8_0-openjdk-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-debugsource-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-demo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-devel-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-headless-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.345-150000.3.70.1 - SUSE Linux Enterprise Server 15-LTSS (aarch64 s390x): java-1_8_0-openjdk-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-debugsource-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-demo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-devel-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-headless-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.345-150000.3.70.1 - SUSE Linux Enterprise Module for Legacy Software 15-SP4 (aarch64 ppc64le s390x x86_64): java-1_8_0-openjdk-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-debugsource-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-demo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-devel-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-headless-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.345-150000.3.70.1 - SUSE Linux Enterprise Module for Legacy Software 15-SP3 (aarch64 ppc64le s390x x86_64): java-1_8_0-openjdk-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-debugsource-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-demo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-devel-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-headless-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.345-150000.3.70.1 - SUSE Enterprise Storage 7 (aarch64 x86_64): java-1_8_0-openjdk-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-debugsource-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-demo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-devel-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-headless-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.345-150000.3.70.1 - SUSE Enterprise Storage 6 (aarch64 x86_64): java-1_8_0-openjdk-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-debugsource-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-demo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-devel-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-headless-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.345-150000.3.70.1 - SUSE CaaS Platform 4.0 (x86_64): java-1_8_0-openjdk-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-debugsource-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-demo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-devel-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-headless-1.8.0.345-150000.3.70.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.345-150000.3.70.1 References: https://www.suse.com/security/cve/CVE-2022-21540.html https://www.suse.com/security/cve/CVE-2022-21541.html https://www.suse.com/security/cve/CVE-2022-34169.html https://bugzilla.suse.com/1195163 https://bugzilla.suse.com/1201684 https://bugzilla.suse.com/1201692 https://bugzilla.suse.com/1201694

1 0

SUSE-SU-2022:2839-1: important: Security update for podman
by opensuse-security＠opensuse.org 18 Aug '22

18 Aug '22

SUSE Security Update: Security update for podman ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:2839-1 Rating: important References: #1182428 #1196338 #1197284 Cross-References: CVE-2022-1227 CVE-2022-21698 CVE-2022-27191 CVSS scores: CVE-2022-1227 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-1227 (SUSE): 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVE-2022-21698 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-21698 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-27191 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-27191 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Module for Containers 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for podman fixes the following issues: Updated to version 3.4.7: - CVE-2022-1227: Fixed an issue that could allow an attacker to publish a malicious image to a public registry and run arbitrary code in the victim's context via the 'podman top' command (bsc#1182428). - CVE-2022-27191: Fixed a potential crash via SSH under specific configurations (bsc#1197284). - CVE-2022-21698: Fixed a potential denial of service that affected servers that used Prometheus instrumentation (bsc#1196338). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-2839=1 - SUSE Linux Enterprise Module for Containers 15-SP3: zypper in -t patch SUSE-SLE-Module-Containers-15-SP3-2022-2839=1 - SUSE Linux Enterprise Micro 5.2: zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-2839=1 - SUSE Linux Enterprise Micro 5.1: zypper in -t patch SUSE-SUSE-MicroOS-5.1-2022-2839=1 - SUSE Enterprise Storage 7.1: zypper in -t patch SUSE-Storage-7.1-2022-2839=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): podman-3.4.7-150300.9.9.2 - openSUSE Leap 15.3 (noarch): podman-cni-config-3.4.7-150300.9.9.2 - SUSE Linux Enterprise Module for Containers 15-SP3 (aarch64 ppc64le s390x x86_64): podman-3.4.7-150300.9.9.2 - SUSE Linux Enterprise Module for Containers 15-SP3 (noarch): podman-cni-config-3.4.7-150300.9.9.2 - SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64): podman-3.4.7-150300.9.9.2 podman-debuginfo-3.4.7-150300.9.9.2 - SUSE Linux Enterprise Micro 5.2 (noarch): podman-cni-config-3.4.7-150300.9.9.2 - SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64): podman-3.4.7-150300.9.9.2 - SUSE Linux Enterprise Micro 5.1 (noarch): podman-cni-config-3.4.7-150300.9.9.2 - SUSE Enterprise Storage 7.1 (aarch64 x86_64): podman-3.4.7-150300.9.9.2 podman-debuginfo-3.4.7-150300.9.9.2 References: https://www.suse.com/security/cve/CVE-2022-1227.html https://www.suse.com/security/cve/CVE-2022-21698.html https://www.suse.com/security/cve/CVE-2022-27191.html https://bugzilla.suse.com/1182428 https://bugzilla.suse.com/1196338 https://bugzilla.suse.com/1197284

1 0