September 2022 - openSUSE Security Announce

SUSE-SU-2022:3353-1: moderate: Security update for permissions
by opensuse-security＠opensuse.org 23 Sep '22

23 Sep '22

SUSE Security Update: Security update for permissions ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3353-1 Rating: moderate References: #1203018 Cross-References: CVE-2022-31252 CVSS scores: CVE-2022-31252 (SUSE): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for permissions fixes the following issues: - CVE-2022-31252: Fixed chkstat group controlled paths (bsc#1203018). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3353=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-3353=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): permissions-20201225-150400.5.11.1 permissions-debuginfo-20201225-150400.5.11.1 permissions-debugsource-20201225-150400.5.11.1 - openSUSE Leap 15.4 (noarch): permissions-zypp-plugin-20201225-150400.5.11.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): permissions-20201225-150400.5.11.1 permissions-debuginfo-20201225-150400.5.11.1 permissions-debugsource-20201225-150400.5.11.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (noarch): permissions-zypp-plugin-20201225-150400.5.11.1 References: https://www.suse.com/security/cve/CVE-2022-31252.html https://bugzilla.suse.com/1203018

1 0

SUSE-SU-2022:3351-1: important: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 23 Sep '22

23 Sep '22

SUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3351-1 Rating: important References: #1202169 #1202807 Cross-References: CVE-2022-32893 CVSS scores: CVE-2022-32893 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-32893 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Desktop Applications 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for webkit2gtk3 fixes the following issues: - CVE-2022-32893: Fixed several crashes and rendering issues (bsc#1202807). - Fixed WebKitGTK not allow to be used from non-main threads (bsc#1202169). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3351=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3351=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP3-2022-3351=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-3351=1 Package List: - openSUSE Leap 15.4 (noarch): libwebkit2gtk3-lang-2.36.7-150200.44.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libjavascriptcoregtk-4_0-18-2.36.7-150200.44.1 libjavascriptcoregtk-4_0-18-debuginfo-2.36.7-150200.44.1 libwebkit2gtk-4_0-37-2.36.7-150200.44.1 libwebkit2gtk-4_0-37-debuginfo-2.36.7-150200.44.1 typelib-1_0-JavaScriptCore-4_0-2.36.7-150200.44.1 typelib-1_0-WebKit2-4_0-2.36.7-150200.44.1 typelib-1_0-WebKit2WebExtension-4_0-2.36.7-150200.44.1 webkit-jsc-4-2.36.7-150200.44.1 webkit-jsc-4-debuginfo-2.36.7-150200.44.1 webkit2gtk-4_0-injected-bundles-2.36.7-150200.44.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.36.7-150200.44.1 webkit2gtk3-debugsource-2.36.7-150200.44.1 webkit2gtk3-devel-2.36.7-150200.44.1 webkit2gtk3-minibrowser-2.36.7-150200.44.1 webkit2gtk3-minibrowser-debuginfo-2.36.7-150200.44.1 - openSUSE Leap 15.3 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.36.7-150200.44.1 libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.36.7-150200.44.1 libwebkit2gtk-4_0-37-32bit-2.36.7-150200.44.1 libwebkit2gtk-4_0-37-32bit-debuginfo-2.36.7-150200.44.1 - openSUSE Leap 15.3 (noarch): libwebkit2gtk3-lang-2.36.7-150200.44.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (aarch64 ppc64le s390x x86_64): typelib-1_0-JavaScriptCore-4_0-2.36.7-150200.44.1 typelib-1_0-WebKit2-4_0-2.36.7-150200.44.1 typelib-1_0-WebKit2WebExtension-4_0-2.36.7-150200.44.1 webkit2gtk3-debugsource-2.36.7-150200.44.1 webkit2gtk3-devel-2.36.7-150200.44.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): libjavascriptcoregtk-4_0-18-2.36.7-150200.44.1 libjavascriptcoregtk-4_0-18-debuginfo-2.36.7-150200.44.1 libwebkit2gtk-4_0-37-2.36.7-150200.44.1 libwebkit2gtk-4_0-37-debuginfo-2.36.7-150200.44.1 webkit2gtk-4_0-injected-bundles-2.36.7-150200.44.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.36.7-150200.44.1 webkit2gtk3-debugsource-2.36.7-150200.44.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (noarch): libwebkit2gtk3-lang-2.36.7-150200.44.1 References: https://www.suse.com/security/cve/CVE-2022-32893.html https://bugzilla.suse.com/1202169 https://bugzilla.suse.com/1202807

1 0

SUSE-SU-2022:3347-1: moderate: Security update for rubygem-rack
by opensuse-security＠opensuse.org 23 Sep '22

23 Sep '22

SUSE Security Update: Security update for rubygem-rack ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3347-1 Rating: moderate References: #1172037 #1173351 Cross-References: CVE-2020-8161 CVE-2020-8184 CVSS scores: CVE-2020-8161 (NVD) : 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N CVE-2020-8161 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2020-8184 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2020-8184 (SUSE): 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N Affected Products: SUSE Linux Enterprise High Availability 15 SUSE Linux Enterprise High Availability 15-SP1 SUSE Linux Enterprise High Availability 15-SP2 SUSE Linux Enterprise High Availability 15-SP3 SUSE Linux Enterprise High Availability 15-SP4 SUSE Linux Enterprise High Performance Computing 15 SUSE Linux Enterprise High Performance Computing 15-SP1 SUSE Linux Enterprise High Performance Computing 15-SP2 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Server 15 SUSE Linux Enterprise Server 15-SP1 SUSE Linux Enterprise Server 15-SP2 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15 SUSE Linux Enterprise Server for SAP Applications 15-SP1 SUSE Linux Enterprise Server for SAP Applications 15-SP2 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 6 SUSE Linux Enterprise Storage 7 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.0 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.0 SUSE Manager Retail Branch Server 4.1 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.0 SUSE Manager Server 4.1 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for rubygem-rack fixes the following issues: - CVE-2020-8184: Fixed vulnerability where percent-encoded cookies can be used to overwrite existing prefixed cookie names (bsc#1173351). - CVE-2020-8161: Fixed directory traversal in Rack:Directory (bsc#1172037). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3347=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3347=1 - SUSE Linux Enterprise High Availability 15-SP4: zypper in -t patch SUSE-SLE-Product-HA-15-SP4-2022-3347=1 - SUSE Linux Enterprise High Availability 15-SP3: zypper in -t patch SUSE-SLE-Product-HA-15-SP3-2022-3347=1 - SUSE Linux Enterprise High Availability 15-SP2: zypper in -t patch SUSE-SLE-Product-HA-15-SP2-2022-3347=1 - SUSE Linux Enterprise High Availability 15-SP1: zypper in -t patch SUSE-SLE-Product-HA-15-SP1-2022-3347=1 - SUSE Linux Enterprise High Availability 15: zypper in -t patch SUSE-SLE-Product-HA-15-2022-3347=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-rack-2.0.8-150000.3.9.1 ruby2.5-rubygem-rack-doc-2.0.8-150000.3.9.1 ruby2.5-rubygem-rack-testsuite-2.0.8-150000.3.9.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-rack-2.0.8-150000.3.9.1 ruby2.5-rubygem-rack-doc-2.0.8-150000.3.9.1 ruby2.5-rubygem-rack-testsuite-2.0.8-150000.3.9.1 - SUSE Linux Enterprise High Availability 15-SP4 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-rack-2.0.8-150000.3.9.1 - SUSE Linux Enterprise High Availability 15-SP3 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-rack-2.0.8-150000.3.9.1 - SUSE Linux Enterprise High Availability 15-SP2 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-rack-2.0.8-150000.3.9.1 - SUSE Linux Enterprise High Availability 15-SP1 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-rack-2.0.8-150000.3.9.1 - SUSE Linux Enterprise High Availability 15 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-rack-2.0.8-150000.3.9.1 References: https://www.suse.com/security/cve/CVE-2020-8161.html https://www.suse.com/security/cve/CVE-2020-8184.html https://bugzilla.suse.com/1172037 https://bugzilla.suse.com/1173351

1 0

SUSE-SU-2022:3341-1: important: Security update for dpdk
by opensuse-security＠opensuse.org 23 Sep '22

23 Sep '22

SUSE Security Update: Security update for dpdk ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3341-1 Rating: important References: #1202903 #1202956 Cross-References: CVE-2022-2132 CVE-2022-28199 CVSS scores: CVE-2022-2132 (NVD) : 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H CVE-2022-2132 (SUSE): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H CVE-2022-28199 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-28199 (SUSE): 7.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Server Applications 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for dpdk fixes the following issues: - CVE-2022-2132: Fixed DoS when a vhost header crosses more than two descriptors and exhausts all mbufs (bsc#1202903). - CVE-2022-28199: Fixed buffer overflow in the vhost code (bsc#1202956). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3341=1 - SUSE Linux Enterprise Module for Server Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2022-3341=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le x86_64): dpdk-19.11.10-150400.4.7.1 dpdk-debuginfo-19.11.10-150400.4.7.1 dpdk-debugsource-19.11.10-150400.4.7.1 dpdk-devel-19.11.10-150400.4.7.1 dpdk-devel-debuginfo-19.11.10-150400.4.7.1 dpdk-examples-19.11.10-150400.4.7.1 dpdk-examples-debuginfo-19.11.10-150400.4.7.1 dpdk-kmp-default-19.11.10_k5.14.21_150400.24.18-150400.4.7.1 dpdk-kmp-default-debuginfo-19.11.10_k5.14.21_150400.24.18-150400.4.7.1 dpdk-tools-19.11.10-150400.4.7.1 dpdk-tools-debuginfo-19.11.10-150400.4.7.1 libdpdk-20_0-19.11.10-150400.4.7.1 libdpdk-20_0-debuginfo-19.11.10-150400.4.7.1 - openSUSE Leap 15.4 (aarch64): dpdk-thunderx-19.11.10-150400.4.7.1 dpdk-thunderx-debuginfo-19.11.10-150400.4.7.1 dpdk-thunderx-debugsource-19.11.10-150400.4.7.1 dpdk-thunderx-devel-19.11.10-150400.4.7.1 dpdk-thunderx-devel-debuginfo-19.11.10-150400.4.7.1 dpdk-thunderx-examples-19.11.10-150400.4.7.1 dpdk-thunderx-examples-debuginfo-19.11.10-150400.4.7.1 dpdk-thunderx-kmp-default-19.11.10_k5.14.21_150400.24.18-150400.4.7.1 dpdk-thunderx-kmp-default-debuginfo-19.11.10_k5.14.21_150400.24.18-150400.4.7.1 dpdk-thunderx-tools-19.11.10-150400.4.7.1 dpdk-thunderx-tools-debuginfo-19.11.10-150400.4.7.1 - openSUSE Leap 15.4 (noarch): dpdk-doc-19.11.10-150400.4.7.1 dpdk-thunderx-doc-19.11.10-150400.4.7.1 - SUSE Linux Enterprise Module for Server Applications 15-SP4 (aarch64 ppc64le x86_64): dpdk-19.11.10-150400.4.7.1 dpdk-debuginfo-19.11.10-150400.4.7.1 dpdk-debugsource-19.11.10-150400.4.7.1 dpdk-devel-19.11.10-150400.4.7.1 dpdk-devel-debuginfo-19.11.10-150400.4.7.1 dpdk-kmp-default-19.11.10_k5.14.21_150400.24.18-150400.4.7.1 dpdk-kmp-default-debuginfo-19.11.10_k5.14.21_150400.24.18-150400.4.7.1 dpdk-tools-19.11.10-150400.4.7.1 dpdk-tools-debuginfo-19.11.10-150400.4.7.1 libdpdk-20_0-19.11.10-150400.4.7.1 libdpdk-20_0-debuginfo-19.11.10-150400.4.7.1 - SUSE Linux Enterprise Module for Server Applications 15-SP4 (aarch64): dpdk-thunderx-19.11.10-150400.4.7.1 dpdk-thunderx-debuginfo-19.11.10-150400.4.7.1 dpdk-thunderx-debugsource-19.11.10-150400.4.7.1 dpdk-thunderx-devel-19.11.10-150400.4.7.1 dpdk-thunderx-devel-debuginfo-19.11.10-150400.4.7.1 dpdk-thunderx-kmp-default-19.11.10_k5.14.21_150400.24.18-150400.4.7.1 dpdk-thunderx-kmp-default-debuginfo-19.11.10_k5.14.21_150400.24.18-150400.4.7.1 References: https://www.suse.com/security/cve/CVE-2022-2132.html https://www.suse.com/security/cve/CVE-2022-28199.html https://bugzilla.suse.com/1202903 https://bugzilla.suse.com/1202956

1 0

openSUSE-SU-2022:10129-1: important: Security update for virtualbox
by opensuse-security＠opensuse.org 23 Sep '22

23 Sep '22

openSUSE Security Update: Security update for virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10129-1 Rating: important References: #1201720 #1203086 #1203306 #1203370 Cross-References: CVE-2022-21554 CVE-2022-21571 CVSS scores: CVE-2022-21554 (NVD) : 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-21554 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-21571 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2022-21571 (SUSE): 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for virtualbox fixes the following issues: Version bump to 6.1.38r86 released by Oracle September 02 2022 This is a maintenance release. The following items were fixed and/or added: - GUI: Improvements in Native Language Support area - Main: OVF Export: Added support for exporting VMs containing Virtio-SCSI controllers - Recording settings: Fixed a regression which could cause not starting the COM server (VBoxSVC) under certain circumstances (bug #21034) - Recording: More deterministic naming for recorded files (will now overwrite old .webm files if present) - Linux Host and Guest Additions installer: Improved check for systemd presence in the system (bug #19033) - Linux Guest Additions: Introduced initial support for kernel 6.0 - Linux Guest Additions: Additional fixes for kernel RHEL 9.1 (bug #21065) - Windows Guest Additions: Improvements in Drag and Drop area - Fixes permission problem with /dev/vboxuser (boo#1203370) - Fixes missing firewall opening (boo#1203086) - Fixes boo#1201720 CVE items for CVE-2022-21571, CVE-2022-21554 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-2022-10129=1 Package List: - openSUSE Leap 15.3 (x86_64): python3-virtualbox-6.1.38-lp153.2.36.1 python3-virtualbox-debuginfo-6.1.38-lp153.2.36.1 virtualbox-6.1.38-lp153.2.36.1 virtualbox-debuginfo-6.1.38-lp153.2.36.1 virtualbox-debugsource-6.1.38-lp153.2.36.1 virtualbox-devel-6.1.38-lp153.2.36.1 virtualbox-guest-tools-6.1.38-lp153.2.36.1 virtualbox-guest-tools-debuginfo-6.1.38-lp153.2.36.1 virtualbox-kmp-debugsource-6.1.38-lp153.2.36.1 virtualbox-kmp-default-6.1.38_k5.3.18_150300.59.93-lp153.2.36.1 virtualbox-kmp-default-debuginfo-6.1.38_k5.3.18_150300.59.93-lp153.2.36.1 virtualbox-kmp-preempt-6.1.38_k5.3.18_150300.59.93-lp153.2.36.1 virtualbox-kmp-preempt-debuginfo-6.1.38_k5.3.18_150300.59.93-lp153.2.36.1 virtualbox-qt-6.1.38-lp153.2.36.1 virtualbox-qt-debuginfo-6.1.38-lp153.2.36.1 virtualbox-vnc-6.1.38-lp153.2.36.1 virtualbox-websrv-6.1.38-lp153.2.36.1 virtualbox-websrv-debuginfo-6.1.38-lp153.2.36.1 - openSUSE Leap 15.3 (noarch): virtualbox-guest-desktop-icons-6.1.38-lp153.2.36.1 virtualbox-guest-source-6.1.38-lp153.2.36.1 virtualbox-host-source-6.1.38-lp153.2.36.1 References: https://www.suse.com/security/cve/CVE-2022-21554.html https://www.suse.com/security/cve/CVE-2022-21571.html https://bugzilla.suse.com/1201720 https://bugzilla.suse.com/1203086 https://bugzilla.suse.com/1203306 https://bugzilla.suse.com/1203370

1 0

SUSE-SU-2022:3334-1: important: Security update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer
by opensuse-security＠opensuse.org 22 Sep '22

22 Sep '22

SUSE Security Update: Security update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3334-1 Rating: important References: #1200528 Cross-References: CVE-2022-1996 CVSS scores: CVE-2022-1996 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2022-1996 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Containers 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer fixes the following issues: Update to version 1.51.0 - Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51. 0 Security issues fixed in vendored dependencies: - CVE-2022-1996: Fixed CORS bypass (bsc#1200528) - Include additional tools used by cdi-importer: cdi-containerimage-server cdi-image-size-detection cdi-source-update-poller - Pack only cdi-operator and cdi-cr release manifests - Install tar for cloning filesystem PVCs Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3334=1 - SUSE Linux Enterprise Module for Containers 15-SP4: zypper in -t patch SUSE-SLE-Module-Containers-15-SP4-2022-3334=1 Package List: - openSUSE Leap 15.4 (x86_64): containerized-data-importer-api-1.51.0-150400.4.3.1 containerized-data-importer-api-debuginfo-1.51.0-150400.4.3.1 containerized-data-importer-cloner-1.51.0-150400.4.3.1 containerized-data-importer-cloner-debuginfo-1.51.0-150400.4.3.1 containerized-data-importer-controller-1.51.0-150400.4.3.1 containerized-data-importer-controller-debuginfo-1.51.0-150400.4.3.1 containerized-data-importer-importer-1.51.0-150400.4.3.1 containerized-data-importer-importer-debuginfo-1.51.0-150400.4.3.1 containerized-data-importer-manifests-1.51.0-150400.4.3.1 containerized-data-importer-operator-1.51.0-150400.4.3.1 containerized-data-importer-operator-debuginfo-1.51.0-150400.4.3.1 containerized-data-importer-uploadproxy-1.51.0-150400.4.3.1 containerized-data-importer-uploadproxy-debuginfo-1.51.0-150400.4.3.1 containerized-data-importer-uploadserver-1.51.0-150400.4.3.1 containerized-data-importer-uploadserver-debuginfo-1.51.0-150400.4.3.1 obs-service-cdi_containers_meta-1.51.0-150400.4.3.1 - SUSE Linux Enterprise Module for Containers 15-SP4 (x86_64): containerized-data-importer-manifests-1.51.0-150400.4.3.1 References: https://www.suse.com/security/cve/CVE-2022-1996.html https://bugzilla.suse.com/1200528

1 0

SUSE-SU-2022:3333-1: important: Security update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container
by opensuse-security＠opensuse.org 22 Sep '22

22 Sep '22

SUSE Security Update: Security update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3333-1 Rating: important References: #1199392 #1199460 #1199603 #1200528 #1202516 Cross-References: CVE-2022-1798 CVE-2022-1996 CVE-2022-29162 CVSS scores: CVE-2022-1798 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2022-1798 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2022-1996 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2022-1996 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-29162 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-29162 (SUSE): 4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Containers 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves three vulnerabilities and has two fixes is now available. Description: This update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container fixes the following issues: The kubevirt stack was updated to version 0.54.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.54.0 Security fixes: - CVE-2022-1798: Fix arbitrary file read on the host from KubeVirt VMs (bsc#1202516) Security fixes in vendored dependencies: - CVE-2022-1996: Fixed go-restful CORS bypass bsc#1200528) - CVE-2022-29162: Fixed runc incorrect handling of inheritable capabilities in default configuration (bsc#1199460) - Fix containerdisk unmount logic - Support topology spread constraints - Update libvirt-go to fix memory leak - Pack nft rules and nsswitch.conf for virt-handler - Only create 1MiB-aligned disk images (bsc#1199603) - Avoid to return nil failure message - Use semantic equality comparison - Drop kubevirt-psp-caasp.yaml - Allow to configure utility containers for update test - Symlink nsswitch.conf and nft rules to proper locations - Drop unused package libvirt-client - Install vim-small instead of vim - Remove unneeded libvirt-daemon-driver-storage-core - Install missing packages ethtool and gawk. Fixes bsc#1199392 Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3333=1 - SUSE Linux Enterprise Module for Containers 15-SP4: zypper in -t patch SUSE-SLE-Module-Containers-15-SP4-2022-3333=1 Package List: - openSUSE Leap 15.4 (x86_64): kubevirt-container-disk-0.54.0-150400.3.3.2 kubevirt-container-disk-debuginfo-0.54.0-150400.3.3.2 kubevirt-manifests-0.54.0-150400.3.3.2 kubevirt-tests-0.54.0-150400.3.3.2 kubevirt-tests-debuginfo-0.54.0-150400.3.3.2 kubevirt-virt-api-0.54.0-150400.3.3.2 kubevirt-virt-api-debuginfo-0.54.0-150400.3.3.2 kubevirt-virt-controller-0.54.0-150400.3.3.2 kubevirt-virt-controller-debuginfo-0.54.0-150400.3.3.2 kubevirt-virt-handler-0.54.0-150400.3.3.2 kubevirt-virt-handler-debuginfo-0.54.0-150400.3.3.2 kubevirt-virt-launcher-0.54.0-150400.3.3.2 kubevirt-virt-launcher-debuginfo-0.54.0-150400.3.3.2 kubevirt-virt-operator-0.54.0-150400.3.3.2 kubevirt-virt-operator-debuginfo-0.54.0-150400.3.3.2 kubevirt-virtctl-0.54.0-150400.3.3.2 kubevirt-virtctl-debuginfo-0.54.0-150400.3.3.2 obs-service-kubevirt_containers_meta-0.54.0-150400.3.3.2 - SUSE Linux Enterprise Module for Containers 15-SP4 (x86_64): kubevirt-manifests-0.54.0-150400.3.3.2 kubevirt-virtctl-0.54.0-150400.3.3.2 kubevirt-virtctl-debuginfo-0.54.0-150400.3.3.2 References: https://www.suse.com/security/cve/CVE-2022-1798.html https://www.suse.com/security/cve/CVE-2022-1996.html https://www.suse.com/security/cve/CVE-2022-29162.html https://bugzilla.suse.com/1199392 https://bugzilla.suse.com/1199460 https://bugzilla.suse.com/1199603 https://bugzilla.suse.com/1200528 https://bugzilla.suse.com/1202516

1 0

SUSE-SU-2022:3335-1: important: Security update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer
by opensuse-security＠opensuse.org 22 Sep '22

22 Sep '22

SUSE Security Update: Security update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3335-1 Rating: important References: #1200528 Cross-References: CVE-2022-1996 CVSS scores: CVE-2022-1996 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2022-1996 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Containers 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer fixes the following issues: Update to version 1.43.2 - Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43. 2 Security issues fixed: - CVE-2022-1996: Fixed CORS bypass in go-restful vendored dependency (bsc#1200528) Other fixes: - Include additional tools used by cdi-importer: cdi-containerimage-server cdi-source-update-poller - Pack only cdi-{cr,operator}.yaml into the manifests RPM - Install tar package (used for cloning filesystem PVCs) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3335=1 - SUSE Linux Enterprise Module for Containers 15-SP3: zypper in -t patch SUSE-SLE-Module-Containers-15-SP3-2022-3335=1 Package List: - openSUSE Leap 15.3 (x86_64): containerized-data-importer-api-1.43.2-150300.8.9.3 containerized-data-importer-api-debuginfo-1.43.2-150300.8.9.3 containerized-data-importer-cloner-1.43.2-150300.8.9.3 containerized-data-importer-cloner-debuginfo-1.43.2-150300.8.9.3 containerized-data-importer-controller-1.43.2-150300.8.9.3 containerized-data-importer-controller-debuginfo-1.43.2-150300.8.9.3 containerized-data-importer-importer-1.43.2-150300.8.9.3 containerized-data-importer-importer-debuginfo-1.43.2-150300.8.9.3 containerized-data-importer-manifests-1.43.2-150300.8.9.3 containerized-data-importer-operator-1.43.2-150300.8.9.3 containerized-data-importer-operator-debuginfo-1.43.2-150300.8.9.3 containerized-data-importer-uploadproxy-1.43.2-150300.8.9.3 containerized-data-importer-uploadproxy-debuginfo-1.43.2-150300.8.9.3 containerized-data-importer-uploadserver-1.43.2-150300.8.9.3 containerized-data-importer-uploadserver-debuginfo-1.43.2-150300.8.9.3 obs-service-cdi_containers_meta-1.43.2-150300.8.9.3 - SUSE Linux Enterprise Module for Containers 15-SP3 (x86_64): containerized-data-importer-manifests-1.43.2-150300.8.9.3 References: https://www.suse.com/security/cve/CVE-2022-1996.html https://bugzilla.suse.com/1200528

1 0

SUSE-SU-2022:3326-1: important: Security update for go1.19
by opensuse-security＠opensuse.org 21 Sep '22

21 Sep '22

SUSE Security Update: Security update for go1.19 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3326-1 Rating: important References: #1200441 #1203185 #1203186 Cross-References: CVE-2022-27664 CVE-2022-32190 CVSS scores: CVE-2022-27664 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-27664 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-32190 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Development Tools 15-SP3 SUSE Linux Enterprise Module for Development Tools 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for go1.19 fixes the following issues: Update to go version 1.19.1 (bsc#1200441): - CVE-2022-27664: Fixed DoS in net/http caused by mishandled server errors after sending GOAWAY (bsc#1203185). - CVE-2022-32190: Fixed missing stripping of relative path components in net/url JoinPath (bsc#1203186). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3326=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3326=1 - SUSE Linux Enterprise Module for Development Tools 15-SP4: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2022-3326=1 - SUSE Linux Enterprise Module for Development Tools 15-SP3: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP3-2022-3326=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): go1.19-1.19.1-150000.1.9.1 go1.19-doc-1.19.1-150000.1.9.1 - openSUSE Leap 15.4 (aarch64 x86_64): go1.19-race-1.19.1-150000.1.9.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): go1.19-1.19.1-150000.1.9.1 go1.19-doc-1.19.1-150000.1.9.1 - openSUSE Leap 15.3 (aarch64 x86_64): go1.19-race-1.19.1-150000.1.9.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 ppc64le s390x x86_64): go1.19-1.19.1-150000.1.9.1 go1.19-doc-1.19.1-150000.1.9.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 x86_64): go1.19-race-1.19.1-150000.1.9.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 ppc64le s390x x86_64): go1.19-1.19.1-150000.1.9.1 go1.19-doc-1.19.1-150000.1.9.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 x86_64): go1.19-race-1.19.1-150000.1.9.1 References: https://www.suse.com/security/cve/CVE-2022-27664.html https://www.suse.com/security/cve/CVE-2022-32190.html https://bugzilla.suse.com/1200441 https://bugzilla.suse.com/1203185 https://bugzilla.suse.com/1203186

1 0

SUSE-SU-2022:3327-1: important: Security update for oniguruma
by opensuse-security＠opensuse.org 21 Sep '22

21 Sep '22

SUSE Security Update: Security update for oniguruma ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3327-1 Rating: important References: #1142847 #1150130 #1157805 #1164550 #1164569 #1177179 Cross-References: CVE-2019-13224 CVE-2019-16163 CVE-2019-19203 CVE-2019-19204 CVE-2019-19246 CVE-2020-26159 CVSS scores: CVE-2019-13224 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-13224 (SUSE): 6.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H CVE-2019-16163 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-16163 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2019-19203 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-19203 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-19204 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-19204 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-19246 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-19246 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-26159 (NVD) : 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H CVE-2020-26159 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: SUSE CaaS Platform 4.0 SUSE Enterprise Storage 6 SUSE Enterprise Storage 7 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP1-BCL SUSE Linux Enterprise Server 15-SP1-LTSS SUSE Linux Enterprise Server 15-SP2-BCL SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP 15-SP1 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.1 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.1 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 openSUSE Leap Micro 5.2 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for oniguruma fixes the following issues: - CVE-2019-19246: Fixed an out of bounds access during regular expression matching (bsc#1157805). - CVE-2019-19204: Fixed an out of bounds access when compiling a crafted regular expression (bsc#1164569). - CVE-2019-19203: Fixed an out of bounds access when performing a string search (bsc#1164550). - CVE-2019-16163: Fixed an uncontrolled recursion issue when compiling a crafted regular expression, which could lead to denial of service (bsc#1150130). - CVE-2020-26159: Fixed an off-by-one buffer overflow (bsc#1177179). - CVE-2019-13224: Fixed a potential use-after-free when handling multiple different encodings (bsc#1142847). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap Micro 5.2: zypper in -t patch openSUSE-Leap-Micro-5.2-2022-3327=1 - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3327=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3327=1 - SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-3327=1 - SUSE Manager Retail Branch Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-3327=1 - SUSE Manager Proxy 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-3327=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-3327=1 - SUSE Linux Enterprise Server for SAP 15-SP1: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2022-3327=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-3327=1 - SUSE Linux Enterprise Server 15-SP2-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-3327=1 - SUSE Linux Enterprise Server 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-3327=1 - SUSE Linux Enterprise Server 15-SP1-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-BCL-2022-3327=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-3327=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-3327=1 - SUSE Linux Enterprise Micro 5.2: zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-3327=1 - SUSE Linux Enterprise Micro 5.1: zypper in -t patch SUSE-SUSE-MicroOS-5.1-2022-3327=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-3327=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-3327=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-3327=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-3327=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2022-3327=1 - SUSE Enterprise Storage 6: zypper in -t patch SUSE-Storage-6-2022-3327=1 - SUSE CaaS Platform 4.0: To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. Package List: - openSUSE Leap Micro 5.2 (aarch64 x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - SUSE Manager Server 4.1 (ppc64le s390x x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - SUSE Manager Retail Branch Server 4.1 (x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - SUSE Manager Proxy 4.1 (x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (ppc64le x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - SUSE Linux Enterprise Server 15-SP2-BCL (x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (aarch64 ppc64le s390x x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - SUSE Linux Enterprise Server 15-SP1-BCL (x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 - SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (aarch64 x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (aarch64 x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - SUSE Enterprise Storage 7 (aarch64 x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - SUSE Enterprise Storage 6 (aarch64 x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - SUSE CaaS Platform 4.0 (x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-13224.html https://www.suse.com/security/cve/CVE-2019-16163.html https://www.suse.com/security/cve/CVE-2019-19203.html https://www.suse.com/security/cve/CVE-2019-19204.html https://www.suse.com/security/cve/CVE-2019-19246.html https://www.suse.com/security/cve/CVE-2020-26159.html https://bugzilla.suse.com/1142847 https://bugzilla.suse.com/1150130 https://bugzilla.suse.com/1157805 https://bugzilla.suse.com/1164550 https://bugzilla.suse.com/1164569 https://bugzilla.suse.com/1177179

1 0