January 2024 - openSUSE Security Announce

SUSE-SU-2024:0249-1: moderate: Security update for xorg-x11-server
by OPENSUSE-SECURITY-UPDATES 26 Jan '24

26 Jan '24

# Security update for xorg-x11-server Announcement ID: SUSE-SU-2024:0249-1 Rating: moderate References: * bsc#1218845 * bsc#1218846 Cross-References: * CVE-2024-0408 * CVE-2024-0409 CVSS scores: * CVE-2024-0408 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N * CVE-2024-0409 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Affected Products: * Basesystem Module 15-SP5 * Development Tools Module 15-SP5 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves two vulnerabilities can now be installed. ## Description: This update for xorg-x11-server fixes the following issues: * CVE-2024-0408: Fixed SELinux unlabeled GLX PBuffer. (bsc#1218845) * CVE-2024-0409: Fixed SELinux context corruption. (bsc#1218846) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2024-249=1 * Development Tools Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP5-2024-249=1 * openSUSE Leap 15.5 zypper in -t patch SUSE-2024-249=1 openSUSE-SLE-15.5-2024-249=1 ## Package List: * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * xorg-x11-server-extra-debuginfo-21.1.4-150500.7.21.1 * xorg-x11-server-debugsource-21.1.4-150500.7.21.1 * xorg-x11-server-Xvfb-21.1.4-150500.7.21.1 * xorg-x11-server-debuginfo-21.1.4-150500.7.21.1 * xorg-x11-server-Xvfb-debuginfo-21.1.4-150500.7.21.1 * xorg-x11-server-21.1.4-150500.7.21.1 * xorg-x11-server-extra-21.1.4-150500.7.21.1 * Development Tools Module 15-SP5 (aarch64 ppc64le s390x x86_64) * xorg-x11-server-debuginfo-21.1.4-150500.7.21.1 * xorg-x11-server-debugsource-21.1.4-150500.7.21.1 * xorg-x11-server-sdk-21.1.4-150500.7.21.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * xorg-x11-server-extra-debuginfo-21.1.4-150500.7.21.1 * xorg-x11-server-sdk-21.1.4-150500.7.21.1 * xorg-x11-server-debugsource-21.1.4-150500.7.21.1 * xorg-x11-server-Xvfb-21.1.4-150500.7.21.1 * xorg-x11-server-source-21.1.4-150500.7.21.1 * xorg-x11-server-debuginfo-21.1.4-150500.7.21.1 * xorg-x11-server-Xvfb-debuginfo-21.1.4-150500.7.21.1 * xorg-x11-server-21.1.4-150500.7.21.1 * xorg-x11-server-extra-21.1.4-150500.7.21.1 ## References: * https://www.suse.com/security/cve/CVE-2024-0408.html * https://www.suse.com/security/cve/CVE-2024-0409.html * https://bugzilla.suse.com/show_bug.cgi?id=1218845 * https://bugzilla.suse.com/show_bug.cgi?id=1218846

1 0

SUSE-SU-2024:0247-1: important: Security update for rear23a
by OPENSUSE-SECURITY-UPDATES 26 Jan '24

26 Jan '24

# Security update for rear23a Announcement ID: SUSE-SU-2024:0247-1 Rating: important References: * bsc#1218728 Cross-References: * CVE-2024-23301 CVSS scores: * CVE-2024-23301 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-23301 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affected Products: * openSUSE Leap 15.3 * openSUSE Leap 15.5 * SUSE Linux Enterprise High Availability Extension 15 SP3 * SUSE Linux Enterprise High Availability Extension 15 SP4 * SUSE Linux Enterprise High Availability Extension 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 Business Critical Linux 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.2 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.2 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.2 * SUSE Manager Server 4.3 An update that solves one vulnerability can now be installed. ## Description: This update for rear23a fixes the following issues: * CVE-2024-23301: Fixed ReaR creates world-readable initrd with GRUB_RESCUE=Y. (bsc#1218728) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.3 zypper in -t patch SUSE-2024-247=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-247=1 * SUSE Linux Enterprise High Availability Extension 15 SP3 zypper in -t patch SUSE-SLE-Product-HA-15-SP3-2024-247=1 * SUSE Linux Enterprise High Availability Extension 15 SP4 zypper in -t patch SUSE-SLE-Product-HA-15-SP4-2024-247=1 * SUSE Linux Enterprise High Availability Extension 15 SP5 zypper in -t patch SUSE-SLE-Product-HA-15-SP5-2024-247=1 ## Package List: * openSUSE Leap 15.3 (ppc64le x86_64 i586) * rear23a-2.3.a-150300.21.3.1 * openSUSE Leap 15.5 (ppc64le x86_64) * rear23a-2.3.a-150300.21.3.1 * SUSE Linux Enterprise High Availability Extension 15 SP3 (ppc64le x86_64) * rear23a-2.3.a-150300.21.3.1 * SUSE Linux Enterprise High Availability Extension 15 SP4 (ppc64le x86_64) * rear23a-2.3.a-150300.21.3.1 * SUSE Linux Enterprise High Availability Extension 15 SP5 (ppc64le x86_64) * rear23a-2.3.a-150300.21.3.1 ## References: * https://www.suse.com/security/cve/CVE-2024-23301.html * https://bugzilla.suse.com/show_bug.cgi?id=1218728

1 0

SUSE-SU-2024:0250-1: important: Security update for sevctl
by OPENSUSE-SECURITY-UPDATES 26 Jan '24

26 Jan '24

# Security update for sevctl Announcement ID: SUSE-SU-2024:0250-1 Rating: important References: * bsc#1218499 * bsc#1218502 * jsc#PED-4981 Cross-References: * CVE-2023-50711 CVSS scores: * CVE-2023-50711 ( SUSE ): 5.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L * CVE-2023-50711 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.5 * Server Applications Module 15-SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves one vulnerability, contains one feature and has one security fix can now be installed. ## Description: This update for sevctl fixes the following issues: * CVE-2023-50711: Fixed out of bounds memory accesses in vmm-sys-util (bsc#1218502, bsc#1218499) Non-security fixes: * Updated to version 0.4.3 (jsc#PED-4981) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2024-250=1 openSUSE-SLE-15.5-2024-250=1 * Server Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP5-2024-250=1 ## Package List: * openSUSE Leap 15.5 (x86_64) * sevctl-debuginfo-0.4.3-150500.3.3.1 * sevctl-debugsource-0.4.3-150500.3.3.1 * sevctl-0.4.3-150500.3.3.1 * Server Applications Module 15-SP5 (x86_64) * sevctl-debuginfo-0.4.3-150500.3.3.1 * sevctl-debugsource-0.4.3-150500.3.3.1 * sevctl-0.4.3-150500.3.3.1 ## References: * https://www.suse.com/security/cve/CVE-2023-50711.html * https://bugzilla.suse.com/show_bug.cgi?id=1218499 * https://bugzilla.suse.com/show_bug.cgi?id=1218502 * https://jira.suse.com/browse/PED-4981

1 0

SUSE-SU-2024:0238-1: moderate: Security update for cpio
by OPENSUSE-SECURITY-UPDATES 26 Jan '24

26 Jan '24

# Security update for cpio Announcement ID: SUSE-SU-2024:0238-1 Rating: moderate References: * bsc#1218571 Cross-References: * CVE-2023-7207 CVSS scores: * CVE-2023-7207 ( SUSE ): 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * openSUSE Leap Micro 5.3 * openSUSE Leap Micro 5.4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves one vulnerability can now be installed. ## Description: This update for cpio fixes the following issues: * CVE-2023-7207: Fixed a path traversal issue that could lead to an arbitrary file write during archive extraction (bsc#1218571). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-238=1 * openSUSE Leap Micro 5.3 zypper in -t patch openSUSE-Leap-Micro-5.3-2024-238=1 * openSUSE Leap Micro 5.4 zypper in -t patch openSUSE-Leap-Micro-5.4-2024-238=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-238=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2024-238=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2024-238=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2024-238=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2024-238=1 * SUSE Linux Enterprise Micro 5.5 zypper in -t patch SUSE-SLE-Micro-5.5-2024-238=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2024-238=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * cpio-mt-debuginfo-2.13-150400.3.3.1 * cpio-mt-2.13-150400.3.3.1 * cpio-debuginfo-2.13-150400.3.3.1 * cpio-2.13-150400.3.3.1 * cpio-debugsource-2.13-150400.3.3.1 * openSUSE Leap 15.4 (noarch) * cpio-lang-2.13-150400.3.3.1 * openSUSE Leap Micro 5.3 (aarch64 x86_64) * cpio-debugsource-2.13-150400.3.3.1 * cpio-debuginfo-2.13-150400.3.3.1 * cpio-2.13-150400.3.3.1 * openSUSE Leap Micro 5.4 (aarch64 s390x x86_64) * cpio-debugsource-2.13-150400.3.3.1 * cpio-debuginfo-2.13-150400.3.3.1 * cpio-2.13-150400.3.3.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * cpio-mt-debuginfo-2.13-150400.3.3.1 * cpio-mt-2.13-150400.3.3.1 * cpio-debuginfo-2.13-150400.3.3.1 * cpio-2.13-150400.3.3.1 * cpio-debugsource-2.13-150400.3.3.1 * openSUSE Leap 15.5 (noarch) * cpio-lang-2.13-150400.3.3.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64) * cpio-debugsource-2.13-150400.3.3.1 * cpio-debuginfo-2.13-150400.3.3.1 * cpio-2.13-150400.3.3.1 * SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64) * cpio-debugsource-2.13-150400.3.3.1 * cpio-debuginfo-2.13-150400.3.3.1 * cpio-2.13-150400.3.3.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64) * cpio-debugsource-2.13-150400.3.3.1 * cpio-debuginfo-2.13-150400.3.3.1 * cpio-2.13-150400.3.3.1 * SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64) * cpio-debugsource-2.13-150400.3.3.1 * cpio-debuginfo-2.13-150400.3.3.1 * cpio-2.13-150400.3.3.1 * SUSE Linux Enterprise Micro 5.5 (aarch64 s390x x86_64) * cpio-debugsource-2.13-150400.3.3.1 * cpio-debuginfo-2.13-150400.3.3.1 * cpio-2.13-150400.3.3.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * cpio-mt-debuginfo-2.13-150400.3.3.1 * cpio-mt-2.13-150400.3.3.1 * cpio-debuginfo-2.13-150400.3.3.1 * cpio-2.13-150400.3.3.1 * cpio-debugsource-2.13-150400.3.3.1 * Basesystem Module 15-SP5 (noarch) * cpio-lang-2.13-150400.3.3.1 ## References: * https://www.suse.com/security/cve/CVE-2023-7207.html * https://bugzilla.suse.com/show_bug.cgi?id=1218571

1 0

SUSE-SU-2024:0241-1: moderate: Security update for jasper
by OPENSUSE-SECURITY-UPDATES 26 Jan '24

26 Jan '24

# Security update for jasper Announcement ID: SUSE-SU-2024:0241-1 Rating: moderate References: * bsc#1218802 Cross-References: * CVE-2023-51257 CVSS scores: * CVE-2023-51257 ( SUSE ): 4.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L * CVE-2023-51257 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * Basesystem Module 15-SP5 * Desktop Applications Module 15-SP5 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves one vulnerability can now be installed. ## Description: This update for jasper fixes the following issues: * CVE-2023-51257: Fixed an out of bounds write in the JPC encoder (bsc#1218802). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-241=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2024-241=1 * Desktop Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP5-2024-241=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * jasper-2.0.14-150000.3.31.1 * libjasper4-2.0.14-150000.3.31.1 * jasper-debugsource-2.0.14-150000.3.31.1 * libjasper-devel-2.0.14-150000.3.31.1 * libjasper4-debuginfo-2.0.14-150000.3.31.1 * jasper-debuginfo-2.0.14-150000.3.31.1 * openSUSE Leap 15.5 (x86_64) * libjasper4-32bit-2.0.14-150000.3.31.1 * libjasper4-32bit-debuginfo-2.0.14-150000.3.31.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * jasper-debugsource-2.0.14-150000.3.31.1 * libjasper4-debuginfo-2.0.14-150000.3.31.1 * libjasper4-2.0.14-150000.3.31.1 * jasper-debuginfo-2.0.14-150000.3.31.1 * Desktop Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64) * jasper-debugsource-2.0.14-150000.3.31.1 * libjasper-devel-2.0.14-150000.3.31.1 * jasper-debuginfo-2.0.14-150000.3.31.1 ## References: * https://www.suse.com/security/cve/CVE-2023-51257.html * https://bugzilla.suse.com/show_bug.cgi?id=1218802

1 0

SUSE-SU-2024:0224-1: important: Security update for apache-parent, apache-sshd
by OPENSUSE-SECURITY-UPDATES 25 Jan '24

25 Jan '24

# Security update for apache-parent, apache-sshd Announcement ID: SUSE-SU-2024:0224-1 Rating: important References: * bsc#1205463 * bsc#1218189 Cross-References: * CVE-2022-45047 * CVE-2023-48795 CVSS scores: * CVE-2022-45047 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2023-48795 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2023-48795 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Affected Products: * Development Tools Module 15-SP5 * openSUSE Leap 15.5 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves two vulnerabilities can now be installed. ## Description: This update for apache-parent, apache-sshd fixes the following issues: apache-parent was updated from version 28 to 31: * Version 31: * New Features: * Added maven-checkstyle-plugin to pluginManagement * Improvements: * Set minimalMavenBuildVersion to 3.6.3 - the minimum used by plugins * Using an SPDX identifier as the license name is recommended by Maven * Use properties to define the versions of plugins * Bugs fixed: * Updated documentation for previous changes apache-sshd was updated from version 2.7.0 to 2.12.0: * Security issues fixed: * CVE-2023-48795: Implemented OpenSSH "strict key exchange" protocol in apache-sshd version 2.12.0 (bsc#1218189) * CVE-2022-45047: Java unsafe deserialization vulnerability fixed in apache- sshd version 2.9.2 (bsc#1205463) * Other changes in version 2.12.0: * Bugs fixed: * SCP client fails silently when error signalled due to missing file or lacking permissions * Ignore unknown key types from agent or in OpenSSH host keys extension * New Features: * Support GIT protocol-v2 * Other changes in version 2.11.0: * Bugs fixed: * Added configurable timeout(s) to DefaultSftpClient * Compare file keys in ModifiableFileWatcher. * Fixed channel pool in SftpFileSystem. * Use correct default OpenOptions in SftpFileSystemProvider.newFileChannel(). * Use correct lock modes for SFTP FileChannel.lock(). * ScpClient: support issuing commands to a server that uses a non-UTF-8 locale. * SftpInputStreamAsync: fix reporting EOF on zero-length reads. * Work-around a bug in WS_FTP <= 12.9 SFTP clients. * (Regression in 2.10.0) SFTP performance fix: override FilterOutputStream.write(byte[], int, int). * Fixed a race condition to ensure SSH_MSG_CHANNEL_EOF is always sent before SSH_MSG_CHANNEL_CLOSE. * Fixed error handling while flushing queued packets at end of KEX. * Fixed wrong log level on closing an Nio2Session. * Fixed detection of Android O/S from system properties. * Consider all applicable host keys from the known_hosts files. * SftpFileSystem: do not close user session. * ChannelAsyncOutputStream: remove write future when done. * SSHD-1332 (Regression in 2.10.0) Resolve ~ in IdentityFile file names in HostConfigEntry. * New Features: * Use KeepAliveHandler global request instance in client as well * Publish snapshot maven artifacts to the Apache Snapshots maven repository. * Bundle sshd-contrib has support classes for the HAProxy protocol V2. * Other changes in version 2.10.0: * Bugs fixed: * Connection attempt not canceled when a connection timeout occurs * Possible OOM in ChannelPipedInputStream * SftpRemotePathChannel.transferFrom(...) ignores position argument * Rooted file system can leak informations * Failed to establish an SSH connection because the server identifier exceeds the int range * Improvements: * Password in clear in SSHD server's logs * Other changes in version 2.9.2: * Bugs fixed: * SFTP worker threads got stuck while processing PUT methods against one specific SFTP server * Use the maximum packet size of the communication partner * ExplicitPortForwardingTracker does not unbind auto-allocated one * Default SshClient FD leak because Selector not closed * Reading again from exhausted ChannelExec#getInvertedOut() throws IOException instead of returning -1 * Keeping error streams and input streams separate after ChannelExec#setRedirectErrorStream(true) is called * Nio2Session.shutdownOutput() should wait for writes in progress * Test: * Research intermittent failure in unit tests using various I/O service factories * Other changes in version 2.9.1: * Bugs fixed: * ClientSession.auth().verify() is terminated with timeout * 2.9.0 release broken on Java 8 * Infinite loop in org.apache.sshd.sftp.client.impl.SftpInputStreamAsync#doRead * Deadlock during session exit * Race condition is logged in ChannelAsyncOutputStream * Other changes in version 2.9.0: * Bugs fixed: * Deadlock on disconnection at the end of key-exchange * Remote port forwarding mode does not handle EOF properly * Public key authentication: wrong signature algorithm used (ed25519 key with ssh-rsa signature) * Client fails window adjust above Integer.MAX_VALUE * class loader fails to load org.apache.sshd.common.cipher.BaseGCMCipher * Shell is not getting closed if the command has already closed the OutputStream it is using. * Sometimes async write listener is not called * Unhandled SSH_MSG_CHANNEL_WINDOW_ADJUST leeds to SocketTimeoutException * different host key algorithm used on rekey than used for the initial connection * OpenSSH certificate is not properly encoded when critical options are included * TCP/IP remote port forwarding with wildcard IP addresses doesn't work with OpenSSH * UserAuthPublicKey: uses ssh-rsa signatures for RSA keys from an agent * New Features: * Added support for Argon2 encrypted PUTTY key files * Added support for merged inverted output and error streams of remote process * Improvements: * Added support for "limits(a)openssh.com" SFTP extension * Support host-based pubkey authentication in the client * Send environment variable and open subsystem at the same time for SSH session * Other changes in version 2.8.0: * Bugs fixed: * Fixed wrong server key algorithm choice * Expiration of OpenSshCertificates needs to compare timestamps as unsigned long * SFTP Get downloads empty file from servers which supports EOF indication after data * skip() doesn't work properly in SftpInputStreamAsync * OpenMode and CopyMode is not honored as expected in version > 4 of SFTP api * SftpTransferTest sometimes hangs (failure during rekeying) * Race condition in KEX * Fix the ciphers supported documentation * Update tarLongFileMode to use POSIX * WinsCP transfer failure to Apache SSHD Server * Pubkey auth: keys from ssh-agent are used even if HostConfigEntry.isIdentitiesOnly() is true * Support RSA SHA2 signatures via SSH agent * NOTICE: wrong copyright year range * Wrong creationTime in writeAttrs for SFTP * sshd-netty logs all traffic on INFO level * New Features: * Add support for chacha20-poly1305(a)openssh.com * Parsing of ~/.ssh/config Host patterns fails with extra whitespace * Support generating OpenSSH client certificates * Improvements: * Add support for curve25519-sha256(a)libssh.org key exchange * OpenSSH certificates: check certificate type * OpenSSHCertificatesTest: certificates expire in 2030 * Display IdleTimeOut in more user-friendly format * sendChunkIfRemoteWindowIsSmallerThanPacketSize flag in ChannelAsyncOutputStream constructor configurable from outside using variable/config file * Intercepting the server exception message from server in SSHD client * Implement RFC 8332 server-sig-algs on the server * Slow performance listing huge number of files on Apache SSHD server * SFTP: too many LSTAT calls * Support key constraints when adding a key to an SSH agent * Add SFTP server side file custom attributes hook ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-224=1 * Development Tools Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP5-2024-224=1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-224=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-224=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-224=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-224=1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-224=1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2024-224=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-224=1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-224=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2024-224=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-224=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-224=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2024-224=1 ## Package List: * openSUSE Leap 15.5 (noarch) * apache-parent-31-150200.3.12.1 * apache-sshd-javadoc-2.12.0-150200.5.8.1 * apache-sshd-2.12.0-150200.5.8.1 * Development Tools Module 15-SP5 (noarch) * apache-sshd-2.12.0-150200.5.8.1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (noarch) * apache-sshd-2.12.0-150200.5.8.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch) * apache-sshd-2.12.0-150200.5.8.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch) * apache-sshd-2.12.0-150200.5.8.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch) * apache-sshd-2.12.0-150200.5.8.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (noarch) * apache-sshd-2.12.0-150200.5.8.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (noarch) * apache-sshd-2.12.0-150200.5.8.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (noarch) * apache-sshd-2.12.0-150200.5.8.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (noarch) * apache-sshd-2.12.0-150200.5.8.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (noarch) * apache-sshd-2.12.0-150200.5.8.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (noarch) * apache-sshd-2.12.0-150200.5.8.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch) * apache-sshd-2.12.0-150200.5.8.1 * SUSE Enterprise Storage 7.1 (noarch) * apache-sshd-2.12.0-150200.5.8.1 ## References: * https://www.suse.com/security/cve/CVE-2022-45047.html * https://www.suse.com/security/cve/CVE-2023-48795.html * https://bugzilla.suse.com/show_bug.cgi?id=1205463 * https://bugzilla.suse.com/show_bug.cgi?id=1218189

1 0

SUSE-SU-2024:0229-1: important: Security update for MozillaFirefox
by OPENSUSE-SECURITY-UPDATES 25 Jan '24

25 Jan '24

# Security update for MozillaFirefox Announcement ID: SUSE-SU-2024:0229-1 Rating: important References: * bsc#1218955 Cross-References: * CVE-2024-0741 * CVE-2024-0742 * CVE-2024-0746 * CVE-2024-0747 * CVE-2024-0749 * CVE-2024-0750 * CVE-2024-0751 * CVE-2024-0753 * CVE-2024-0755 CVSS scores: Affected Products: * Desktop Applications Module 15-SP5 * openSUSE Leap 15.5 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves nine vulnerabilities can now be installed. ## Description: This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 115.7.0 ESR (MFSA2024-02) (bsc#1218955): * CVE-2024-0741: Out of bounds write in ANGLE * CVE-2024-0742: Failure to update user input timestamp * CVE-2024-0746: Crash when listing printers on Linux * CVE-2024-0747: Bypass of Content Security Policy when directive unsafe- inline was set * CVE-2024-0749: Phishing site popup could show local origin in address bar * CVE-2024-0750: Potential permissions request bypass via clickjacking * CVE-2024-0751: Privilege escalation through devtools * CVE-2024-0753: HSTS policy on subdomain could bypass policy of upper domain * CVE-2024-0755: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7 ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-229=1 * Desktop Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP5-2024-229=1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-229=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-229=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-229=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-229=1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-229=1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2024-229=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-229=1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-229=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2024-229=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-229=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-229=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2024-229=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * MozillaFirefox-115.7.0-150200.152.123.1 * MozillaFirefox-debugsource-115.7.0-150200.152.123.1 * MozillaFirefox-debuginfo-115.7.0-150200.152.123.1 * MozillaFirefox-translations-other-115.7.0-150200.152.123.1 * MozillaFirefox-translations-common-115.7.0-150200.152.123.1 * MozillaFirefox-branding-upstream-115.7.0-150200.152.123.1 * openSUSE Leap 15.5 (noarch) * MozillaFirefox-devel-115.7.0-150200.152.123.1 * Desktop Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64) * MozillaFirefox-115.7.0-150200.152.123.1 * MozillaFirefox-debugsource-115.7.0-150200.152.123.1 * MozillaFirefox-debuginfo-115.7.0-150200.152.123.1 * MozillaFirefox-translations-other-115.7.0-150200.152.123.1 * MozillaFirefox-translations-common-115.7.0-150200.152.123.1 * Desktop Applications Module 15-SP5 (noarch) * MozillaFirefox-devel-115.7.0-150200.152.123.1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (aarch64 x86_64) * MozillaFirefox-115.7.0-150200.152.123.1 * MozillaFirefox-debugsource-115.7.0-150200.152.123.1 * MozillaFirefox-debuginfo-115.7.0-150200.152.123.1 * MozillaFirefox-translations-other-115.7.0-150200.152.123.1 * MozillaFirefox-translations-common-115.7.0-150200.152.123.1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (noarch) * MozillaFirefox-devel-115.7.0-150200.152.123.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) * MozillaFirefox-115.7.0-150200.152.123.1 * MozillaFirefox-debugsource-115.7.0-150200.152.123.1 * MozillaFirefox-debuginfo-115.7.0-150200.152.123.1 * MozillaFirefox-translations-other-115.7.0-150200.152.123.1 * MozillaFirefox-translations-common-115.7.0-150200.152.123.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch) * MozillaFirefox-devel-115.7.0-150200.152.123.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * MozillaFirefox-115.7.0-150200.152.123.1 * MozillaFirefox-debugsource-115.7.0-150200.152.123.1 * MozillaFirefox-debuginfo-115.7.0-150200.152.123.1 * MozillaFirefox-translations-other-115.7.0-150200.152.123.1 * MozillaFirefox-translations-common-115.7.0-150200.152.123.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch) * MozillaFirefox-devel-115.7.0-150200.152.123.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * MozillaFirefox-115.7.0-150200.152.123.1 * MozillaFirefox-debugsource-115.7.0-150200.152.123.1 * MozillaFirefox-debuginfo-115.7.0-150200.152.123.1 * MozillaFirefox-translations-other-115.7.0-150200.152.123.1 * MozillaFirefox-translations-common-115.7.0-150200.152.123.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch) * MozillaFirefox-devel-115.7.0-150200.152.123.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (x86_64) * MozillaFirefox-115.7.0-150200.152.123.1 * MozillaFirefox-debugsource-115.7.0-150200.152.123.1 * MozillaFirefox-debuginfo-115.7.0-150200.152.123.1 * MozillaFirefox-translations-other-115.7.0-150200.152.123.1 * MozillaFirefox-translations-common-115.7.0-150200.152.123.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (noarch) * MozillaFirefox-devel-115.7.0-150200.152.123.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (aarch64 ppc64le s390x x86_64) * MozillaFirefox-115.7.0-150200.152.123.1 * MozillaFirefox-debugsource-115.7.0-150200.152.123.1 * MozillaFirefox-debuginfo-115.7.0-150200.152.123.1 * MozillaFirefox-translations-other-115.7.0-150200.152.123.1 * MozillaFirefox-translations-common-115.7.0-150200.152.123.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (noarch) * MozillaFirefox-devel-115.7.0-150200.152.123.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x x86_64) * MozillaFirefox-115.7.0-150200.152.123.1 * MozillaFirefox-debugsource-115.7.0-150200.152.123.1 * MozillaFirefox-debuginfo-115.7.0-150200.152.123.1 * MozillaFirefox-translations-other-115.7.0-150200.152.123.1 * MozillaFirefox-translations-common-115.7.0-150200.152.123.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (noarch) * MozillaFirefox-devel-115.7.0-150200.152.123.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (aarch64 ppc64le s390x x86_64) * MozillaFirefox-115.7.0-150200.152.123.1 * MozillaFirefox-debugsource-115.7.0-150200.152.123.1 * MozillaFirefox-debuginfo-115.7.0-150200.152.123.1 * MozillaFirefox-translations-other-115.7.0-150200.152.123.1 * MozillaFirefox-translations-common-115.7.0-150200.152.123.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (noarch) * MozillaFirefox-devel-115.7.0-150200.152.123.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (ppc64le x86_64) * MozillaFirefox-115.7.0-150200.152.123.1 * MozillaFirefox-debugsource-115.7.0-150200.152.123.1 * MozillaFirefox-debuginfo-115.7.0-150200.152.123.1 * MozillaFirefox-translations-other-115.7.0-150200.152.123.1 * MozillaFirefox-translations-common-115.7.0-150200.152.123.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (noarch) * MozillaFirefox-devel-115.7.0-150200.152.123.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64) * MozillaFirefox-115.7.0-150200.152.123.1 * MozillaFirefox-debugsource-115.7.0-150200.152.123.1 * MozillaFirefox-debuginfo-115.7.0-150200.152.123.1 * MozillaFirefox-translations-other-115.7.0-150200.152.123.1 * MozillaFirefox-translations-common-115.7.0-150200.152.123.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (noarch) * MozillaFirefox-devel-115.7.0-150200.152.123.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * MozillaFirefox-115.7.0-150200.152.123.1 * MozillaFirefox-debugsource-115.7.0-150200.152.123.1 * MozillaFirefox-debuginfo-115.7.0-150200.152.123.1 * MozillaFirefox-translations-other-115.7.0-150200.152.123.1 * MozillaFirefox-translations-common-115.7.0-150200.152.123.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch) * MozillaFirefox-devel-115.7.0-150200.152.123.1 * SUSE Enterprise Storage 7.1 (aarch64 x86_64) * MozillaFirefox-115.7.0-150200.152.123.1 * MozillaFirefox-debugsource-115.7.0-150200.152.123.1 * MozillaFirefox-debuginfo-115.7.0-150200.152.123.1 * MozillaFirefox-translations-other-115.7.0-150200.152.123.1 * MozillaFirefox-translations-common-115.7.0-150200.152.123.1 * SUSE Enterprise Storage 7.1 (noarch) * MozillaFirefox-devel-115.7.0-150200.152.123.1 ## References: * https://www.suse.com/security/cve/CVE-2024-0741.html * https://www.suse.com/security/cve/CVE-2024-0742.html * https://www.suse.com/security/cve/CVE-2024-0746.html * https://www.suse.com/security/cve/CVE-2024-0747.html * https://www.suse.com/security/cve/CVE-2024-0749.html * https://www.suse.com/security/cve/CVE-2024-0750.html * https://www.suse.com/security/cve/CVE-2024-0751.html * https://www.suse.com/security/cve/CVE-2024-0753.html * https://www.suse.com/security/cve/CVE-2024-0755.html * https://bugzilla.suse.com/show_bug.cgi?id=1218955

1 0

openSUSE-SU-2024:0033-1: important: Security update for opera
by opensuse-security＠opensuse.org 24 Jan '24

24 Jan '24

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0033-1 Rating: important References: Cross-References: CVE-2024-0517 CVE-2024-0518 CVE-2024-0519 CVSS scores: CVE-2024-0517 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-0518 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-0519 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.5:NonFree ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for opera fixes the following issues: Update to 106.0.4998.52 * CHR-9580 Update Chromium on desktop-stable-120-4998 to 120.0.6099.234 * DNA-113175 Can not merge folders on start page * DNA-113341 Implement 'special' menus * DNA-113811 Removing icons in sidepanel heading * DNA-114059 [Move to context menu] Workspaces icons always displayed in 1 line * DNA-114361 "Move to workspace" submenu shows icons vertically * The update to chromium 120.0.6099.234 fixes following issues: CVE-2024-0517, CVE-2024-0518, CVE-2024-0519 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.5:NonFree: zypper in -t patch openSUSE-2024-33=1 Package List: - openSUSE Leap 15.5:NonFree (x86_64): opera-106.0.4998.52-lp155.3.33.1 References: https://www.suse.com/security/cve/CVE-2024-0517.html https://www.suse.com/security/cve/CVE-2024-0518.html https://www.suse.com/security/cve/CVE-2024-0519.html

1 0

openSUSE-SU-2024:0031-1: important: Security update for cacti, cacti-spine
by opensuse-security＠opensuse.org 24 Jan '24

24 Jan '24

openSUSE Security Update: Security update for cacti, cacti-spine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0031-1 Rating: important References: #1218360 #1218366 #1218378 #1218379 #1218380 #1218381 Cross-References: CVE-2023-49084 CVE-2023-49085 CVE-2023-49086 CVE-2023-49088 CVE-2023-50250 CVE-2023-51448 CVSS scores: CVE-2023-49084 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-49085 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-49086 (NVD) : 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVE-2023-49088 (NVD) : 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVE-2023-50250 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2023-51448 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP4 SUSE Linux Enterprise Server 12-SP5 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12-SP3 SUSE Linux Enterprise Server for SAP Applications 12-SP4 SUSE Linux Enterprise Server for SAP Applications 12-SP5 SUSE Package Hub for SUSE Linux Enterprise 12 openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for cacti, cacti-spine fixes the following issues: cacti-spine 1.2.26: * Fix: Errors when uptime OID is not present * Fix: MySQL reconnect option is depreciated * Fix: Spine does not check a host with no poller items * Fix: Poller may report the wrong number of devices polled * Feature: Allow users to override the threads setting at the command line * Feature: Allow spine to run in ping-only mode cacti 1.2.26: * CVE-2023-50250: XSS vulnerability when importing a template file (boo#1218380) * CVE-2023-49084: RCE vulnerability when managing links (boo#1218360) * CVE-2023-49085: SQL Injection vulnerability when managing poller devices (boo#1218378) * CVE-2023-49086: XSS vulnerability when adding new devices (boo#1218366) * CVE-2023-49088: XSS vulnerability when viewing data sources in debug mode (boo#1218379) * CVE-2023-51448: SQL Injection vulnerability when managing SNMP Notification Receivers (boo#1218381) * When viewing data sources, an undefined variable error may be seen * Improvements for Poller Last Run Date * Attempting to edit a Data Query that does not exist throws warnings and not an GUI error * Improve PHP 8.1 support when adding devices * Viewing Data Query Cache can cause errors to be logged * Preserve option is not properly honoured when removing devices at command line * Infinite recursion is possible during a database failure * Monitoring Host CPU's does not always work on Windows endpoints * Multi select drop down list box not rendered correctly in Chrome and Edge * Selective Plugin Debugging may not always work as intended * During upgrades, Plugins may be falsely reported as incompatible * Plugin management at command line does not work with multiple plugins * Improve PHP 8.1 support for incrementing only numbers * Allow the renaming of guest and template accounts * DS Stats issues warnings when the RRDfile has not been initialized * When upgrading, missing data source profile can cause errors to be logged * When deleting a single Data Source, purge historical debug data * Improvements to form element warnings * Some interface aliases do not appear correctly * Aggregate graph does not show other percentiles * Settings table updates for large values reverted by database repair * When obtaining graph records, error messages may be recorded * Unable to change a device's community at command line * Increase timeout for RRDChecker * When viewing a graph, option to edit template may lead to incorrect URL * When upgrading, failures may occur due to missing color table keys * On installation, allow a more appropriate template to be used as the default * When data input parameters are allowed to be null, allow null * CSV Exports may not always output data correctly * When debugging a graph, long CDEF's can cause undesirable scrolling * Secondary LDAP server not evaluated when the first one has failed * When adding a device, using the bulk walk option can make version information appear * When parsing a Data Query resource, an error can be reported if no direction is specified * Database reconnection can cause errors to be reported incorrectly * fix returned value if $sau is empty * Add Aruba switch, Aruba controller and HPE iLO templates * Add OSCX 6x00 templates Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2024-31=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2024-31=1 Package List: - openSUSE Backports SLE-15-SP5 (aarch64 i586 ppc64le s390x x86_64): cacti-spine-1.2.26-bp155.2.6.1 - openSUSE Backports SLE-15-SP5 (noarch): cacti-1.2.26-bp155.2.6.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): cacti-spine-1.2.26-32.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): cacti-1.2.26-38.1 References: https://www.suse.com/security/cve/CVE-2023-49084.html https://www.suse.com/security/cve/CVE-2023-49085.html https://www.suse.com/security/cve/CVE-2023-49086.html https://www.suse.com/security/cve/CVE-2023-49088.html https://www.suse.com/security/cve/CVE-2023-50250.html https://www.suse.com/security/cve/CVE-2023-51448.html https://bugzilla.suse.com/1218360 https://bugzilla.suse.com/1218366 https://bugzilla.suse.com/1218378 https://bugzilla.suse.com/1218379 https://bugzilla.suse.com/1218380 https://bugzilla.suse.com/1218381

1 0

openSUSE-SU-2024:0031-1: important: Security update for cacti, cacti-spine
by opensuse-security＠opensuse.org 24 Jan '24

24 Jan '24

openSUSE Security Update: Security update for cacti, cacti-spine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0031-1 Rating: important References: #1218360 #1218366 #1218378 #1218379 #1218380 #1218381 Cross-References: CVE-2023-49084 CVE-2023-49085 CVE-2023-49086 CVE-2023-49088 CVE-2023-50250 CVE-2023-51448 CVSS scores: CVE-2023-49084 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-49085 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-49086 (NVD) : 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVE-2023-49088 (NVD) : 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVE-2023-50250 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2023-51448 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP4 SUSE Linux Enterprise Server 12-SP5 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12-SP3 SUSE Linux Enterprise Server for SAP Applications 12-SP4 SUSE Linux Enterprise Server for SAP Applications 12-SP5 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for cacti, cacti-spine fixes the following issues: cacti-spine 1.2.26: * Fix: Errors when uptime OID is not present * Fix: MySQL reconnect option is depreciated * Fix: Spine does not check a host with no poller items * Fix: Poller may report the wrong number of devices polled * Feature: Allow users to override the threads setting at the command line * Feature: Allow spine to run in ping-only mode cacti 1.2.26: * CVE-2023-50250: XSS vulnerability when importing a template file (boo#1218380) * CVE-2023-49084: RCE vulnerability when managing links (boo#1218360) * CVE-2023-49085: SQL Injection vulnerability when managing poller devices (boo#1218378) * CVE-2023-49086: XSS vulnerability when adding new devices (boo#1218366) * CVE-2023-49088: XSS vulnerability when viewing data sources in debug mode (boo#1218379) * CVE-2023-51448: SQL Injection vulnerability when managing SNMP Notification Receivers (boo#1218381) * When viewing data sources, an undefined variable error may be seen * Improvements for Poller Last Run Date * Attempting to edit a Data Query that does not exist throws warnings and not an GUI error * Improve PHP 8.1 support when adding devices * Viewing Data Query Cache can cause errors to be logged * Preserve option is not properly honoured when removing devices at command line * Infinite recursion is possible during a database failure * Monitoring Host CPU's does not always work on Windows endpoints * Multi select drop down list box not rendered correctly in Chrome and Edge * Selective Plugin Debugging may not always work as intended * During upgrades, Plugins may be falsely reported as incompatible * Plugin management at command line does not work with multiple plugins * Improve PHP 8.1 support for incrementing only numbers * Allow the renaming of guest and template accounts * DS Stats issues warnings when the RRDfile has not been initialized * When upgrading, missing data source profile can cause errors to be logged * When deleting a single Data Source, purge historical debug data * Improvements to form element warnings * Some interface aliases do not appear correctly * Aggregate graph does not show other percentiles * Settings table updates for large values reverted by database repair * When obtaining graph records, error messages may be recorded * Unable to change a device's community at command line * Increase timeout for RRDChecker * When viewing a graph, option to edit template may lead to incorrect URL * When upgrading, failures may occur due to missing color table keys * On installation, allow a more appropriate template to be used as the default * When data input parameters are allowed to be null, allow null * CSV Exports may not always output data correctly * When debugging a graph, long CDEF's can cause undesirable scrolling * Secondary LDAP server not evaluated when the first one has failed * When adding a device, using the bulk walk option can make version information appear * When parsing a Data Query resource, an error can be reported if no direction is specified * Database reconnection can cause errors to be reported incorrectly * fix returned value if $sau is empty * Add Aruba switch, Aruba controller and HPE iLO templates * Add OSCX 6x00 templates Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2024-31=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): cacti-spine-1.2.26-32.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): cacti-1.2.26-38.1 References: https://www.suse.com/security/cve/CVE-2023-49084.html https://www.suse.com/security/cve/CVE-2023-49085.html https://www.suse.com/security/cve/CVE-2023-49086.html https://www.suse.com/security/cve/CVE-2023-49088.html https://www.suse.com/security/cve/CVE-2023-50250.html https://www.suse.com/security/cve/CVE-2023-51448.html https://bugzilla.suse.com/1218360 https://bugzilla.suse.com/1218366 https://bugzilla.suse.com/1218378 https://bugzilla.suse.com/1218379 https://bugzilla.suse.com/1218380 https://bugzilla.suse.com/1218381

1 0