November 2023 - openSUSE Security Announce

SUSE-SU-2023:4473-1: moderate: Security update for frr
by security＠lists.opensuse.org 17 Nov '23

17 Nov '23

# Security update for frr Announcement ID: SUSE-SU-2023:4473-1 Rating: moderate References: * bsc#1216626 * bsc#1216627 Cross-References: * CVE-2023-46752 * CVE-2023-46753 CVSS scores: * CVE-2023-46752 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-46752 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-46753 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-46753 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * openSUSE Leap 15.5 * Server Applications Module 15-SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves two vulnerabilities can now be installed. ## Description: This update for frr fixes the following issues: * CVE-2023-46753: Fixed a crash caused from a crafted BGP UPDATE message. (bsc#1216626) * CVE-2023-46752: Fixed a crash caused from a mishandled malformed MP_REACH_NLRI data. (bsc#1216627) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2023-4473=1 openSUSE-SLE-15.5-2023-4473=1 * Server Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP5-2023-4473=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * libmlag_pb0-debuginfo-8.4-150500.4.11.1 * libfrrzmq0-8.4-150500.4.11.1 * libfrrfpm_pb0-8.4-150500.4.11.1 * frr-debuginfo-8.4-150500.4.11.1 * libfrrcares0-debuginfo-8.4-150500.4.11.1 * libfrrfpm_pb0-debuginfo-8.4-150500.4.11.1 * libfrrospfapiclient0-8.4-150500.4.11.1 * libfrrzmq0-debuginfo-8.4-150500.4.11.1 * libfrr_pb0-8.4-150500.4.11.1 * libmlag_pb0-8.4-150500.4.11.1 * frr-debugsource-8.4-150500.4.11.1 * frr-8.4-150500.4.11.1 * libfrr_pb0-debuginfo-8.4-150500.4.11.1 * libfrrsnmp0-8.4-150500.4.11.1 * libfrr0-debuginfo-8.4-150500.4.11.1 * libfrrospfapiclient0-debuginfo-8.4-150500.4.11.1 * libfrrcares0-8.4-150500.4.11.1 * libfrrsnmp0-debuginfo-8.4-150500.4.11.1 * frr-devel-8.4-150500.4.11.1 * libfrr0-8.4-150500.4.11.1 * Server Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64) * libmlag_pb0-debuginfo-8.4-150500.4.11.1 * libfrrzmq0-8.4-150500.4.11.1 * libfrrfpm_pb0-8.4-150500.4.11.1 * frr-debuginfo-8.4-150500.4.11.1 * libfrrcares0-debuginfo-8.4-150500.4.11.1 * libfrrfpm_pb0-debuginfo-8.4-150500.4.11.1 * libfrrospfapiclient0-8.4-150500.4.11.1 * libfrrzmq0-debuginfo-8.4-150500.4.11.1 * libfrr_pb0-8.4-150500.4.11.1 * libmlag_pb0-8.4-150500.4.11.1 * frr-debugsource-8.4-150500.4.11.1 * frr-8.4-150500.4.11.1 * libfrr_pb0-debuginfo-8.4-150500.4.11.1 * libfrrsnmp0-8.4-150500.4.11.1 * libfrr0-debuginfo-8.4-150500.4.11.1 * libfrrospfapiclient0-debuginfo-8.4-150500.4.11.1 * libfrrcares0-8.4-150500.4.11.1 * libfrrsnmp0-debuginfo-8.4-150500.4.11.1 * frr-devel-8.4-150500.4.11.1 * libfrr0-8.4-150500.4.11.1 ## References: * https://www.suse.com/security/cve/CVE-2023-46752.html * https://www.suse.com/security/cve/CVE-2023-46753.html * https://bugzilla.suse.com/show_bug.cgi?id=1216626 * https://bugzilla.suse.com/show_bug.cgi?id=1216627

1 0

SUSE-SU-2023:4475-1: important: Security update for xen
by security＠lists.opensuse.org 17 Nov '23

17 Nov '23

# Security update for xen Announcement ID: SUSE-SU-2023:4475-1 Rating: important References: * bsc#1027519 * bsc#1215145 * bsc#1215474 * bsc#1215746 * bsc#1215747 * bsc#1215748 * bsc#1216654 * bsc#1216807 Cross-References: * CVE-2023-20588 * CVE-2023-34322 * CVE-2023-34325 * CVE-2023-34326 * CVE-2023-34327 * CVE-2023-34328 * CVE-2023-46835 * CVE-2023-46836 CVSS scores: * CVE-2023-20588 ( SUSE ): 6.0 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N * CVE-2023-20588 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N * CVE-2023-34322 ( SUSE ): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H * CVE-2023-34325 ( SUSE ): 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L * CVE-2023-34326 ( SUSE ): 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2023-34327 ( SUSE ): 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2023-34328 ( SUSE ): 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2023-46835 ( SUSE ): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.5 * Server Applications Module 15-SP5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves eight vulnerabilities can now be installed. ## Description: This update for xen fixes the following issues: * CVE-2023-20588: AMD CPU transitional execution leak via division by zero (XSA-439) (bsc#1215474). * CVE-2023-34322: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) (bsc#1215145). * CVE-2023-34325: Multiple vulnerabilities in libfsimage disk handling (XSA-443) (bsc#1215747). * CVE-2023-34326: x86/AMD: missing IOMMU TLB flushing (XSA-442) (bsc#1215746). * CVE-2023-34327,CVE-2023-34328: x86/AMD: Debug Mask handling (XSA-444) (bsc#1215748). * CVE-2023-46835: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) (bsc#1216654). * CVE-2023-46836: x86: BTC/SRSO fixes not fully effective (XSA-446) (bsc#1216807). * Upstream bug fixes (bsc#1027519) ## Special Instructions and Notes: * Please reboot the system after installing this update. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2023-4475=1 openSUSE-SLE-15.5-2023-4475=1 * SUSE Linux Enterprise Micro 5.5 zypper in -t patch SUSE-SLE-Micro-5.5-2023-4475=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-4475=1 * Server Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP5-2023-4475=1 ## Package List: * openSUSE Leap 15.5 (aarch64 x86_64 i586) * xen-libs-debuginfo-4.17.2_08-150500.3.15.1 * xen-debugsource-4.17.2_08-150500.3.15.1 * xen-libs-4.17.2_08-150500.3.15.1 * xen-tools-domU-debuginfo-4.17.2_08-150500.3.15.1 * xen-tools-domU-4.17.2_08-150500.3.15.1 * xen-devel-4.17.2_08-150500.3.15.1 * openSUSE Leap 15.5 (x86_64) * xen-libs-32bit-debuginfo-4.17.2_08-150500.3.15.1 * xen-libs-32bit-4.17.2_08-150500.3.15.1 * openSUSE Leap 15.5 (aarch64 x86_64) * xen-doc-html-4.17.2_08-150500.3.15.1 * xen-tools-4.17.2_08-150500.3.15.1 * xen-4.17.2_08-150500.3.15.1 * xen-tools-debuginfo-4.17.2_08-150500.3.15.1 * openSUSE Leap 15.5 (noarch) * xen-tools-xendomains-wait-disk-4.17.2_08-150500.3.15.1 * openSUSE Leap 15.5 (aarch64_ilp32) * xen-libs-64bit-debuginfo-4.17.2_08-150500.3.15.1 * xen-libs-64bit-4.17.2_08-150500.3.15.1 * SUSE Linux Enterprise Micro 5.5 (x86_64) * xen-libs-4.17.2_08-150500.3.15.1 * xen-libs-debuginfo-4.17.2_08-150500.3.15.1 * xen-debugsource-4.17.2_08-150500.3.15.1 * Basesystem Module 15-SP5 (x86_64) * xen-libs-debuginfo-4.17.2_08-150500.3.15.1 * xen-debugsource-4.17.2_08-150500.3.15.1 * xen-libs-4.17.2_08-150500.3.15.1 * xen-tools-domU-debuginfo-4.17.2_08-150500.3.15.1 * xen-tools-domU-4.17.2_08-150500.3.15.1 * Server Applications Module 15-SP5 (x86_64) * xen-tools-4.17.2_08-150500.3.15.1 * xen-debugsource-4.17.2_08-150500.3.15.1 * xen-4.17.2_08-150500.3.15.1 * xen-tools-debuginfo-4.17.2_08-150500.3.15.1 * xen-devel-4.17.2_08-150500.3.15.1 * Server Applications Module 15-SP5 (noarch) * xen-tools-xendomains-wait-disk-4.17.2_08-150500.3.15.1 ## References: * https://www.suse.com/security/cve/CVE-2023-20588.html * https://www.suse.com/security/cve/CVE-2023-34322.html * https://www.suse.com/security/cve/CVE-2023-34325.html * https://www.suse.com/security/cve/CVE-2023-34326.html * https://www.suse.com/security/cve/CVE-2023-34327.html * https://www.suse.com/security/cve/CVE-2023-34328.html * https://www.suse.com/security/cve/CVE-2023-46835.html * https://www.suse.com/security/cve/CVE-2023-46836.html * https://bugzilla.suse.com/show_bug.cgi?id=1027519 * https://bugzilla.suse.com/show_bug.cgi?id=1215145 * https://bugzilla.suse.com/show_bug.cgi?id=1215474 * https://bugzilla.suse.com/show_bug.cgi?id=1215746 * https://bugzilla.suse.com/show_bug.cgi?id=1215747 * https://bugzilla.suse.com/show_bug.cgi?id=1215748 * https://bugzilla.suse.com/show_bug.cgi?id=1216654 * https://bugzilla.suse.com/show_bug.cgi?id=1216807

1 0

SUSE-SU-2023:4476-1: important: Security update for xen
by security＠lists.opensuse.org 17 Nov '23

17 Nov '23

# Security update for xen Announcement ID: SUSE-SU-2023:4476-1 Rating: important References: * bsc#1027519 * bsc#1215145 * bsc#1215474 * bsc#1215746 * bsc#1215747 * bsc#1215748 * bsc#1216654 * bsc#1216807 Cross-References: * CVE-2023-20588 * CVE-2023-34322 * CVE-2023-34325 * CVE-2023-34326 * CVE-2023-34327 * CVE-2023-34328 * CVE-2023-46835 * CVE-2023-46836 CVSS scores: * CVE-2023-20588 ( SUSE ): 6.0 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N * CVE-2023-20588 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N * CVE-2023-34322 ( SUSE ): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H * CVE-2023-34325 ( SUSE ): 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L * CVE-2023-34326 ( SUSE ): 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2023-34327 ( SUSE ): 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2023-34328 ( SUSE ): 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2023-46835 ( SUSE ): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Affected Products: * Basesystem Module 15-SP4 * openSUSE Leap 15.4 * openSUSE Leap Micro 5.3 * openSUSE Leap Micro 5.4 * Server Applications Module 15-SP4 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves eight vulnerabilities can now be installed. ## Description: This update for xen fixes the following issues: * CVE-2023-20588: AMD CPU transitional execution leak via division by zero (XSA-439) (bsc#1215474). * CVE-2023-34322: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) (bsc#1215145). * CVE-2023-34325: Multiple vulnerabilities in libfsimage disk handling (XSA-443) (bsc#1215747). * CVE-2023-34326: x86/AMD: missing IOMMU TLB flushing (XSA-442) (bsc#1215746). * CVE-2023-34327,CVE-2023-34328: x86/AMD: Debug Mask handling (XSA-444) (bsc#1215748). * CVE-2023-46835: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) (bsc#1216654). * CVE-2023-46836: x86: BTC/SRSO fixes not fully effective (XSA-446) (bsc#1216807). * Upstream bug fixes (bsc#1027519) ## Special Instructions and Notes: * Please reboot the system after installing this update. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-4476=1 SUSE-2023-4476=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2023-4476=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2023-4476=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2023-4476=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2023-4476=1 * Basesystem Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-4476=1 * Server Applications Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2023-4476=1 * openSUSE Leap Micro 5.3 zypper in -t patch openSUSE-Leap-Micro-5.3-2023-4476=1 * openSUSE Leap Micro 5.4 zypper in -t patch openSUSE-Leap-Micro-5.4-2023-4476=1 ## Package List: * openSUSE Leap 15.4 (aarch64 x86_64) * xen-tools-4.16.5_08-150400.4.40.1 * xen-tools-debuginfo-4.16.5_08-150400.4.40.1 * xen-4.16.5_08-150400.4.40.1 * xen-doc-html-4.16.5_08-150400.4.40.1 * openSUSE Leap 15.4 (aarch64 x86_64 i586) * xen-tools-domU-4.16.5_08-150400.4.40.1 * xen-libs-4.16.5_08-150400.4.40.1 * xen-libs-debuginfo-4.16.5_08-150400.4.40.1 * xen-tools-domU-debuginfo-4.16.5_08-150400.4.40.1 * xen-debugsource-4.16.5_08-150400.4.40.1 * xen-devel-4.16.5_08-150400.4.40.1 * openSUSE Leap 15.4 (x86_64) * xen-libs-32bit-4.16.5_08-150400.4.40.1 * xen-libs-32bit-debuginfo-4.16.5_08-150400.4.40.1 * openSUSE Leap 15.4 (noarch) * xen-tools-xendomains-wait-disk-4.16.5_08-150400.4.40.1 * openSUSE Leap 15.4 (aarch64_ilp32) * xen-libs-64bit-debuginfo-4.16.5_08-150400.4.40.1 * xen-libs-64bit-4.16.5_08-150400.4.40.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (x86_64) * xen-libs-4.16.5_08-150400.4.40.1 * xen-libs-debuginfo-4.16.5_08-150400.4.40.1 * xen-debugsource-4.16.5_08-150400.4.40.1 * SUSE Linux Enterprise Micro 5.3 (x86_64) * xen-libs-4.16.5_08-150400.4.40.1 * xen-libs-debuginfo-4.16.5_08-150400.4.40.1 * xen-debugsource-4.16.5_08-150400.4.40.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (x86_64) * xen-libs-4.16.5_08-150400.4.40.1 * xen-libs-debuginfo-4.16.5_08-150400.4.40.1 * xen-debugsource-4.16.5_08-150400.4.40.1 * SUSE Linux Enterprise Micro 5.4 (x86_64) * xen-libs-4.16.5_08-150400.4.40.1 * xen-libs-debuginfo-4.16.5_08-150400.4.40.1 * xen-debugsource-4.16.5_08-150400.4.40.1 * Basesystem Module 15-SP4 (x86_64) * xen-tools-domU-4.16.5_08-150400.4.40.1 * xen-libs-4.16.5_08-150400.4.40.1 * xen-libs-debuginfo-4.16.5_08-150400.4.40.1 * xen-tools-domU-debuginfo-4.16.5_08-150400.4.40.1 * xen-debugsource-4.16.5_08-150400.4.40.1 * Server Applications Module 15-SP4 (x86_64) * xen-tools-debuginfo-4.16.5_08-150400.4.40.1 * xen-4.16.5_08-150400.4.40.1 * xen-tools-4.16.5_08-150400.4.40.1 * xen-debugsource-4.16.5_08-150400.4.40.1 * xen-devel-4.16.5_08-150400.4.40.1 * Server Applications Module 15-SP4 (noarch) * xen-tools-xendomains-wait-disk-4.16.5_08-150400.4.40.1 * openSUSE Leap Micro 5.3 (x86_64) * xen-libs-4.16.5_08-150400.4.40.1 * xen-libs-debuginfo-4.16.5_08-150400.4.40.1 * xen-debugsource-4.16.5_08-150400.4.40.1 * openSUSE Leap Micro 5.4 (x86_64) * xen-libs-4.16.5_08-150400.4.40.1 * xen-libs-debuginfo-4.16.5_08-150400.4.40.1 * xen-debugsource-4.16.5_08-150400.4.40.1 ## References: * https://www.suse.com/security/cve/CVE-2023-20588.html * https://www.suse.com/security/cve/CVE-2023-34322.html * https://www.suse.com/security/cve/CVE-2023-34325.html * https://www.suse.com/security/cve/CVE-2023-34326.html * https://www.suse.com/security/cve/CVE-2023-34327.html * https://www.suse.com/security/cve/CVE-2023-34328.html * https://www.suse.com/security/cve/CVE-2023-46835.html * https://www.suse.com/security/cve/CVE-2023-46836.html * https://bugzilla.suse.com/show_bug.cgi?id=1027519 * https://bugzilla.suse.com/show_bug.cgi?id=1215145 * https://bugzilla.suse.com/show_bug.cgi?id=1215474 * https://bugzilla.suse.com/show_bug.cgi?id=1215746 * https://bugzilla.suse.com/show_bug.cgi?id=1215747 * https://bugzilla.suse.com/show_bug.cgi?id=1215748 * https://bugzilla.suse.com/show_bug.cgi?id=1216654 * https://bugzilla.suse.com/show_bug.cgi?id=1216807

1 0

SUSE-SU-2023:4463-1: moderate: Security update for libnbd
by security＠lists.opensuse.org 16 Nov '23

16 Nov '23

# Security update for libnbd Announcement ID: SUSE-SU-2023:4463-1 Rating: moderate References: * bsc#1216769 Cross-References: * CVE-2023-5871 CVSS scores: * CVE-2023-5871 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: * openSUSE Leap 15.3 * openSUSE Leap 15.4 * openSUSE Leap 15.5 An update that solves one vulnerability can now be installed. ## Description: This update for libnbd fixes the following issues: * CVE-2023-5871: Fixed an assertion problem in ext-mode BLOCK_STATUS (bsc#1216769). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-4463=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-4463=1 * openSUSE Leap 15.3 zypper in -t patch SUSE-2023-4463=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * libnbd-devel-1.18.1-150300.8.18.1 * libnbd-debuginfo-1.18.1-150300.8.18.1 * libnbd-1.18.1-150300.8.18.1 * libnbd0-1.18.1-150300.8.18.1 * libnbd0-debuginfo-1.18.1-150300.8.18.1 * nbdfuse-debuginfo-1.18.1-150300.8.18.1 * libnbd-debugsource-1.18.1-150300.8.18.1 * nbdfuse-1.18.1-150300.8.18.1 * openSUSE Leap 15.4 (noarch) * libnbd-bash-completion-1.18.1-150300.8.18.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * libnbd-devel-1.18.1-150300.8.18.1 * python3-libnbd-1.18.1-150300.8.18.1 * python3-libnbd-debuginfo-1.18.1-150300.8.18.1 * libnbd-debuginfo-1.18.1-150300.8.18.1 * libnbd-1.18.1-150300.8.18.1 * libnbd0-1.18.1-150300.8.18.1 * libnbd0-debuginfo-1.18.1-150300.8.18.1 * nbdfuse-debuginfo-1.18.1-150300.8.18.1 * libnbd-debugsource-1.18.1-150300.8.18.1 * nbdfuse-1.18.1-150300.8.18.1 * openSUSE Leap 15.5 (noarch) * libnbd-bash-completion-1.18.1-150300.8.18.1 * openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64 i586) * libnbd-devel-1.18.1-150300.8.18.1 * python3-libnbd-1.18.1-150300.8.18.1 * python3-libnbd-debuginfo-1.18.1-150300.8.18.1 * libnbd-debuginfo-1.18.1-150300.8.18.1 * libnbd-1.18.1-150300.8.18.1 * libnbd0-1.18.1-150300.8.18.1 * libnbd0-debuginfo-1.18.1-150300.8.18.1 * nbdfuse-debuginfo-1.18.1-150300.8.18.1 * libnbd-debugsource-1.18.1-150300.8.18.1 * nbdfuse-1.18.1-150300.8.18.1 * openSUSE Leap 15.3 (noarch) * libnbd-bash-completion-1.18.1-150300.8.18.1 ## References: * https://www.suse.com/security/cve/CVE-2023-5871.html * https://bugzilla.suse.com/show_bug.cgi?id=1216769

1 0

SUSE-SU-2023:4464-1: moderate: Security update for libxml2
by security＠lists.opensuse.org 16 Nov '23

16 Nov '23

# Security update for libxml2 Announcement ID: SUSE-SU-2023:4464-1 Rating: moderate References: * bsc#1216129 Cross-References: * CVE-2023-45322 CVSS scores: * CVE-2023-45322 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2023-45322 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise Micro 5.1 * SUSE Linux Enterprise Micro 5.2 * SUSE Linux Enterprise Micro for Rancher 5.2 An update that solves one vulnerability can now be installed. ## Description: This update for libxml2 fixes the following issues: * CVE-2023-45322: Fixed a use-after-free in xmlUnlinkNode() in tree.c (bsc#1216129). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-4464=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-4464=1 * SUSE Linux Enterprise Micro 5.1 zypper in -t patch SUSE-SUSE-MicroOS-5.1-2023-4464=1 * SUSE Linux Enterprise Micro 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2023-4464=1 * SUSE Linux Enterprise Micro for Rancher 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2023-4464=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * python3-libxml2-python-2.9.7-150000.3.63.1 * python3-libxml2-python-debuginfo-2.9.7-150000.3.63.1 * python-libxml2-python-debugsource-2.9.7-150000.3.63.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * python3-libxml2-python-2.9.7-150000.3.63.1 * python3-libxml2-python-debuginfo-2.9.7-150000.3.63.1 * python-libxml2-python-debugsource-2.9.7-150000.3.63.1 * SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64) * libxml2-2-debuginfo-2.9.7-150000.3.63.1 * libxml2-tools-debuginfo-2.9.7-150000.3.63.1 * libxml2-2-2.9.7-150000.3.63.1 * libxml2-tools-2.9.7-150000.3.63.1 * libxml2-debugsource-2.9.7-150000.3.63.1 * SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64) * python3-libxml2-python-2.9.7-150000.3.63.1 * libxml2-2-debuginfo-2.9.7-150000.3.63.1 * libxml2-tools-debuginfo-2.9.7-150000.3.63.1 * libxml2-2-2.9.7-150000.3.63.1 * libxml2-tools-2.9.7-150000.3.63.1 * libxml2-debugsource-2.9.7-150000.3.63.1 * python3-libxml2-python-debuginfo-2.9.7-150000.3.63.1 * python-libxml2-python-debugsource-2.9.7-150000.3.63.1 * SUSE Linux Enterprise Micro for Rancher 5.2 (aarch64 s390x x86_64) * python3-libxml2-python-2.9.7-150000.3.63.1 * libxml2-2-debuginfo-2.9.7-150000.3.63.1 * libxml2-tools-debuginfo-2.9.7-150000.3.63.1 * libxml2-2-2.9.7-150000.3.63.1 * libxml2-tools-2.9.7-150000.3.63.1 * libxml2-debugsource-2.9.7-150000.3.63.1 * python3-libxml2-python-debuginfo-2.9.7-150000.3.63.1 * python-libxml2-python-debugsource-2.9.7-150000.3.63.1 ## References: * https://www.suse.com/security/cve/CVE-2023-45322.html * https://bugzilla.suse.com/show_bug.cgi?id=1216129

1 0

SUSE-SU-2023:4465-1: important: Security update for python-Pillow
by security＠lists.opensuse.org 16 Nov '23

16 Nov '23

# Security update for python-Pillow Announcement ID: SUSE-SU-2023:4465-1 Rating: important References: * bsc#1216894 Cross-References: * CVE-2023-44271 CVSS scores: * CVE-2023-44271 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-44271 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * openSUSE Leap 15.3 * openSUSE Leap 15.4 * openSUSE Leap 15.5 An update that solves one vulnerability can now be installed. ## Description: This update for python-Pillow fixes the following issues: * CVE-2023-44271: Fixed uncontrolled resource consumption when textlength in an ImageDraw instance operates on a long text argument (bsc#1216894). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-4465=1 * openSUSE Leap 15.3 zypper in -t patch SUSE-2023-4465=1 * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-4465=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * python-Pillow-debuginfo-7.2.0-150300.3.3.1 * python3-Pillow-tk-debuginfo-7.2.0-150300.3.3.1 * python3-Pillow-tk-7.2.0-150300.3.3.1 * python3-Pillow-7.2.0-150300.3.3.1 * python-Pillow-debugsource-7.2.0-150300.3.3.1 * python3-Pillow-debuginfo-7.2.0-150300.3.3.1 * openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64 i586) * python-Pillow-debuginfo-7.2.0-150300.3.3.1 * python3-Pillow-tk-debuginfo-7.2.0-150300.3.3.1 * python3-Pillow-tk-7.2.0-150300.3.3.1 * python3-Pillow-7.2.0-150300.3.3.1 * python-Pillow-debugsource-7.2.0-150300.3.3.1 * python3-Pillow-debuginfo-7.2.0-150300.3.3.1 * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * python-Pillow-debuginfo-7.2.0-150300.3.3.1 * python3-Pillow-tk-debuginfo-7.2.0-150300.3.3.1 * python3-Pillow-tk-7.2.0-150300.3.3.1 * python3-Pillow-7.2.0-150300.3.3.1 * python-Pillow-debugsource-7.2.0-150300.3.3.1 * python3-Pillow-debuginfo-7.2.0-150300.3.3.1 ## References: * https://www.suse.com/security/cve/CVE-2023-44271.html * https://bugzilla.suse.com/show_bug.cgi?id=1216894

1 0

SUSE-SU-2023:4466-1: important: Security update for xen
by security＠lists.opensuse.org 16 Nov '23

16 Nov '23

# Security update for xen Announcement ID: SUSE-SU-2023:4466-1 Rating: important References: * bsc#1216654 * bsc#1216807 Cross-References: * CVE-2023-46835 * CVE-2023-46836 CVSS scores: * CVE-2023-46835 ( SUSE ): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Affected Products: * openSUSE Leap 15.3 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise Micro 5.1 * SUSE Linux Enterprise Micro 5.2 * SUSE Linux Enterprise Micro for Rancher 5.2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 An update that solves two vulnerabilities can now be installed. ## Description: This update for xen fixes the following issues: * CVE-2023-46835: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) (bsc#1216654). * CVE-2023-46836: x86: BTC/SRSO fixes not fully effective (XSA-446) (bsc#1216807). ## Special Instructions and Notes: * Please reboot the system after installing this update. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.3 zypper in -t patch SUSE-2023-4466=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-4466=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-4466=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-4466=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-4466=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2023-4466=1 * SUSE Linux Enterprise Micro 5.1 zypper in -t patch SUSE-SUSE-MicroOS-5.1-2023-4466=1 * SUSE Linux Enterprise Micro 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2023-4466=1 * SUSE Linux Enterprise Micro for Rancher 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2023-4466=1 ## Package List: * openSUSE Leap 15.3 (aarch64 x86_64 i586) * xen-debugsource-4.14.6_08-150300.3.60.1 * xen-tools-domU-debuginfo-4.14.6_08-150300.3.60.1 * xen-libs-debuginfo-4.14.6_08-150300.3.60.1 * xen-libs-4.14.6_08-150300.3.60.1 * xen-tools-domU-4.14.6_08-150300.3.60.1 * xen-devel-4.14.6_08-150300.3.60.1 * openSUSE Leap 15.3 (x86_64) * xen-libs-32bit-4.14.6_08-150300.3.60.1 * xen-libs-32bit-debuginfo-4.14.6_08-150300.3.60.1 * openSUSE Leap 15.3 (aarch64 x86_64) * xen-tools-debuginfo-4.14.6_08-150300.3.60.1 * xen-tools-4.14.6_08-150300.3.60.1 * xen-4.14.6_08-150300.3.60.1 * xen-doc-html-4.14.6_08-150300.3.60.1 * openSUSE Leap 15.3 (noarch) * xen-tools-xendomains-wait-disk-4.14.6_08-150300.3.60.1 * openSUSE Leap 15.3 (aarch64_ilp32) * xen-libs-64bit-4.14.6_08-150300.3.60.1 * xen-libs-64bit-debuginfo-4.14.6_08-150300.3.60.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (x86_64) * xen-4.14.6_08-150300.3.60.1 * xen-debugsource-4.14.6_08-150300.3.60.1 * xen-tools-debuginfo-4.14.6_08-150300.3.60.1 * xen-tools-domU-debuginfo-4.14.6_08-150300.3.60.1 * xen-libs-debuginfo-4.14.6_08-150300.3.60.1 * xen-libs-4.14.6_08-150300.3.60.1 * xen-tools-domU-4.14.6_08-150300.3.60.1 * xen-tools-4.14.6_08-150300.3.60.1 * xen-devel-4.14.6_08-150300.3.60.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (noarch) * xen-tools-xendomains-wait-disk-4.14.6_08-150300.3.60.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (x86_64) * xen-4.14.6_08-150300.3.60.1 * xen-debugsource-4.14.6_08-150300.3.60.1 * xen-tools-debuginfo-4.14.6_08-150300.3.60.1 * xen-tools-domU-debuginfo-4.14.6_08-150300.3.60.1 * xen-libs-debuginfo-4.14.6_08-150300.3.60.1 * xen-libs-4.14.6_08-150300.3.60.1 * xen-tools-domU-4.14.6_08-150300.3.60.1 * xen-tools-4.14.6_08-150300.3.60.1 * xen-devel-4.14.6_08-150300.3.60.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch) * xen-tools-xendomains-wait-disk-4.14.6_08-150300.3.60.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (x86_64) * xen-4.14.6_08-150300.3.60.1 * xen-debugsource-4.14.6_08-150300.3.60.1 * xen-tools-debuginfo-4.14.6_08-150300.3.60.1 * xen-tools-domU-debuginfo-4.14.6_08-150300.3.60.1 * xen-libs-debuginfo-4.14.6_08-150300.3.60.1 * xen-libs-4.14.6_08-150300.3.60.1 * xen-tools-domU-4.14.6_08-150300.3.60.1 * xen-tools-4.14.6_08-150300.3.60.1 * xen-devel-4.14.6_08-150300.3.60.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (noarch) * xen-tools-xendomains-wait-disk-4.14.6_08-150300.3.60.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (x86_64) * xen-4.14.6_08-150300.3.60.1 * xen-debugsource-4.14.6_08-150300.3.60.1 * xen-tools-debuginfo-4.14.6_08-150300.3.60.1 * xen-tools-domU-debuginfo-4.14.6_08-150300.3.60.1 * xen-libs-debuginfo-4.14.6_08-150300.3.60.1 * xen-libs-4.14.6_08-150300.3.60.1 * xen-tools-domU-4.14.6_08-150300.3.60.1 * xen-tools-4.14.6_08-150300.3.60.1 * xen-devel-4.14.6_08-150300.3.60.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (noarch) * xen-tools-xendomains-wait-disk-4.14.6_08-150300.3.60.1 * SUSE Enterprise Storage 7.1 (x86_64) * xen-4.14.6_08-150300.3.60.1 * xen-debugsource-4.14.6_08-150300.3.60.1 * xen-tools-debuginfo-4.14.6_08-150300.3.60.1 * xen-tools-domU-debuginfo-4.14.6_08-150300.3.60.1 * xen-libs-debuginfo-4.14.6_08-150300.3.60.1 * xen-libs-4.14.6_08-150300.3.60.1 * xen-tools-domU-4.14.6_08-150300.3.60.1 * xen-tools-4.14.6_08-150300.3.60.1 * xen-devel-4.14.6_08-150300.3.60.1 * SUSE Enterprise Storage 7.1 (noarch) * xen-tools-xendomains-wait-disk-4.14.6_08-150300.3.60.1 * SUSE Linux Enterprise Micro 5.1 (x86_64) * xen-libs-debuginfo-4.14.6_08-150300.3.60.1 * xen-debugsource-4.14.6_08-150300.3.60.1 * xen-libs-4.14.6_08-150300.3.60.1 * SUSE Linux Enterprise Micro 5.2 (x86_64) * xen-libs-debuginfo-4.14.6_08-150300.3.60.1 * xen-debugsource-4.14.6_08-150300.3.60.1 * xen-libs-4.14.6_08-150300.3.60.1 * SUSE Linux Enterprise Micro for Rancher 5.2 (x86_64) * xen-libs-debuginfo-4.14.6_08-150300.3.60.1 * xen-debugsource-4.14.6_08-150300.3.60.1 * xen-libs-4.14.6_08-150300.3.60.1 ## References: * https://www.suse.com/security/cve/CVE-2023-46835.html * https://www.suse.com/security/cve/CVE-2023-46836.html * https://bugzilla.suse.com/show_bug.cgi?id=1216654 * https://bugzilla.suse.com/show_bug.cgi?id=1216807

1 0

SUSE-SU-2023:4467-1: moderate: Security update for python-urllib3
by security＠lists.opensuse.org 16 Nov '23

16 Nov '23

# Security update for python-urllib3 Announcement ID: SUSE-SU-2023:4467-1 Rating: moderate References: * bsc#1216377 Cross-References: * CVE-2023-45803 CVSS scores: * CVE-2023-45803 ( SUSE ): 4.2 CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N * CVE-2023-45803 ( NVD ): 4.2 CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N Affected Products: * Basesystem Module 15-SP4 * Basesystem Module 15-SP5 * openSUSE Leap 15.3 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * openSUSE Leap Micro 5.3 * openSUSE Leap Micro 5.4 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.1 * SUSE Linux Enterprise Micro 5.2 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Micro for Rancher 5.2 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.2 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.2 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.2 * SUSE Manager Server 4.3 An update that solves one vulnerability can now be installed. ## Description: This update for python-urllib3 fixes the following issues: * CVE-2023-45803: Fix a request body leak that could occur when receiving a 303 HTTP response (bsc#1216377). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.3 zypper in -t patch SUSE-2023-4467=1 * openSUSE Leap Micro 5.3 zypper in -t patch openSUSE-Leap-Micro-5.3-2023-4467=1 * openSUSE Leap Micro 5.4 zypper in -t patch openSUSE-Leap-Micro-5.4-2023-4467=1 * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-4467=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-4467=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2023-4467=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2023-4467=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2023-4467=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2023-4467=1 * SUSE Linux Enterprise Micro 5.5 zypper in -t patch SUSE-SLE-Micro-5.5-2023-4467=1 * Basesystem Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-4467=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-4467=1 * SUSE Manager Proxy 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.2-2023-4467=1 * SUSE Manager Retail Branch Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.2-2023-4467=1 * SUSE Manager Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-4467=1 * SUSE Linux Enterprise Micro 5.1 zypper in -t patch SUSE-SUSE-MicroOS-5.1-2023-4467=1 * SUSE Linux Enterprise Micro 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2023-4467=1 * SUSE Linux Enterprise Micro for Rancher 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2023-4467=1 ## Package List: * openSUSE Leap 15.3 (noarch) * python3-urllib3-1.25.10-150300.4.9.1 * openSUSE Leap Micro 5.3 (noarch) * python3-urllib3-1.25.10-150300.4.9.1 * openSUSE Leap Micro 5.4 (noarch) * python3-urllib3-1.25.10-150300.4.9.1 * openSUSE Leap 15.4 (noarch) * python3-urllib3-1.25.10-150300.4.9.1 * openSUSE Leap 15.5 (noarch) * python3-urllib3-1.25.10-150300.4.9.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (noarch) * python3-urllib3-1.25.10-150300.4.9.1 * SUSE Linux Enterprise Micro 5.3 (noarch) * python3-urllib3-1.25.10-150300.4.9.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (noarch) * python3-urllib3-1.25.10-150300.4.9.1 * SUSE Linux Enterprise Micro 5.4 (noarch) * python3-urllib3-1.25.10-150300.4.9.1 * SUSE Linux Enterprise Micro 5.5 (noarch) * python3-urllib3-1.25.10-150300.4.9.1 * Basesystem Module 15-SP4 (noarch) * python3-urllib3-1.25.10-150300.4.9.1 * Basesystem Module 15-SP5 (noarch) * python3-urllib3-1.25.10-150300.4.9.1 * SUSE Manager Proxy 4.2 (noarch) * python3-urllib3-1.25.10-150300.4.9.1 * SUSE Manager Retail Branch Server 4.2 (noarch) * python3-urllib3-1.25.10-150300.4.9.1 * SUSE Manager Server 4.2 (noarch) * python3-urllib3-1.25.10-150300.4.9.1 * SUSE Linux Enterprise Micro 5.1 (noarch) * python3-urllib3-1.25.10-150300.4.9.1 * SUSE Linux Enterprise Micro 5.2 (noarch) * python3-urllib3-1.25.10-150300.4.9.1 * SUSE Linux Enterprise Micro for Rancher 5.2 (noarch) * python3-urllib3-1.25.10-150300.4.9.1 ## References: * https://www.suse.com/security/cve/CVE-2023-45803.html * https://bugzilla.suse.com/show_bug.cgi?id=1216377

1 0

SUSE-SU-2023:4469-1: moderate: Security update for go1.21-openssl
by security＠lists.opensuse.org 16 Nov '23

16 Nov '23

# Security update for go1.21-openssl Announcement ID: SUSE-SU-2023:4469-1 Rating: moderate References: * bsc#1212475 * bsc#1212667 * bsc#1212669 * bsc#1215084 * bsc#1215085 * bsc#1215086 * bsc#1215087 * bsc#1215090 * bsc#1215985 * bsc#1216109 * bsc#1216943 * bsc#1216944 * jsc#SLE-18320 Cross-References: * CVE-2023-39318 * CVE-2023-39319 * CVE-2023-39320 * CVE-2023-39321 * CVE-2023-39322 * CVE-2023-39323 * CVE-2023-39325 * CVE-2023-44487 * CVE-2023-45283 * CVE-2023-45284 CVSS scores: * CVE-2023-39318 ( SUSE ): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N * CVE-2023-39318 ( NVD ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2023-39319 ( SUSE ): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N * CVE-2023-39319 ( NVD ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2023-39320 ( SUSE ): 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2023-39320 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2023-39321 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-39321 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-39322 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-39322 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-39323 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-39323 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2023-39325 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-39325 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-44487 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-44487 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-45283 ( SUSE ): 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N * CVE-2023-45284 ( SUSE ): 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N Affected Products: * Development Tools Module 15-SP4 * Development Tools Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves 10 vulnerabilities, contains one feature and has two security fixes can now be installed. ## Description: This update for go1.21-openssl fixes the following issues: Update to version 1.21.4.1 cut from the go1.21-openssl-fips branch at the revision tagged go1.21.4-1-openssl-fips. * Update to go1.21.4 go1.21.4 (released 2023-11-07) includes security fixes to the path/filepath package, as well as bug fixes to the linker, the runtime, the compiler, and the go/types, net/http, and runtime/cgo packages. * security: fix CVE-2023-45283 CVE-2023-45284 path/filepath: insecure parsing of Windows paths (bsc#1216943, bsc#1216944) * spec: update unification rules * cmd/compile: internal compiler error: expected struct value to have type struct * cmd/link: split text sections for arm 32-bit * runtime: MADV_COLLAPSE causes production performance issues on Linux * go/types, x/tools/go/ssa: panic: type param without replacement encountered * cmd/compile: -buildmode=c-archive produces code not suitable for use in a shared object on arm64 * net/http: http2 page fails on firefox/safari if pushing resources Initial package go1.21-openssl version 1.21.3.1 cut from the go1.21-openssl-fips branch at the revision tagged go1.21.3-1-openssl-fips. (jsc#SLE-18320) * Go upstream merged branch dev.boringcrypto in go1.19+. * In go1.x enable BoringCrypto via GOEXPERIMENT=boringcrypto. * In go1.x-openssl enable FIPS mode (or boring mode as the package is named) either via an environment variable GOLANG_FIPS=1 or by virtue of booting the host in FIPS mode. * When the operating system is operating in FIPS mode, Go applications which import crypto/tls/fipsonly limit operations to the FIPS ciphersuite. * go1.x-openssl is delivered as two large patches to go1.x applying necessary modifications from the golang-fips/go GitHub project for the Go crypto library to use OpenSSL as the external cryptographic library in a FIPS compliant way. * go1.x-openssl modifies the crypto/* packages to use OpenSSL for cryptographic operations. * go1.x-openssl uses dlopen() to call into OpenSSL. * SUSE RPM packaging introduces a fourth version digit go1.x.y.z corresponding to the golang-fips/go patchset tagged revision. * Patchset improvements can be updated independently of upstream Go maintenance releases. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-4469=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-4469=1 * Development Tools Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2023-4469=1 * Development Tools Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP5-2023-4469=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * go1.21-openssl-doc-1.21.4.1-150000.1.5.1 * go1.21-openssl-race-1.21.4.1-150000.1.5.1 * go1.21-openssl-1.21.4.1-150000.1.5.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * go1.21-openssl-doc-1.21.4.1-150000.1.5.1 * go1.21-openssl-race-1.21.4.1-150000.1.5.1 * go1.21-openssl-1.21.4.1-150000.1.5.1 * Development Tools Module 15-SP4 (aarch64 ppc64le s390x x86_64) * go1.21-openssl-doc-1.21.4.1-150000.1.5.1 * go1.21-openssl-race-1.21.4.1-150000.1.5.1 * go1.21-openssl-1.21.4.1-150000.1.5.1 * Development Tools Module 15-SP5 (aarch64 ppc64le s390x x86_64) * go1.21-openssl-doc-1.21.4.1-150000.1.5.1 * go1.21-openssl-race-1.21.4.1-150000.1.5.1 * go1.21-openssl-1.21.4.1-150000.1.5.1 ## References: * https://www.suse.com/security/cve/CVE-2023-39318.html * https://www.suse.com/security/cve/CVE-2023-39319.html * https://www.suse.com/security/cve/CVE-2023-39320.html * https://www.suse.com/security/cve/CVE-2023-39321.html * https://www.suse.com/security/cve/CVE-2023-39322.html * https://www.suse.com/security/cve/CVE-2023-39323.html * https://www.suse.com/security/cve/CVE-2023-39325.html * https://www.suse.com/security/cve/CVE-2023-44487.html * https://www.suse.com/security/cve/CVE-2023-45283.html * https://www.suse.com/security/cve/CVE-2023-45284.html * https://bugzilla.suse.com/show_bug.cgi?id=1212475 * https://bugzilla.suse.com/show_bug.cgi?id=1212667 * https://bugzilla.suse.com/show_bug.cgi?id=1212669 * https://bugzilla.suse.com/show_bug.cgi?id=1215084 * https://bugzilla.suse.com/show_bug.cgi?id=1215085 * https://bugzilla.suse.com/show_bug.cgi?id=1215086 * https://bugzilla.suse.com/show_bug.cgi?id=1215087 * https://bugzilla.suse.com/show_bug.cgi?id=1215090 * https://bugzilla.suse.com/show_bug.cgi?id=1215985 * https://bugzilla.suse.com/show_bug.cgi?id=1216109 * https://bugzilla.suse.com/show_bug.cgi?id=1216943 * https://bugzilla.suse.com/show_bug.cgi?id=1216944 * https://jira.suse.com/browse/SLE-18320

1 0

SUSE-SU-2023:4470-1: moderate: Security update for go1.20
by security＠lists.opensuse.org 16 Nov '23

16 Nov '23

# Security update for go1.20 Announcement ID: SUSE-SU-2023:4470-1 Rating: moderate References: * bsc#1206346 * bsc#1216943 * bsc#1216944 Cross-References: * CVE-2023-45283 * CVE-2023-45284 CVSS scores: * CVE-2023-45283 ( SUSE ): 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N * CVE-2023-45284 ( SUSE ): 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N Affected Products: * Development Tools Module 15-SP4 * Development Tools Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves two vulnerabilities and has one security fix can now be installed. ## Description: This update for go1.20 fixes the following issues: go1.20.11 (released 2023-11-07) includes security fixes to the path/filepath package, as well as bug fixes to the linker and the net/http package. * security: fix CVE-2023-45283 CVE-2023-45284 path/filepath: insecure parsing of Windows paths (bsc#1216943, bsc#1216944) * cmd/link: split text sections for arm 32-bit * net/http: http2 page fails on firefox/safari if pushing resources ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-4470=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-4470=1 * Development Tools Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2023-4470=1 * Development Tools Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP5-2023-4470=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * go1.20-race-1.20.11-150000.1.32.1 * go1.20-debuginfo-1.20.11-150000.1.32.1 * go1.20-1.20.11-150000.1.32.1 * go1.20-doc-1.20.11-150000.1.32.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * go1.20-race-1.20.11-150000.1.32.1 * go1.20-debuginfo-1.20.11-150000.1.32.1 * go1.20-1.20.11-150000.1.32.1 * go1.20-doc-1.20.11-150000.1.32.1 * Development Tools Module 15-SP4 (aarch64 ppc64le s390x x86_64) * go1.20-doc-1.20.11-150000.1.32.1 * go1.20-1.20.11-150000.1.32.1 * Development Tools Module 15-SP4 (aarch64 x86_64) * go1.20-race-1.20.11-150000.1.32.1 * Development Tools Module 15-SP5 (aarch64 ppc64le s390x x86_64) * go1.20-race-1.20.11-150000.1.32.1 * go1.20-debuginfo-1.20.11-150000.1.32.1 * go1.20-1.20.11-150000.1.32.1 * go1.20-doc-1.20.11-150000.1.32.1 ## References: * https://www.suse.com/security/cve/CVE-2023-45283.html * https://www.suse.com/security/cve/CVE-2023-45284.html * https://bugzilla.suse.com/show_bug.cgi?id=1206346 * https://bugzilla.suse.com/show_bug.cgi?id=1216943 * https://bugzilla.suse.com/show_bug.cgi?id=1216944

1 0