September 2022 - openSUSE Security Announce

openSUSE-SU-2022:10134-1: critical: Security update for connman
by opensuse-security＠opensuse.org 30 Sep '22

30 Sep '22

openSUSE Security Update: Security update for connman ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10134-1 Rating: critical References: #1200189 #1200190 Cross-References: CVE-2022-32292 CVE-2022-32293 CVSS scores: CVE-2022-32292 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-32293 (NVD) : 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for connman fixes the following issues: - CVE-2022-32292: Add refcounting to wispr portal detection to avoid heap overflow (boo#1200190) - CVE-2022-32292: Fix OOB write in received_data (boo#1200189) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-10134=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): connman-1.41-bp153.2.6.1 connman-client-1.41-bp153.2.6.1 connman-devel-1.41-bp153.2.6.1 connman-doc-1.41-bp153.2.6.1 connman-nmcompat-1.41-bp153.2.6.1 connman-plugin-iospm-1.41-bp153.2.6.1 connman-plugin-l2tp-1.41-bp153.2.6.1 connman-plugin-openvpn-1.41-bp153.2.6.1 connman-plugin-polkit-1.41-bp153.2.6.1 connman-plugin-pptp-1.41-bp153.2.6.1 connman-plugin-wireguard-1.41-bp153.2.6.1 connman-test-1.41-bp153.2.6.1 - openSUSE Backports SLE-15-SP3 (aarch64 ppc64le s390x x86_64): connman-plugin-vpnc-1.41-bp153.2.6.1 - openSUSE Backports SLE-15-SP3 (aarch64 i586 s390x x86_64): connman-plugin-hh2serial-gps-1.41-bp153.2.6.1 connman-plugin-tist-1.41-bp153.2.6.1 References: https://www.suse.com/security/cve/CVE-2022-32292.html https://www.suse.com/security/cve/CVE-2022-32293.html https://bugzilla.suse.com/1200189 https://bugzilla.suse.com/1200190

1 0

SUSE-SU-2022:3473-1: important: Security update for python310
by opensuse-security＠opensuse.org 30 Sep '22

30 Sep '22

SUSE Security Update: Security update for python310 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3473-1 Rating: important References: #1202624 #1203125 Cross-References: CVE-2020-10735 CVE-2021-28861 CVSS scores: CVE-2020-10735 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-10735 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-28861 (NVD) : 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N CVE-2021-28861 (SUSE): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Python3 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for python310 fixes the following issues: Updated to version 3.10.7: - CVE-2020-10735: Fixed DoS due to missing limit of amount of digits when converting text to int (bsc#1203125). - CVE-2021-28861: Fixed an open redirect in the http server when an URI path starts with // (bsc#1202624). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3473=1 - SUSE Linux Enterprise Module for Python3 15-SP4: zypper in -t patch SUSE-SLE-Module-Python3-15-SP4-2022-3473=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libpython3_10-1_0-3.10.7-150400.4.10.1 libpython3_10-1_0-debuginfo-3.10.7-150400.4.10.1 python310-3.10.7-150400.4.10.1 python310-base-3.10.7-150400.4.10.1 python310-base-debuginfo-3.10.7-150400.4.10.1 python310-core-debugsource-3.10.7-150400.4.10.1 python310-curses-3.10.7-150400.4.10.1 python310-curses-debuginfo-3.10.7-150400.4.10.1 python310-dbm-3.10.7-150400.4.10.1 python310-dbm-debuginfo-3.10.7-150400.4.10.1 python310-debuginfo-3.10.7-150400.4.10.1 python310-debugsource-3.10.7-150400.4.10.1 python310-devel-3.10.7-150400.4.10.1 python310-doc-3.10.7-150400.4.10.1 python310-doc-devhelp-3.10.7-150400.4.10.1 python310-idle-3.10.7-150400.4.10.1 python310-testsuite-3.10.7-150400.4.10.1 python310-testsuite-debuginfo-3.10.7-150400.4.10.1 python310-tk-3.10.7-150400.4.10.1 python310-tk-debuginfo-3.10.7-150400.4.10.1 python310-tools-3.10.7-150400.4.10.1 - openSUSE Leap 15.4 (x86_64): libpython3_10-1_0-32bit-3.10.7-150400.4.10.1 libpython3_10-1_0-32bit-debuginfo-3.10.7-150400.4.10.1 python310-32bit-3.10.7-150400.4.10.1 python310-32bit-debuginfo-3.10.7-150400.4.10.1 python310-base-32bit-3.10.7-150400.4.10.1 python310-base-32bit-debuginfo-3.10.7-150400.4.10.1 - SUSE Linux Enterprise Module for Python3 15-SP4 (aarch64 ppc64le s390x x86_64): libpython3_10-1_0-3.10.7-150400.4.10.1 libpython3_10-1_0-debuginfo-3.10.7-150400.4.10.1 python310-3.10.7-150400.4.10.1 python310-base-3.10.7-150400.4.10.1 python310-base-debuginfo-3.10.7-150400.4.10.1 python310-core-debugsource-3.10.7-150400.4.10.1 python310-curses-3.10.7-150400.4.10.1 python310-curses-debuginfo-3.10.7-150400.4.10.1 python310-dbm-3.10.7-150400.4.10.1 python310-dbm-debuginfo-3.10.7-150400.4.10.1 python310-debuginfo-3.10.7-150400.4.10.1 python310-debugsource-3.10.7-150400.4.10.1 python310-devel-3.10.7-150400.4.10.1 python310-idle-3.10.7-150400.4.10.1 python310-tk-3.10.7-150400.4.10.1 python310-tk-debuginfo-3.10.7-150400.4.10.1 python310-tools-3.10.7-150400.4.10.1 References: https://www.suse.com/security/cve/CVE-2020-10735.html https://www.suse.com/security/cve/CVE-2021-28861.html https://bugzilla.suse.com/1202624 https://bugzilla.suse.com/1203125

1 0

SUSE-SU-2022:3462-1: important: Security update for slurm_18_08
by opensuse-security＠opensuse.org 29 Sep '22

29 Sep '22

SUSE Security Update: Security update for slurm_18_08 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3462-1 Rating: important References: #1199278 #1199279 #1201674 Cross-References: CVE-2022-29500 CVE-2022-29501 CVE-2022-31251 CVSS scores: CVE-2022-29500 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-29500 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-29501 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-29501 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-31251 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 15-ESPOS SUSE Linux Enterprise High Performance Computing 15-LTSS openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for slurm_18_08 fixes the following issues: - CVE-2022-31251: Fixed a potential security vulnerability in the test package (bsc#1201674). - CVE-2022-29500: Fixed an architectural flaw can be exploited to allow an unprivileged user to execute arbitrary processes as root (bsc#1199278). - CVE-2022-29501: Fixed a vulnerability where an unprivileged user can send data to arbitrary unix socket as root (bsc#1199279). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3462=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3462=1 - SUSE Linux Enterprise High Performance Computing 15-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-2022-3462=1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-2022-3462=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libpmi0_18_08-18.08.9-150000.1.17.1 libpmi0_18_08-debuginfo-18.08.9-150000.1.17.1 perl-slurm_18_08-18.08.9-150000.1.17.1 perl-slurm_18_08-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-18.08.9-150000.1.17.1 slurm_18_08-auth-none-18.08.9-150000.1.17.1 slurm_18_08-auth-none-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-config-18.08.9-150000.1.17.1 slurm_18_08-config-man-18.08.9-150000.1.17.1 slurm_18_08-cray-18.08.9-150000.1.17.1 slurm_18_08-cray-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-debugsource-18.08.9-150000.1.17.1 slurm_18_08-devel-18.08.9-150000.1.17.1 slurm_18_08-doc-18.08.9-150000.1.17.1 slurm_18_08-hdf5-18.08.9-150000.1.17.1 slurm_18_08-hdf5-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-lua-18.08.9-150000.1.17.1 slurm_18_08-lua-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-munge-18.08.9-150000.1.17.1 slurm_18_08-munge-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-node-18.08.9-150000.1.17.1 slurm_18_08-node-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-openlava-18.08.9-150000.1.17.1 slurm_18_08-pam_slurm-18.08.9-150000.1.17.1 slurm_18_08-pam_slurm-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-plugins-18.08.9-150000.1.17.1 slurm_18_08-plugins-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-seff-18.08.9-150000.1.17.1 slurm_18_08-sjstat-18.08.9-150000.1.17.1 slurm_18_08-slurmdbd-18.08.9-150000.1.17.1 slurm_18_08-slurmdbd-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-sql-18.08.9-150000.1.17.1 slurm_18_08-sql-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-sview-18.08.9-150000.1.17.1 slurm_18_08-sview-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-torque-18.08.9-150000.1.17.1 slurm_18_08-torque-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-webdoc-18.08.9-150000.1.17.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libpmi0_18_08-18.08.9-150000.1.17.1 libpmi0_18_08-debuginfo-18.08.9-150000.1.17.1 perl-slurm_18_08-18.08.9-150000.1.17.1 perl-slurm_18_08-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-18.08.9-150000.1.17.1 slurm_18_08-auth-none-18.08.9-150000.1.17.1 slurm_18_08-auth-none-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-config-18.08.9-150000.1.17.1 slurm_18_08-config-man-18.08.9-150000.1.17.1 slurm_18_08-cray-18.08.9-150000.1.17.1 slurm_18_08-cray-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-debugsource-18.08.9-150000.1.17.1 slurm_18_08-devel-18.08.9-150000.1.17.1 slurm_18_08-doc-18.08.9-150000.1.17.1 slurm_18_08-hdf5-18.08.9-150000.1.17.1 slurm_18_08-hdf5-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-lua-18.08.9-150000.1.17.1 slurm_18_08-lua-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-munge-18.08.9-150000.1.17.1 slurm_18_08-munge-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-node-18.08.9-150000.1.17.1 slurm_18_08-node-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-openlava-18.08.9-150000.1.17.1 slurm_18_08-pam_slurm-18.08.9-150000.1.17.1 slurm_18_08-pam_slurm-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-plugins-18.08.9-150000.1.17.1 slurm_18_08-plugins-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-seff-18.08.9-150000.1.17.1 slurm_18_08-sjstat-18.08.9-150000.1.17.1 slurm_18_08-slurmdbd-18.08.9-150000.1.17.1 slurm_18_08-slurmdbd-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-sql-18.08.9-150000.1.17.1 slurm_18_08-sql-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-sview-18.08.9-150000.1.17.1 slurm_18_08-sview-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-torque-18.08.9-150000.1.17.1 slurm_18_08-torque-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-webdoc-18.08.9-150000.1.17.1 - SUSE Linux Enterprise High Performance Computing 15-LTSS (aarch64 x86_64): libpmi0_18_08-18.08.9-150000.1.17.1 libpmi0_18_08-debuginfo-18.08.9-150000.1.17.1 libslurm33-18.08.9-150000.1.17.1 libslurm33-debuginfo-18.08.9-150000.1.17.1 perl-slurm_18_08-18.08.9-150000.1.17.1 perl-slurm_18_08-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-18.08.9-150000.1.17.1 slurm_18_08-auth-none-18.08.9-150000.1.17.1 slurm_18_08-auth-none-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-config-18.08.9-150000.1.17.1 slurm_18_08-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-debugsource-18.08.9-150000.1.17.1 slurm_18_08-devel-18.08.9-150000.1.17.1 slurm_18_08-doc-18.08.9-150000.1.17.1 slurm_18_08-lua-18.08.9-150000.1.17.1 slurm_18_08-lua-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-munge-18.08.9-150000.1.17.1 slurm_18_08-munge-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-node-18.08.9-150000.1.17.1 slurm_18_08-node-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-pam_slurm-18.08.9-150000.1.17.1 slurm_18_08-pam_slurm-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-plugins-18.08.9-150000.1.17.1 slurm_18_08-plugins-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-slurmdbd-18.08.9-150000.1.17.1 slurm_18_08-slurmdbd-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-sql-18.08.9-150000.1.17.1 slurm_18_08-sql-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-torque-18.08.9-150000.1.17.1 slurm_18_08-torque-debuginfo-18.08.9-150000.1.17.1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS (aarch64 x86_64): libpmi0_18_08-18.08.9-150000.1.17.1 libpmi0_18_08-debuginfo-18.08.9-150000.1.17.1 libslurm33-18.08.9-150000.1.17.1 libslurm33-debuginfo-18.08.9-150000.1.17.1 perl-slurm_18_08-18.08.9-150000.1.17.1 perl-slurm_18_08-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-18.08.9-150000.1.17.1 slurm_18_08-auth-none-18.08.9-150000.1.17.1 slurm_18_08-auth-none-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-config-18.08.9-150000.1.17.1 slurm_18_08-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-debugsource-18.08.9-150000.1.17.1 slurm_18_08-devel-18.08.9-150000.1.17.1 slurm_18_08-doc-18.08.9-150000.1.17.1 slurm_18_08-lua-18.08.9-150000.1.17.1 slurm_18_08-lua-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-munge-18.08.9-150000.1.17.1 slurm_18_08-munge-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-node-18.08.9-150000.1.17.1 slurm_18_08-node-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-pam_slurm-18.08.9-150000.1.17.1 slurm_18_08-pam_slurm-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-plugins-18.08.9-150000.1.17.1 slurm_18_08-plugins-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-slurmdbd-18.08.9-150000.1.17.1 slurm_18_08-slurmdbd-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-sql-18.08.9-150000.1.17.1 slurm_18_08-sql-debuginfo-18.08.9-150000.1.17.1 slurm_18_08-torque-18.08.9-150000.1.17.1 slurm_18_08-torque-debuginfo-18.08.9-150000.1.17.1 References: https://www.suse.com/security/cve/CVE-2022-29500.html https://www.suse.com/security/cve/CVE-2022-29501.html https://www.suse.com/security/cve/CVE-2022-31251.html https://bugzilla.suse.com/1199278 https://bugzilla.suse.com/1199279 https://bugzilla.suse.com/1201674

1 0

openSUSE-SU-2022:10132-1: moderate: Security update for lighttpd
by opensuse-security＠opensuse.org 29 Sep '22

29 Sep '22

openSUSE Security Update: Security update for lighttpd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10132-1 Rating: moderate References: #1203358 Cross-References: CVE-2022-37797 CVSS scores: CVE-2022-37797 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-37797 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP3 openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for lighttpd fixes the following issues: lighttpd was updated to 1.4.66: * a number of bug fixes * Fix HTTP/2 downloads >= 4GiB * Fix SIGUSR1 graceful restart with TLS * futher bug fixes * CVE-2022-37797: null pointer dereference in mod_wstunnel, possibly a remotely triggerable crash (boo#1203358) * In an upcoming release the TLS modules will default to using stronger, modern chiphers and will default to allow client preference in selecting ciphers. ��CipherString�� => ��EECDH+AESGCM:AES256+EECDH:CHACHA20:SHA256:!SHA384��, ��Options�� => ��-ServerPreference�� old defaults: ��CipherString�� => ��HIGH��, ��Options�� => ��ServerPreference�� * A number of TLS options are how deprecated and will be removed in a future release: �� ssl.honor-cipher-order �� ssl.dh-file �� ssl.ec-curve �� ssl.disable-client-renegotiation �� ssl.use-sslv2 �� ssl.use-sslv3 The replacement option is ssl.openssl.ssl-conf-cmd, but lighttpd defaults should be prefered * A number of modules are now deprecated and will be removed in a future release: mod_evasive, mod_secdownload, mod_uploadprogress, mod_usertrack can be replaced by mod_magnet and a few lines of lua. update to 1.4.65: * WebSockets over HTTP/2 * RFC 8441 Bootstrapping WebSockets with HTTP/2 * HTTP/2 PRIORITY_UPDATE * RFC 9218 Extensible Prioritization Scheme for HTTP * prefix/suffix conditions in lighttpd.conf * mod_webdav safe partial-PUT * webdav.opts += (��partial-put-copy-modify�� => ��enable��) * mod_accesslog option: accesslog.escaping = ��json�� * mod_deflate libdeflate build option * speed up request body uploads via HTTP/2 * Behavior Changes * change default server.max-keep-alive-requests = 1000 to adjust * to increasing HTTP/2 usage and to web2/web3 application usage * (prior default was 100) * mod_status HTML now includes HTTP/2 control stream id 0 in the output * which contains aggregate counts for the HTTP/2 connection * (These lines can be identified with URL ��*��, part of ��PRI *�� preface) * alternative: https://wiki.lighttpd.net/ModMagnetExamples#lua-mod_status * MIME type application/javascript is translated to text/javascript (RFC 9239) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10132=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-10132=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 i586 ppc64le s390x x86_64): lighttpd-1.4.66-bp154.2.3.1 lighttpd-debuginfo-1.4.66-bp154.2.3.1 lighttpd-debugsource-1.4.66-bp154.2.3.1 lighttpd-mod_authn_gssapi-1.4.66-bp154.2.3.1 lighttpd-mod_authn_gssapi-debuginfo-1.4.66-bp154.2.3.1 lighttpd-mod_authn_ldap-1.4.66-bp154.2.3.1 lighttpd-mod_authn_ldap-debuginfo-1.4.66-bp154.2.3.1 lighttpd-mod_authn_pam-1.4.66-bp154.2.3.1 lighttpd-mod_authn_pam-debuginfo-1.4.66-bp154.2.3.1 lighttpd-mod_authn_sasl-1.4.66-bp154.2.3.1 lighttpd-mod_authn_sasl-debuginfo-1.4.66-bp154.2.3.1 lighttpd-mod_magnet-1.4.66-bp154.2.3.1 lighttpd-mod_magnet-debuginfo-1.4.66-bp154.2.3.1 lighttpd-mod_maxminddb-1.4.66-bp154.2.3.1 lighttpd-mod_maxminddb-debuginfo-1.4.66-bp154.2.3.1 lighttpd-mod_rrdtool-1.4.66-bp154.2.3.1 lighttpd-mod_rrdtool-debuginfo-1.4.66-bp154.2.3.1 lighttpd-mod_vhostdb_dbi-1.4.66-bp154.2.3.1 lighttpd-mod_vhostdb_dbi-debuginfo-1.4.66-bp154.2.3.1 lighttpd-mod_vhostdb_ldap-1.4.66-bp154.2.3.1 lighttpd-mod_vhostdb_ldap-debuginfo-1.4.66-bp154.2.3.1 lighttpd-mod_vhostdb_mysql-1.4.66-bp154.2.3.1 lighttpd-mod_vhostdb_mysql-debuginfo-1.4.66-bp154.2.3.1 lighttpd-mod_vhostdb_pgsql-1.4.66-bp154.2.3.1 lighttpd-mod_vhostdb_pgsql-debuginfo-1.4.66-bp154.2.3.1 lighttpd-mod_webdav-1.4.66-bp154.2.3.1 lighttpd-mod_webdav-debuginfo-1.4.66-bp154.2.3.1 - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): lighttpd-1.4.66-bp153.2.9.1 lighttpd-mod_authn_gssapi-1.4.66-bp153.2.9.1 lighttpd-mod_authn_ldap-1.4.66-bp153.2.9.1 lighttpd-mod_authn_pam-1.4.66-bp153.2.9.1 lighttpd-mod_authn_sasl-1.4.66-bp153.2.9.1 lighttpd-mod_magnet-1.4.66-bp153.2.9.1 lighttpd-mod_maxminddb-1.4.66-bp153.2.9.1 lighttpd-mod_rrdtool-1.4.66-bp153.2.9.1 lighttpd-mod_vhostdb_dbi-1.4.66-bp153.2.9.1 lighttpd-mod_vhostdb_ldap-1.4.66-bp153.2.9.1 lighttpd-mod_vhostdb_mysql-1.4.66-bp153.2.9.1 lighttpd-mod_vhostdb_pgsql-1.4.66-bp153.2.9.1 lighttpd-mod_webdav-1.4.66-bp153.2.9.1 References: https://www.suse.com/security/cve/CVE-2022-37797.html https://bugzilla.suse.com/1203358

1 0

SUSE-SU-2022:3468-1: important: Security update for slurm
by opensuse-security＠opensuse.org 29 Sep '22

29 Sep '22

SUSE Security Update: Security update for slurm ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3468-1 Rating: important References: #1199278 #1199279 #1201674 Cross-References: CVE-2022-29500 CVE-2022-29501 CVE-2022-31251 CVSS scores: CVE-2022-29500 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-29500 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-29501 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-29501 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-31251 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for slurm fixes the following issues: - CVE-2022-31251: Fixed a potential security vulnerability in the test package (bsc#1201674). - CVE-2022-29500: Fixed an architectural flaw can be exploited to allow an unprivileged user to execute arbitrary processes as root (bsc#1199278). - CVE-2022-29501: Fixed a vulnerability where an unprivileged user can send data to arbitrary unix socket as root (bsc#1199279). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3468=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3468=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-3468=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-3468=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libslurm33-18.08.9-150100.3.22.1 libslurm33-debuginfo-18.08.9-150100.3.22.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libslurm33-18.08.9-150100.3.22.1 libslurm33-debuginfo-18.08.9-150100.3.22.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (aarch64 x86_64): libpmi0-18.08.9-150100.3.22.1 libpmi0-debuginfo-18.08.9-150100.3.22.1 libslurm33-18.08.9-150100.3.22.1 libslurm33-debuginfo-18.08.9-150100.3.22.1 perl-slurm-18.08.9-150100.3.22.1 perl-slurm-debuginfo-18.08.9-150100.3.22.1 slurm-18.08.9-150100.3.22.1 slurm-auth-none-18.08.9-150100.3.22.1 slurm-auth-none-debuginfo-18.08.9-150100.3.22.1 slurm-config-18.08.9-150100.3.22.1 slurm-config-man-18.08.9-150100.3.22.1 slurm-debuginfo-18.08.9-150100.3.22.1 slurm-debugsource-18.08.9-150100.3.22.1 slurm-devel-18.08.9-150100.3.22.1 slurm-doc-18.08.9-150100.3.22.1 slurm-lua-18.08.9-150100.3.22.1 slurm-lua-debuginfo-18.08.9-150100.3.22.1 slurm-munge-18.08.9-150100.3.22.1 slurm-munge-debuginfo-18.08.9-150100.3.22.1 slurm-node-18.08.9-150100.3.22.1 slurm-node-debuginfo-18.08.9-150100.3.22.1 slurm-pam_slurm-18.08.9-150100.3.22.1 slurm-pam_slurm-debuginfo-18.08.9-150100.3.22.1 slurm-plugins-18.08.9-150100.3.22.1 slurm-plugins-debuginfo-18.08.9-150100.3.22.1 slurm-slurmdbd-18.08.9-150100.3.22.1 slurm-slurmdbd-debuginfo-18.08.9-150100.3.22.1 slurm-sql-18.08.9-150100.3.22.1 slurm-sql-debuginfo-18.08.9-150100.3.22.1 slurm-sview-18.08.9-150100.3.22.1 slurm-sview-debuginfo-18.08.9-150100.3.22.1 slurm-torque-18.08.9-150100.3.22.1 slurm-torque-debuginfo-18.08.9-150100.3.22.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (aarch64 x86_64): libpmi0-18.08.9-150100.3.22.1 libpmi0-debuginfo-18.08.9-150100.3.22.1 libslurm33-18.08.9-150100.3.22.1 libslurm33-debuginfo-18.08.9-150100.3.22.1 perl-slurm-18.08.9-150100.3.22.1 perl-slurm-debuginfo-18.08.9-150100.3.22.1 slurm-18.08.9-150100.3.22.1 slurm-auth-none-18.08.9-150100.3.22.1 slurm-auth-none-debuginfo-18.08.9-150100.3.22.1 slurm-config-18.08.9-150100.3.22.1 slurm-config-man-18.08.9-150100.3.22.1 slurm-debuginfo-18.08.9-150100.3.22.1 slurm-debugsource-18.08.9-150100.3.22.1 slurm-devel-18.08.9-150100.3.22.1 slurm-doc-18.08.9-150100.3.22.1 slurm-lua-18.08.9-150100.3.22.1 slurm-lua-debuginfo-18.08.9-150100.3.22.1 slurm-munge-18.08.9-150100.3.22.1 slurm-munge-debuginfo-18.08.9-150100.3.22.1 slurm-node-18.08.9-150100.3.22.1 slurm-node-debuginfo-18.08.9-150100.3.22.1 slurm-pam_slurm-18.08.9-150100.3.22.1 slurm-pam_slurm-debuginfo-18.08.9-150100.3.22.1 slurm-plugins-18.08.9-150100.3.22.1 slurm-plugins-debuginfo-18.08.9-150100.3.22.1 slurm-slurmdbd-18.08.9-150100.3.22.1 slurm-slurmdbd-debuginfo-18.08.9-150100.3.22.1 slurm-sql-18.08.9-150100.3.22.1 slurm-sql-debuginfo-18.08.9-150100.3.22.1 slurm-sview-18.08.9-150100.3.22.1 slurm-sview-debuginfo-18.08.9-150100.3.22.1 slurm-torque-18.08.9-150100.3.22.1 slurm-torque-debuginfo-18.08.9-150100.3.22.1 References: https://www.suse.com/security/cve/CVE-2022-29500.html https://www.suse.com/security/cve/CVE-2022-29501.html https://www.suse.com/security/cve/CVE-2022-31251.html https://bugzilla.suse.com/1199278 https://bugzilla.suse.com/1199279 https://bugzilla.suse.com/1201674

1 0

SUSE-SU-2022:3456-1: important: Security update for libostree
by opensuse-security＠opensuse.org 28 Sep '22

28 Sep '22

SUSE Security Update: Security update for libostree ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3456-1 Rating: important References: #1201770 Cross-References: CVE-2014-9862 CVSS scores: CVE-2014-9862 (NVD) : 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2014-9862 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: SUSE Enterprise Storage 7 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Desktop Applications 15-SP3 SUSE Linux Enterprise Server 15-SP2-BCL SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.1 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.1 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libostree fixes the following issues: - CVE-2014-9862: Fixed arbitrary write on heap vulnerability (bsc#1201770). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3456=1 - SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-3456=1 - SUSE Manager Retail Branch Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-3456=1 - SUSE Manager Proxy 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-3456=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-3456=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-3456=1 - SUSE Linux Enterprise Server 15-SP2-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-3456=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP3-2022-3456=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-3456=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-3456=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-3456=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2022-3456=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libostree-1-1-2020.8-150200.3.6.1 libostree-1-1-debuginfo-2020.8-150200.3.6.1 libostree-2020.8-150200.3.6.1 libostree-debuginfo-2020.8-150200.3.6.1 libostree-debugsource-2020.8-150200.3.6.1 libostree-devel-2020.8-150200.3.6.1 typelib-1_0-OSTree-1_0-2020.8-150200.3.6.1 - openSUSE Leap 15.3 (aarch64 ppc64le x86_64): libostree-grub2-2020.8-150200.3.6.1 - SUSE Manager Server 4.1 (ppc64le s390x x86_64): libostree-1-1-2020.8-150200.3.6.1 libostree-1-1-debuginfo-2020.8-150200.3.6.1 libostree-2020.8-150200.3.6.1 libostree-debuginfo-2020.8-150200.3.6.1 libostree-debugsource-2020.8-150200.3.6.1 libostree-devel-2020.8-150200.3.6.1 typelib-1_0-OSTree-1_0-2020.8-150200.3.6.1 - SUSE Manager Retail Branch Server 4.1 (x86_64): libostree-1-1-2020.8-150200.3.6.1 libostree-1-1-debuginfo-2020.8-150200.3.6.1 libostree-2020.8-150200.3.6.1 libostree-debuginfo-2020.8-150200.3.6.1 libostree-debugsource-2020.8-150200.3.6.1 libostree-devel-2020.8-150200.3.6.1 typelib-1_0-OSTree-1_0-2020.8-150200.3.6.1 - SUSE Manager Proxy 4.1 (x86_64): libostree-1-1-2020.8-150200.3.6.1 libostree-1-1-debuginfo-2020.8-150200.3.6.1 libostree-2020.8-150200.3.6.1 libostree-debuginfo-2020.8-150200.3.6.1 libostree-debugsource-2020.8-150200.3.6.1 libostree-devel-2020.8-150200.3.6.1 typelib-1_0-OSTree-1_0-2020.8-150200.3.6.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): libostree-1-1-2020.8-150200.3.6.1 libostree-1-1-debuginfo-2020.8-150200.3.6.1 libostree-2020.8-150200.3.6.1 libostree-debuginfo-2020.8-150200.3.6.1 libostree-debugsource-2020.8-150200.3.6.1 libostree-devel-2020.8-150200.3.6.1 typelib-1_0-OSTree-1_0-2020.8-150200.3.6.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): libostree-1-1-2020.8-150200.3.6.1 libostree-1-1-debuginfo-2020.8-150200.3.6.1 libostree-2020.8-150200.3.6.1 libostree-debuginfo-2020.8-150200.3.6.1 libostree-debugsource-2020.8-150200.3.6.1 libostree-devel-2020.8-150200.3.6.1 typelib-1_0-OSTree-1_0-2020.8-150200.3.6.1 - SUSE Linux Enterprise Server 15-SP2-BCL (x86_64): libostree-1-1-2020.8-150200.3.6.1 libostree-1-1-debuginfo-2020.8-150200.3.6.1 libostree-2020.8-150200.3.6.1 libostree-debuginfo-2020.8-150200.3.6.1 libostree-debugsource-2020.8-150200.3.6.1 libostree-devel-2020.8-150200.3.6.1 typelib-1_0-OSTree-1_0-2020.8-150200.3.6.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (aarch64 ppc64le s390x x86_64): libostree-2020.8-150200.3.6.1 libostree-debuginfo-2020.8-150200.3.6.1 libostree-debugsource-2020.8-150200.3.6.1 libostree-devel-2020.8-150200.3.6.1 typelib-1_0-OSTree-1_0-2020.8-150200.3.6.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): libostree-1-1-2020.8-150200.3.6.1 libostree-1-1-debuginfo-2020.8-150200.3.6.1 libostree-debuginfo-2020.8-150200.3.6.1 libostree-debugsource-2020.8-150200.3.6.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64): libostree-1-1-2020.8-150200.3.6.1 libostree-1-1-debuginfo-2020.8-150200.3.6.1 libostree-2020.8-150200.3.6.1 libostree-debuginfo-2020.8-150200.3.6.1 libostree-debugsource-2020.8-150200.3.6.1 libostree-devel-2020.8-150200.3.6.1 typelib-1_0-OSTree-1_0-2020.8-150200.3.6.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64): libostree-1-1-2020.8-150200.3.6.1 libostree-1-1-debuginfo-2020.8-150200.3.6.1 libostree-2020.8-150200.3.6.1 libostree-debuginfo-2020.8-150200.3.6.1 libostree-debugsource-2020.8-150200.3.6.1 libostree-devel-2020.8-150200.3.6.1 typelib-1_0-OSTree-1_0-2020.8-150200.3.6.1 - SUSE Enterprise Storage 7 (aarch64 x86_64): libostree-1-1-2020.8-150200.3.6.1 libostree-1-1-debuginfo-2020.8-150200.3.6.1 libostree-2020.8-150200.3.6.1 libostree-debuginfo-2020.8-150200.3.6.1 libostree-debugsource-2020.8-150200.3.6.1 libostree-devel-2020.8-150200.3.6.1 typelib-1_0-OSTree-1_0-2020.8-150200.3.6.1 References: https://www.suse.com/security/cve/CVE-2014-9862.html https://bugzilla.suse.com/1201770

1 0

SUSE-SU-2022:3457-1: important: Security update for vsftpd
by opensuse-security＠opensuse.org 28 Sep '22

28 Sep '22

SUSE Security Update: Security update for vsftpd ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3457-1 Rating: important References: #1021387 #1052900 #1181400 #1187678 #1187686 #786024 #971784 PM-3322 SLE-23896 Cross-References: CVE-2021-3618 CVSS scores: CVE-2021-3618 (NVD) : 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2021-3618 (SUSE): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affected Products: SUSE Enterprise Storage 7 SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Server Applications 15-SP3 SUSE Linux Enterprise Server 15-SP2-BCL SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.1 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.1 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves one vulnerability, contains two features and has 6 fixes is now available. Description: This update for vsftpd fixes the following issues: - CVE-2021-3618: Enforced security checks against ALPACA attack (PM-3322, jsc#SLE-23896, bsc#1187686, bsc#1187678). - Added hardening to systemd services (bsc#1181400). Bugfixes: - Fixed a seccomp failure in FIPS mode when SSL was enabled (bsc#1052900). - Allowed wait4() to be called so that the broker can wait for its child processes (bsc#1021387). - Fixed hang when using seccomp and syslog (bsc#971784). - Allowed sendto() syscall when /dev/log support is enabled (bsc#786024). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3457=1 - SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-3457=1 - SUSE Manager Retail Branch Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-3457=1 - SUSE Manager Proxy 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-3457=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-3457=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-3457=1 - SUSE Linux Enterprise Server 15-SP2-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-3457=1 - SUSE Linux Enterprise Module for Server Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP3-2022-3457=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-3457=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-3457=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2022-3457=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): vsftpd-3.0.5-150200.12.9.1 vsftpd-debuginfo-3.0.5-150200.12.9.1 vsftpd-debugsource-3.0.5-150200.12.9.1 - SUSE Manager Server 4.1 (ppc64le s390x x86_64): vsftpd-3.0.5-150200.12.9.1 vsftpd-debuginfo-3.0.5-150200.12.9.1 vsftpd-debugsource-3.0.5-150200.12.9.1 - SUSE Manager Retail Branch Server 4.1 (x86_64): vsftpd-3.0.5-150200.12.9.1 vsftpd-debuginfo-3.0.5-150200.12.9.1 vsftpd-debugsource-3.0.5-150200.12.9.1 - SUSE Manager Proxy 4.1 (x86_64): vsftpd-3.0.5-150200.12.9.1 vsftpd-debuginfo-3.0.5-150200.12.9.1 vsftpd-debugsource-3.0.5-150200.12.9.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): vsftpd-3.0.5-150200.12.9.1 vsftpd-debuginfo-3.0.5-150200.12.9.1 vsftpd-debugsource-3.0.5-150200.12.9.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): vsftpd-3.0.5-150200.12.9.1 vsftpd-debuginfo-3.0.5-150200.12.9.1 vsftpd-debugsource-3.0.5-150200.12.9.1 - SUSE Linux Enterprise Server 15-SP2-BCL (x86_64): vsftpd-3.0.5-150200.12.9.1 vsftpd-debuginfo-3.0.5-150200.12.9.1 vsftpd-debugsource-3.0.5-150200.12.9.1 - SUSE Linux Enterprise Module for Server Applications 15-SP3 (aarch64 ppc64le s390x x86_64): vsftpd-3.0.5-150200.12.9.1 vsftpd-debuginfo-3.0.5-150200.12.9.1 vsftpd-debugsource-3.0.5-150200.12.9.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64): vsftpd-3.0.5-150200.12.9.1 vsftpd-debuginfo-3.0.5-150200.12.9.1 vsftpd-debugsource-3.0.5-150200.12.9.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64): vsftpd-3.0.5-150200.12.9.1 vsftpd-debuginfo-3.0.5-150200.12.9.1 vsftpd-debugsource-3.0.5-150200.12.9.1 - SUSE Enterprise Storage 7 (aarch64 x86_64): vsftpd-3.0.5-150200.12.9.1 vsftpd-debuginfo-3.0.5-150200.12.9.1 vsftpd-debugsource-3.0.5-150200.12.9.1 References: https://www.suse.com/security/cve/CVE-2021-3618.html https://bugzilla.suse.com/1021387 https://bugzilla.suse.com/1052900 https://bugzilla.suse.com/1181400 https://bugzilla.suse.com/1187678 https://bugzilla.suse.com/1187686 https://bugzilla.suse.com/786024 https://bugzilla.suse.com/971784

1 0

SUSE-SU-2022:3451-1: moderate: Security update for rust1.62
by opensuse-security＠opensuse.org 28 Sep '22

28 Sep '22

SUSE Security Update: Security update for rust1.62 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3451-1 Rating: moderate References: #1203431 #1203433 Cross-References: CVE-2022-36113 CVE-2022-36114 CVSS scores: CVE-2022-36113 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2022-36113 (SUSE): 5.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:L CVE-2022-36114 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-36114 (SUSE): 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Development Tools 15-SP3 SUSE Linux Enterprise Module for Development Tools 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for rust1.62 fixes the following issues: - CVE-2022-36113: Fixed symlink hijack vulnerability (bsc#1203433). - CVE-2022-36114: Fixed zip bomb vulnerability (bsc#1203431). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3451=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3451=1 - SUSE Linux Enterprise Module for Development Tools 15-SP4: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2022-3451=1 - SUSE Linux Enterprise Module for Development Tools 15-SP3: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP3-2022-3451=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): cargo1.62-1.62.1-150300.7.7.1 cargo1.62-debuginfo-1.62.1-150300.7.7.1 rust1.62-1.62.1-150300.7.7.1 rust1.62-debuginfo-1.62.1-150300.7.7.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): cargo1.62-1.62.1-150300.7.7.1 cargo1.62-debuginfo-1.62.1-150300.7.7.1 rust1.62-1.62.1-150300.7.7.1 rust1.62-debuginfo-1.62.1-150300.7.7.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 ppc64le s390x x86_64): cargo1.62-1.62.1-150300.7.7.1 cargo1.62-debuginfo-1.62.1-150300.7.7.1 rust1.62-1.62.1-150300.7.7.1 rust1.62-debuginfo-1.62.1-150300.7.7.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 ppc64le s390x x86_64): cargo1.62-1.62.1-150300.7.7.1 cargo1.62-debuginfo-1.62.1-150300.7.7.1 rust1.62-1.62.1-150300.7.7.1 rust1.62-debuginfo-1.62.1-150300.7.7.1 References: https://www.suse.com/security/cve/CVE-2022-36113.html https://www.suse.com/security/cve/CVE-2022-36114.html https://bugzilla.suse.com/1203431 https://bugzilla.suse.com/1203433

1 0

SUSE-SU-2022:3430-1: important: Security update for dpdk
by opensuse-security＠opensuse.org 27 Sep '22

27 Sep '22

SUSE Security Update: Security update for dpdk ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3430-1 Rating: important References: #1202903 Cross-References: CVE-2022-2132 CVSS scores: CVE-2022-2132 (NVD) : 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H CVE-2022-2132 (SUSE): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H Affected Products: SUSE CaaS Platform 4.0 SUSE Enterprise Storage 6 SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS SUSE Linux Enterprise Server 15-SP1-BCL SUSE Linux Enterprise Server 15-SP1-LTSS SUSE Linux Enterprise Server for SAP 15-SP1 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for dpdk fixes the following issues: - CVE-2022-2132: Fixed DoS when a vhost header crosses more than two descriptors and exhausts all mbufs (bsc#1202903). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3430=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3430=1 - SUSE Linux Enterprise Server for SAP 15-SP1: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2022-3430=1 - SUSE Linux Enterprise Server 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-3430=1 - SUSE Linux Enterprise Server 15-SP1-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-BCL-2022-3430=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-3430=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-3430=1 - SUSE Enterprise Storage 6: zypper in -t patch SUSE-Storage-6-2022-3430=1 - SUSE CaaS Platform 4.0: To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. Package List: - openSUSE Leap 15.4 (aarch64 ppc64le x86_64): libdpdk-18_11-18.11.9-150100.4.19.1 libdpdk-18_11-debuginfo-18.11.9-150100.4.19.1 - openSUSE Leap 15.3 (aarch64 ppc64le x86_64): libdpdk-18_11-18.11.9-150100.4.19.1 libdpdk-18_11-debuginfo-18.11.9-150100.4.19.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (ppc64le x86_64): dpdk-18.11.9-150100.4.19.1 dpdk-debuginfo-18.11.9-150100.4.19.1 dpdk-debugsource-18.11.9-150100.4.19.1 dpdk-devel-18.11.9-150100.4.19.1 dpdk-devel-debuginfo-18.11.9-150100.4.19.1 dpdk-kmp-default-18.11.9_k4.12.14_150100.197.120-150100.4.19.1 dpdk-kmp-default-debuginfo-18.11.9_k4.12.14_150100.197.120-150100.4.19.1 dpdk-tools-18.11.9-150100.4.19.1 dpdk-tools-debuginfo-18.11.9-150100.4.19.1 libdpdk-18_11-18.11.9-150100.4.19.1 libdpdk-18_11-debuginfo-18.11.9-150100.4.19.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (aarch64 ppc64le x86_64): dpdk-18.11.9-150100.4.19.1 dpdk-debuginfo-18.11.9-150100.4.19.1 dpdk-debugsource-18.11.9-150100.4.19.1 dpdk-devel-18.11.9-150100.4.19.1 dpdk-devel-debuginfo-18.11.9-150100.4.19.1 dpdk-kmp-default-18.11.9_k4.12.14_150100.197.120-150100.4.19.1 dpdk-kmp-default-debuginfo-18.11.9_k4.12.14_150100.197.120-150100.4.19.1 dpdk-tools-18.11.9-150100.4.19.1 dpdk-tools-debuginfo-18.11.9-150100.4.19.1 libdpdk-18_11-18.11.9-150100.4.19.1 libdpdk-18_11-debuginfo-18.11.9-150100.4.19.1 - SUSE Linux Enterprise Server 15-SP1-BCL (x86_64): dpdk-18.11.9-150100.4.19.1 dpdk-debuginfo-18.11.9-150100.4.19.1 dpdk-debugsource-18.11.9-150100.4.19.1 dpdk-devel-18.11.9-150100.4.19.1 dpdk-devel-debuginfo-18.11.9-150100.4.19.1 dpdk-kmp-default-18.11.9_k4.12.14_150100.197.120-150100.4.19.1 dpdk-kmp-default-debuginfo-18.11.9_k4.12.14_150100.197.120-150100.4.19.1 dpdk-tools-18.11.9-150100.4.19.1 dpdk-tools-debuginfo-18.11.9-150100.4.19.1 libdpdk-18_11-18.11.9-150100.4.19.1 libdpdk-18_11-debuginfo-18.11.9-150100.4.19.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (aarch64 x86_64): dpdk-18.11.9-150100.4.19.1 dpdk-debuginfo-18.11.9-150100.4.19.1 dpdk-debugsource-18.11.9-150100.4.19.1 dpdk-devel-18.11.9-150100.4.19.1 dpdk-devel-debuginfo-18.11.9-150100.4.19.1 dpdk-kmp-default-18.11.9_k4.12.14_150100.197.120-150100.4.19.1 dpdk-kmp-default-debuginfo-18.11.9_k4.12.14_150100.197.120-150100.4.19.1 dpdk-tools-18.11.9-150100.4.19.1 dpdk-tools-debuginfo-18.11.9-150100.4.19.1 libdpdk-18_11-18.11.9-150100.4.19.1 libdpdk-18_11-debuginfo-18.11.9-150100.4.19.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (aarch64 x86_64): dpdk-18.11.9-150100.4.19.1 dpdk-debuginfo-18.11.9-150100.4.19.1 dpdk-debugsource-18.11.9-150100.4.19.1 dpdk-devel-18.11.9-150100.4.19.1 dpdk-devel-debuginfo-18.11.9-150100.4.19.1 dpdk-kmp-default-18.11.9_k4.12.14_150100.197.120-150100.4.19.1 dpdk-kmp-default-debuginfo-18.11.9_k4.12.14_150100.197.120-150100.4.19.1 dpdk-tools-18.11.9-150100.4.19.1 dpdk-tools-debuginfo-18.11.9-150100.4.19.1 libdpdk-18_11-18.11.9-150100.4.19.1 libdpdk-18_11-debuginfo-18.11.9-150100.4.19.1 - SUSE Enterprise Storage 6 (aarch64 x86_64): dpdk-18.11.9-150100.4.19.1 dpdk-debuginfo-18.11.9-150100.4.19.1 dpdk-debugsource-18.11.9-150100.4.19.1 dpdk-devel-18.11.9-150100.4.19.1 dpdk-devel-debuginfo-18.11.9-150100.4.19.1 dpdk-kmp-default-18.11.9_k4.12.14_150100.197.120-150100.4.19.1 dpdk-kmp-default-debuginfo-18.11.9_k4.12.14_150100.197.120-150100.4.19.1 dpdk-tools-18.11.9-150100.4.19.1 dpdk-tools-debuginfo-18.11.9-150100.4.19.1 libdpdk-18_11-18.11.9-150100.4.19.1 libdpdk-18_11-debuginfo-18.11.9-150100.4.19.1 - SUSE CaaS Platform 4.0 (x86_64): dpdk-18.11.9-150100.4.19.1 dpdk-debuginfo-18.11.9-150100.4.19.1 dpdk-debugsource-18.11.9-150100.4.19.1 dpdk-devel-18.11.9-150100.4.19.1 dpdk-devel-debuginfo-18.11.9-150100.4.19.1 dpdk-kmp-default-18.11.9_k4.12.14_150100.197.120-150100.4.19.1 dpdk-kmp-default-debuginfo-18.11.9_k4.12.14_150100.197.120-150100.4.19.1 dpdk-tools-18.11.9-150100.4.19.1 dpdk-tools-debuginfo-18.11.9-150100.4.19.1 libdpdk-18_11-18.11.9-150100.4.19.1 libdpdk-18_11-debuginfo-18.11.9-150100.4.19.1 References: https://www.suse.com/security/cve/CVE-2022-2132.html https://bugzilla.suse.com/1202903

1 0

openSUSE-SU-2022:10131-1: important: Security update for opera
by opensuse-security＠opensuse.org 27 Sep '22

27 Sep '22

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10131-1 Rating: important References: Cross-References: CVE-2022-3196 CVE-2022-3197 CVE-2022-3198 CVE-2022-3199 CVE-2022-3200 CVE-2022-3201 Affected Products: openSUSE Leap 15.4:NonFree ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for opera fixes the following issues: Update to 91.0.4516.20 - CHR-9019 Update chromium on desktop-stable-105-4516 to 105.0.5195.127 - DNA-101312 Allow changing logged in user with BrowserAPI - The update to chromium 105.0.5195.127 fixes following issues: CVE-2022-3196, CVE-2022-3197, CVE-2022-3198, CVE-2022-3199, CVE-2022-3200, CVE-2022-3201 Update to 91.0.4516.16 - CHR-9010 Update chromium on desktop-stable-105-4516 to 105.0.5195.102 - DNA-101447 Incorrect translation in Russian - DNA-101482 Crash at ProfileKey::GetProtoDatabaseProvider() - DNA-101495 Performance Stint 2022 - DNA-101551 Add version number info to browser API - DNA-101662 Suppress 'Allowing special test code paths' warning on buildbot - DNA-101753 News don't show after close browser - DNA-101760 Translations for O91 - DNA-101799 Crash at opera::SuggestionList::SortAndCull - DNA-101812 Sponsored site gets chosen as default entry when typing part of top-level domain - DNA-101876 Promote 91 to stable - Complete Opera 91.0 changelog at: https://blogs.opera.com/desktop/changelog-for-91/ - Update to 90.0.4480.107 - DNA-100664 Shopping corner widget - DNA-101495 Performance Stint 2022 - DNA-101753 News don��t show after close browser - DNA-101799 Crash at opera::SuggestionList::SortAndCull Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4:NonFree: zypper in -t patch openSUSE-2022-10131=1 Package List: - openSUSE Leap 15.4:NonFree (x86_64): opera-91.0.4516.20-lp154.2.23.1 References: https://www.suse.com/security/cve/CVE-2022-3196.html https://www.suse.com/security/cve/CVE-2022-3197.html https://www.suse.com/security/cve/CVE-2022-3198.html https://www.suse.com/security/cve/CVE-2022-3199.html https://www.suse.com/security/cve/CVE-2022-3200.html https://www.suse.com/security/cve/CVE-2022-3201.html

1 0