September 2023 - openSUSE Security Announce

openSUSE-SU-2023:0277-1: critical: Security update for chromium
by opensuse-security＠opensuse.org 29 Sep '23

29 Sep '23

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2023:0277-1 Rating: critical References: #1215776 #1215778 Cross-References: CVE-2023-5186 CVE-2023-5187 CVE-2023-5217 CVSS scores: CVE-2023-5217 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP4 openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for chromium fixes the following issues: - Chromium 117.0.5938.132 (boo#1215776): * CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx (boo#1215778) * CVE-2023-5186: Use after free in Passwords * CVE-2023-5187: Use after free in Extensions - Chromium 117.0.5938.92: * stability improvements Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2023-277=1 - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2023-277=1 Package List: - openSUSE Backports SLE-15-SP5 (aarch64 x86_64): chromedriver-117.0.5938.132-bp155.2.40.1 chromedriver-debuginfo-117.0.5938.132-bp155.2.40.1 chromium-117.0.5938.132-bp155.2.40.1 chromium-debuginfo-117.0.5938.132-bp155.2.40.1 - openSUSE Backports SLE-15-SP4 (aarch64 x86_64): chromedriver-117.0.5938.132-bp154.2.126.1 chromium-117.0.5938.132-bp154.2.126.1 References: https://www.suse.com/security/cve/CVE-2023-5186.html https://www.suse.com/security/cve/CVE-2023-5187.html https://www.suse.com/security/cve/CVE-2023-5217.html https://bugzilla.suse.com/1215776 https://bugzilla.suse.com/1215778

1 0

SUSE-SU-2023:3897-1: moderate: Security update for libqb
by security＠lists.opensuse.org 29 Sep '23

29 Sep '23

# Security update for libqb Announcement ID: SUSE-SU-2023:3897-1 Rating: moderate References: * #1214066 Cross-References: * CVE-2023-39976 CVSS scores: * CVE-2023-39976 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-39976 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Availability Extension 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves one vulnerability can now be installed. ## Description: This update for libqb fixes the following issues: * CVE-2023-39976: Fixed potential buffer overflow with long log messages (bsc#1214066). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2023-3897=1 openSUSE-SLE-15.5-2023-3897=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-3897=1 * SUSE Linux Enterprise High Availability Extension 15 SP5 zypper in -t patch SUSE-SLE-Product-HA-15-SP5-2023-3897=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * libqb-tools-debuginfo-2.0.6+20220323.758044b-150500.3.3.1 * doxygen2man-2.0.6+20220323.758044b-150500.3.3.1 * libqb-devel-2.0.6+20220323.758044b-150500.3.3.1 * libqb100-2.0.6+20220323.758044b-150500.3.3.1 * libqb-tests-debuginfo-2.0.6+20220323.758044b-150500.3.3.1 * libqb-debugsource-2.0.6+20220323.758044b-150500.3.3.1 * doxygen2man-debuginfo-2.0.6+20220323.758044b-150500.3.3.1 * libqb-tools-2.0.6+20220323.758044b-150500.3.3.1 * libqb-tests-2.0.6+20220323.758044b-150500.3.3.1 * libqb100-debuginfo-2.0.6+20220323.758044b-150500.3.3.1 * openSUSE Leap 15.5 (x86_64) * libqb100-32bit-debuginfo-2.0.6+20220323.758044b-150500.3.3.1 * libqb100-32bit-2.0.6+20220323.758044b-150500.3.3.1 * libqb-devel-32bit-2.0.6+20220323.758044b-150500.3.3.1 * openSUSE Leap 15.5 (aarch64_ilp32) * libqb-devel-64bit-2.0.6+20220323.758044b-150500.3.3.1 * libqb100-64bit-debuginfo-2.0.6+20220323.758044b-150500.3.3.1 * libqb100-64bit-2.0.6+20220323.758044b-150500.3.3.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * libqb100-2.0.6+20220323.758044b-150500.3.3.1 * libqb100-debuginfo-2.0.6+20220323.758044b-150500.3.3.1 * libqb-debugsource-2.0.6+20220323.758044b-150500.3.3.1 * libqb-devel-2.0.6+20220323.758044b-150500.3.3.1 * SUSE Linux Enterprise High Availability Extension 15 SP5 (aarch64 ppc64le s390x x86_64) * libqb-tools-debuginfo-2.0.6+20220323.758044b-150500.3.3.1 * doxygen2man-2.0.6+20220323.758044b-150500.3.3.1 * libqb-tests-debuginfo-2.0.6+20220323.758044b-150500.3.3.1 * libqb-debugsource-2.0.6+20220323.758044b-150500.3.3.1 * doxygen2man-debuginfo-2.0.6+20220323.758044b-150500.3.3.1 * libqb-tools-2.0.6+20220323.758044b-150500.3.3.1 * libqb-tests-2.0.6+20220323.758044b-150500.3.3.1 ## References: * https://www.suse.com/security/cve/CVE-2023-39976.html * https://bugzilla.suse.com/show_bug.cgi?id=1214066

1 0

SUSE-SU-2023:3898-1: important: Security update for MozillaFirefox
by security＠lists.opensuse.org 29 Sep '23

29 Sep '23

# Security update for MozillaFirefox Announcement ID: SUSE-SU-2023:3898-1 Rating: important References: * #1215309 * #1215575 Cross-References: * CVE-2023-5168 * CVE-2023-5169 * CVE-2023-5171 * CVE-2023-5174 * CVE-2023-5176 CVSS scores: Affected Products: * Desktop Applications Module 15-SP4 * Desktop Applications Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves five vulnerabilities can now be installed. ## Description: This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 115.3.0 ESR (MFSA 2023-42, bsc#1215575): Security fixes: * CVE-2023-5168: Out-of-bounds write in FilterNodeD2D1 (bmo#1846683). * CVE-2023-5169: Out-of-bounds write in PathOps (bmo#1846685). * CVE-2023-5171: Use-after-free in Ion Compiler (bmo#1851599). * CVE-2023-5174: Double-free in process spawning on Windows (bmo#1848454). * CVE-2023-5176: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3 (bmo#1836353, bmo#1842674, bmo#1843824, bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983, bmo#1851195). Other fixes: * Fix broken build with newer binutils (bsc#1215309) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3898=1 * Desktop Applications Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP4-2023-3898=1 * Desktop Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP5-2023-3898=1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2023-3898=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-3898=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-3898=1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2023-3898=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-3898=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2023-3898=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-3898=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2023-3898=1 * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3898=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * MozillaFirefox-debugsource-115.3.0-150200.152.108.1 * MozillaFirefox-branding-upstream-115.3.0-150200.152.108.1 * MozillaFirefox-debuginfo-115.3.0-150200.152.108.1 * MozillaFirefox-translations-other-115.3.0-150200.152.108.1 * MozillaFirefox-translations-common-115.3.0-150200.152.108.1 * MozillaFirefox-115.3.0-150200.152.108.1 * openSUSE Leap 15.5 (noarch) * MozillaFirefox-devel-115.3.0-150200.152.108.1 * Desktop Applications Module 15-SP4 (aarch64 ppc64le s390x x86_64) * MozillaFirefox-debugsource-115.3.0-150200.152.108.1 * MozillaFirefox-debuginfo-115.3.0-150200.152.108.1 * MozillaFirefox-translations-other-115.3.0-150200.152.108.1 * MozillaFirefox-translations-common-115.3.0-150200.152.108.1 * MozillaFirefox-115.3.0-150200.152.108.1 * Desktop Applications Module 15-SP4 (noarch) * MozillaFirefox-devel-115.3.0-150200.152.108.1 * Desktop Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64) * MozillaFirefox-debugsource-115.3.0-150200.152.108.1 * MozillaFirefox-debuginfo-115.3.0-150200.152.108.1 * MozillaFirefox-translations-other-115.3.0-150200.152.108.1 * MozillaFirefox-translations-common-115.3.0-150200.152.108.1 * MozillaFirefox-115.3.0-150200.152.108.1 * Desktop Applications Module 15-SP5 (noarch) * MozillaFirefox-devel-115.3.0-150200.152.108.1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (aarch64 x86_64) * MozillaFirefox-debugsource-115.3.0-150200.152.108.1 * MozillaFirefox-debuginfo-115.3.0-150200.152.108.1 * MozillaFirefox-translations-other-115.3.0-150200.152.108.1 * MozillaFirefox-translations-common-115.3.0-150200.152.108.1 * MozillaFirefox-115.3.0-150200.152.108.1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (noarch) * MozillaFirefox-devel-115.3.0-150200.152.108.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (aarch64 x86_64) * MozillaFirefox-debugsource-115.3.0-150200.152.108.1 * MozillaFirefox-debuginfo-115.3.0-150200.152.108.1 * MozillaFirefox-translations-other-115.3.0-150200.152.108.1 * MozillaFirefox-translations-common-115.3.0-150200.152.108.1 * MozillaFirefox-115.3.0-150200.152.108.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (noarch) * MozillaFirefox-devel-115.3.0-150200.152.108.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) * MozillaFirefox-debugsource-115.3.0-150200.152.108.1 * MozillaFirefox-debuginfo-115.3.0-150200.152.108.1 * MozillaFirefox-translations-other-115.3.0-150200.152.108.1 * MozillaFirefox-translations-common-115.3.0-150200.152.108.1 * MozillaFirefox-115.3.0-150200.152.108.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch) * MozillaFirefox-devel-115.3.0-150200.152.108.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (aarch64 ppc64le s390x x86_64) * MozillaFirefox-debugsource-115.3.0-150200.152.108.1 * MozillaFirefox-debuginfo-115.3.0-150200.152.108.1 * MozillaFirefox-translations-other-115.3.0-150200.152.108.1 * MozillaFirefox-translations-common-115.3.0-150200.152.108.1 * MozillaFirefox-115.3.0-150200.152.108.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (noarch) * MozillaFirefox-devel-115.3.0-150200.152.108.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x x86_64) * MozillaFirefox-debugsource-115.3.0-150200.152.108.1 * MozillaFirefox-debuginfo-115.3.0-150200.152.108.1 * MozillaFirefox-translations-other-115.3.0-150200.152.108.1 * MozillaFirefox-translations-common-115.3.0-150200.152.108.1 * MozillaFirefox-115.3.0-150200.152.108.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (noarch) * MozillaFirefox-devel-115.3.0-150200.152.108.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (ppc64le x86_64) * MozillaFirefox-debugsource-115.3.0-150200.152.108.1 * MozillaFirefox-debuginfo-115.3.0-150200.152.108.1 * MozillaFirefox-translations-other-115.3.0-150200.152.108.1 * MozillaFirefox-translations-common-115.3.0-150200.152.108.1 * MozillaFirefox-115.3.0-150200.152.108.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (noarch) * MozillaFirefox-devel-115.3.0-150200.152.108.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64) * MozillaFirefox-debugsource-115.3.0-150200.152.108.1 * MozillaFirefox-debuginfo-115.3.0-150200.152.108.1 * MozillaFirefox-translations-other-115.3.0-150200.152.108.1 * MozillaFirefox-translations-common-115.3.0-150200.152.108.1 * MozillaFirefox-115.3.0-150200.152.108.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (noarch) * MozillaFirefox-devel-115.3.0-150200.152.108.1 * SUSE Enterprise Storage 7.1 (aarch64 x86_64) * MozillaFirefox-debugsource-115.3.0-150200.152.108.1 * MozillaFirefox-debuginfo-115.3.0-150200.152.108.1 * MozillaFirefox-translations-other-115.3.0-150200.152.108.1 * MozillaFirefox-translations-common-115.3.0-150200.152.108.1 * MozillaFirefox-115.3.0-150200.152.108.1 * SUSE Enterprise Storage 7.1 (noarch) * MozillaFirefox-devel-115.3.0-150200.152.108.1 * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * MozillaFirefox-debugsource-115.3.0-150200.152.108.1 * MozillaFirefox-branding-upstream-115.3.0-150200.152.108.1 * MozillaFirefox-debuginfo-115.3.0-150200.152.108.1 * MozillaFirefox-translations-other-115.3.0-150200.152.108.1 * MozillaFirefox-translations-common-115.3.0-150200.152.108.1 * MozillaFirefox-115.3.0-150200.152.108.1 * openSUSE Leap 15.4 (noarch) * MozillaFirefox-devel-115.3.0-150200.152.108.1 ## References: * https://www.suse.com/security/cve/CVE-2023-5168.html * https://www.suse.com/security/cve/CVE-2023-5169.html * https://www.suse.com/security/cve/CVE-2023-5171.html * https://www.suse.com/security/cve/CVE-2023-5174.html * https://www.suse.com/security/cve/CVE-2023-5176.html * https://bugzilla.suse.com/show_bug.cgi?id=1215309 * https://bugzilla.suse.com/show_bug.cgi?id=1215575

1 0

SUSE-SU-2023:3887-1: important: Security update for iperf
by security＠lists.opensuse.org 28 Sep '23

28 Sep '23

# Security update for iperf Announcement ID: SUSE-SU-2023:3887-1 Rating: important References: * #1215662 Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 * SUSE Package Hub 15 15-SP4 * SUSE Package Hub 15 15-SP5 An update that has one security fix can now be installed. ## Description: This update for iperf fixes the following issues: * update to 3.15 (bsc#1215662, ESNET-SECADV-2023-0002): * Several bugs that could allow the iperf3 server to hang waiting for input on the control connection has been fixed (ESnet Software Security Advisory ESNET-SECADV-2023-0002) * A bug that caused garbled output with UDP tests on 32-bit hosts has been fixed (PR #1554, PR #1556). This bug was introduced in iperf-3.14. * A bug in counting UDP messages has been fixed * update to 3.14 (bsc#1213430, CVE-2023-38403): * fixes a memory allocation hazard that allowed a remote user to crash an iperf3 process * see https://downloads.es.net/pub/iperf/esnet-secadv-2023-0001.txt.asc * update to 3.13: * Added missing bind_dev getter and setter. * a fix for A resource leak bug in function iperf_create_pidfile (#1443) * doc: Fix copy-and-paste error leading to wrong error message * Fix crash on rcv-timeout with JSON logfile * update to 3.12: * cJSON has been updated to version 1.7.15 (#1383). * The --bind <host>%<dev> option syntax now works properly (#1360 / * A server-side file descriptor leak with the --logfile option has been fixed (#1369 / #1360 / #1369 / #1389 / #1393). * A bug that caused some large values from TCP_INFO to be misprinted as negative numbers has been fixed (#1372). * Using the -k or -n flags with --reverse no longer leak into future tests (#1363 / #1364). * There are now various debug level options available with the \--debug option. These can be used to adjust the amount of debugging output (#1327). * A new --snd-timeout option has been added to set a termination timeout for idle TCP connections (#1215 / #1282). * iperf3 is slightly more robust to out-of-order packets during UDP connection setup in --reverse mode (#914 / #1123 / #1182 / #1212 / * iperf3 will now use different ports for each direction when the \--cport and --bdir options are set (#1249 / #1259). * The iperf3 server will now exit if it can't open its log file * Various help message and output fixes have been made (#1299 / * Various compiler warnings have been fixed (#1211 / #1316). * Operation of bootstrap.sh has been fixed and simplified (#1335 / * Flow label support / compatibility under Linux has been improved * Various minor memory leaks have been fixed (#1332 / #1333). * A getter/setter has been added for the bind_port parameter (--cport option). (#1303, #1305) * Various internal documentation improvements (#1265 / #1285 / #1304). * update to 3.11: * Update links to Discussions in documentation * Fix DSCP so that TOS = DSCP * 4 (#1162) * Fix --bind-dev for TCP streams (#1153) * Fix interface specification so doesn't overlap with IPv6 link-local addresses for -c and -B (#1157, #1180) * Add get/set test_unit_format function declaration to iperf_api.h * Auto adjustment of test-end condition for file transfers (-F), if no end condition is set, it will automatically adjust it to file size in bytes * Exit if idle time expires waiting for a connection in one-off mode (#1187, #1197) * Support zerocopy by reverse mode (#1204) * Update help and manpage text for #1157, support bind device * Consistently print target_bandwidth in JSON start section (#1177) * Test bitrate added to JSON output (#1168) * Remove fsync call after every write to receiving --file (#1176, #1159) * Update documentation for -w (#1175) * Fix for #952, different JSON object names for bidir reverse channel * update to 3.10.1: * Fixed a problem with autoconf scripts that made builds fail in some environments (#1154 / #1155). * GNU autoconf 2.71 or newer is now required to regenerate iperf3's configure scripts. * update to 3.10: * Fix a bug where some --reverse tests didn't terminate (#982 / #1054). * Responsiveness of control connections is slightly improved (#1045 / #1046 / #1063). * The allowable clock skew when doing authentication between client and server is now configurable with the new --time-skew-threshold (#1065 / #1070). * Bitrate throttling using the -b option now works when a burst size is specified (#1090). * A bug with calculating CPU utilization has been fixed (#1076 / #1077). * A --bind-dev option to support binding sockets to a given network interface has been added to make iperf3 work better with multi-homed machines and/or VRFs (#817 / #1089 / #1097). * \--pidfile now works with --client mode (#1110). * The server is now less likely to get stuck due to network errors (#1101, #1125), controlled by the new --rcv-timeout option. * Fixed a few bugs in termination conditions for byte or block-limited tests (#1113, #1114, #1115). * Added tcp_info.snd_wnd to JSON output (#1148). * Some bugs with garbled JSON output have been fixed (#1086, #1118, #1143 / #1146). * Support for setting the IPv4 don't-fragment (DF) bit has been added with the new --dont-fragment option (#1119). * A failure with not being able to read the congestion control algorithm under WSL1 has been fixed (#1061 / #1126). * Error handling and error messages now make more sense in cases where sockets were not successfully opened (#1129 / #1132 / #1136, #1135 / #1138, #1128 / #1139). * Some buffer overflow hazards were fixed (#1134). * It is now possible to use the API to set/get the congestion control algorithm (#1036 / #1112). * update to 3.9: * A --timestamps flag has been added, which prepends a timestamp to each output line. An optional argument to this flag, which is a format specification to strftime(3), allows for custom timestamp formats (#909, #1028). * A --server-bitrate-limit flag has been added as a server-side command-line argument. It allows a server to enforce a maximum throughput rate; client connections that specify a higher bitrate or exceed this bitrate during a test will be terminated. The bitrate is expressed in bits per second, with an optional trailing slash and integer count that specifies an averaging interval over which to enforce the limit (#999). * A bug that caused increased CPU usage with the --bidir option has been fixed (#1011). * Fixed various minor memory leaks (#1023). * update to 3.8.1 * Minor bugfixes and enhancements * update to 3.7 * Support for simultaneous bidirectional tests with the --bidir flag * Use POSIX standard clock_gettime(3) interface for timekeeping where available * Passwords for authentication can be provided via environment variable * Specifying --repeating-payload and --reverse now works * Failed authentication doesn't count for --one-off * Several memory leaks related to authenticated use were fixed * The delay for tearing down the control connection for the default timed tests has been increased, to more gracefully handle high-delay paths * Various improvements to the libiperf APIs * Fixed build behavior when OpenSSL is absent * Portability fixes * update to 3.6 * A new --extra-data option can be used to fill in a user-defined string field that appears in JSON output. * A new --repeating-payload option makes iperf3 use a payload pattern similar to that used by iperf2, which could help in recreating results that might be affected by payload entropy (for example, compression). * -B now works properly with SCTP tests. * A compile fix for Solaris 10 was added. * Some minor bug fixes for JSON output. In particular, warnings for debug and/or verbose modes with --json output and a fix for JSON output on CentOS 6 * This maintenance release adds a -1 flag to make the iperf3 execute a single test and exit, needed for an upcoming bwctl there is only one stream. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3887=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3887=1 * SUSE Package Hub 15 15-SP4 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2023-3887=1 * SUSE Package Hub 15 15-SP5 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2023-3887=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2023-3887=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * iperf-debuginfo-3.15-150000.3.6.1 * libiperf0-3.15-150000.3.6.1 * iperf-devel-3.15-150000.3.6.1 * libiperf0-debuginfo-3.15-150000.3.6.1 * iperf-debugsource-3.15-150000.3.6.1 * iperf-3.15-150000.3.6.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * iperf-debuginfo-3.15-150000.3.6.1 * libiperf0-3.15-150000.3.6.1 * iperf-devel-3.15-150000.3.6.1 * libiperf0-debuginfo-3.15-150000.3.6.1 * iperf-debugsource-3.15-150000.3.6.1 * iperf-3.15-150000.3.6.1 * SUSE Package Hub 15 15-SP4 (aarch64 ppc64le s390x x86_64) * iperf-debuginfo-3.15-150000.3.6.1 * libiperf0-3.15-150000.3.6.1 * iperf-devel-3.15-150000.3.6.1 * libiperf0-debuginfo-3.15-150000.3.6.1 * iperf-debugsource-3.15-150000.3.6.1 * iperf-3.15-150000.3.6.1 * SUSE Package Hub 15 15-SP5 (aarch64 ppc64le s390x x86_64) * iperf-debuginfo-3.15-150000.3.6.1 * libiperf0-3.15-150000.3.6.1 * iperf-devel-3.15-150000.3.6.1 * libiperf0-debuginfo-3.15-150000.3.6.1 * iperf-debugsource-3.15-150000.3.6.1 * iperf-3.15-150000.3.6.1 * SUSE Enterprise Storage 7.1 (aarch64 x86_64) * iperf-debuginfo-3.15-150000.3.6.1 * libiperf0-3.15-150000.3.6.1 * libiperf0-debuginfo-3.15-150000.3.6.1 * iperf-debugsource-3.15-150000.3.6.1 * iperf-3.15-150000.3.6.1 ## References: * https://bugzilla.suse.com/show_bug.cgi?id=1215662

1 0

SUSE-SU-2023:3888-1: important: Security update for Golang Prometheus
by security＠lists.opensuse.org 28 Sep '23

28 Sep '23

# Security update for Golang Prometheus Announcement ID: SUSE-SU-2023:3888-1 Rating: important References: * #1213880 Cross-References: * CVE-2023-29409 CVSS scores: * CVE-2023-29409 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-29409 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: * Basesystem Module 15-SP4 * Basesystem Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE CaaS Platform 4.0 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise Desktop 15 * SUSE Linux Enterprise Desktop 15 SP1 * SUSE Linux Enterprise Desktop 15 SP2 * SUSE Linux Enterprise Desktop 15 SP3 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 * SUSE Linux Enterprise High Performance Computing 15 SP1 * SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise Micro 5.0 * SUSE Linux Enterprise Micro 5.1 * SUSE Linux Enterprise Micro 5.2 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP1 * SUSE Linux Enterprise Real Time 15 SP2 * SUSE Linux Enterprise Real Time 15 SP3 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 * SUSE Linux Enterprise Server 15 SP1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Client Tools for SLE 15 * SUSE Manager Client Tools for SLE Micro 5 * SUSE Manager Proxy 4.2 * SUSE Manager Proxy 4.2 Module 4.2 * SUSE Manager Proxy 4.3 * SUSE Manager Proxy 4.3 Module 4.3 * SUSE Manager Retail Branch Server 4.2 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.2 * SUSE Manager Server 4.3 * SUSE Package Hub 15 15-SP5 An update that solves one vulnerability can now be installed. ## Description: This update for Golang Prometheus fixes the following issues: golang-github-prometheus-alertmanager: * CVE-2023-29409: Restrict RSA keys in certificates to less than or equal to 8192 bits to avoid DoSing client/server while validating signatures for extremely large RSA keys. (bsc#1213880) There are no direct source changes. The CVE is fixed rebuilding the sources with the patched Go version. golang-github-prometheus-node_exporter: * CVE-2023-29409: Restrict RSA keys in certificates to less than or equal to 8192 bits to avoid DoSing client/server while validating signatures for extremely large RSA keys. (bsc#1213880) There are no direct source changes. The CVE is fixed rebuilding the sources with the patched Go version. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3888=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3888=1 * SUSE Manager Client Tools for SLE 15 zypper in -t patch SUSE-SLE-Manager-Tools-15-2023-3888=1 * SUSE Manager Client Tools for SLE Micro 5 zypper in -t patch SUSE-SLE-Manager-Tools-For-Micro-5-2023-3888=1 * Basesystem Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-3888=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-3888=1 * SUSE Package Hub 15 15-SP5 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2023-3888=1 * SUSE Manager Proxy 4.2 Module 4.2 zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Proxy-4.2-2023-3888=1 * SUSE Manager Proxy 4.3 Module 4.3 zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Proxy-4.3-2023-3888=1 * SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2023-3888=1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2023-3888=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-3888=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-3888=1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2023-3888=1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2023-3888=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-3888=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2023-3888=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2023-3888=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-3888=1 * SUSE Manager Proxy 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.2-2023-3888=1 * SUSE Manager Retail Branch Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.2-2023-3888=1 * SUSE Manager Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-3888=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2023-3888=1 * SUSE CaaS Platform 4.0 To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * golang-github-prometheus-alertmanager-0.23.0-150100.4.16.2 * golang-github-prometheus-node_exporter-1.5.0-150100.3.26.2 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * golang-github-prometheus-alertmanager-0.23.0-150100.4.16.2 * golang-github-prometheus-node_exporter-1.5.0-150100.3.26.2 * SUSE Manager Client Tools for SLE 15 (aarch64 ppc64le s390x x86_64) * golang-github-prometheus-alertmanager-0.23.0-150100.4.16.2 * SUSE Manager Client Tools for SLE Micro 5 (aarch64 s390x x86_64) * golang-github-prometheus-node_exporter-1.5.0-150100.3.26.2 * Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64) * golang-github-prometheus-node_exporter-1.5.0-150100.3.26.2 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * golang-github-prometheus-node_exporter-1.5.0-150100.3.26.2 * SUSE Package Hub 15 15-SP5 (aarch64 ppc64le s390x x86_64) * golang-github-prometheus-alertmanager-0.23.0-150100.4.16.2 * SUSE Manager Proxy 4.2 Module 4.2 (aarch64 ppc64le s390x x86_64) * golang-github-prometheus-alertmanager-0.23.0-150100.4.16.2 * SUSE Manager Proxy 4.3 Module 4.3 (aarch64 ppc64le s390x x86_64) * golang-github-prometheus-alertmanager-0.23.0-150100.4.16.2 * SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (aarch64 x86_64) * golang-github-prometheus-node_exporter-1.5.0-150100.3.26.2 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (aarch64 x86_64) * golang-github-prometheus-node_exporter-1.5.0-150100.3.26.2 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (aarch64 x86_64) * golang-github-prometheus-node_exporter-1.5.0-150100.3.26.2 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) * golang-github-prometheus-node_exporter-1.5.0-150100.3.26.2 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (aarch64 ppc64le s390x x86_64) * golang-github-prometheus-node_exporter-1.5.0-150100.3.26.2 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (aarch64 ppc64le s390x x86_64) * golang-github-prometheus-node_exporter-1.5.0-150100.3.26.2 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x x86_64) * golang-github-prometheus-node_exporter-1.5.0-150100.3.26.2 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 (ppc64le x86_64) * golang-github-prometheus-node_exporter-1.5.0-150100.3.26.2 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (ppc64le x86_64) * golang-github-prometheus-node_exporter-1.5.0-150100.3.26.2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64) * golang-github-prometheus-node_exporter-1.5.0-150100.3.26.2 * SUSE Manager Proxy 4.2 (x86_64) * golang-github-prometheus-node_exporter-1.5.0-150100.3.26.2 * SUSE Manager Retail Branch Server 4.2 (x86_64) * golang-github-prometheus-node_exporter-1.5.0-150100.3.26.2 * SUSE Manager Server 4.2 (ppc64le s390x x86_64) * golang-github-prometheus-node_exporter-1.5.0-150100.3.26.2 * SUSE Enterprise Storage 7.1 (aarch64 x86_64) * golang-github-prometheus-node_exporter-1.5.0-150100.3.26.2 * SUSE CaaS Platform 4.0 (x86_64) * golang-github-prometheus-node_exporter-1.5.0-150100.3.26.2 ## References: * https://www.suse.com/security/cve/CVE-2023-29409.html * https://bugzilla.suse.com/show_bug.cgi?id=1213880

1 0

SUSE-SU-2023:3858-1: moderate: Security update for gsl
by security＠lists.opensuse.org 28 Sep '23

28 Sep '23

# Security update for gsl Announcement ID: SUSE-SU-2023:3858-1 Rating: moderate References: * #1214681 Cross-References: * CVE-2020-35357 CVSS scores: * CVE-2020-35357 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2020-35357 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: * Desktop Applications Module 15-SP4 * Desktop Applications Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 * SUSE Package Hub 15 15-SP4 * SUSE Package Hub 15 15-SP5 An update that solves one vulnerability can now be installed. ## Description: This update for gsl fixes the following issues: * CVE-2020-35357: Fixed a stack out of bounds read in gsl_stats_quantile_from_sorted_data(). (bsc#1214681) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3858=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3858=1 * Desktop Applications Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP4-2023-3858=1 * Desktop Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP5-2023-3858=1 * SUSE Package Hub 15 15-SP4 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2023-3858=1 * SUSE Package Hub 15 15-SP5 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2023-3858=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * gsl_2_6-gnu-hpc-doc-2.6-150200.3.4.3 * gsl_2_6-gnu-hpc-debugsource-2.6-150200.3.4.3 * gsl-debuginfo-2.6-150200.3.4.3 * gsl-debugsource-2.6-150200.3.4.3 * libgsl-gnu-hpc-2.6-150200.3.4.3 * gsl-devel-2.6-150200.3.4.3 * gsl_2_6-gnu-hpc-devel-2.6-150200.3.4.3 * libgslcblas0-2.6-150200.3.4.3 * libgslcblas_2_6-gnu-hpc-debuginfo-2.6-150200.3.4.3 * libgsl_2_6-gnu-hpc-debuginfo-2.6-150200.3.4.3 * libgsl25-2.6-150200.3.4.3 * libgslcblas-gnu-hpc-2.6-150200.3.4.3 * libgsl25-debuginfo-2.6-150200.3.4.3 * gsl-2.6-150200.3.4.3 * libgslcblas_2_6-gnu-hpc-2.6-150200.3.4.3 * libgslcblas0-debuginfo-2.6-150200.3.4.3 * gsl_2_6-gnu-hpc-debuginfo-2.6-150200.3.4.3 * libgsl_2_6-gnu-hpc-2.6-150200.3.4.3 * gsl-doc-2.6-150200.3.4.3 * gsl_2_6-gnu-hpc-2.6-150200.3.4.3 * gsl_2_6-gnu-hpc-module-2.6-150200.3.4.3 * openSUSE Leap 15.4 (noarch) * gsl_2_6-gnu-hpc-examples-2.6-150200.3.4.3 * gsl-gnu-hpc-doc-2.6-150200.3.4.3 * gsl-examples-2.6-150200.3.4.3 * gsl-gnu-hpc-2.6-150200.3.4.3 * gsl-gnu-hpc-devel-2.6-150200.3.4.3 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * gsl_2_6-gnu-hpc-doc-2.6-150200.3.4.3 * gsl_2_6-gnu-hpc-debugsource-2.6-150200.3.4.3 * gsl-debuginfo-2.6-150200.3.4.3 * gsl-debugsource-2.6-150200.3.4.3 * libgsl-gnu-hpc-2.6-150200.3.4.3 * gsl-devel-2.6-150200.3.4.3 * gsl_2_6-gnu-hpc-devel-2.6-150200.3.4.3 * libgslcblas0-2.6-150200.3.4.3 * libgslcblas_2_6-gnu-hpc-debuginfo-2.6-150200.3.4.3 * libgsl_2_6-gnu-hpc-debuginfo-2.6-150200.3.4.3 * libgsl25-2.6-150200.3.4.3 * libgslcblas-gnu-hpc-2.6-150200.3.4.3 * libgsl25-debuginfo-2.6-150200.3.4.3 * gsl-2.6-150200.3.4.3 * libgslcblas_2_6-gnu-hpc-2.6-150200.3.4.3 * libgslcblas0-debuginfo-2.6-150200.3.4.3 * gsl_2_6-gnu-hpc-debuginfo-2.6-150200.3.4.3 * libgsl_2_6-gnu-hpc-2.6-150200.3.4.3 * gsl-doc-2.6-150200.3.4.3 * gsl_2_6-gnu-hpc-2.6-150200.3.4.3 * gsl_2_6-gnu-hpc-module-2.6-150200.3.4.3 * openSUSE Leap 15.5 (noarch) * gsl_2_6-gnu-hpc-examples-2.6-150200.3.4.3 * gsl-gnu-hpc-doc-2.6-150200.3.4.3 * gsl-examples-2.6-150200.3.4.3 * gsl-gnu-hpc-2.6-150200.3.4.3 * gsl-gnu-hpc-devel-2.6-150200.3.4.3 * Desktop Applications Module 15-SP4 (aarch64 ppc64le s390x x86_64) * gsl-devel-2.6-150200.3.4.3 * libgslcblas0-2.6-150200.3.4.3 * libgslcblas0-debuginfo-2.6-150200.3.4.3 * gsl-debuginfo-2.6-150200.3.4.3 * libgsl25-debuginfo-2.6-150200.3.4.3 * gsl-debugsource-2.6-150200.3.4.3 * libgsl25-2.6-150200.3.4.3 * Desktop Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64) * gsl-devel-2.6-150200.3.4.3 * libgslcblas0-2.6-150200.3.4.3 * libgslcblas0-debuginfo-2.6-150200.3.4.3 * gsl-debuginfo-2.6-150200.3.4.3 * libgsl25-debuginfo-2.6-150200.3.4.3 * gsl-debugsource-2.6-150200.3.4.3 * libgsl25-2.6-150200.3.4.3 * SUSE Package Hub 15 15-SP4 (aarch64 ppc64le s390x) * libgslcblas0-2.6-150200.3.4.3 * SUSE Package Hub 15 15-SP5 (aarch64 ppc64le s390x) * libgslcblas0-2.6-150200.3.4.3 ## References: * https://www.suse.com/security/cve/CVE-2020-35357.html * https://bugzilla.suse.com/show_bug.cgi?id=1214681

1 0

SUSE-SU-2023:3859-1: moderate: Security update for pmix
by security＠lists.opensuse.org 28 Sep '23

28 Sep '23

# Security update for pmix Announcement ID: SUSE-SU-2023:3859-1 Rating: moderate References: * #1215190 Cross-References: * CVE-2023-41915 CVSS scores: * CVE-2023-41915 ( SUSE ): 6.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L * CVE-2023-41915 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: * HPC Module 15-SP4 * HPC Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 An update that solves one vulnerability can now be installed. ## Description: This update for pmix fixes the following issues: * CVE-2023-41915: Fixed a potential vulnerability where a `chown` may follow a user-created link (bsc#1215190). * Install pmix-plugin-munge if munge is installed. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3859=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3859=1 * HPC Module 15-SP4 zypper in -t patch SUSE-SLE-Module-HPC-15-SP4-2023-3859=1 * HPC Module 15-SP5 zypper in -t patch SUSE-SLE-Module-HPC-15-SP5-2023-3859=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * libpmix2-debuginfo-3.2.3-150300.3.8.1 * pmix-3.2.3-150300.3.8.1 * pmix-plugins-3.2.3-150300.3.8.1 * pmix-plugin-munge-3.2.3-150300.3.8.1 * pmix-test-debuginfo-3.2.3-150300.3.8.1 * pmix-plugins-debuginfo-3.2.3-150300.3.8.1 * libmca_common_dstore1-debuginfo-3.2.3-150300.3.8.1 * pmix-plugin-munge-debuginfo-3.2.3-150300.3.8.1 * pmix-test-3.2.3-150300.3.8.1 * libpmix2-3.2.3-150300.3.8.1 * libmca_common_dstore1-3.2.3-150300.3.8.1 * pmix-debuginfo-3.2.3-150300.3.8.1 * pmix-debugsource-3.2.3-150300.3.8.1 * pmix-devel-3.2.3-150300.3.8.1 * openSUSE Leap 15.4 (noarch) * pmix-headers-3.2.3-150300.3.8.1 * pmix-mca-params-3.2.3-150300.3.8.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * libpmix2-debuginfo-3.2.3-150300.3.8.1 * pmix-3.2.3-150300.3.8.1 * pmix-plugins-3.2.3-150300.3.8.1 * pmix-plugin-munge-3.2.3-150300.3.8.1 * pmix-test-debuginfo-3.2.3-150300.3.8.1 * pmix-plugins-debuginfo-3.2.3-150300.3.8.1 * libmca_common_dstore1-debuginfo-3.2.3-150300.3.8.1 * pmix-plugin-munge-debuginfo-3.2.3-150300.3.8.1 * pmix-test-3.2.3-150300.3.8.1 * libpmix2-3.2.3-150300.3.8.1 * libmca_common_dstore1-3.2.3-150300.3.8.1 * pmix-debuginfo-3.2.3-150300.3.8.1 * pmix-debugsource-3.2.3-150300.3.8.1 * pmix-devel-3.2.3-150300.3.8.1 * openSUSE Leap 15.5 (noarch) * pmix-headers-3.2.3-150300.3.8.1 * pmix-mca-params-3.2.3-150300.3.8.1 * HPC Module 15-SP4 (aarch64 x86_64) * libpmix2-debuginfo-3.2.3-150300.3.8.1 * pmix-3.2.3-150300.3.8.1 * pmix-plugins-3.2.3-150300.3.8.1 * pmix-plugin-munge-3.2.3-150300.3.8.1 * pmix-test-debuginfo-3.2.3-150300.3.8.1 * pmix-plugins-debuginfo-3.2.3-150300.3.8.1 * libmca_common_dstore1-debuginfo-3.2.3-150300.3.8.1 * pmix-plugin-munge-debuginfo-3.2.3-150300.3.8.1 * pmix-test-3.2.3-150300.3.8.1 * libpmix2-3.2.3-150300.3.8.1 * libmca_common_dstore1-3.2.3-150300.3.8.1 * pmix-debuginfo-3.2.3-150300.3.8.1 * pmix-debugsource-3.2.3-150300.3.8.1 * HPC Module 15-SP4 (noarch) * pmix-headers-3.2.3-150300.3.8.1 * pmix-mca-params-3.2.3-150300.3.8.1 * HPC Module 15-SP4 (x86_64) * pmix-devel-3.2.3-150300.3.8.1 * HPC Module 15-SP5 (aarch64 x86_64) * libpmix2-debuginfo-3.2.3-150300.3.8.1 * pmix-3.2.3-150300.3.8.1 * pmix-plugins-3.2.3-150300.3.8.1 * pmix-plugin-munge-3.2.3-150300.3.8.1 * pmix-test-debuginfo-3.2.3-150300.3.8.1 * pmix-plugins-debuginfo-3.2.3-150300.3.8.1 * libmca_common_dstore1-debuginfo-3.2.3-150300.3.8.1 * pmix-plugin-munge-debuginfo-3.2.3-150300.3.8.1 * pmix-test-3.2.3-150300.3.8.1 * libpmix2-3.2.3-150300.3.8.1 * libmca_common_dstore1-3.2.3-150300.3.8.1 * pmix-debuginfo-3.2.3-150300.3.8.1 * pmix-debugsource-3.2.3-150300.3.8.1 * HPC Module 15-SP5 (noarch) * pmix-headers-3.2.3-150300.3.8.1 * pmix-mca-params-3.2.3-150300.3.8.1 * HPC Module 15-SP5 (x86_64) * pmix-devel-3.2.3-150300.3.8.1 ## References: * https://www.suse.com/security/cve/CVE-2023-41915.html * https://bugzilla.suse.com/show_bug.cgi?id=1215190

1 0

SUSE-SU-2023:3862-1: moderate: Security update for salt
by security＠lists.opensuse.org 28 Sep '23

28 Sep '23

# Security update for salt Announcement ID: SUSE-SU-2023:3862-1 Rating: moderate References: * #1193948 * #1210994 * #1212794 * #1212844 * #1212855 * #1213257 * #1213441 * #1213630 * #1213960 * #1214796 * #1214797 * #1215489 Cross-References: * CVE-2023-20897 * CVE-2023-20898 CVSS scores: * CVE-2023-20897 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2023-20897 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2023-20898 ( SUSE ): 4.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N * CVE-2023-20898 ( NVD ): 4.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.5 * Server Applications Module 15-SP5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * Transactional Server Module 15-SP5 An update that solves two vulnerabilities and has 10 security fixes can now be installed. ## Description: This update for salt fixes the following issues: Security issues fixed: * CVE-2023-20897: Fixed DOS in minion return. (bsc#1214796, bsc#1213441) * CVE-2023-20898: Fixed Git Providers can read from the wrong environment because they get the same cache directory base name. (bsc#1214797, bsc#1193948) Bugs fixed: * Create minion_id with reproducible mtime * Fix broken tests to make them running in the testsuite * Fix detection of Salt codename by "salt_version" execution module * Fix inconsistency in reported version by egg-info metadata (bsc#1215489) * Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) * Fix the regression of user.present state when group is unset (bsc#1212855) * Fix utf8 handling in 'pass' renderer and make it more robust * Fix zypper repositories always being reconfigured * Make sure configured user is properly set by Salt (bsc#1210994) * Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) * Revert usage of long running REQ channel to prevent possible missing responses on requests and duplicated responses (bsc#1213960, bsc#1213630, bsc#1213257) ## Special Instructions and Notes: ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2023-3862=1 openSUSE-SLE-15.5-2023-3862=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-3862=1 * Server Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP5-2023-3862=1 * Transactional Server Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Transactional-Server-15-SP5-2023-3862=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * salt-3006.0-150500.4.19.1 * python3-salt-3006.0-150500.4.19.1 * salt-syndic-3006.0-150500.4.19.1 * salt-proxy-3006.0-150500.4.19.1 * salt-tests-3006.0-150500.4.19.1 * salt-standalone-formulas-configuration-3006.0-150500.4.19.1 * salt-ssh-3006.0-150500.4.19.1 * salt-minion-3006.0-150500.4.19.1 * salt-doc-3006.0-150500.4.19.1 * salt-transactional-update-3006.0-150500.4.19.1 * salt-api-3006.0-150500.4.19.1 * salt-cloud-3006.0-150500.4.19.1 * salt-master-3006.0-150500.4.19.1 * openSUSE Leap 15.5 (noarch) * salt-zsh-completion-3006.0-150500.4.19.1 * salt-fish-completion-3006.0-150500.4.19.1 * salt-bash-completion-3006.0-150500.4.19.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * salt-minion-3006.0-150500.4.19.1 * salt-3006.0-150500.4.19.1 * salt-doc-3006.0-150500.4.19.1 * python3-salt-3006.0-150500.4.19.1 * Basesystem Module 15-SP5 (noarch) * salt-zsh-completion-3006.0-150500.4.19.1 * salt-bash-completion-3006.0-150500.4.19.1 * Server Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64) * salt-syndic-3006.0-150500.4.19.1 * salt-proxy-3006.0-150500.4.19.1 * salt-standalone-formulas-configuration-3006.0-150500.4.19.1 * salt-ssh-3006.0-150500.4.19.1 * salt-api-3006.0-150500.4.19.1 * salt-cloud-3006.0-150500.4.19.1 * salt-master-3006.0-150500.4.19.1 * Server Applications Module 15-SP5 (noarch) * salt-fish-completion-3006.0-150500.4.19.1 * Transactional Server Module 15-SP5 (aarch64 ppc64le s390x x86_64) * salt-transactional-update-3006.0-150500.4.19.1 ## References: * https://www.suse.com/security/cve/CVE-2023-20897.html * https://www.suse.com/security/cve/CVE-2023-20898.html * https://bugzilla.suse.com/show_bug.cgi?id=1193948 * https://bugzilla.suse.com/show_bug.cgi?id=1210994 * https://bugzilla.suse.com/show_bug.cgi?id=1212794 * https://bugzilla.suse.com/show_bug.cgi?id=1212844 * https://bugzilla.suse.com/show_bug.cgi?id=1212855 * https://bugzilla.suse.com/show_bug.cgi?id=1213257 * https://bugzilla.suse.com/show_bug.cgi?id=1213441 * https://bugzilla.suse.com/show_bug.cgi?id=1213630 * https://bugzilla.suse.com/show_bug.cgi?id=1213960 * https://bugzilla.suse.com/show_bug.cgi?id=1214796 * https://bugzilla.suse.com/show_bug.cgi?id=1214797 * https://bugzilla.suse.com/show_bug.cgi?id=1215489

1 0

SUSE-SU-2023:3863-1: moderate: Security update for salt
by security＠lists.opensuse.org 28 Sep '23

28 Sep '23

# Security update for salt Announcement ID: SUSE-SU-2023:3863-1 Rating: moderate References: * #1193948 * #1210994 * #1212794 * #1212844 * #1212855 * #1213257 * #1213441 * #1213630 * #1213960 * #1214796 * #1214797 * #1215489 Cross-References: * CVE-2023-20897 * CVE-2023-20898 CVSS scores: * CVE-2023-20897 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2023-20897 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2023-20898 ( SUSE ): 4.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N * CVE-2023-20898 ( NVD ): 4.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N Affected Products: * Basesystem Module 15-SP4 * openSUSE Leap 15.4 * Server Applications Module 15-SP4 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 * Transactional Server Module 15-SP4 An update that solves two vulnerabilities and has 10 security fixes can now be installed. ## Description: This update for salt fixes the following issues: Security issues fixed: * CVE-2023-20897: Fixed DOS in minion return. (bsc#1214796, bsc#1213441) * CVE-2023-20898: Fixed Git Providers can read from the wrong environment because they get the same cache directory base name. (bsc#1214797, bsc#1193948) Bugs fixed: * Create minion_id with reproducible mtime * Fix broken tests to make them running in the testsuite * Fix detection of Salt codename by "salt_version" execution module * Fix inconsistency in reported version by egg-info metadata (bsc#1215489) * Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) * Fix the regression of user.present state when group is unset (bsc#1212855) * Fix utf8 handling in 'pass' renderer and make it more robust * Fix zypper repositories always being reconfigured * Make sure configured user is properly set by Salt (bsc#1210994) * Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) * Revert usage of long running REQ channel to prevent possible missing responses on requests and duplicated responses (bsc#1213960, bsc#1213630, bsc#1213257) ## Special Instructions and Notes: ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * Transactional Server Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Transactional-Server-15-SP4-2023-3863=1 * openSUSE Leap 15.4 zypper in -t patch SUSE-2023-3863=1 openSUSE-SLE-15.4-2023-3863=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2023-3863=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2023-3863=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2023-3863=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2023-3863=1 * Basesystem Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-3863=1 * Server Applications Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2023-3863=1 ## Package List: * Transactional Server Module 15-SP4 (aarch64 ppc64le s390x x86_64) * salt-transactional-update-3006.0-150400.8.44.1 * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * salt-standalone-formulas-configuration-3006.0-150400.8.44.1 * salt-doc-3006.0-150400.8.44.1 * salt-proxy-3006.0-150400.8.44.1 * salt-syndic-3006.0-150400.8.44.1 * salt-tests-3006.0-150400.8.44.1 * salt-3006.0-150400.8.44.1 * salt-ssh-3006.0-150400.8.44.1 * salt-transactional-update-3006.0-150400.8.44.1 * salt-master-3006.0-150400.8.44.1 * salt-cloud-3006.0-150400.8.44.1 * salt-minion-3006.0-150400.8.44.1 * python3-salt-3006.0-150400.8.44.1 * salt-api-3006.0-150400.8.44.1 * openSUSE Leap 15.4 (noarch) * salt-fish-completion-3006.0-150400.8.44.1 * salt-zsh-completion-3006.0-150400.8.44.1 * salt-bash-completion-3006.0-150400.8.44.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64) * salt-transactional-update-3006.0-150400.8.44.1 * salt-3006.0-150400.8.44.1 * salt-minion-3006.0-150400.8.44.1 * python3-salt-3006.0-150400.8.44.1 * SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64) * salt-transactional-update-3006.0-150400.8.44.1 * salt-3006.0-150400.8.44.1 * salt-minion-3006.0-150400.8.44.1 * python3-salt-3006.0-150400.8.44.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64) * salt-transactional-update-3006.0-150400.8.44.1 * salt-3006.0-150400.8.44.1 * salt-minion-3006.0-150400.8.44.1 * python3-salt-3006.0-150400.8.44.1 * SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64) * salt-transactional-update-3006.0-150400.8.44.1 * salt-3006.0-150400.8.44.1 * salt-minion-3006.0-150400.8.44.1 * python3-salt-3006.0-150400.8.44.1 * Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64) * salt-minion-3006.0-150400.8.44.1 * salt-3006.0-150400.8.44.1 * salt-doc-3006.0-150400.8.44.1 * python3-salt-3006.0-150400.8.44.1 * Basesystem Module 15-SP4 (noarch) * salt-zsh-completion-3006.0-150400.8.44.1 * salt-bash-completion-3006.0-150400.8.44.1 * Server Applications Module 15-SP4 (aarch64 ppc64le s390x x86_64) * salt-standalone-formulas-configuration-3006.0-150400.8.44.1 * salt-proxy-3006.0-150400.8.44.1 * salt-syndic-3006.0-150400.8.44.1 * salt-ssh-3006.0-150400.8.44.1 * salt-master-3006.0-150400.8.44.1 * salt-cloud-3006.0-150400.8.44.1 * salt-api-3006.0-150400.8.44.1 * Server Applications Module 15-SP4 (noarch) * salt-fish-completion-3006.0-150400.8.44.1 ## References: * https://www.suse.com/security/cve/CVE-2023-20897.html * https://www.suse.com/security/cve/CVE-2023-20898.html * https://bugzilla.suse.com/show_bug.cgi?id=1193948 * https://bugzilla.suse.com/show_bug.cgi?id=1210994 * https://bugzilla.suse.com/show_bug.cgi?id=1212794 * https://bugzilla.suse.com/show_bug.cgi?id=1212844 * https://bugzilla.suse.com/show_bug.cgi?id=1212855 * https://bugzilla.suse.com/show_bug.cgi?id=1213257 * https://bugzilla.suse.com/show_bug.cgi?id=1213441 * https://bugzilla.suse.com/show_bug.cgi?id=1213630 * https://bugzilla.suse.com/show_bug.cgi?id=1213960 * https://bugzilla.suse.com/show_bug.cgi?id=1214796 * https://bugzilla.suse.com/show_bug.cgi?id=1214797 * https://bugzilla.suse.com/show_bug.cgi?id=1215489

1 0

SUSE-SU-2023:3868-1: important: Security update for SUSE Manager Client Tools
by security＠lists.opensuse.org 28 Sep '23

28 Sep '23

# Security update for SUSE Manager Client Tools Announcement ID: SUSE-SU-2023:3868-1 Rating: important References: * #1204501 * #1208046 * #1208270 * #1208298 * #1208692 * #1211525 * #1213880 * MSQA-699 * PED-5405 * PED-5406 Cross-References: * CVE-2022-32149 * CVE-2022-41723 * CVE-2022-46146 * CVE-2023-29409 CVSS scores: * CVE-2022-32149 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2022-32149 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2022-41723 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2022-41723 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2022-46146 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2022-46146 ( NVD ): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2023-29409 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-29409 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 * SUSE Linux Enterprise Desktop 15 SP1 * SUSE Linux Enterprise Desktop 15 SP2 * SUSE Linux Enterprise Desktop 15 SP3 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 * SUSE Linux Enterprise High Performance Computing 15 SP1 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.0 * SUSE Linux Enterprise Micro 5.1 * SUSE Linux Enterprise Micro 5.2 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Real Time 15 SP1 * SUSE Linux Enterprise Real Time 15 SP2 * SUSE Linux Enterprise Real Time 15 SP3 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 * SUSE Linux Enterprise Server 15 SP1 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Client Tools for SLE 15 * SUSE Manager Client Tools for SLE Micro 5 * SUSE Manager Proxy 4.2 * SUSE Manager Proxy 4.2 Module 4.2 * SUSE Manager Proxy 4.3 * SUSE Manager Proxy 4.3 Module 4.3 * SUSE Manager Retail Branch Server 4.2 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.2 * SUSE Manager Server 4.2 Module 4.2 * SUSE Manager Server 4.3 * SUSE Manager Server 4.3 Module 4.3 An update that solves four vulnerabilities, contains three features and has three security fixes can now be installed. ## Description: This update fixes the following issues: golang-github-lusitaniae-apache_exporter: * Security issues fixed: * CVE-2022-32149: Fix denial of service vulnerability (bsc#1204501) * CVE-2022-41723: Fix uncontrolled resource consumption (bsc#1208270) * CVE-2022-46146: Fix authentication bypass vulnarability (bsc#1208046) * Changes and bugs fixed: * Updated to 1.0.0 (jsc#PED-5405) * Improved flag parsing * Added support for custom headers * Changes from 0.13.1 * Fix panic caused by missing flagConfig options * Added AppArmor profile * Added sandboxing options to systemd service unit * Build using promu * Build with Go 1.19 * Exclude s390 architecture golang-github-prometheus-prometheus: * This update introduces breaking changes. Please, read carefully the provided informations. * Security issues fixed: * CVE-2022-41723: Fix uncontrolled resource consumption by updating Go to version 1.20.1 (bsc#1208298) * Updated to 2.45.0 (jsc#PED-5406): * [FEATURE] API: New limit parameter to limit the number of items returned by `/api/v1/status/tsdb` endpoint * [FEATURE] Config: Add limits to global config * [FEATURE] Consul SD: Added support for `path_prefix` * [FEATURE] Native histograms: Add option to scrape both classic and native histograms. * [FEATURE] Native histograms: Added support for two more arithmetic operators `avg_over_time` and `sum_over_time` * [FEATURE] Promtool: When providing the block id, only one block will be loaded and analyzed * [FEATURE] Remote-write: New Azure ad configuration to support remote writing directly to Azure Monitor workspace * [FEATURE] TSDB: Samples per chunk are now configurable with flag `storage.tsdb.samples-per-chunk`. By default set to its former value 120 * [ENHANCEMENT] Native histograms: bucket size can now be limited to avoid scrape fails * [ENHANCEMENT] TSDB: Dropped series are now deleted from the WAL sooner * [BUGFIX] Native histograms: ChunkSeries iterator now checks if a new sample can be appended to the open chunk * [BUGFIX] Native histograms: Fix Histogram Appender `Appendable()` segfault * [BUGFIX] Native histograms: Fix setting reset header to gauge histograms in seriesToChunkEncoder * [BUGFIX] TSDB: Tombstone intervals are not modified after Get() call * [BUGFIX] TSDB: Use path/filepath to set the WAL directory. * Changes from 2.44.0: * [FEATURE] Remote-read: Handle native histograms * [FEATURE] Promtool: Health and readiness check of prometheus server in CLI * [FEATURE] PromQL: Add `query_samples_total` metric, the total number of samples loaded by all queries * [ENHANCEMENT] Storage: Optimise buffer used to iterate through samples * [ENHANCEMENT] Scrape: Reduce memory allocations on target labels * [ENHANCEMENT] PromQL: Use faster heap method for `topk()` / `bottomk()` * [ENHANCEMENT] Rules API: Allow filtering by rule name * [ENHANCEMENT] Native Histograms: Various fixes and improvements * [ENHANCEMENT] UI: Search of scraping pools is now case-insensitive * [ENHANCEMENT] TSDB: Add an affirmative log message for successful WAL repair * [BUGFIX] TSDB: Block compaction failed when shutting down * [BUGFIX] TSDB: Out-of-order chunks could be ignored if the write-behind log was deleted * Changes from 2.43.1 * [BUGFIX] Labels: Set() after Del() would be ignored, which broke some relabeling rules * Changes from 2.43.0: * [FEATURE] Promtool: Add HTTP client configuration to query commands * [FEATURE] Scrape: Add `include_scrape_configs` to include scrape configs from different files * [FEATURE] HTTP client: Add `no_proxy` to exclude URLs from proxied requests * [FEATURE] HTTP client: Add `proxy_from_enviroment` to read proxies from env variables * [ENHANCEMENT] API: Add support for setting lookback delta per query via the API * [ENHANCEMENT] API: Change HTTP status code from 503/422 to 499 if a request is canceled * [ENHANCEMENT] Scrape: Allow exemplars for all metric types * [ENHANCEMENT] TSDB: Add metrics for head chunks and WAL folders size * [ENHANCEMENT] TSDB: Automatically remove incorrect snapshot with index that is ahead of WAL * [ENHANCEMENT] TSDB: Improve Prometheus parser error outputs to be more comprehensible * [ENHANCEMENT] UI: Scope `group by` labels to metric in autocompletion * [BUGFIX] Scrape: Fix `prometheus_target_scrape_pool_target_limit` metric not set before reloading * [BUGFIX] TSDB: Correctly update `prometheus_tsdb_head_chunks_removed_total` and `prometheus_tsdb_head_chunks` metrics when reading WAL * [BUGFIX] TSDB: Use the correct unit (seconds) when recording out-of-order append deltas in the `prometheus_tsdb_sample_ooo_delta` metric * Changes from 2.42.0: This release comes with a new feature coverage for native histograms and breaking changes. If you are trying native histograms already, we recommend you remove the `wal` directory when upgrading. Because the old WAL record for native histograms is not backward compatible in v2.42.0, this will lead to some data loss for the latest data. Additionally, if you scrape "float histograms" or use recording rules on native histograms in v2.42.0 (which writes float histograms), it is a one-way street since older versions do not support float histograms. * [CHANGE] **breaking** TSDB: Changed WAL record format for the experimental native histograms * [FEATURE] Add 'keep_firing_for' field to alerting rules * [FEATURE] Promtool: Add support of selecting timeseries for TSDB dump * [ENHANCEMENT] Agent: Native histogram support. * [ENHANCEMENT] Rules: Support native histograms in recording rules * [ENHANCEMENT] SD: Add container ID as a meta label for pod targets for Kubernetes * [ENHANCEMENT] SD: Add VM size label to azure service discovery * [ENHANCEMENT] Support native histograms in federation * [ENHANCEMENT] TSDB: Add gauge histogram support * [ENHANCEMENT] TSDB/Scrape: Support FloatHistogram that represents buckets as float64 values * [ENHANCEMENT] UI: Show individual scrape pools on /targets page * Changes from 2.41.0: * [FEATURE] Relabeling: Add keepequal and dropequal relabel actions * [FEATURE] Add support for HTTP proxy headers * [ENHANCEMENT] Reload private certificates when changed on disk * [ENHANCEMENT] Add max_version to specify maximum TLS version in tls_config * [ENHANCEMENT] Add goos and goarch labels to prometheus_build_info * [ENHANCEMENT] SD: Add proxy support for EC2 and LightSail SDs * [ENHANCEMENT] SD: Add new metric prometheus_sd_file_watcher_errors_total * [ENHANCEMENT] Remote Read: Use a pool to speed up marshalling * [ENHANCEMENT] TSDB: Improve handling of tombstoned chunks in iterators * [ENHANCEMENT] TSDB: Optimize postings offset table reading * [BUGFIX] Scrape: Validate the metric name, label names, and label values after relabeling * [BUGFIX] Remote Write receiver and rule manager: Fix error handling * Changes from 2.40.7: * [BUGFIX] TSDB: Fix queries involving negative buckets of native histograms * Changes from 2.40.5: * [BUGFIX] TSDB: Fix queries involving native histograms due to improper reset of iterators * Changes from 2.40.3: * [BUGFIX] TSDB: Fix compaction after a deletion is called * Changes from 2.40.2: * [BUGFIX] UI: Fix black-on-black metric name color in dark mode * Changes from 2.40.1: * [BUGFIX] TSDB: Fix alignment for atomic int64 for 32 bit architecture * [BUGFIX] Scrape: Fix accept headers * Changes from 2.40.0: * [FEATURE] Add experimental support for native histograms. Enable with the flag --enable-feature=native-histograms. * [FEATURE] SD: Add service discovery for OVHcloud * [ENHANCEMENT] Kubernetes SD: Use protobuf encoding * [ENHANCEMENT] TSDB: Use golang.org/x/exp/slices for improved sorting speed * [ENHANCEMENT] Consul SD: Add enterprise admin partitions. Adds __meta_consul_partition label. Adds partition config in consul_sd_config * [BUGFIX] API: Fix API error codes for /api/v1/labels and /api/v1/series * Changes from 2.39.1: * [BUGFIX] Rules: Fix notifier relabel changing the labels on active alerts * Changes from 2.39.0: * [FEATURE] experimental TSDB: Add support for ingesting out-of-order samples. This is configured via out_of_order_time_window field in the config file; check config file docs for more info * [ENHANCEMENT] API: /-/healthy and /-/ready API calls now also respond to a HEAD request on top of existing GET support. * [ENHANCEMENT] PuppetDB SD: Add __meta_puppetdb_query label. * [ENHANCEMENT] AWS EC2 SD: Add __meta_ec2_region label. * [ENHANCEMENT] AWS Lightsail SD: Add __meta_lightsail_region label. * [ENHANCEMENT] Scrape: Optimise relabeling by re-using memory. * [ENHANCEMENT] TSDB: Improve WAL replay timings. * [ENHANCEMENT] TSDB: Optimise memory by not storing unnecessary data in the memory. * [ENHANCEMENT] TSDB: Allow overlapping blocks by default. \--storage.tsdb.allow-overlapping-blocks now has no effect. * [ENHANCEMENT] UI: Click to copy label-value pair from query result to clipboard. * [BUGFIX] TSDB: Turn off isolation for Head compaction to fix a memory leak. * [BUGFIX] TSDB: Fix 'invalid magic number 0' error on Prometheus startup. * [BUGFIX] PromQL: Properly close file descriptor when logging unfinished queries. * [BUGFIX] Agent: Fix validation of flag options and prevent WAL from growing more than desired. * Changes from 2.38.0: * [FEATURE]: Web: Add a /api/v1/format_query HTTP API endpoint that allows pretty-formatting PromQL expressions. * [FEATURE]: UI: Add support for formatting PromQL expressions in the UI. * [FEATURE]: DNS SD: Support MX records for discovering targets. * [FEATURE]: Templates: Add toTime() template function that allows converting sample timestamps to Go time.Time values * [ENHANCEMENT]: Kubernetes SD: Add __meta_kubernetes_service_port_number meta label indicating the service port number. __meta_kubernetes_pod_container_image meta label indicating the container image. * [ENHANCEMENT]: PromQL: When a query panics, also log the query itself alongside the panic message. * [ENHANCEMENT]: UI: Tweak colors in the dark theme to improve the contrast ratio. * [ENHANCEMENT]: Web: Speed up calls to /api/v1/rules by avoiding locks and using atomic types instead. * [ENHANCEMENT]: Scrape: Add a no-default-scrape-port feature flag, which omits or removes any default HTTP (:80) or HTTPS (:443) ports in the target's scrape address. * [BUGFIX]: TSDB: In the WAL watcher metrics, expose the type="exemplar" label instead of type="unknown" for exemplar records. * [BUGFIX]: TSDB: Fix race condition around allocating series IDs during chunk snapshot loading. golang-github-QubitProducts-exporter_exporter: * CVE-2023-29409: Restrict RSA keys in certificates to less than or equal to 8192 bits to avoid DoSing client/server while validating signatures for extremely large RSA keys. (bsc#1213880) There are no direct source changes. The CVE is fixed rebuilding the sources with the patched Go version. grafana: * CVE-2023-29409: Restrict RSA keys in certificates to less than or equal to 8192 bits to avoid DoSing client/server while validating signatures for extremely large RSA keys. (bsc#1213880) There are no direct source changes. The CVE is fixed rebuilding the sources with the patched Go version. prometheus-blackbox_exporter: * CVE-2023-29409: Restrict RSA keys in certificates to less than or equal to 8192 bits to avoid DoSing client/server while validating signatures for extremely large RSA keys. (bsc#1213880) There are no direct source changes. The CVE is fixed rebuilding the sources with the patched Go version. prometheus-postgres_exporter: * CVE-2023-29409: Restrict RSA keys in certificates to less than or equal to 8192 bits to avoid DoSing client/server while validating signatures for extremely large RSA keys. (bsc#1213880) There are no direct source changes. The CVE is fixed rebuilding the sources with the patched Go version. python-pyvmomi: * Preparing submission to SUSE:SLE-15-SP3:Update as part of ECO PED-3623. spacecmd: * Updated to 4.3.23-1 * Update translation strings supportutils-plugin-susemanager-client: * Updated to 4.3.3-1 * Write configured crypto-policy in supportconfig * Add cloud and Pay-as-you-go checks uyuni-common-libs: * Updated to 4.3.9-1 * Workaround for python3-debian bug about collecting control file (bsc#1211525, bsc#1208692) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3868=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3868=1 * SUSE Manager Client Tools for SLE 15 zypper in -t patch SUSE-SLE-Manager-Tools-15-2023-3868=1 * SUSE Manager Client Tools for SLE Micro 5 zypper in -t patch SUSE-SLE-Manager-Tools-For-Micro-5-2023-3868=1 * SUSE Manager Proxy 4.2 Module 4.2 zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Proxy-4.2-2023-3868=1 * SUSE Manager Proxy 4.3 Module 4.3 zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Proxy-4.3-2023-3868=1 * SUSE Manager Server 4.2 Module 4.2 zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Server-4.2-2023-3868=1 * SUSE Manager Server 4.3 Module 4.3 zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Server-4.3-2023-3868=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * golang-github-QubitProducts-exporter_exporter-0.4.0-150000.1.18.3 * golang-github-lusitaniae-apache_exporter-1.0.0-150000.1.17.2 * prometheus-postgres_exporter-0.10.1-150000.1.14.3 * golang-github-lusitaniae-apache_exporter-debuginfo-1.0.0-150000.1.17.2 * prometheus-blackbox_exporter-0.24.0-150000.1.23.3 * openSUSE Leap 15.4 (noarch) * supportutils-plugin-susemanager-client-4.3.3-150000.3.21.2 * spacecmd-4.3.23-150000.3.104.2 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * golang-github-QubitProducts-exporter_exporter-0.4.0-150000.1.18.3 * golang-github-lusitaniae-apache_exporter-1.0.0-150000.1.17.2 * prometheus-postgres_exporter-0.10.1-150000.1.14.3 * golang-github-lusitaniae-apache_exporter-debuginfo-1.0.0-150000.1.17.2 * prometheus-blackbox_exporter-0.24.0-150000.1.23.3 * openSUSE Leap 15.5 (noarch) * supportutils-plugin-susemanager-client-4.3.3-150000.3.21.2 * spacecmd-4.3.23-150000.3.104.2 * SUSE Manager Client Tools for SLE 15 (aarch64 ppc64le s390x x86_64) * golang-github-QubitProducts-exporter_exporter-0.4.0-150000.1.18.3 * golang-github-lusitaniae-apache_exporter-1.0.0-150000.1.17.2 * prometheus-postgres_exporter-0.10.1-150000.1.14.3 * firewalld-prometheus-config-0.1-150000.3.50.3 * golang-github-lusitaniae-apache_exporter-debuginfo-1.0.0-150000.1.17.2 * grafana-9.5.5-150000.1.54.3 * golang-github-prometheus-prometheus-2.45.0-150000.3.50.3 * grafana-debuginfo-9.5.5-150000.1.54.3 * prometheus-blackbox_exporter-0.24.0-150000.1.23.3 * python3-uyuni-common-libs-4.3.9-150000.1.36.2 * SUSE Manager Client Tools for SLE 15 (noarch) * supportutils-plugin-susemanager-client-4.3.3-150000.3.21.2 * python3-pyvmomi-6.7.3-150000.1.6.2 * spacecmd-4.3.23-150000.3.104.2 * SUSE Manager Client Tools for SLE Micro 5 (aarch64 s390x x86_64) * golang-github-QubitProducts-exporter_exporter-0.4.0-150000.1.18.3 * prometheus-blackbox_exporter-0.24.0-150000.1.23.3 * SUSE Manager Proxy 4.2 Module 4.2 (aarch64 ppc64le s390x x86_64) * golang-github-QubitProducts-exporter_exporter-0.4.0-150000.1.18.3 * golang-github-lusitaniae-apache_exporter-1.0.0-150000.1.17.2 * golang-github-lusitaniae-apache_exporter-debuginfo-1.0.0-150000.1.17.2 * prometheus-blackbox_exporter-0.24.0-150000.1.23.3 * SUSE Manager Proxy 4.3 Module 4.3 (aarch64 ppc64le s390x x86_64) * golang-github-QubitProducts-exporter_exporter-0.4.0-150000.1.18.3 * golang-github-lusitaniae-apache_exporter-1.0.0-150000.1.17.2 * golang-github-lusitaniae-apache_exporter-debuginfo-1.0.0-150000.1.17.2 * prometheus-blackbox_exporter-0.24.0-150000.1.23.3 * SUSE Manager Server 4.2 Module 4.2 (aarch64 ppc64le s390x x86_64) * golang-github-QubitProducts-exporter_exporter-0.4.0-150000.1.18.3 * golang-github-lusitaniae-apache_exporter-1.0.0-150000.1.17.2 * prometheus-postgres_exporter-0.10.1-150000.1.14.3 * golang-github-lusitaniae-apache_exporter-debuginfo-1.0.0-150000.1.17.2 * SUSE Manager Server 4.3 Module 4.3 (aarch64 ppc64le s390x x86_64) * golang-github-QubitProducts-exporter_exporter-0.4.0-150000.1.18.3 * golang-github-lusitaniae-apache_exporter-1.0.0-150000.1.17.2 * golang-github-lusitaniae-apache_exporter-debuginfo-1.0.0-150000.1.17.2 ## References: * https://www.suse.com/security/cve/CVE-2022-32149.html * https://www.suse.com/security/cve/CVE-2022-41723.html * https://www.suse.com/security/cve/CVE-2022-46146.html * https://www.suse.com/security/cve/CVE-2023-29409.html * https://bugzilla.suse.com/show_bug.cgi?id=1204501 * https://bugzilla.suse.com/show_bug.cgi?id=1208046 * https://bugzilla.suse.com/show_bug.cgi?id=1208270 * https://bugzilla.suse.com/show_bug.cgi?id=1208298 * https://bugzilla.suse.com/show_bug.cgi?id=1208692 * https://bugzilla.suse.com/show_bug.cgi?id=1211525 * https://bugzilla.suse.com/show_bug.cgi?id=1213880 * https://jira.suse.com/browse/MSQA-699 * https://jira.suse.com/browse/PED-5405 * https://jira.suse.com/browse/PED-5406

1 0