July 2023 - openSUSE Security Announce

SUSE-SU-2023:3079-1: important: Security update for the Linux Kernel (Live Patch 2 for SLE 15 SP4)
by security＠lists.opensuse.org 31 Jul '23

31 Jul '23

# Security update for the Linux Kernel (Live Patch 2 for SLE 15 SP4) Announcement ID: SUSE-SU-2023:3079-1 Rating: important References: * #1210566 * #1210987 * #1212509 Cross-References: * CVE-2023-2002 * CVE-2023-2235 * CVE-2023-35788 CVSS scores: * CVE-2023-2002 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-2002 ( NVD ): 6.8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H * CVE-2023-2235 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-2235 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-35788 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H * CVE-2023-35788 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise Live Patching 15-SP4 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 An update that solves three vulnerabilities can now be installed. ## Description: This update for the Linux Kernel 5.14.21-150400_24_18 fixes several issues. The following security issues were fixed: * CVE-2023-35788: Fixed an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets in fl_set_geneve_opt in net/sched/cls_flower.c (bsc#1212509). * CVE-2023-2235: Fixed an use-after-free in the Performance Events system can be exploited to achieve local privilege escalation (bsc#1210987). * CVE-2023-2002: Fixed a flaw that allowed an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth communication (bsc#1210566). ## Patch Instructions: To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2023-3079=1 SUSE-2023-3080=1 * SUSE Linux Enterprise Live Patching 15-SP4 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP4-2023-3079=1 SUSE-SLE- Module-Live-Patching-15-SP4-2023-3080=1 ## Package List: * openSUSE Leap 15.4 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150400_24_18-default-debuginfo-13-150400.2.2 * kernel-livepatch-5_14_21-150400_24_38-default-debuginfo-8-150400.2.2 * kernel-livepatch-5_14_21-150400_24_18-default-13-150400.2.2 * kernel-livepatch-5_14_21-150400_24_38-default-8-150400.2.2 * kernel-livepatch-SLE15-SP4_Update_6-debugsource-8-150400.2.2 * kernel-livepatch-SLE15-SP4_Update_2-debugsource-13-150400.2.2 * SUSE Linux Enterprise Live Patching 15-SP4 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150400_24_18-default-debuginfo-13-150400.2.2 * kernel-livepatch-5_14_21-150400_24_38-default-debuginfo-8-150400.2.2 * kernel-livepatch-5_14_21-150400_24_18-default-13-150400.2.2 * kernel-livepatch-5_14_21-150400_24_38-default-8-150400.2.2 * kernel-livepatch-SLE15-SP4_Update_6-debugsource-8-150400.2.2 * kernel-livepatch-SLE15-SP4_Update_2-debugsource-13-150400.2.2 ## References: * https://www.suse.com/security/cve/CVE-2023-2002.html * https://www.suse.com/security/cve/CVE-2023-2235.html * https://www.suse.com/security/cve/CVE-2023-35788.html * https://bugzilla.suse.com/show_bug.cgi?id=1210566 * https://bugzilla.suse.com/show_bug.cgi?id=1210987 * https://bugzilla.suse.com/show_bug.cgi?id=1212509

1 0

SUSE-SU-2023:3063-1: important: Security update for the Linux Kernel RT (Live Patch 2 for SLE 15 SP4)
by security＠lists.opensuse.org 31 Jul '23

31 Jul '23

# Security update for the Linux Kernel RT (Live Patch 2 for SLE 15 SP4) Announcement ID: SUSE-SU-2023:3063-1 Rating: important References: * #1210566 * #1210987 * #1212509 Cross-References: * CVE-2023-2002 * CVE-2023-2235 * CVE-2023-35788 CVSS scores: * CVE-2023-2002 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-2002 ( NVD ): 6.8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H * CVE-2023-2235 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-2235 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-35788 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H * CVE-2023-35788 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise Live Patching 15-SP4 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 An update that solves three vulnerabilities can now be installed. ## Description: This update for the Linux Kernel 5.14.21-150400_15_8 fixes several issues. The following security issues were fixed: * CVE-2023-35788: Fixed an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets in fl_set_geneve_opt in net/sched/cls_flower.c (bsc#1212509). * CVE-2023-2235: Fixed an use-after-free in the Performance Events system can be exploited to achieve local privilege escalation (bsc#1210987). * CVE-2023-2002: Fixed a flaw that allowed an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth communication (bsc#1210566). ## Patch Instructions: To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Live Patching 15-SP4 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP4-2023-3064=1 SUSE-SLE- Module-Live-Patching-15-SP4-2023-3070=1 SUSE-SLE-Module-Live- Patching-15-SP4-2023-3067=1 SUSE-SLE-Module-Live-Patching-15-SP4-2023-3063=1 * openSUSE Leap 15.4 zypper in -t patch SUSE-2023-3064=1 SUSE-2023-3070=1 SUSE-2023-3067=1 ## Package List: * SUSE Linux Enterprise Live Patching 15-SP4 (x86_64) * kernel-livepatch-5_14_21-150400_15_8-rt-7-150400.2.2 * kernel-livepatch-SLE15-SP4-RT_Update_2-debugsource-7-150400.2.2 * kernel-livepatch-5_14_21-150400_15_8-rt-debuginfo-7-150400.2.2 * SUSE Linux Enterprise Live Patching 15-SP4 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150400_24_46-default-debuginfo-6-150400.2.2 * kernel-livepatch-5_14_21-150400_24_33-default-9-150400.2.2 * kernel-livepatch-5_14_21-150400_24_21-default-12-150400.2.2 * kernel-livepatch-SLE15-SP4_Update_5-debugsource-9-150400.2.2 * kernel-livepatch-SLE15-SP4_Update_8-debugsource-6-150400.2.2 * kernel-livepatch-SLE15-SP4_Update_3-debugsource-12-150400.2.2 * kernel-livepatch-5_14_21-150400_24_46-default-6-150400.2.2 * kernel-livepatch-5_14_21-150400_24_33-default-debuginfo-9-150400.2.2 * kernel-livepatch-5_14_21-150400_24_21-default-debuginfo-12-150400.2.2 * openSUSE Leap 15.4 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150400_24_46-default-debuginfo-6-150400.2.2 * kernel-livepatch-5_14_21-150400_24_33-default-9-150400.2.2 * kernel-livepatch-5_14_21-150400_24_21-default-12-150400.2.2 * kernel-livepatch-SLE15-SP4_Update_5-debugsource-9-150400.2.2 * kernel-livepatch-SLE15-SP4_Update_8-debugsource-6-150400.2.2 * kernel-livepatch-SLE15-SP4_Update_3-debugsource-12-150400.2.2 * kernel-livepatch-5_14_21-150400_24_46-default-6-150400.2.2 * kernel-livepatch-5_14_21-150400_24_33-default-debuginfo-9-150400.2.2 * kernel-livepatch-5_14_21-150400_24_21-default-debuginfo-12-150400.2.2 ## References: * https://www.suse.com/security/cve/CVE-2023-2002.html * https://www.suse.com/security/cve/CVE-2023-2235.html * https://www.suse.com/security/cve/CVE-2023-35788.html * https://bugzilla.suse.com/show_bug.cgi?id=1210566 * https://bugzilla.suse.com/show_bug.cgi?id=1210987 * https://bugzilla.suse.com/show_bug.cgi?id=1212509

1 0

SUSE-SU-2023:3043-1: moderate: Security update for libvirt
by security＠lists.opensuse.org 31 Jul '23

31 Jul '23

# Security update for libvirt Announcement ID: SUSE-SU-2023:3043-1 Rating: moderate References: * #1213352 * #1213447 Cross-References: * CVE-2023-3750 CVSS scores: * CVE-2023-3750 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2023-3750 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.5 * Server Applications Module 15-SP5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves one vulnerability and has one fix can now be installed. ## Description: This update for libvirt fixes the following issues: Security fixes: * CVE-2023-3750: Fixed mproper locking in virStoragePoolObjListSearch that may lead to denial of service (bsc#1213447). Other fixes: * build library with support for modular daemons (bsc#1213352). ## Patch Instructions: To install this SUSE Moderate update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2023-3043=1 openSUSE-SLE-15.5-2023-3043=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-3043=1 * Server Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP5-2023-3043=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * libvirt-daemon-driver-nwfilter-9.0.0-150500.6.11.1 * libvirt-client-9.0.0-150500.6.11.1 * libvirt-9.0.0-150500.6.11.1 * libvirt-daemon-9.0.0-150500.6.11.1 * libvirt-client-qemu-9.0.0-150500.6.11.1 * libvirt-devel-9.0.0-150500.6.11.1 * libvirt-daemon-driver-storage-core-9.0.0-150500.6.11.1 * libvirt-daemon-driver-qemu-debuginfo-9.0.0-150500.6.11.1 * libvirt-daemon-hooks-9.0.0-150500.6.11.1 * libvirt-daemon-qemu-9.0.0-150500.6.11.1 * libvirt-daemon-config-nwfilter-9.0.0-150500.6.11.1 * libvirt-daemon-driver-interface-debuginfo-9.0.0-150500.6.11.1 * libvirt-daemon-debuginfo-9.0.0-150500.6.11.1 * wireshark-plugin-libvirt-9.0.0-150500.6.11.1 * libvirt-daemon-driver-storage-core-debuginfo-9.0.0-150500.6.11.1 * libvirt-daemon-driver-nwfilter-debuginfo-9.0.0-150500.6.11.1 * libvirt-daemon-driver-storage-gluster-debuginfo-9.0.0-150500.6.11.1 * libvirt-daemon-driver-storage-logical-9.0.0-150500.6.11.1 * libvirt-nss-9.0.0-150500.6.11.1 * libvirt-daemon-driver-storage-iscsi-debuginfo-9.0.0-150500.6.11.1 * libvirt-daemon-driver-storage-iscsi-direct-debuginfo-9.0.0-150500.6.11.1 * libvirt-daemon-driver-secret-debuginfo-9.0.0-150500.6.11.1 * libvirt-nss-debuginfo-9.0.0-150500.6.11.1 * libvirt-daemon-driver-nodedev-9.0.0-150500.6.11.1 * libvirt-daemon-driver-storage-logical-debuginfo-9.0.0-150500.6.11.1 * libvirt-daemon-driver-storage-scsi-9.0.0-150500.6.11.1 * libvirt-daemon-driver-lxc-debuginfo-9.0.0-150500.6.11.1 * libvirt-libs-9.0.0-150500.6.11.1 * libvirt-daemon-driver-nodedev-debuginfo-9.0.0-150500.6.11.1 * libvirt-daemon-driver-storage-mpath-debuginfo-9.0.0-150500.6.11.1 * libvirt-daemon-driver-secret-9.0.0-150500.6.11.1 * libvirt-daemon-driver-storage-disk-9.0.0-150500.6.11.1 * libvirt-lock-sanlock-debuginfo-9.0.0-150500.6.11.1 * libvirt-daemon-driver-network-9.0.0-150500.6.11.1 * libvirt-libs-debuginfo-9.0.0-150500.6.11.1 * libvirt-client-debuginfo-9.0.0-150500.6.11.1 * libvirt-daemon-driver-network-debuginfo-9.0.0-150500.6.11.1 * libvirt-daemon-driver-interface-9.0.0-150500.6.11.1 * libvirt-daemon-driver-storage-disk-debuginfo-9.0.0-150500.6.11.1 * libvirt-lock-sanlock-9.0.0-150500.6.11.1 * libvirt-daemon-config-network-9.0.0-150500.6.11.1 * wireshark-plugin-libvirt-debuginfo-9.0.0-150500.6.11.1 * libvirt-daemon-driver-storage-iscsi-9.0.0-150500.6.11.1 * libvirt-debugsource-9.0.0-150500.6.11.1 * libvirt-daemon-lxc-9.0.0-150500.6.11.1 * libvirt-daemon-driver-storage-iscsi-direct-9.0.0-150500.6.11.1 * libvirt-daemon-driver-storage-gluster-9.0.0-150500.6.11.1 * libvirt-daemon-driver-storage-scsi-debuginfo-9.0.0-150500.6.11.1 * libvirt-daemon-driver-storage-9.0.0-150500.6.11.1 * libvirt-daemon-driver-lxc-9.0.0-150500.6.11.1 * libvirt-daemon-driver-storage-mpath-9.0.0-150500.6.11.1 * libvirt-daemon-driver-qemu-9.0.0-150500.6.11.1 * openSUSE Leap 15.5 (x86_64) * libvirt-client-32bit-debuginfo-9.0.0-150500.6.11.1 * libvirt-daemon-xen-9.0.0-150500.6.11.1 * libvirt-daemon-driver-libxl-debuginfo-9.0.0-150500.6.11.1 * libvirt-devel-32bit-9.0.0-150500.6.11.1 * libvirt-daemon-driver-libxl-9.0.0-150500.6.11.1 * openSUSE Leap 15.5 (noarch) * libvirt-doc-9.0.0-150500.6.11.1 * openSUSE Leap 15.5 (aarch64 x86_64) * libvirt-daemon-driver-storage-rbd-debuginfo-9.0.0-150500.6.11.1 * libvirt-daemon-driver-storage-rbd-9.0.0-150500.6.11.1 * openSUSE Leap 15.5 (aarch64_ilp32) * libvirt-devel-64bit-9.0.0-150500.6.11.1 * libvirt-client-64bit-debuginfo-9.0.0-150500.6.11.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * libvirt-debugsource-9.0.0-150500.6.11.1 * libvirt-libs-debuginfo-9.0.0-150500.6.11.1 * libvirt-libs-9.0.0-150500.6.11.1 * Server Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64) * libvirt-daemon-driver-nwfilter-9.0.0-150500.6.11.1 * libvirt-client-9.0.0-150500.6.11.1 * libvirt-9.0.0-150500.6.11.1 * libvirt-daemon-9.0.0-150500.6.11.1 * libvirt-client-qemu-9.0.0-150500.6.11.1 * libvirt-devel-9.0.0-150500.6.11.1 * libvirt-daemon-driver-storage-core-9.0.0-150500.6.11.1 * libvirt-daemon-driver-qemu-debuginfo-9.0.0-150500.6.11.1 * libvirt-daemon-hooks-9.0.0-150500.6.11.1 * libvirt-daemon-qemu-9.0.0-150500.6.11.1 * libvirt-daemon-config-nwfilter-9.0.0-150500.6.11.1 * libvirt-daemon-driver-interface-debuginfo-9.0.0-150500.6.11.1 * libvirt-daemon-debuginfo-9.0.0-150500.6.11.1 * libvirt-daemon-driver-storage-core-debuginfo-9.0.0-150500.6.11.1 * libvirt-daemon-driver-nwfilter-debuginfo-9.0.0-150500.6.11.1 * libvirt-daemon-driver-storage-logical-9.0.0-150500.6.11.1 * libvirt-nss-9.0.0-150500.6.11.1 * libvirt-daemon-driver-storage-iscsi-debuginfo-9.0.0-150500.6.11.1 * libvirt-daemon-driver-storage-iscsi-direct-debuginfo-9.0.0-150500.6.11.1 * libvirt-daemon-driver-secret-debuginfo-9.0.0-150500.6.11.1 * libvirt-nss-debuginfo-9.0.0-150500.6.11.1 * libvirt-daemon-driver-nodedev-9.0.0-150500.6.11.1 * libvirt-daemon-driver-storage-logical-debuginfo-9.0.0-150500.6.11.1 * libvirt-daemon-driver-storage-scsi-9.0.0-150500.6.11.1 * libvirt-daemon-driver-nodedev-debuginfo-9.0.0-150500.6.11.1 * libvirt-daemon-driver-storage-mpath-debuginfo-9.0.0-150500.6.11.1 * libvirt-daemon-driver-secret-9.0.0-150500.6.11.1 * libvirt-daemon-driver-storage-disk-9.0.0-150500.6.11.1 * libvirt-lock-sanlock-debuginfo-9.0.0-150500.6.11.1 * libvirt-daemon-driver-network-9.0.0-150500.6.11.1 * libvirt-client-debuginfo-9.0.0-150500.6.11.1 * libvirt-daemon-driver-network-debuginfo-9.0.0-150500.6.11.1 * libvirt-daemon-driver-interface-9.0.0-150500.6.11.1 * libvirt-daemon-driver-storage-disk-debuginfo-9.0.0-150500.6.11.1 * libvirt-lock-sanlock-9.0.0-150500.6.11.1 * libvirt-daemon-config-network-9.0.0-150500.6.11.1 * libvirt-daemon-driver-storage-iscsi-9.0.0-150500.6.11.1 * libvirt-debugsource-9.0.0-150500.6.11.1 * libvirt-daemon-driver-storage-iscsi-direct-9.0.0-150500.6.11.1 * libvirt-daemon-driver-storage-scsi-debuginfo-9.0.0-150500.6.11.1 * libvirt-daemon-driver-storage-9.0.0-150500.6.11.1 * libvirt-daemon-driver-storage-mpath-9.0.0-150500.6.11.1 * libvirt-daemon-driver-qemu-9.0.0-150500.6.11.1 * Server Applications Module 15-SP5 (aarch64 x86_64) * libvirt-daemon-driver-storage-rbd-debuginfo-9.0.0-150500.6.11.1 * libvirt-daemon-driver-storage-rbd-9.0.0-150500.6.11.1 * Server Applications Module 15-SP5 (noarch) * libvirt-doc-9.0.0-150500.6.11.1 * Server Applications Module 15-SP5 (x86_64) * libvirt-daemon-driver-libxl-9.0.0-150500.6.11.1 * libvirt-daemon-xen-9.0.0-150500.6.11.1 * libvirt-daemon-driver-libxl-debuginfo-9.0.0-150500.6.11.1 ## References: * https://www.suse.com/security/cve/CVE-2023-3750.html * https://bugzilla.suse.com/show_bug.cgi?id=1213352 * https://bugzilla.suse.com/show_bug.cgi?id=1213447

1 0

SUSE-SU-2023:3057-1: moderate: Security update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container
by security＠lists.opensuse.org 31 Jul '23

31 Jul '23

# Security update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools- container, virt-operator-container Announcement ID: SUSE-SU-2023:3057-1 Rating: moderate References: Affected Products: * Containers Module 15-SP4 * openSUSE Leap 15.4 * openSUSE Leap Micro 5.3 * openSUSE Leap Micro 5.4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that can now be installed. ## Description: This update for kubevirt, virt-api-container, virt-controller-container, virt- handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container fixes the following issues: This update rebuilds the kubevirt stack with the current GO release. ## Patch Instructions: To install this SUSE Moderate update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2023-3057=1 openSUSE-SLE-15.4-2023-3057=1 * openSUSE Leap Micro 5.3 zypper in -t patch openSUSE-Leap-Micro-5.3-2023-3057=1 * openSUSE Leap Micro 5.4 zypper in -t patch openSUSE-Leap-Micro-5.4-2023-3057=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2023-3057=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2023-3057=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2023-3057=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2023-3057=1 * Containers Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Containers-15-SP4-2023-3057=1 ## Package List: * openSUSE Leap 15.4 (x86_64) * kubevirt-virt-api-debuginfo-0.54.0-150400.3.19.1 * kubevirt-virt-operator-debuginfo-0.54.0-150400.3.19.1 * kubevirt-virt-api-0.54.0-150400.3.19.1 * kubevirt-container-disk-0.54.0-150400.3.19.1 * kubevirt-tests-debuginfo-0.54.0-150400.3.19.1 * kubevirt-virt-controller-0.54.0-150400.3.19.1 * kubevirt-virt-launcher-debuginfo-0.54.0-150400.3.19.1 * kubevirt-virt-handler-0.54.0-150400.3.19.1 * kubevirt-tests-0.54.0-150400.3.19.1 * kubevirt-virt-controller-debuginfo-0.54.0-150400.3.19.1 * kubevirt-virtctl-0.54.0-150400.3.19.1 * kubevirt-virt-handler-debuginfo-0.54.0-150400.3.19.1 * kubevirt-container-disk-debuginfo-0.54.0-150400.3.19.1 * kubevirt-virt-launcher-0.54.0-150400.3.19.1 * kubevirt-manifests-0.54.0-150400.3.19.1 * kubevirt-virtctl-debuginfo-0.54.0-150400.3.19.1 * obs-service-kubevirt_containers_meta-0.54.0-150400.3.19.1 * kubevirt-virt-operator-0.54.0-150400.3.19.1 * openSUSE Leap Micro 5.3 (x86_64) * kubevirt-virtctl-debuginfo-0.54.0-150400.3.19.1 * kubevirt-manifests-0.54.0-150400.3.19.1 * kubevirt-virtctl-0.54.0-150400.3.19.1 * openSUSE Leap Micro 5.4 (x86_64) * kubevirt-virtctl-debuginfo-0.54.0-150400.3.19.1 * kubevirt-manifests-0.54.0-150400.3.19.1 * kubevirt-virtctl-0.54.0-150400.3.19.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (x86_64) * kubevirt-virtctl-debuginfo-0.54.0-150400.3.19.1 * kubevirt-manifests-0.54.0-150400.3.19.1 * kubevirt-virtctl-0.54.0-150400.3.19.1 * SUSE Linux Enterprise Micro 5.3 (x86_64) * kubevirt-virtctl-debuginfo-0.54.0-150400.3.19.1 * kubevirt-manifests-0.54.0-150400.3.19.1 * kubevirt-virtctl-0.54.0-150400.3.19.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (x86_64) * kubevirt-virtctl-debuginfo-0.54.0-150400.3.19.1 * kubevirt-manifests-0.54.0-150400.3.19.1 * kubevirt-virtctl-0.54.0-150400.3.19.1 * SUSE Linux Enterprise Micro 5.4 (x86_64) * kubevirt-virtctl-debuginfo-0.54.0-150400.3.19.1 * kubevirt-manifests-0.54.0-150400.3.19.1 * kubevirt-virtctl-0.54.0-150400.3.19.1 * Containers Module 15-SP4 (x86_64) * kubevirt-virtctl-debuginfo-0.54.0-150400.3.19.1 * kubevirt-manifests-0.54.0-150400.3.19.1 * kubevirt-virtctl-0.54.0-150400.3.19.1

1 0

SUSE-SU-2023:3059-1: important: Security update for MozillaThunderbird
by security＠lists.opensuse.org 31 Jul '23

31 Jul '23

# Security update for MozillaThunderbird Announcement ID: SUSE-SU-2023:3059-1 Rating: important References: * #1212438 Cross-References: * CVE-2023-3417 * CVE-2023-3600 CVSS scores: * CVE-2023-3417 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-3600 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-3600 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Workstation Extension 15 SP4 * SUSE Linux Enterprise Workstation Extension 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 * SUSE Package Hub 15 15-SP4 * SUSE Package Hub 15 15-SP5 An update that solves two vulnerabilities can now be installed. ## Description: This update for MozillaThunderbird fixes the following issues: Mozilla Thunderbird was updated to version 115.0.1 (bsc#1212438): * CVE-2023-3600: Fixed use-after-free in workers (bmo#1839703). * CVE-2023-3417: Fixed File Extension Spoofing using the Text Direction Override Character (bmo#1835582). Bugfixes: * changed: Added Thunderbird Supernova branding to about:dialog (bmo#1842102) * fixed: Message list was not updated when message was deleted from server outside of Thunderbird (bmo#1837041) * fixed: Scrolling behaved unexpectedly when moving to next message unread message in another folder (bmo#1841711) * fixed: Scrolling animation was unnecessarily used when switching or toggling the sort column in message list (bmo#1838522) * fixed: Attempting to delete a message and then cancelling the action still marked the message as read (bmo#793353) * fixed: Unified Toolbar could not be customized under certain tabs (bmo#1841480) * fixed: Selecting a folder with one or more subfolders and pressing enter did not expand folder (bmo#1841200) * fixed: Tooltips did not appear when hovering over folders (bmo#1839780) * fixed: Deleting large amounts of messages from Trash folder consumed excessive time and memory (bmo#1833665) * fixed: Message Summary header buttons were not keyboard accessible (bmo#1827199) * fixed: "New" button in Message Filters dialog was not keyboard accessible (bmo#1841477) * fixed: Backing up secret keys from OpenPGP Key Manager dialog silently failed (bmo#1839415) * fixed: Various visual and UX improvements (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319) ## Patch Instructions: To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3059=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3059=1 * SUSE Package Hub 15 15-SP4 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2023-3059=1 * SUSE Package Hub 15 15-SP5 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2023-3059=1 * SUSE Linux Enterprise Workstation Extension 15 SP4 zypper in -t patch SUSE-SLE-Product-WE-15-SP4-2023-3059=1 * SUSE Linux Enterprise Workstation Extension 15 SP5 zypper in -t patch SUSE-SLE-Product-WE-15-SP5-2023-3059=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * MozillaThunderbird-debugsource-115.0.1-150200.8.124.1 * MozillaThunderbird-debuginfo-115.0.1-150200.8.124.1 * MozillaThunderbird-translations-other-115.0.1-150200.8.124.1 * MozillaThunderbird-115.0.1-150200.8.124.1 * MozillaThunderbird-translations-common-115.0.1-150200.8.124.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * MozillaThunderbird-debugsource-115.0.1-150200.8.124.1 * MozillaThunderbird-debuginfo-115.0.1-150200.8.124.1 * MozillaThunderbird-translations-other-115.0.1-150200.8.124.1 * MozillaThunderbird-115.0.1-150200.8.124.1 * MozillaThunderbird-translations-common-115.0.1-150200.8.124.1 * SUSE Package Hub 15 15-SP4 (aarch64 ppc64le s390x) * MozillaThunderbird-debugsource-115.0.1-150200.8.124.1 * MozillaThunderbird-debuginfo-115.0.1-150200.8.124.1 * MozillaThunderbird-translations-other-115.0.1-150200.8.124.1 * MozillaThunderbird-115.0.1-150200.8.124.1 * MozillaThunderbird-translations-common-115.0.1-150200.8.124.1 * SUSE Package Hub 15 15-SP5 (aarch64 ppc64le s390x) * MozillaThunderbird-debugsource-115.0.1-150200.8.124.1 * MozillaThunderbird-debuginfo-115.0.1-150200.8.124.1 * MozillaThunderbird-translations-other-115.0.1-150200.8.124.1 * MozillaThunderbird-115.0.1-150200.8.124.1 * MozillaThunderbird-translations-common-115.0.1-150200.8.124.1 * SUSE Linux Enterprise Workstation Extension 15 SP4 (x86_64) * MozillaThunderbird-debugsource-115.0.1-150200.8.124.1 * MozillaThunderbird-debuginfo-115.0.1-150200.8.124.1 * MozillaThunderbird-translations-other-115.0.1-150200.8.124.1 * MozillaThunderbird-115.0.1-150200.8.124.1 * MozillaThunderbird-translations-common-115.0.1-150200.8.124.1 * SUSE Linux Enterprise Workstation Extension 15 SP5 (x86_64) * MozillaThunderbird-debugsource-115.0.1-150200.8.124.1 * MozillaThunderbird-debuginfo-115.0.1-150200.8.124.1 * MozillaThunderbird-translations-other-115.0.1-150200.8.124.1 * MozillaThunderbird-115.0.1-150200.8.124.1 * MozillaThunderbird-translations-common-115.0.1-150200.8.124.1 ## References: * https://www.suse.com/security/cve/CVE-2023-3417.html * https://www.suse.com/security/cve/CVE-2023-3600.html * https://bugzilla.suse.com/show_bug.cgi?id=1212438

1 0

SUSE-SU-2023:3055-1: important: Security update for the Linux Kernel RT (Live Patch 1 for SLE 15 SP4)
by security＠lists.opensuse.org 31 Jul '23

31 Jul '23

# Security update for the Linux Kernel RT (Live Patch 1 for SLE 15 SP4) Announcement ID: SUSE-SU-2023:3055-1 Rating: important References: * #1210566 * #1210987 * #1212509 Cross-References: * CVE-2023-2002 * CVE-2023-2235 * CVE-2023-35788 CVSS scores: * CVE-2023-2002 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-2002 ( NVD ): 6.8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H * CVE-2023-2235 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-2235 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-35788 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H * CVE-2023-35788 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise Live Patching 15-SP4 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 An update that solves three vulnerabilities can now be installed. ## Description: This update for the Linux Kernel 5.14.21-150400_15_5 fixes several issues. The following security issues were fixed: * CVE-2023-35788: Fixed an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets in fl_set_geneve_opt in net/sched/cls_flower.c (bsc#1212509). * CVE-2023-2235: Fixed an use-after-free in the Performance Events system can be exploited to achieve local privilege escalation (bsc#1210987). * CVE-2023-2002: Fixed a flaw that allowed an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth communication (bsc#1210566). ## Patch Instructions: To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2023-3052=1 SUSE-2023-3058=1 SUSE-2023-3062=1 SUSE-2023-3056=1 * SUSE Linux Enterprise Live Patching 15-SP4 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP4-2023-3052=1 SUSE-SLE- Module-Live-Patching-15-SP4-2023-3058=1 SUSE-SLE-Module-Live- Patching-15-SP4-2023-3055=1 SUSE-SLE-Module-Live-Patching-15-SP4-2023-3038=1 SUSE-SLE-Module-Live-Patching-15-SP4-2023-3039=1 SUSE-SLE-Module-Live- Patching-15-SP4-2023-3040=1 SUSE-SLE-Module-Live-Patching-15-SP4-2023-3062=1 SUSE-SLE-Module-Live-Patching-15-SP4-2023-3056=1 ## Package List: * openSUSE Leap 15.4 (ppc64le s390x x86_64) * kernel-livepatch-SLE15-SP4_Update_11-debugsource-4-150400.2.1 * kernel-livepatch-5_14_21-150400_24_41-default-7-150400.2.2 * kernel-livepatch-SLE15-SP4_Update_7-debugsource-7-150400.2.2 * kernel-livepatch-5_14_21-150400_24_41-default-debuginfo-7-150400.2.2 * kernel-livepatch-5_14_21-150400_24_60-default-debuginfo-4-150400.2.1 * kernel-livepatch-5_14_21-150400_24_28-default-debuginfo-10-150400.2.2 * kernel-livepatch-5_14_21-150400_24_28-default-10-150400.2.2 * kernel-livepatch-SLE15-SP4_Update_4-debugsource-10-150400.2.2 * kernel-livepatch-5_14_21-150400_24_55-default-debuginfo-5-150400.2.1 * kernel-livepatch-5_14_21-150400_24_55-default-5-150400.2.1 * kernel-livepatch-SLE15-SP4_Update_10-debugsource-5-150400.2.1 * kernel-livepatch-5_14_21-150400_24_60-default-4-150400.2.1 * SUSE Linux Enterprise Live Patching 15-SP4 (ppc64le s390x x86_64) * kernel-livepatch-SLE15-SP4_Update_11-debugsource-4-150400.2.1 * kernel-livepatch-5_14_21-150400_24_41-default-7-150400.2.2 * kernel-livepatch-SLE15-SP4_Update_7-debugsource-7-150400.2.2 * kernel-livepatch-5_14_21-150400_24_41-default-debuginfo-7-150400.2.2 * kernel-livepatch-5_14_21-150400_24_60-default-debuginfo-4-150400.2.1 * kernel-livepatch-5_14_21-150400_24_28-default-debuginfo-10-150400.2.2 * kernel-livepatch-5_14_21-150400_24_28-default-10-150400.2.2 * kernel-livepatch-SLE15-SP4_Update_4-debugsource-10-150400.2.2 * kernel-livepatch-5_14_21-150400_24_55-default-debuginfo-5-150400.2.1 * kernel-livepatch-5_14_21-150400_24_55-default-5-150400.2.1 * kernel-livepatch-SLE15-SP4_Update_10-debugsource-5-150400.2.1 * kernel-livepatch-5_14_21-150400_24_60-default-4-150400.2.1 * SUSE Linux Enterprise Live Patching 15-SP4 (x86_64) * kernel-livepatch-SLE15-SP4-RT_Update_3-debugsource-6-150400.2.2 * kernel-livepatch-5_14_21-150400_15_11-rt-6-150400.2.2 * kernel-livepatch-SLE15-SP4-RT_Update_6-debugsource-4-150400.2.1 * kernel-livepatch-SLE15-SP4-RT_Update_1-debugsource-8-150400.2.2 * kernel-livepatch-5_14_21-150400_15_23-rt-debuginfo-4-150400.2.1 * kernel-livepatch-5_14_21-150400_15_11-rt-debuginfo-6-150400.2.2 * kernel-livepatch-5_14_21-150400_15_5-rt-debuginfo-8-150400.2.2 * kernel-livepatch-5_14_21-150400_15_18-rt-debuginfo-5-150400.2.1 * kernel-livepatch-5_14_21-150400_15_23-rt-4-150400.2.1 * kernel-livepatch-SLE15-SP4-RT_Update_5-debugsource-5-150400.2.1 * kernel-livepatch-5_14_21-150400_15_18-rt-5-150400.2.1 * kernel-livepatch-5_14_21-150400_15_5-rt-8-150400.2.2 ## References: * https://www.suse.com/security/cve/CVE-2023-2002.html * https://www.suse.com/security/cve/CVE-2023-2235.html * https://www.suse.com/security/cve/CVE-2023-35788.html * https://bugzilla.suse.com/show_bug.cgi?id=1210566 * https://bugzilla.suse.com/show_bug.cgi?id=1210987 * https://bugzilla.suse.com/show_bug.cgi?id=1212509

1 0

SUSE-SU-2023:3041-1: important: Security update for the Linux Kernel RT (Live Patch 7 for SLE 15 SP4)
by security＠lists.opensuse.org 31 Jul '23

31 Jul '23

# Security update for the Linux Kernel RT (Live Patch 7 for SLE 15 SP4) Announcement ID: SUSE-SU-2023:3041-1 Rating: important References: * #1212509 Cross-References: * CVE-2023-35788 CVSS scores: * CVE-2023-35788 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H * CVE-2023-35788 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise Live Patching 15-SP4 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 An update that solves one vulnerability can now be installed. ## Description: This update for the Linux Kernel 5.14.21-150400_15_28 fixes one issue. The following security issue was fixed: * CVE-2023-35788: Fixed an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets in fl_set_geneve_opt in net/sched/cls_flower.c (bsc#1212509). ## Patch Instructions: To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Live Patching 15-SP4 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP4-2023-3041=1 SUSE-SLE- Module-Live-Patching-15-SP4-2023-3044=1 * openSUSE Leap 15.4 zypper in -t patch SUSE-2023-3044=1 ## Package List: * SUSE Linux Enterprise Live Patching 15-SP4 (x86_64) * kernel-livepatch-SLE15-SP4-RT_Update_7-debugsource-4-150400.2.1 * kernel-livepatch-5_14_21-150400_15_28-rt-4-150400.2.1 * SUSE Linux Enterprise Live Patching 15-SP4 (ppc64le s390x x86_64) * kernel-livepatch-SLE15-SP4_Update_12-debugsource-4-150400.2.1 * kernel-livepatch-5_14_21-150400_24_63-default-debuginfo-4-150400.2.1 * kernel-livepatch-5_14_21-150400_24_63-default-4-150400.2.1 * openSUSE Leap 15.4 (ppc64le s390x x86_64) * kernel-livepatch-SLE15-SP4_Update_12-debugsource-4-150400.2.1 * kernel-livepatch-5_14_21-150400_24_63-default-debuginfo-4-150400.2.1 * kernel-livepatch-5_14_21-150400_24_63-default-4-150400.2.1 ## References: * https://www.suse.com/security/cve/CVE-2023-35788.html * https://bugzilla.suse.com/show_bug.cgi?id=1212509

1 0

SUSE-SU-2023:3023-1: important: Security update for java-17-openjdk
by security＠lists.opensuse.org 31 Jul '23

31 Jul '23

# Security update for java-17-openjdk Announcement ID: SUSE-SU-2023:3023-1 Rating: important References: * #1207922 * #1213473 * #1213474 * #1213475 * #1213479 * #1213481 * #1213482 Cross-References: * CVE-2023-22006 * CVE-2023-22036 * CVE-2023-22041 * CVE-2023-22044 * CVE-2023-22045 * CVE-2023-22049 * CVE-2023-25193 CVSS scores: * CVE-2023-22006 ( SUSE ): 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N * CVE-2023-22006 ( NVD ): 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N * CVE-2023-22036 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2023-22036 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2023-22041 ( SUSE ): 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2023-22041 ( NVD ): 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2023-22044 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2023-22044 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2023-22045 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2023-22049 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2023-25193 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-25193 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * Basesystem Module 15-SP4 * Basesystem Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves seven vulnerabilities can now be installed. ## Description: This update for java-17-openjdk fixes the following issues: Updated to version jdk-17.0.8+7 (July 2023 CPU): * CVE-2023-22006: Fixed vulnerability in the network component (bsc#1213473). * CVE-2023-22036: Fixed vulnerability in the utility component (bsc#1213474). * CVE-2023-22041: Fixed vulnerability in the hotspot component (bsc#1213475). * CVE-2023-22044: Fixed vulnerability in the hotspot component (bsc#1213479). * CVE-2023-22045: Fixed vulnerability in the hotspot component (bsc#1213481). * CVE-2023-22049: Fixed vulnerability in the libraries component (bsc#1213482). * CVE-2023-25193: Fixed vulnerability in the embedded harfbuzz module (bsc#1207922). * JDK-8294323: Improve Shared Class Data * JDK-8296565: Enhanced archival support * JDK-8298676, JDK-8300891: Enhanced Look and Feel * JDK-8300285: Enhance TLS data handling * JDK-8300596: Enhance Jar Signature validation * JDK-8301998, JDK-8302084: Update HarfBuzz to 7.0.1 * JDK-8302475: Enhance HTTP client file downloading * JDK-8302483: Enhance ZIP performance * JDK-8303376: Better launching of JDI * JDK-8304460: Improve array usages * JDK-8304468: Better array usages * JDK-8305312: Enhanced path handling * JDK-8308682: Enhance AES performance Bugfixes: * JDK-8178806: Better exception logging in crypto code * JDK-8201516: DebugNonSafepoints generates incorrect information * JDK-8224768: Test ActalisCA.java fails * JDK-8227060: Optimize safepoint cleanup subtask order * JDK-8227257: javax/swing/JFileChooser/4847375/bug4847375.java fails with AssertionError * JDK-8238274: (sctp) JDK-7118373 is not fixed for SctpChannel * JDK-8244976: vmTestbase/nsk/jdi/Event/request/request001.java doesn' initialize eName * JDK-8245877: assert(_value != __null) failed: resolving NULL _value in JvmtiExport::post_compiled_method_load * JDK-8248001: javadoc generates invalid HTML pages whose ftp:// links are broken * JDK-8252990: Intrinsify Unsafe.storeStoreFence * JDK-8254711: Add java.security.Provider.getService JFR Event * JDK-8257856: Make ClassFileVersionsTest.java robust to JDK version updates * JDK-8261495: Shenandoah: reconsider update references memory ordering * JDK-8268288: jdk/jfr/api/consumer/streaming/ /TestOutOfProcessMigration.java fails with "Error: ShouldNotReachHere()" * JDK-8268298: jdk/jfr/api/consumer/log/TestVerbosity.java fails: unexpected log message * JDK-8268582: javadoc throws NPE with --ignore-source-errors option * JDK-8269821: Remove is-queue-active check in inner loop of write_ref_array_pre_work * JDK-8270434: JDI+UT: Unexpected event in JDI tests * JDK-8270859: Post JEP 411 refactoring: client libs with maximum covering > 10K * JDK-8270869: G1ServiceThread may not terminate * JDK-8271519: java/awt/event/SequencedEvent/ /MultipleContextsFunctionalTest.java failed with "Total [200] * Expected [400]" * JDK-8273909: vmTestbase/nsk/jdi/Event/request/request001 can still fail with "ERROR: new event is not ThreadStartEvent" * JDK-8274243: Implement fast-path for ASCII-compatible CharsetEncoders on aarch64 * JDK-8274615: Support relaxed atomic add for linux-aarch64 * JDK-8274864: Remove Amman/Cairo hacks in ZoneInfoFile * JDK-8275233: Incorrect line number reported in exception stack trace thrown from a lambda expression * JDK-8275287: Relax memory ordering constraints on updating instance class and array class counters * JDK-8275721: Name of UTC timezone in a locale changes depending on previous code * JDK-8275735: [linux] Remove deprecated Metrics api (kernel memory limit) * JDK-8276058: Some swing test fails on specific CI macos system * JDK-8277407: javax/swing/plaf/synth/SynthButtonUI/6276188/ /bug6276188.java fails to compile after JDK-8276058 * JDK-8277775: Fixup bugids in RemoveDropTargetCrashTest.java - add 4357905 * JDK-8278146: G1: Rework VM_G1Concurrent VMOp to clearly identify it as pause * JDK-8278434: timeouts in test java/time/test/java/time/ /format/TestZoneTextPrinterParser.java * JDK-8278834: Error "Cannot read field "sym" because "this.lvar[od]" is null" when compiling * JDK-8282077: PKCS11 provider C_sign() impl should handle CKR_BUFFER_TOO_SMALL error * JDK-8282201: Consider removal of expiry check in VerifyCACerts.java test * JDK-8282227: Locale information for nb is not working properly * JDK-8282704: runtime/Thread/StopAtExit.java may leak memory * JDK-8283057: Update GCC to version 11.2.0 for Oracle builds on Linux * JDK-8283062: Uninitialized warnings in libgtest with GCC 11.2 * JDK-8283520: JFR: Memory leak in dcmd_arena * JDK-8283566: G1: Improve G1BarrierSet::enqueue performance * JDK-8284331: Add sanity check for signal handler modification warning. * JDK-8285635: javax/swing/JRootPane/DefaultButtonTest.java failed with Default Button not pressed for L&F: com.sun.java.swing.plaf.motif.MotifLookAndFeel * JDK-8285987: executing shell scripts without #! fails on Alpine linux * JDK-8286191: misc tests fail due to JDK-8285987 * JDK-8286287: Reading file as UTF-16 causes Error which "shouldn't happen" * JDK-8286331: jni_GetStringUTFChars() uses wrong heap allocator * JDK-8286346: 3-parameter version of AllocateHeap should not ignore AllocFailType * JDK-8286398: Address possibly lossy conversions in jdk.internal.le * JDK-8287007: [cgroups] Consistently use stringStream throughout parsing code * JDK-8287246: DSAKeyValue should check for missing params instead of relying on KeyFactory provider * JDK-8287541: Files.writeString fails to throw IOException for charset "windows-1252" * JDK-8287854: Dangling reference in ClassVerifier::verify_class * JDK-8287876: The recently de-problemlisted TestTitledBorderLeak test is unstable * JDK-8287897: Augment src/jdk.internal.le/share/legal/jline.md with information on 4th party dependencies * JDK-8288589: Files.readString ignores encoding errors for UTF-16 * JDK-8289509: Improve test coverage for XPath Axes: descendant, descendant- or-self, following, following-sibling * JDK-8289735: UTIL_LOOKUP_PROGS fails on pathes with space * JDK-8289949: Improve test coverage for XPath: operators * JDK-8290822: C2: assert in PhaseIdealLoop::do_unroll() is subject to undefined behavior * JDK-8291226: Create Test Cases to cover scenarios for JDK-8278067 * JDK-8291637: HttpClient default keep alive timeout not followed if server sends invalid value * JDK-8291638: Keep-Alive timeout of 0 should close connection immediately * JDK-8292206: TestCgroupMetrics.java fails as getMemoryUsage() is lower than expected * JDK-8292301: [REDO v2] C2 crash when allocating array of size too large * JDK-8292407: Improve Weak CAS VarHandle/Unsafe tests resilience under spurious failures * JDK-8292713: Unsafe.allocateInstance should be intrinsified without UseUnalignedAccesses * JDK-8292755: Non-default method in interface leads to a stack overflow in JShell * JDK-8292990: Improve test coverage for XPath Axes: parent * JDK-8293295: Add type check asserts to java_lang_ref_Reference accessors * JDK-8293492: ShenandoahControlThread missing from hs-err log and thread dump * JDK-8293858: Change PKCS7 code to use default SecureRandom impl instead of SHA1PRNG * JDK-8293887: AArch64 build failure with GCC 12 due to maybe-uninitialized warning in libfdlibm k_rem_pio2.c * JDK-8294183: AArch64: Wrong macro check in SharedRuntime::generate_deopt_blob * JDK-8294281: Allow warnings to be disabled on a per-file basis * JDK-8294673: JFR: Add SecurityProviderService#threshold to TestActiveSettingEvent.java * JDK-8294717: (bf) DirectByteBuffer constructor will leak if allocating Deallocator or Cleaner fails with OOME * JDK-8294906: Memory leak in PKCS11 NSS TLS server * JDK-8295564: Norwegian Nynorsk Locale is missing formatting * JDK-8295974: jni_FatalError and Xcheck:jni warnings should print the native stack when there are no Java frames * JDK-8296084: javax/swing/JSpinner/4788637/bug4788637.java fails intermittently on a VM * JDK-8296318: use-def assert: special case undetected loops nested in infinite loops * JDK-8296343: CPVE thrown on missing content-length in OCSP response * JDK-8296412: Special case infinite loops with unmerged backedges in IdealLoopTree::check_safepts * JDK-8296545: C2 Blackholes should allow load optimizations * JDK-8296934: Write a test to verify whether Undecorated Frame can be iconified or not * JDK-8297000: [jib] Add more friendly warning for proxy issues * JDK-8297154: Improve safepoint cleanup logging * JDK-8297450: ScaledTextFieldBorderTest.java fails when run with -show parameter * JDK-8297587: Upgrade JLine to 3.22.0 * JDK-8297730: C2: Arraycopy intrinsic throws incorrect exception * JDK-8297955: LDAP CertStore should use LdapName and not String for DNs * JDK-8298488: [macos13] tools/jpackage tests failing with "Exit code: 137" on macOS * JDK-8298887: On the latest macOS+XCode the Robot API may report wrong colors * JDK-8299179: ArrayFill with store on backedge needs to reduce length by 1 * JDK-8299259: C2: Div/Mod nodes without zero check could be split through iv phi of loop resulting in SIGFPE * JDK-8299544: Improve performance of CRC32C intrinsics (non-AVX-512) for small inputs * JDK-8299570: [JVMCI] Insufficient error handling when CodeBuffer is exhausted * JDK-8299959: C2: CmpU::Value must filter overflow computation against local sub computation * JDK-8300042: Improve CPU related JFR events descriptions * JDK-8300079: SIGSEGV in LibraryCallKit::inline_string_copy due to constant NULL src argument * JDK-8300823: UB: Compile::_phase_optimize_finished is initialized too late * JDK-8300939: sun/security/provider/certpath/OCSP/ /OCSPNoContentLength.java fails due to network errors * JDK-8301050: Detect Xen Virtualization on Linux aarch64 * JDK-8301119: Support for GB18030-2022 * JDK-8301123: Enable Symbol refcounting underflow checks in PRODUCT * JDK-8301190: [vectorapi] The typeChar of LaneType is incorrect when default locale is tr * JDK-8301216: ForkJoinPool invokeAll() ignores timeout * JDK-8301338: Identical branch conditions in CompileBroker::print_heapinfo * JDK-8301491: C2: java.lang.StringUTF16::indexOfChar intrinsic called with negative character argument * JDK-8301637: ThreadLocalRandom.current().doubles().parallel() contention * JDK-8301661: Enhance os::pd_print_cpu_info on macOS and Windows * JDK-8302151: BMPImageReader throws an exception reading BMP images * JDK-8302172: [JVMCI] HotSpotResolvedJavaMethodImpl.canBeInlined must respect ForceInline * JDK-8302320: AsyncGetCallTrace obtains too few frames in sanity test * JDK-8302491: NoClassDefFoundError omits the original cause of an error * JDK-8302508: Add timestamp to the output TraceCompilerThreads * JDK-8302594: use-after-free in Node::destruct * JDK-8302595: use-after-free related to GraphKit::clone_map * JDK-8302791: Add specific ClassLoader object to Proxy IllegalArgumentException message * JDK-8302849: SurfaceManager might expose partially constructed object * JDK-8303069: Memory leak in CompilerOracle::parse_from_line * JDK-8303102: jcmd: ManagementAgent.status truncates the text longer than O_BUFLEN * JDK-8303130: Document required Accessibility permissions on macOS * JDK-8303354: addCertificatesToKeystore in KeystoreImpl.m needs CFRelease call in early potential CHECK_NULL return * JDK-8303433: Bump update version for OpenJDK: jdk-17.0.8 * JDK-8303440: The "ZonedDateTime.parse" may not accept the "UTC+XX" zone id * JDK-8303465: KeyStore of type KeychainStore, provider Apple does not show all trusted certificates * JDK-8303476: Add the runtime version in the release file of a JDK image * JDK-8303482: Update LCMS to 2.15 * JDK-8303508: Vector.lane() gets wrong value on x86 * JDK-8303511: C2: assert(get_ctrl(n) == cle_out) during unrolling * JDK-8303564: C2: "Bad graph detected in build_loop_late" after a CMove is wrongly split thru phi * JDK-8303575: adjust Xen handling on Linux aarch64 * JDK-8303576: addIdentitiesToKeystore in KeystoreImpl.m needs CFRelease call in early potential CHECK_NULL return * JDK-8303588: [JVMCI] make JVMCI source directories conform with standard layout * JDK-8303809: Dispose context in SPNEGO NegotiatorImpl * JDK-8303822: gtestMain should give more helpful output * JDK-8303861: Error handling step timeouts should never be blocked by OnError and others * JDK-8303937: Corrupted heap dumps due to missing retries for os::write() * JDK-8303949: gcc10 warning Linux ppc64le - note: the layout of aggregates containing vectors with 8-byte alignment has changed in GCC 5 * JDK-8304054: Linux: NullPointerException from FontConfiguration.getVersion in case no fonts are installed * JDK-8304063: tools/jpackage/share/AppLauncherEnvTest.java fails when checking LD_LIBRARY_PATH * JDK-8304134: jib bootstrapper fails to quote filename when checking download filetype * JDK-8304291: [AIX] Broken build after JDK-8301998 * JDK-8304295: harfbuzz build fails with GCC 7 after JDK-8301998 * JDK-8304350: Font.getStringBounds calculates wrong width for TextAttribute.TRACKING other than 0.0 * JDK-8304671: javac regression: Compilation with --release 8 fails on underscore in enum identifiers * JDK-8304683: Memory leak in WB_IsMethodCompatible * JDK-8304760: Add 2 Microsoft TLS roots * JDK-8304867: Explicitly disable dtrace for ppc builds * JDK-8304880: [PPC64] VerifyOops code in C1 doesn't work with ZGC * JDK-8305088: SIGSEGV in Method::is_method_handle_intrinsic * JDK-8305113: (tz) Update Timezone Data to 2023c * JDK-8305400: ISO 4217 Amendment 175 Update * JDK-8305403: Shenandoah evacuation workers may deadlock * JDK-8305481: gtest is_first_C_frame failing on ARM * JDK-8305690: [X86] Do not emit two REX prefixes in Assembler::prefix * JDK-8305711: Arm: C2 always enters slowpath for monitorexit * JDK-8305721: add `make compile-commands` artifacts to .gitignore * JDK-8305975: Add TWCA Global Root CA * JDK-8305993: Add handleSocketErrorWithMessage to extend nio Net.c exception message * JDK-8305994: Guarantee eventual async monitor deflation * JDK-8306072: Open source several AWT MouseInfo related tests * JDK-8306133: Open source few AWT Drag & Drop related tests * JDK-8306409: Open source AWT KeyBoardFocusManger, LightWeightComponent related tests * JDK-8306432: Open source several AWT Text Component related tests * JDK-8306466: Open source more AWT Drag & Drop related tests * JDK-8306489: Open source AWT List related tests * JDK-8306543: GHA: MSVC installation is failing * JDK-8306640: Open source several AWT TextArea related tests * JDK-8306652: Open source AWT MenuItem related tests * JDK-8306658: GHA: MSVC installation could be optional since it might already be pre-installed * JDK-8306664: GHA: Update MSVC version to latest stepping * JDK-8306681: Open source more AWT DnD related tests * JDK-8306683: Open source several clipboard and color AWT tests * JDK-8306752: Open source several container and component AWT tests * JDK-8306753: Open source several container AWT tests * JDK-8306755: Open source few Swing JComponent and AbstractButton tests * JDK-8306768: CodeCache Analytics reports wrong threshold * JDK-8306774: Make runtime/Monitor/ /GuaranteedAsyncDeflationIntervalTest.java more reliable * JDK-8306825: Monitor deflation might be accidentally disabled by zero intervals * JDK-8306850: Open source AWT Modal related tests * JDK-8306871: Open source more AWT Drag & Drop tests * JDK-8306883: Thread stacksize is reported with wrong units in os::create_thread logging * JDK-8306941: Open source several datatransfer and dnd AWT tests * JDK-8306943: Open source several dnd AWT tests * JDK-8306954: Open source five Focus related tests * JDK-8306955: Open source several JComboBox jtreg tests * JDK-8306976: UTIL_REQUIRE_SPECIAL warning on grep * JDK-8306996: Open source Swing MenuItem related tests * JDK-8307080: Open source some more JComboBox jtreg tests * JDK-8307128: Open source some drag and drop tests 4 * JDK-8307130: Open source few Swing JMenu tests * JDK-8307133: Open source some JTable jtreg tests * JDK-8307134: Add GTS root CAs * JDK-8307135: java/awt/dnd/NotReallySerializableTest/ /NotReallySerializableTest.java failed * JDK-8307331: Correctly update line maps when class redefine rewrites bytecodes * JDK-8307346: Add missing gc+phases logging for ObjectCount(AfterGC) JFR event collection code * JDK-8307347: serviceability/sa/ClhsdbDumpclass.java could leave files owned by root on macOS * JDK-8307378: Allow collectors to provide specific values for GC notifications' actions * JDK-8307381: Open Source JFrame, JIF related Swing Tests * JDK-8307425: Socket input stream read burns CPU cycles with back-to-back poll(0) calls * JDK-8307799: Newly added java/awt/dnd/MozillaDnDTest.java has invalid jtreg `@requires` clause * JDK-8308554: [17u] Fix commit of 8286191. vm.musl was not removed from ExternalEditorTest * JDK-8308880: [17u] micro bench ZoneStrings missed in backport of 8278434 * JDK-8308884: [17u/11u] Backout JDK-8297951 * JDK-8311467: [17u] Remove designator DEFAULT_PROMOTED_VERSION_PRE=ea for release 17.0.8 ## Patch Instructions: To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3023=1 SUSE-2023-3023=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3023=1 * Basesystem Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-3023=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-3023=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * java-17-openjdk-headless-debuginfo-17.0.8.0-150400.3.27.1 * java-17-openjdk-debuginfo-17.0.8.0-150400.3.27.1 * java-17-openjdk-jmods-17.0.8.0-150400.3.27.1 * java-17-openjdk-devel-debuginfo-17.0.8.0-150400.3.27.1 * java-17-openjdk-headless-17.0.8.0-150400.3.27.1 * java-17-openjdk-debugsource-17.0.8.0-150400.3.27.1 * java-17-openjdk-src-17.0.8.0-150400.3.27.1 * java-17-openjdk-demo-17.0.8.0-150400.3.27.1 * java-17-openjdk-devel-17.0.8.0-150400.3.27.1 * java-17-openjdk-17.0.8.0-150400.3.27.1 * openSUSE Leap 15.4 (noarch) * java-17-openjdk-javadoc-17.0.8.0-150400.3.27.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * java-17-openjdk-headless-debuginfo-17.0.8.0-150400.3.27.1 * java-17-openjdk-debuginfo-17.0.8.0-150400.3.27.1 * java-17-openjdk-jmods-17.0.8.0-150400.3.27.1 * java-17-openjdk-devel-debuginfo-17.0.8.0-150400.3.27.1 * java-17-openjdk-headless-17.0.8.0-150400.3.27.1 * java-17-openjdk-debugsource-17.0.8.0-150400.3.27.1 * java-17-openjdk-src-17.0.8.0-150400.3.27.1 * java-17-openjdk-demo-17.0.8.0-150400.3.27.1 * java-17-openjdk-devel-17.0.8.0-150400.3.27.1 * java-17-openjdk-17.0.8.0-150400.3.27.1 * openSUSE Leap 15.5 (noarch) * java-17-openjdk-javadoc-17.0.8.0-150400.3.27.1 * Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64) * java-17-openjdk-headless-debuginfo-17.0.8.0-150400.3.27.1 * java-17-openjdk-debuginfo-17.0.8.0-150400.3.27.1 * java-17-openjdk-devel-debuginfo-17.0.8.0-150400.3.27.1 * java-17-openjdk-headless-17.0.8.0-150400.3.27.1 * java-17-openjdk-debugsource-17.0.8.0-150400.3.27.1 * java-17-openjdk-demo-17.0.8.0-150400.3.27.1 * java-17-openjdk-devel-17.0.8.0-150400.3.27.1 * java-17-openjdk-17.0.8.0-150400.3.27.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * java-17-openjdk-headless-debuginfo-17.0.8.0-150400.3.27.1 * java-17-openjdk-debuginfo-17.0.8.0-150400.3.27.1 * java-17-openjdk-devel-debuginfo-17.0.8.0-150400.3.27.1 * java-17-openjdk-headless-17.0.8.0-150400.3.27.1 * java-17-openjdk-debugsource-17.0.8.0-150400.3.27.1 * java-17-openjdk-demo-17.0.8.0-150400.3.27.1 * java-17-openjdk-devel-17.0.8.0-150400.3.27.1 * java-17-openjdk-17.0.8.0-150400.3.27.1 ## References: * https://www.suse.com/security/cve/CVE-2023-22006.html * https://www.suse.com/security/cve/CVE-2023-22036.html * https://www.suse.com/security/cve/CVE-2023-22041.html * https://www.suse.com/security/cve/CVE-2023-22044.html * https://www.suse.com/security/cve/CVE-2023-22045.html * https://www.suse.com/security/cve/CVE-2023-22049.html * https://www.suse.com/security/cve/CVE-2023-25193.html * https://bugzilla.suse.com/show_bug.cgi?id=1207922 * https://bugzilla.suse.com/show_bug.cgi?id=1213473 * https://bugzilla.suse.com/show_bug.cgi?id=1213474 * https://bugzilla.suse.com/show_bug.cgi?id=1213475 * https://bugzilla.suse.com/show_bug.cgi?id=1213479 * https://bugzilla.suse.com/show_bug.cgi?id=1213481 * https://bugzilla.suse.com/show_bug.cgi?id=1213482

1 0

SUSE-SU-2023:3010-1: moderate: Security update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, cont
by security＠lists.opensuse.org 28 Jul '23

28 Jul '23

# Security update for cdi-apiserver-container, cdi-cloner-container, cdi- controller-container, cdi-importer-container, cdi-operator-container, cdi- uploadproxy-container, cdi-uploadserver-container, cont Announcement ID: SUSE-SU-2023:3010-1 Rating: moderate References: Affected Products: * Containers Module 15-SP4 * openSUSE Leap 15.4 * openSUSE Leap Micro 5.3 * openSUSE Leap Micro 5.4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that can now be installed. ## Description: This update for cdi-apiserver-container, cdi-cloner-container, cdi-controller- container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy- container, cdi-uploadserver-container, containerized-data-importer fixes the following issues: This update rebuilds containerized-data-importer against the current GO security release. ## Patch Instructions: To install this SUSE Moderate update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2023-3010=1 openSUSE-SLE-15.4-2023-3010=1 * openSUSE Leap Micro 5.3 zypper in -t patch openSUSE-Leap-Micro-5.3-2023-3010=1 * openSUSE Leap Micro 5.4 zypper in -t patch openSUSE-Leap-Micro-5.4-2023-3010=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2023-3010=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2023-3010=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2023-3010=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2023-3010=1 * Containers Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Containers-15-SP4-2023-3010=1 ## Package List: * openSUSE Leap 15.4 (x86_64) * containerized-data-importer-api-1.51.0-150400.4.16.1 * containerized-data-importer-controller-1.51.0-150400.4.16.1 * containerized-data-importer-manifests-1.51.0-150400.4.16.1 * containerized-data-importer-uploadproxy-1.51.0-150400.4.16.1 * containerized-data-importer-controller-debuginfo-1.51.0-150400.4.16.1 * containerized-data-importer-cloner-1.51.0-150400.4.16.1 * containerized-data-importer-uploadserver-1.51.0-150400.4.16.1 * containerized-data-importer-api-debuginfo-1.51.0-150400.4.16.1 * containerized-data-importer-uploadproxy-debuginfo-1.51.0-150400.4.16.1 * containerized-data-importer-cloner-debuginfo-1.51.0-150400.4.16.1 * containerized-data-importer-importer-debuginfo-1.51.0-150400.4.16.1 * obs-service-cdi_containers_meta-1.51.0-150400.4.16.1 * containerized-data-importer-importer-1.51.0-150400.4.16.1 * containerized-data-importer-uploadserver-debuginfo-1.51.0-150400.4.16.1 * containerized-data-importer-operator-debuginfo-1.51.0-150400.4.16.1 * containerized-data-importer-operator-1.51.0-150400.4.16.1 * openSUSE Leap Micro 5.3 (x86_64) * containerized-data-importer-manifests-1.51.0-150400.4.16.1 * openSUSE Leap Micro 5.4 (x86_64) * containerized-data-importer-manifests-1.51.0-150400.4.16.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (x86_64) * containerized-data-importer-manifests-1.51.0-150400.4.16.1 * SUSE Linux Enterprise Micro 5.3 (x86_64) * containerized-data-importer-manifests-1.51.0-150400.4.16.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (x86_64) * containerized-data-importer-manifests-1.51.0-150400.4.16.1 * SUSE Linux Enterprise Micro 5.4 (x86_64) * containerized-data-importer-manifests-1.51.0-150400.4.16.1 * Containers Module 15-SP4 (x86_64) * containerized-data-importer-manifests-1.51.0-150400.4.16.1

1 0

SUSE-SU-2023:3011-1: moderate: Security update for openssl-3
by security＠lists.opensuse.org 28 Jul '23

28 Jul '23

# Security update for openssl-3 Announcement ID: SUSE-SU-2023:3011-1 Rating: moderate References: * #1213383 * #1213487 Cross-References: * CVE-2023-2975 * CVE-2023-3446 CVSS scores: * CVE-2023-2975 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2023-2975 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2023-3446 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves two vulnerabilities can now be installed. ## Description: This update for openssl-3 fixes the following issues: * CVE-2023-2975: Fixed AES-SIV implementation ignores empty associated data entries (bsc#1213383). * CVE-2023-3446: Fixed DH_check() excessive time with over sized modulus (bsc#1213487). ## Patch Instructions: To install this SUSE Moderate update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2023-3011=1 openSUSE-SLE-15.5-2023-3011=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-3011=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * libopenssl3-debuginfo-3.0.8-150500.5.8.1 * libopenssl-3-devel-3.0.8-150500.5.8.1 * libopenssl3-3.0.8-150500.5.8.1 * openssl-3-debuginfo-3.0.8-150500.5.8.1 * openssl-3-debugsource-3.0.8-150500.5.8.1 * openssl-3-3.0.8-150500.5.8.1 * openSUSE Leap 15.5 (x86_64) * libopenssl3-32bit-3.0.8-150500.5.8.1 * libopenssl3-32bit-debuginfo-3.0.8-150500.5.8.1 * libopenssl-3-devel-32bit-3.0.8-150500.5.8.1 * openSUSE Leap 15.5 (noarch) * openssl-3-doc-3.0.8-150500.5.8.1 * openSUSE Leap 15.5 (aarch64_ilp32) * libopenssl3-64bit-debuginfo-3.0.8-150500.5.8.1 * libopenssl3-64bit-3.0.8-150500.5.8.1 * libopenssl-3-devel-64bit-3.0.8-150500.5.8.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * libopenssl3-debuginfo-3.0.8-150500.5.8.1 * libopenssl-3-devel-3.0.8-150500.5.8.1 * libopenssl3-3.0.8-150500.5.8.1 * openssl-3-debuginfo-3.0.8-150500.5.8.1 * openssl-3-debugsource-3.0.8-150500.5.8.1 * openssl-3-3.0.8-150500.5.8.1 ## References: * https://www.suse.com/security/cve/CVE-2023-2975.html * https://www.suse.com/security/cve/CVE-2023-3446.html * https://bugzilla.suse.com/show_bug.cgi?id=1213383 * https://bugzilla.suse.com/show_bug.cgi?id=1213487

1 0