January 2024 - openSUSE Security Announce

openSUSE-SU-2024:0036-1: moderate: Security update for tinyssh
by opensuse-security＠opensuse.org 31 Jan '24

31 Jan '24

openSUSE Security Update: Security update for tinyssh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0036-1 Rating: moderate References: #1218197 Cross-References: CVE-2023-48795 CVSS scores: CVE-2023-48795 (NVD) : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2023-48795 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Affected Products: openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tinyssh fixes the following issues: tinyssh was updated to 20240101 (boo#1218197, CVE-2023-48795): * fixed channel_forkpty() race condition between close(slave) in parent process and login_tty(slave) in child process * fixed behavior when using terminal mode and stdin redirected to /dev/null 'ssh -tt -n' * added an 'strict-key' key exchange kex-strict- s-v00(a)openssh.com (Mitigates CVE-2023-48795 "Terrapin attack") Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2024-36=1 Package List: - openSUSE Backports SLE-15-SP5 (aarch64 i586 ppc64le s390x x86_64): tinyssh-20240101-bp155.2.3.1 References: https://www.suse.com/security/cve/CVE-2023-48795.html https://bugzilla.suse.com/1218197

1 0

openSUSE-SU-2024:0037-1: moderate: Security update for mbedtls
by opensuse-security＠opensuse.org 31 Jan '24

31 Jan '24

openSUSE Security Update: Security update for mbedtls ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0037-1 Rating: moderate References: #1219336 Cross-References: CVE-2024-23170 Affected Products: openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mbedtls fixes the following issues: - Update to version 2.28.7: - Resolves CVE-2024-23170 boo#1219336 - Update to 2.28.6: Changes: * Mbed TLS is now released under a dual Apache-2.0 OR GPL-2.0-or-later license. Users may choose which license they take the code under. - Update to 2.28.5: Features: * The documentation of mbedtls_ecp_group now describes the optimized representation of A for some curves. Fixes gh#Mbed-TLS/mbedtls#8045. Security: * Developers using mbedtls_pkcs5_pbes2() or mbedtls_pkcs12_pbe() should review the size of the output buffer passed to this function, and note that the output after decryption may include CBC padding. Consider moving to the new functions mbedtls_pkcs5_pbes2_ext() or mbedtls_pkcs12_pbe_ext() which checks for overflow of the output buffer and reports the actual length of the output. * Improve padding calculations in CBC decryption, NIST key unwrapping and RSA OAEP decryption. With the previous implementation, some compilers (notably recent versions of Clang and IAR) could produce non-constant time code, which could allow a padding oracle attack if the attacker has access to precise timing measurements. * Fix a buffer overread when parsing short TLS application data records in ARC4 or null-cipher cipher suites. Credit to OSS-Fuzz. Bugfix: * Fix x509 certificate generation to conform to RFC 5480 / RFC 5758 when using ECC key. The certificate was rejected by some crypto frameworks. Fixes gh#Mbed-TLS/mbedtls#2924. * Fix some cases where mbedtls_mpi_mod_exp, RSA key construction or ECDSA signature can silently return an incorrect result in low memory conditions. * Fix IAR compiler warnings. Fixes gh#Mbed-TLS/mbedtls#7873, gh#Mbed-TLS/mbedtls#4300. * Fix an issue when parsing an otherName subject alternative name into a mbedtls_x509_san_other_name struct. The type-id of the otherName was not copied to the struct. This meant that the struct had incomplete information about the otherName SAN and contained uninitialized memory. * Fix the detection of HardwareModuleName otherName SANs. These were being detected by comparing the wrong field and the check was erroneously inverted. * Fix an error when MBEDTLS_ECDSA_SIGN_ALT is defined but not MBEDTLS_ECDSA_VERIFY_ALT, causing ecdsa verify to fail. Fixes gh#Mbed-TLS/mbedtls#7498. Functions in the ssl_cache module now return a negative MBEDTLS_ERR_xxx error code on failure. Before, they returned 1 to indicate failure in some cases involving a missing entry or a full cache. Changes: * In configurations with ARIA or Camellia but not AES, the value of MBEDTLS_CIPHER_BLKSIZE_MAX was 8, rather than 16 as the name might suggest. This did not affect any library code, because this macro was only used in relation with CMAC which does not support these ciphers. Its value is now 16 if ARIA or Camellia are present. This may affect application code that uses this macro. - Update to 2.28.4: Features: * Allow MBEDTLS_CONFIG_FILE and MBEDTLS_USER_CONFIG_FILE to be set by setting the CMake variable of the same name at configuration time. Bugfix: * Fix crypt_and_hash decryption fail when used with a stream cipher mode of operation, due to the input not being a multiple of the block size. Resolves #7417. * Fix a bug where mbedtls_x509_string_to_names() would return success when given a invalid name string, if it did not contain '=' or ','. * Fix missing PSA initialization in sample programs when MBEDTLS_USE_PSA_CRYPTO is enabled. * Fix clang and armclang compilation error when targeting certain Arm M-class CPUs (Cortex-M0, Cortex-M0+, Cortex-M1, Cortex-M23, SecurCore SC000). Fixes #1077. * Fixed an issue that caused compile errors when using CMake and the IAR toolchain. * Fix the build with MBEDTLS_PSA_INJECT_ENTROPY. Fixes #7516. * Fix builds on Windows with clang. * Fix compilation warnings in aes.c for certain combinations of configuration options. * Fix a compilation error on some platforms when including mbedtls/ssl.h with all TLS support disabled. Fixes #6628. Changes: * Update test data to avoid failures of unit tests after 2023-08-07, and update expiring certififcates in the certs - Update to 2.28.3: Features: * Use HOSTCC (if it is set) when compiling C code during generation of the configuration-independent files. This allows them to be generated when CC is set for cross compilation. * AES-NI is now supported with Visual Studio. * AES-NI is now supported in 32-bit builds, or when MBEDTLS_HAVE_ASM is disabled, when compiling with GCC or Clang or a compatible compiler for a target CPU that supports the requisite instructions (for example gcc -m32 -msse2 -maes -mpclmul). (Generic x86 builds with GCC-like compilers still require MBEDTLS_HAVE_ASM and a 64-bit target.) Security: * MBEDTLS_AESNI_C, which is enabled by default, was silently ignored on builds that couldn't compile the GCC-style assembly implementation (most notably builds with Visual Studio), leaving them vulnerable to timing side-channel attacks. There is now an intrinsics-based AES-NI implementation as a fallback for when the assembly one cannot be used. Bugfix: * Fix a build issue on Windows where the source and build directory could not be on different drives (#5751). * Fix possible integer overflow in mbedtls_timing_hardclock(), which could cause a crash for certain platforms & compiler options. * Fix IAR compiler warnings. Fixes #6924. * Fix a bug in the build where directory names containing spaces were causing generate_errors.pl to error out resulting in a build failure. Fixes issue #6879. * Fix compile error where MBEDTLS_RSA_C and MBEDTLS_X509_CRT_WRITE_C are defined, but MBEDTLS_PK_RSA_ALT_SUPPORT is not defined. Fixes #3174. * Fix a build issue when defining MBEDTLS_TIMING_ALT and MBEDTLS_SELF_TEST. The library would not link if the user didn't provide an external self-test function. The self-test is now provided regardless of the choice of internal/alternative timing implementation. Fixes #6923. * mbedtls_x509write_crt_set_serial() now explicitly rejects serial numbers whose binary representation is longer than 20 bytes. This was already forbidden by the standard (RFC5280 - section 4.1.2.2) and now it's being enforced also at code level. * Fix potential undefined behavior in mbedtls_mpi_sub_abs(). Reported by Pascal Cuoq using TrustInSoft Analyzer in #6701; observed independently by Aaron Ucko under Valgrind. * Fix behavior of certain sample programs which could, when run with no arguments, access uninitialized memory in some cases. Fixes #6700 (which was found by TrustInSoft Analyzer during REDOCS'22) and #1120. * Fix build errors in test programs when MBEDTLS_CERTS_C is disabled. Fixes #6243. * Fix parsing of X.509 SubjectAlternativeName extension. Previously, malformed alternative name components were not caught during initial certificate parsing, but only on subsequent calls to mbedtls_x509_parse_subject_alt_name(). Fixes #2838. * Fix bug in conversion from OID to string in mbedtls_oid_get_numeric_string(). OIDs such as 2.40.0.25 are now printed correctly. * Reject OIDs with overlong-encoded subidentifiers when converting them to a string. * Reject OIDs with subidentifier values exceeding UINT_MAX. Such subidentifiers can be valid, but Mbed TLS cannot currently handle them. * Reject OIDs that have unterminated subidentifiers, or (equivalently) have the most-significant bit set in their last byte. * Silence a warning about an unused local variable in bignum.c on some architectures. Fixes #7166. * Silence warnings from clang -Wdocumentation about empty \retval descriptions, which started appearing with Clang 15. Fixes #6960. * Fix undefined behavior in mbedtls_ssl_read() and mbedtls_ssl_write() if len argument is 0 and buffer is NULL. Changes: * The C code follows a new coding style. This is transparent for users but affects contributors and maintainers of local patches. For more information, see https://mbed-tls.readthedocs.io/en/latest/kb/how-to/rewrite-branch-for-codi ng-style/ * Changed the default MBEDTLS_ECP_WINDOW_SIZE from 6 to 2. As tested in issue 6790, the correlation between this define and RSA decryption performance has changed lately due to security fixes. To fix the performance degradation when using default values the window was reduced from 6 to 2, a value that gives the best or close to best results when tested on Cortex-M4 and Intel i7. - Setup the mbedtls-2 package - Build AVX2 enabled hwcaps library for x86_64-v3 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2024-37=1 Package List: - openSUSE Backports SLE-15-SP5 (aarch64 i586 ppc64le s390x x86_64): libmbedcrypto7-2.28.7-bp155.2.3.1 libmbedtls14-2.28.7-bp155.2.3.1 libmbedx509-1-2.28.7-bp155.2.3.1 mbedtls-devel-2.28.7-bp155.2.3.1 - openSUSE Backports SLE-15-SP5 (aarch64_ilp32): libmbedcrypto7-64bit-2.28.7-bp155.2.3.1 libmbedtls14-64bit-2.28.7-bp155.2.3.1 libmbedx509-1-64bit-2.28.7-bp155.2.3.1 - openSUSE Backports SLE-15-SP5 (x86_64): libmbedcrypto7-32bit-2.28.7-bp155.2.3.1 libmbedtls14-32bit-2.28.7-bp155.2.3.1 libmbedx509-1-32bit-2.28.7-bp155.2.3.1 References: https://www.suse.com/security/cve/CVE-2024-23170.html https://bugzilla.suse.com/1219336

1 0

SUSE-SU-2024:0283-1: important: Security update for slurm_22_05
by OPENSUSE-SECURITY-UPDATES 31 Jan '24

31 Jan '24

# Security update for slurm_22_05 Announcement ID: SUSE-SU-2024:0283-1 Rating: important References: * bsc#1216869 * bsc#1217711 * bsc#1218046 * bsc#1218050 * bsc#1218051 * bsc#1218053 Cross-References: * CVE-2023-49933 * CVE-2023-49936 * CVE-2023-49937 * CVE-2023-49938 CVSS scores: * CVE-2023-49933 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2023-49933 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2023-49936 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H * CVE-2023-49936 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-49937 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H * CVE-2023-49937 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2023-49938 ( SUSE ): 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2023-49938 ( NVD ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N Affected Products: * openSUSE Leap 15.3 * openSUSE Leap 15.5 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 An update that solves four vulnerabilities and has two security fixes can now be installed. ## Description: This update for slurm_22_05 fixes the following issues: Update to slurm 22.05.11: Security fixes: * CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046) * CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050) * CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051) * CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053) Other fixes: * Add missing service file for slurmrestd (bsc#1217711). * Fix slurm upgrading to incompatible versions (bsc#1216869). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.3 zypper in -t patch SUSE-2024-283=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-283=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-283=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-283=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-283=1 ## Package List: * openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64) * slurm_22_05-pam_slurm-22.05.11-150300.7.9.1 * slurm_22_05-pam_slurm-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-slurmdbd-22.05.11-150300.7.9.1 * slurm_22_05-torque-22.05.11-150300.7.9.1 * slurm_22_05-devel-22.05.11-150300.7.9.1 * slurm_22_05-slurmdbd-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-munge-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-torque-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-debugsource-22.05.11-150300.7.9.1 * slurm_22_05-rest-22.05.11-150300.7.9.1 * slurm_22_05-hdf5-22.05.11-150300.7.9.1 * slurm_22_05-sjstat-22.05.11-150300.7.9.1 * perl-slurm_22_05-22.05.11-150300.7.9.1 * libpmi0_22_05-22.05.11-150300.7.9.1 * perl-slurm_22_05-debuginfo-22.05.11-150300.7.9.1 * libnss_slurm2_22_05-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-sql-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-cray-22.05.11-150300.7.9.1 * slurm_22_05-lua-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-sql-22.05.11-150300.7.9.1 * slurm_22_05-seff-22.05.11-150300.7.9.1 * slurm_22_05-lua-22.05.11-150300.7.9.1 * slurm_22_05-cray-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-22.05.11-150300.7.9.1 * slurm_22_05-auth-none-22.05.11-150300.7.9.1 * slurm_22_05-plugins-debuginfo-22.05.11-150300.7.9.1 * libslurm38-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-rest-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-sview-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-auth-none-debuginfo-22.05.11-150300.7.9.1 * libslurm38-22.05.11-150300.7.9.1 * slurm_22_05-munge-22.05.11-150300.7.9.1 * slurm_22_05-sview-22.05.11-150300.7.9.1 * slurm_22_05-plugins-22.05.11-150300.7.9.1 * slurm_22_05-openlava-22.05.11-150300.7.9.1 * libnss_slurm2_22_05-22.05.11-150300.7.9.1 * slurm_22_05-hdf5-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-node-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-node-22.05.11-150300.7.9.1 * slurm_22_05-testsuite-22.05.11-150300.7.9.1 * libpmi0_22_05-debuginfo-22.05.11-150300.7.9.1 * openSUSE Leap 15.3 (noarch) * slurm_22_05-config-man-22.05.11-150300.7.9.1 * slurm_22_05-config-22.05.11-150300.7.9.1 * slurm_22_05-webdoc-22.05.11-150300.7.9.1 * slurm_22_05-doc-22.05.11-150300.7.9.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * slurm_22_05-pam_slurm-22.05.11-150300.7.9.1 * slurm_22_05-pam_slurm-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-slurmdbd-22.05.11-150300.7.9.1 * slurm_22_05-torque-22.05.11-150300.7.9.1 * slurm_22_05-devel-22.05.11-150300.7.9.1 * slurm_22_05-slurmdbd-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-munge-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-torque-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-debugsource-22.05.11-150300.7.9.1 * slurm_22_05-rest-22.05.11-150300.7.9.1 * slurm_22_05-hdf5-22.05.11-150300.7.9.1 * slurm_22_05-sjstat-22.05.11-150300.7.9.1 * perl-slurm_22_05-22.05.11-150300.7.9.1 * libpmi0_22_05-22.05.11-150300.7.9.1 * perl-slurm_22_05-debuginfo-22.05.11-150300.7.9.1 * libnss_slurm2_22_05-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-sql-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-cray-22.05.11-150300.7.9.1 * slurm_22_05-lua-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-sql-22.05.11-150300.7.9.1 * slurm_22_05-seff-22.05.11-150300.7.9.1 * slurm_22_05-lua-22.05.11-150300.7.9.1 * slurm_22_05-cray-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-22.05.11-150300.7.9.1 * slurm_22_05-auth-none-22.05.11-150300.7.9.1 * slurm_22_05-plugins-debuginfo-22.05.11-150300.7.9.1 * libslurm38-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-rest-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-sview-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-auth-none-debuginfo-22.05.11-150300.7.9.1 * libslurm38-22.05.11-150300.7.9.1 * slurm_22_05-munge-22.05.11-150300.7.9.1 * slurm_22_05-sview-22.05.11-150300.7.9.1 * slurm_22_05-plugins-22.05.11-150300.7.9.1 * slurm_22_05-openlava-22.05.11-150300.7.9.1 * libnss_slurm2_22_05-22.05.11-150300.7.9.1 * slurm_22_05-hdf5-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-node-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-node-22.05.11-150300.7.9.1 * slurm_22_05-testsuite-22.05.11-150300.7.9.1 * libpmi0_22_05-debuginfo-22.05.11-150300.7.9.1 * openSUSE Leap 15.5 (noarch) * slurm_22_05-config-man-22.05.11-150300.7.9.1 * slurm_22_05-config-22.05.11-150300.7.9.1 * slurm_22_05-webdoc-22.05.11-150300.7.9.1 * slurm_22_05-doc-22.05.11-150300.7.9.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) * slurm_22_05-pam_slurm-22.05.11-150300.7.9.1 * slurm_22_05-pam_slurm-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-slurmdbd-22.05.11-150300.7.9.1 * slurm_22_05-torque-22.05.11-150300.7.9.1 * slurm_22_05-devel-22.05.11-150300.7.9.1 * slurm_22_05-slurmdbd-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-munge-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-torque-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-debugsource-22.05.11-150300.7.9.1 * slurm_22_05-rest-22.05.11-150300.7.9.1 * perl-slurm_22_05-22.05.11-150300.7.9.1 * libpmi0_22_05-22.05.11-150300.7.9.1 * perl-slurm_22_05-debuginfo-22.05.11-150300.7.9.1 * libnss_slurm2_22_05-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-sql-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-lua-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-sql-22.05.11-150300.7.9.1 * slurm_22_05-lua-22.05.11-150300.7.9.1 * slurm_22_05-22.05.11-150300.7.9.1 * slurm_22_05-auth-none-22.05.11-150300.7.9.1 * slurm_22_05-plugins-debuginfo-22.05.11-150300.7.9.1 * libslurm38-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-rest-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-sview-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-auth-none-debuginfo-22.05.11-150300.7.9.1 * libslurm38-22.05.11-150300.7.9.1 * slurm_22_05-munge-22.05.11-150300.7.9.1 * slurm_22_05-sview-22.05.11-150300.7.9.1 * slurm_22_05-plugins-22.05.11-150300.7.9.1 * libnss_slurm2_22_05-22.05.11-150300.7.9.1 * slurm_22_05-node-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-node-22.05.11-150300.7.9.1 * libpmi0_22_05-debuginfo-22.05.11-150300.7.9.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch) * slurm_22_05-config-man-22.05.11-150300.7.9.1 * slurm_22_05-config-22.05.11-150300.7.9.1 * slurm_22_05-webdoc-22.05.11-150300.7.9.1 * slurm_22_05-doc-22.05.11-150300.7.9.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * slurm_22_05-pam_slurm-22.05.11-150300.7.9.1 * slurm_22_05-pam_slurm-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-slurmdbd-22.05.11-150300.7.9.1 * slurm_22_05-torque-22.05.11-150300.7.9.1 * slurm_22_05-devel-22.05.11-150300.7.9.1 * slurm_22_05-slurmdbd-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-munge-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-torque-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-debugsource-22.05.11-150300.7.9.1 * slurm_22_05-rest-22.05.11-150300.7.9.1 * perl-slurm_22_05-22.05.11-150300.7.9.1 * libpmi0_22_05-22.05.11-150300.7.9.1 * perl-slurm_22_05-debuginfo-22.05.11-150300.7.9.1 * libnss_slurm2_22_05-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-sql-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-cray-22.05.11-150300.7.9.1 * slurm_22_05-lua-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-sql-22.05.11-150300.7.9.1 * slurm_22_05-lua-22.05.11-150300.7.9.1 * slurm_22_05-cray-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-22.05.11-150300.7.9.1 * slurm_22_05-auth-none-22.05.11-150300.7.9.1 * slurm_22_05-plugins-debuginfo-22.05.11-150300.7.9.1 * libslurm38-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-rest-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-sview-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-auth-none-debuginfo-22.05.11-150300.7.9.1 * libslurm38-22.05.11-150300.7.9.1 * slurm_22_05-munge-22.05.11-150300.7.9.1 * slurm_22_05-sview-22.05.11-150300.7.9.1 * slurm_22_05-plugins-22.05.11-150300.7.9.1 * libnss_slurm2_22_05-22.05.11-150300.7.9.1 * slurm_22_05-node-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-node-22.05.11-150300.7.9.1 * libpmi0_22_05-debuginfo-22.05.11-150300.7.9.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch) * slurm_22_05-config-man-22.05.11-150300.7.9.1 * slurm_22_05-config-22.05.11-150300.7.9.1 * slurm_22_05-webdoc-22.05.11-150300.7.9.1 * slurm_22_05-doc-22.05.11-150300.7.9.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * slurm_22_05-pam_slurm-22.05.11-150300.7.9.1 * slurm_22_05-pam_slurm-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-slurmdbd-22.05.11-150300.7.9.1 * slurm_22_05-torque-22.05.11-150300.7.9.1 * slurm_22_05-devel-22.05.11-150300.7.9.1 * slurm_22_05-slurmdbd-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-munge-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-torque-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-debugsource-22.05.11-150300.7.9.1 * slurm_22_05-rest-22.05.11-150300.7.9.1 * perl-slurm_22_05-22.05.11-150300.7.9.1 * libpmi0_22_05-22.05.11-150300.7.9.1 * perl-slurm_22_05-debuginfo-22.05.11-150300.7.9.1 * libnss_slurm2_22_05-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-sql-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-cray-22.05.11-150300.7.9.1 * slurm_22_05-lua-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-sql-22.05.11-150300.7.9.1 * slurm_22_05-lua-22.05.11-150300.7.9.1 * slurm_22_05-cray-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-22.05.11-150300.7.9.1 * slurm_22_05-auth-none-22.05.11-150300.7.9.1 * slurm_22_05-plugins-debuginfo-22.05.11-150300.7.9.1 * libslurm38-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-rest-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-sview-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-auth-none-debuginfo-22.05.11-150300.7.9.1 * libslurm38-22.05.11-150300.7.9.1 * slurm_22_05-munge-22.05.11-150300.7.9.1 * slurm_22_05-sview-22.05.11-150300.7.9.1 * slurm_22_05-plugins-22.05.11-150300.7.9.1 * libnss_slurm2_22_05-22.05.11-150300.7.9.1 * slurm_22_05-node-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-debuginfo-22.05.11-150300.7.9.1 * slurm_22_05-node-22.05.11-150300.7.9.1 * libpmi0_22_05-debuginfo-22.05.11-150300.7.9.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch) * slurm_22_05-config-man-22.05.11-150300.7.9.1 * slurm_22_05-config-22.05.11-150300.7.9.1 * slurm_22_05-webdoc-22.05.11-150300.7.9.1 * slurm_22_05-doc-22.05.11-150300.7.9.1 ## References: * https://www.suse.com/security/cve/CVE-2023-49933.html * https://www.suse.com/security/cve/CVE-2023-49936.html * https://www.suse.com/security/cve/CVE-2023-49937.html * https://www.suse.com/security/cve/CVE-2023-49938.html * https://bugzilla.suse.com/show_bug.cgi?id=1216869 * https://bugzilla.suse.com/show_bug.cgi?id=1217711 * https://bugzilla.suse.com/show_bug.cgi?id=1218046 * https://bugzilla.suse.com/show_bug.cgi?id=1218050 * https://bugzilla.suse.com/show_bug.cgi?id=1218051 * https://bugzilla.suse.com/show_bug.cgi?id=1218053

1 0

SUSE-SU-2024:0284-1: important: Security update for slurm
by OPENSUSE-SECURITY-UPDATES 31 Jan '24

31 Jan '24

# Security update for slurm Announcement ID: SUSE-SU-2024:0284-1 Rating: important References: * bsc#1216869 * bsc#1217711 * bsc#1218046 * bsc#1218049 * bsc#1218050 * bsc#1218051 * bsc#1218053 Cross-References: * CVE-2023-49933 * CVE-2023-49935 * CVE-2023-49936 * CVE-2023-49937 * CVE-2023-49938 CVSS scores: * CVE-2023-49933 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2023-49933 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2023-49935 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2023-49935 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-49936 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H * CVE-2023-49936 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-49937 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H * CVE-2023-49937 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2023-49938 ( SUSE ): 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2023-49938 ( NVD ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N Affected Products: * HPC Module 15-SP5 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Package Hub 15 15-SP5 An update that solves five vulnerabilities and has two security fixes can now be installed. ## Description: This update for slurm fixes the following issues: Update to slurm 23.02.6: Security fixes: * CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046) * CVE-2023-49935: Prevent message hash bypass in slurmd which can allow an attacker to reuse root-level MUNGE tokens and escalate permissions. (bsc#1218049) * CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050) * CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051) * CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053) Other fixes: * Add missing service file for slurmrestd (bsc#1217711). * Fix slurm upgrading to incompatible versions (bsc#1216869). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * HPC Module 15-SP5 zypper in -t patch SUSE-SLE-Module-HPC-15-SP5-2024-284=1 * SUSE Package Hub 15 15-SP5 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2024-284=1 * openSUSE Leap 15.5 zypper in -t patch SUSE-2024-284=1 openSUSE-SLE-15.5-2024-284=1 ## Package List: * HPC Module 15-SP5 (aarch64 x86_64) * slurm-sql-debuginfo-23.02.7-150500.5.15.1 * slurm-munge-23.02.7-150500.5.15.1 * slurm-cray-23.02.7-150500.5.15.1 * slurm-pam_slurm-debuginfo-23.02.7-150500.5.15.1 * slurm-slurmdbd-debuginfo-23.02.7-150500.5.15.1 * slurm-rest-23.02.7-150500.5.15.1 * slurm-torque-debuginfo-23.02.7-150500.5.15.1 * slurm-plugin-ext-sensors-rrd-23.02.7-150500.5.15.1 * perl-slurm-debuginfo-23.02.7-150500.5.15.1 * slurm-auth-none-23.02.7-150500.5.15.1 * slurm-plugin-ext-sensors-rrd-debuginfo-23.02.7-150500.5.15.1 * slurm-sview-23.02.7-150500.5.15.1 * slurm-debuginfo-23.02.7-150500.5.15.1 * slurm-23.02.7-150500.5.15.1 * slurm-node-23.02.7-150500.5.15.1 * slurm-devel-23.02.7-150500.5.15.1 * slurm-plugins-debuginfo-23.02.7-150500.5.15.1 * slurm-torque-23.02.7-150500.5.15.1 * libpmi0-23.02.7-150500.5.15.1 * libpmi0-debuginfo-23.02.7-150500.5.15.1 * slurm-auth-none-debuginfo-23.02.7-150500.5.15.1 * slurm-sql-23.02.7-150500.5.15.1 * libnss_slurm2-23.02.7-150500.5.15.1 * libnss_slurm2-debuginfo-23.02.7-150500.5.15.1 * slurm-cray-debuginfo-23.02.7-150500.5.15.1 * slurm-rest-debuginfo-23.02.7-150500.5.15.1 * slurm-sview-debuginfo-23.02.7-150500.5.15.1 * perl-slurm-23.02.7-150500.5.15.1 * slurm-pam_slurm-23.02.7-150500.5.15.1 * slurm-debugsource-23.02.7-150500.5.15.1 * slurm-lua-23.02.7-150500.5.15.1 * libslurm39-debuginfo-23.02.7-150500.5.15.1 * libslurm39-23.02.7-150500.5.15.1 * slurm-munge-debuginfo-23.02.7-150500.5.15.1 * slurm-node-debuginfo-23.02.7-150500.5.15.1 * slurm-plugins-23.02.7-150500.5.15.1 * slurm-slurmdbd-23.02.7-150500.5.15.1 * slurm-lua-debuginfo-23.02.7-150500.5.15.1 * HPC Module 15-SP5 (noarch) * slurm-config-man-23.02.7-150500.5.15.1 * slurm-doc-23.02.7-150500.5.15.1 * slurm-config-23.02.7-150500.5.15.1 * slurm-webdoc-23.02.7-150500.5.15.1 * SUSE Package Hub 15 15-SP5 (ppc64le s390x) * slurm-sql-debuginfo-23.02.7-150500.5.15.1 * slurm-munge-23.02.7-150500.5.15.1 * slurm-cray-23.02.7-150500.5.15.1 * slurm-pam_slurm-debuginfo-23.02.7-150500.5.15.1 * slurm-slurmdbd-debuginfo-23.02.7-150500.5.15.1 * slurm-rest-23.02.7-150500.5.15.1 * slurm-hdf5-23.02.7-150500.5.15.1 * slurm-torque-debuginfo-23.02.7-150500.5.15.1 * perl-slurm-debuginfo-23.02.7-150500.5.15.1 * slurm-auth-none-23.02.7-150500.5.15.1 * slurm-sview-23.02.7-150500.5.15.1 * slurm-debuginfo-23.02.7-150500.5.15.1 * slurm-23.02.7-150500.5.15.1 * slurm-node-23.02.7-150500.5.15.1 * slurm-devel-23.02.7-150500.5.15.1 * slurm-plugins-debuginfo-23.02.7-150500.5.15.1 * slurm-torque-23.02.7-150500.5.15.1 * libpmi0-23.02.7-150500.5.15.1 * libpmi0-debuginfo-23.02.7-150500.5.15.1 * slurm-auth-none-debuginfo-23.02.7-150500.5.15.1 * slurm-sql-23.02.7-150500.5.15.1 * libnss_slurm2-23.02.7-150500.5.15.1 * libnss_slurm2-debuginfo-23.02.7-150500.5.15.1 * slurm-cray-debuginfo-23.02.7-150500.5.15.1 * slurm-rest-debuginfo-23.02.7-150500.5.15.1 * slurm-sview-debuginfo-23.02.7-150500.5.15.1 * perl-slurm-23.02.7-150500.5.15.1 * slurm-pam_slurm-23.02.7-150500.5.15.1 * slurm-debugsource-23.02.7-150500.5.15.1 * slurm-lua-23.02.7-150500.5.15.1 * slurm-munge-debuginfo-23.02.7-150500.5.15.1 * slurm-hdf5-debuginfo-23.02.7-150500.5.15.1 * slurm-node-debuginfo-23.02.7-150500.5.15.1 * slurm-plugins-23.02.7-150500.5.15.1 * slurm-slurmdbd-23.02.7-150500.5.15.1 * slurm-lua-debuginfo-23.02.7-150500.5.15.1 * SUSE Package Hub 15 15-SP5 (noarch) * slurm-seff-23.02.7-150500.5.15.1 * slurm-openlava-23.02.7-150500.5.15.1 * slurm-doc-23.02.7-150500.5.15.1 * slurm-config-23.02.7-150500.5.15.1 * slurm-webdoc-23.02.7-150500.5.15.1 * slurm-config-man-23.02.7-150500.5.15.1 * slurm-sjstat-23.02.7-150500.5.15.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * slurm-sql-debuginfo-23.02.7-150500.5.15.1 * slurm-munge-23.02.7-150500.5.15.1 * slurm-cray-23.02.7-150500.5.15.1 * slurm-pam_slurm-debuginfo-23.02.7-150500.5.15.1 * slurm-slurmdbd-debuginfo-23.02.7-150500.5.15.1 * slurm-rest-23.02.7-150500.5.15.1 * slurm-hdf5-23.02.7-150500.5.15.1 * slurm-torque-debuginfo-23.02.7-150500.5.15.1 * slurm-plugin-ext-sensors-rrd-23.02.7-150500.5.15.1 * perl-slurm-debuginfo-23.02.7-150500.5.15.1 * slurm-auth-none-23.02.7-150500.5.15.1 * slurm-plugin-ext-sensors-rrd-debuginfo-23.02.7-150500.5.15.1 * slurm-sview-23.02.7-150500.5.15.1 * slurm-debuginfo-23.02.7-150500.5.15.1 * slurm-23.02.7-150500.5.15.1 * slurm-node-23.02.7-150500.5.15.1 * slurm-devel-23.02.7-150500.5.15.1 * slurm-plugins-debuginfo-23.02.7-150500.5.15.1 * slurm-torque-23.02.7-150500.5.15.1 * libpmi0-23.02.7-150500.5.15.1 * libpmi0-debuginfo-23.02.7-150500.5.15.1 * slurm-auth-none-debuginfo-23.02.7-150500.5.15.1 * slurm-sql-23.02.7-150500.5.15.1 * libnss_slurm2-23.02.7-150500.5.15.1 * libnss_slurm2-debuginfo-23.02.7-150500.5.15.1 * slurm-cray-debuginfo-23.02.7-150500.5.15.1 * slurm-rest-debuginfo-23.02.7-150500.5.15.1 * slurm-sview-debuginfo-23.02.7-150500.5.15.1 * perl-slurm-23.02.7-150500.5.15.1 * slurm-testsuite-23.02.7-150500.5.15.1 * slurm-pam_slurm-23.02.7-150500.5.15.1 * slurm-debugsource-23.02.7-150500.5.15.1 * slurm-lua-23.02.7-150500.5.15.1 * libslurm39-debuginfo-23.02.7-150500.5.15.1 * libslurm39-23.02.7-150500.5.15.1 * slurm-munge-debuginfo-23.02.7-150500.5.15.1 * slurm-hdf5-debuginfo-23.02.7-150500.5.15.1 * slurm-node-debuginfo-23.02.7-150500.5.15.1 * slurm-plugins-23.02.7-150500.5.15.1 * slurm-slurmdbd-23.02.7-150500.5.15.1 * slurm-lua-debuginfo-23.02.7-150500.5.15.1 * openSUSE Leap 15.5 (noarch) * slurm-seff-23.02.7-150500.5.15.1 * slurm-openlava-23.02.7-150500.5.15.1 * slurm-doc-23.02.7-150500.5.15.1 * slurm-config-23.02.7-150500.5.15.1 * slurm-webdoc-23.02.7-150500.5.15.1 * slurm-config-man-23.02.7-150500.5.15.1 * slurm-sjstat-23.02.7-150500.5.15.1 ## References: * https://www.suse.com/security/cve/CVE-2023-49933.html * https://www.suse.com/security/cve/CVE-2023-49935.html * https://www.suse.com/security/cve/CVE-2023-49936.html * https://www.suse.com/security/cve/CVE-2023-49937.html * https://www.suse.com/security/cve/CVE-2023-49938.html * https://bugzilla.suse.com/show_bug.cgi?id=1216869 * https://bugzilla.suse.com/show_bug.cgi?id=1217711 * https://bugzilla.suse.com/show_bug.cgi?id=1218046 * https://bugzilla.suse.com/show_bug.cgi?id=1218049 * https://bugzilla.suse.com/show_bug.cgi?id=1218050 * https://bugzilla.suse.com/show_bug.cgi?id=1218051 * https://bugzilla.suse.com/show_bug.cgi?id=1218053

1 0

SUSE-SU-2024:0288-1: important: Security update for slurm_20_11
by OPENSUSE-SECURITY-UPDATES 31 Jan '24

31 Jan '24

# Security update for slurm_20_11 Announcement ID: SUSE-SU-2024:0288-1 Rating: important References: * bsc#1216207 * bsc#1216869 * bsc#1217711 * bsc#1218046 * bsc#1218050 * bsc#1218051 * bsc#1218053 Cross-References: * CVE-2023-41914 * CVE-2023-49933 * CVE-2023-49936 * CVE-2023-49937 * CVE-2023-49938 CVSS scores: * CVE-2023-41914 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-41914 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-49933 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2023-49933 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2023-49936 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H * CVE-2023-49936 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-49937 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H * CVE-2023-49937 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2023-49938 ( SUSE ): 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2023-49938 ( NVD ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N Affected Products: * openSUSE Leap 15.5 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 An update that solves five vulnerabilities and has two security fixes can now be installed. ## Description: This update for slurm_20_11 fixes the following issues: Security fixes: * CVE-2023-41914: Prevent filesystem race conditions that could let an attacker take control of an arbitrary file, or remove entire directories' contents. (bsc#1216207) * CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046) * CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050) * CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051) * CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053) Other fixes: * Add missing service file for slurmrestd (bsc#1217711). * Fix slurm upgrading to incompatible versions (bsc#1216869). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-288=1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-288=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le x86_64) * perl-slurm_20_11-debuginfo-20.11.9-150200.6.16.1 * slurm_20_11-munge-20.11.9-150200.6.16.1 * slurm_20_11-debugsource-20.11.9-150200.6.16.1 * slurm_20_11-lua-20.11.9-150200.6.16.1 * slurm_20_11-plugins-debuginfo-20.11.9-150200.6.16.1 * slurm_20_11-webdoc-20.11.9-150200.6.16.1 * slurm_20_11-config-man-20.11.9-150200.6.16.1 * slurm_20_11-openlava-20.11.9-150200.6.16.1 * slurm_20_11-sql-20.11.9-150200.6.16.1 * slurm_20_11-20.11.9-150200.6.16.1 * libpmi0_20_11-20.11.9-150200.6.16.1 * slurm_20_11-sjstat-20.11.9-150200.6.16.1 * slurm_20_11-sql-debuginfo-20.11.9-150200.6.16.1 * slurm_20_11-munge-debuginfo-20.11.9-150200.6.16.1 * slurm_20_11-seff-20.11.9-150200.6.16.1 * slurm_20_11-auth-none-20.11.9-150200.6.16.1 * slurm_20_11-cray-20.11.9-150200.6.16.1 * slurm_20_11-slurmdbd-debuginfo-20.11.9-150200.6.16.1 * slurm_20_11-plugins-20.11.9-150200.6.16.1 * slurm_20_11-rest-debuginfo-20.11.9-150200.6.16.1 * slurm_20_11-node-20.11.9-150200.6.16.1 * slurm_20_11-debuginfo-20.11.9-150200.6.16.1 * slurm_20_11-doc-20.11.9-150200.6.16.1 * slurm_20_11-hdf5-debuginfo-20.11.9-150200.6.16.1 * slurm_20_11-pam_slurm-20.11.9-150200.6.16.1 * slurm_20_11-slurmdbd-20.11.9-150200.6.16.1 * slurm_20_11-torque-20.11.9-150200.6.16.1 * perl-slurm_20_11-20.11.9-150200.6.16.1 * libnss_slurm2_20_11-debuginfo-20.11.9-150200.6.16.1 * libnss_slurm2_20_11-20.11.9-150200.6.16.1 * slurm_20_11-auth-none-debuginfo-20.11.9-150200.6.16.1 * slurm_20_11-cray-debuginfo-20.11.9-150200.6.16.1 * slurm_20_11-sview-debuginfo-20.11.9-150200.6.16.1 * slurm_20_11-node-debuginfo-20.11.9-150200.6.16.1 * slurm_20_11-torque-debuginfo-20.11.9-150200.6.16.1 * slurm_20_11-devel-20.11.9-150200.6.16.1 * slurm_20_11-pam_slurm-debuginfo-20.11.9-150200.6.16.1 * slurm_20_11-hdf5-20.11.9-150200.6.16.1 * slurm_20_11-lua-debuginfo-20.11.9-150200.6.16.1 * slurm_20_11-rest-20.11.9-150200.6.16.1 * slurm_20_11-sview-20.11.9-150200.6.16.1 * libpmi0_20_11-debuginfo-20.11.9-150200.6.16.1 * slurm_20_11-config-20.11.9-150200.6.16.1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (aarch64 x86_64) * slurm_20_11-munge-20.11.9-150200.6.16.1 * libslurm36-debuginfo-20.11.9-150200.6.16.1 * slurm_20_11-lua-20.11.9-150200.6.16.1 * slurm_20_11-webdoc-20.11.9-150200.6.16.1 * libslurm36-20.11.9-150200.6.16.1 * slurm_20_11-config-man-20.11.9-150200.6.16.1 * slurm_20_11-sql-20.11.9-150200.6.16.1 * slurm_20_11-20.11.9-150200.6.16.1 * libpmi0_20_11-20.11.9-150200.6.16.1 * slurm_20_11-auth-none-20.11.9-150200.6.16.1 * slurm_20_11-plugins-20.11.9-150200.6.16.1 * slurm_20_11-node-20.11.9-150200.6.16.1 * slurm_20_11-doc-20.11.9-150200.6.16.1 * slurm_20_11-pam_slurm-20.11.9-150200.6.16.1 * slurm_20_11-slurmdbd-20.11.9-150200.6.16.1 * slurm_20_11-torque-20.11.9-150200.6.16.1 * perl-slurm_20_11-20.11.9-150200.6.16.1 * libnss_slurm2_20_11-20.11.9-150200.6.16.1 * slurm_20_11-devel-20.11.9-150200.6.16.1 * slurm_20_11-sview-20.11.9-150200.6.16.1 * slurm_20_11-config-20.11.9-150200.6.16.1 ## References: * https://www.suse.com/security/cve/CVE-2023-41914.html * https://www.suse.com/security/cve/CVE-2023-49933.html * https://www.suse.com/security/cve/CVE-2023-49936.html * https://www.suse.com/security/cve/CVE-2023-49937.html * https://www.suse.com/security/cve/CVE-2023-49938.html * https://bugzilla.suse.com/show_bug.cgi?id=1216207 * https://bugzilla.suse.com/show_bug.cgi?id=1216869 * https://bugzilla.suse.com/show_bug.cgi?id=1217711 * https://bugzilla.suse.com/show_bug.cgi?id=1218046 * https://bugzilla.suse.com/show_bug.cgi?id=1218050 * https://bugzilla.suse.com/show_bug.cgi?id=1218051 * https://bugzilla.suse.com/show_bug.cgi?id=1218053

1 0

SUSE-SU-2024:0264-1: moderate: Security update for xen
by OPENSUSE-SECURITY-UPDATES 31 Jan '24

31 Jan '24

# Security update for xen Announcement ID: SUSE-SU-2024:0264-1 Rating: moderate References: * bsc#1218851 Cross-References: * CVE-2023-46839 CVSS scores: * CVE-2023-46839 ( SUSE ): 4.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N Affected Products: * openSUSE Leap 15.3 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise Micro 5.1 * SUSE Linux Enterprise Micro 5.2 * SUSE Linux Enterprise Micro for Rancher 5.2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 An update that solves one vulnerability can now be installed. ## Description: This update for xen fixes the following issues: * CVE-2023-46839: Fixed phantom functions assigned to incorrect contexts (XSA-449) (bsc#1218851) ## Special Instructions and Notes: * Please reboot the system after installing this update. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.3 zypper in -t patch SUSE-2024-264=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-264=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-264=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-264=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2024-264=1 * SUSE Linux Enterprise Micro 5.1 zypper in -t patch SUSE-SUSE-MicroOS-5.1-2024-264=1 * SUSE Linux Enterprise Micro 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2024-264=1 * SUSE Linux Enterprise Micro for Rancher 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2024-264=1 ## Package List: * openSUSE Leap 15.3 (aarch64 x86_64 i586) * xen-tools-domU-debuginfo-4.14.6_10-150300.3.63.1 * xen-libs-4.14.6_10-150300.3.63.1 * xen-tools-domU-4.14.6_10-150300.3.63.1 * xen-debugsource-4.14.6_10-150300.3.63.1 * xen-devel-4.14.6_10-150300.3.63.1 * xen-libs-debuginfo-4.14.6_10-150300.3.63.1 * openSUSE Leap 15.3 (x86_64) * xen-libs-32bit-debuginfo-4.14.6_10-150300.3.63.1 * xen-libs-32bit-4.14.6_10-150300.3.63.1 * openSUSE Leap 15.3 (aarch64 x86_64) * xen-tools-4.14.6_10-150300.3.63.1 * xen-tools-debuginfo-4.14.6_10-150300.3.63.1 * xen-doc-html-4.14.6_10-150300.3.63.1 * xen-4.14.6_10-150300.3.63.1 * openSUSE Leap 15.3 (noarch) * xen-tools-xendomains-wait-disk-4.14.6_10-150300.3.63.1 * openSUSE Leap 15.3 (aarch64_ilp32) * xen-libs-64bit-debuginfo-4.14.6_10-150300.3.63.1 * xen-libs-64bit-4.14.6_10-150300.3.63.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (x86_64) * xen-tools-domU-debuginfo-4.14.6_10-150300.3.63.1 * xen-libs-4.14.6_10-150300.3.63.1 * xen-tools-4.14.6_10-150300.3.63.1 * xen-tools-domU-4.14.6_10-150300.3.63.1 * xen-debugsource-4.14.6_10-150300.3.63.1 * xen-4.14.6_10-150300.3.63.1 * xen-devel-4.14.6_10-150300.3.63.1 * xen-libs-debuginfo-4.14.6_10-150300.3.63.1 * xen-tools-debuginfo-4.14.6_10-150300.3.63.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch) * xen-tools-xendomains-wait-disk-4.14.6_10-150300.3.63.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (x86_64) * xen-tools-domU-debuginfo-4.14.6_10-150300.3.63.1 * xen-libs-4.14.6_10-150300.3.63.1 * xen-tools-4.14.6_10-150300.3.63.1 * xen-tools-domU-4.14.6_10-150300.3.63.1 * xen-debugsource-4.14.6_10-150300.3.63.1 * xen-4.14.6_10-150300.3.63.1 * xen-devel-4.14.6_10-150300.3.63.1 * xen-libs-debuginfo-4.14.6_10-150300.3.63.1 * xen-tools-debuginfo-4.14.6_10-150300.3.63.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (noarch) * xen-tools-xendomains-wait-disk-4.14.6_10-150300.3.63.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (x86_64) * xen-tools-domU-debuginfo-4.14.6_10-150300.3.63.1 * xen-libs-4.14.6_10-150300.3.63.1 * xen-tools-4.14.6_10-150300.3.63.1 * xen-tools-domU-4.14.6_10-150300.3.63.1 * xen-debugsource-4.14.6_10-150300.3.63.1 * xen-4.14.6_10-150300.3.63.1 * xen-devel-4.14.6_10-150300.3.63.1 * xen-libs-debuginfo-4.14.6_10-150300.3.63.1 * xen-tools-debuginfo-4.14.6_10-150300.3.63.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (noarch) * xen-tools-xendomains-wait-disk-4.14.6_10-150300.3.63.1 * SUSE Enterprise Storage 7.1 (x86_64) * xen-tools-domU-debuginfo-4.14.6_10-150300.3.63.1 * xen-libs-4.14.6_10-150300.3.63.1 * xen-tools-4.14.6_10-150300.3.63.1 * xen-tools-domU-4.14.6_10-150300.3.63.1 * xen-debugsource-4.14.6_10-150300.3.63.1 * xen-4.14.6_10-150300.3.63.1 * xen-devel-4.14.6_10-150300.3.63.1 * xen-libs-debuginfo-4.14.6_10-150300.3.63.1 * xen-tools-debuginfo-4.14.6_10-150300.3.63.1 * SUSE Enterprise Storage 7.1 (noarch) * xen-tools-xendomains-wait-disk-4.14.6_10-150300.3.63.1 * SUSE Linux Enterprise Micro 5.1 (x86_64) * xen-libs-4.14.6_10-150300.3.63.1 * xen-debugsource-4.14.6_10-150300.3.63.1 * xen-libs-debuginfo-4.14.6_10-150300.3.63.1 * SUSE Linux Enterprise Micro 5.2 (x86_64) * xen-libs-4.14.6_10-150300.3.63.1 * xen-debugsource-4.14.6_10-150300.3.63.1 * xen-libs-debuginfo-4.14.6_10-150300.3.63.1 * SUSE Linux Enterprise Micro for Rancher 5.2 (x86_64) * xen-libs-4.14.6_10-150300.3.63.1 * xen-debugsource-4.14.6_10-150300.3.63.1 * xen-libs-debuginfo-4.14.6_10-150300.3.63.1 ## References: * https://www.suse.com/security/cve/CVE-2023-46839.html * https://bugzilla.suse.com/show_bug.cgi?id=1218851

1 0

SUSE-SU-2024:0278-1: important: Security update for slurm_20_02
by OPENSUSE-SECURITY-UPDATES 31 Jan '24

31 Jan '24

# Security update for slurm_20_02 Announcement ID: SUSE-SU-2024:0278-1 Rating: important References: * bsc#1216869 * bsc#1218046 * bsc#1218050 * bsc#1218051 * bsc#1218053 Cross-References: * CVE-2023-49933 * CVE-2023-49936 * CVE-2023-49937 * CVE-2023-49938 CVSS scores: * CVE-2023-49933 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2023-49933 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2023-49936 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H * CVE-2023-49936 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-49937 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H * CVE-2023-49937 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2023-49938 ( SUSE ): 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2023-49938 ( NVD ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N Affected Products: * openSUSE Leap 15.5 An update that solves four vulnerabilities and has one security fix can now be installed. ## Description: This update for slurm_20_02 fixes the following issues: Security fixes: * CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046) * CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050) * CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051) * CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053) Other fixes: * Fix slurm upgrading to incompatible versions (bsc#1216869). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-278=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * slurm_20_02-node-20.02.7-150100.3.30.1 * libpmi0_20_02-debuginfo-20.02.7-150100.3.30.1 * slurm_20_02-munge-debuginfo-20.02.7-150100.3.30.1 * slurm_20_02-slurmdbd-20.02.7-150100.3.30.1 * slurm_20_02-lua-debuginfo-20.02.7-150100.3.30.1 * slurm_20_02-auth-none-20.02.7-150100.3.30.1 * slurm_20_02-sjstat-20.02.7-150100.3.30.1 * slurm_20_02-config-20.02.7-150100.3.30.1 * slurm_20_02-node-debuginfo-20.02.7-150100.3.30.1 * slurm_20_02-pam_slurm-debuginfo-20.02.7-150100.3.30.1 * slurm_20_02-cray-debuginfo-20.02.7-150100.3.30.1 * slurm_20_02-debugsource-20.02.7-150100.3.30.1 * slurm_20_02-testsuite-20.02.7-150100.3.30.1 * slurm_20_02-hdf5-20.02.7-150100.3.30.1 * slurm_20_02-sview-20.02.7-150100.3.30.1 * slurm_20_02-seff-20.02.7-150100.3.30.1 * perl-slurm_20_02-20.02.7-150100.3.30.1 * slurm_20_02-pam_slurm-20.02.7-150100.3.30.1 * slurm_20_02-sview-debuginfo-20.02.7-150100.3.30.1 * slurm_20_02-sql-20.02.7-150100.3.30.1 * slurm_20_02-slurmdbd-debuginfo-20.02.7-150100.3.30.1 * libpmi0_20_02-20.02.7-150100.3.30.1 * slurm_20_02-torque-20.02.7-150100.3.30.1 * perl-slurm_20_02-debuginfo-20.02.7-150100.3.30.1 * slurm_20_02-lua-20.02.7-150100.3.30.1 * slurm_20_02-devel-20.02.7-150100.3.30.1 * slurm_20_02-munge-20.02.7-150100.3.30.1 * slurm_20_02-plugins-debuginfo-20.02.7-150100.3.30.1 * slurm_20_02-20.02.7-150100.3.30.1 * slurm_20_02-cray-20.02.7-150100.3.30.1 * slurm_20_02-auth-none-debuginfo-20.02.7-150100.3.30.1 * slurm_20_02-rest-20.02.7-150100.3.30.1 * slurm_20_02-webdoc-20.02.7-150100.3.30.1 * libnss_slurm2_20_02-20.02.7-150100.3.30.1 * slurm_20_02-openlava-20.02.7-150100.3.30.1 * slurm_20_02-torque-debuginfo-20.02.7-150100.3.30.1 * slurm_20_02-config-man-20.02.7-150100.3.30.1 * slurm_20_02-doc-20.02.7-150100.3.30.1 * slurm_20_02-plugins-20.02.7-150100.3.30.1 * libnss_slurm2_20_02-debuginfo-20.02.7-150100.3.30.1 * slurm_20_02-sql-debuginfo-20.02.7-150100.3.30.1 * slurm_20_02-rest-debuginfo-20.02.7-150100.3.30.1 * slurm_20_02-debuginfo-20.02.7-150100.3.30.1 * slurm_20_02-hdf5-debuginfo-20.02.7-150100.3.30.1 ## References: * https://www.suse.com/security/cve/CVE-2023-49933.html * https://www.suse.com/security/cve/CVE-2023-49936.html * https://www.suse.com/security/cve/CVE-2023-49937.html * https://www.suse.com/security/cve/CVE-2023-49938.html * https://bugzilla.suse.com/show_bug.cgi?id=1216869 * https://bugzilla.suse.com/show_bug.cgi?id=1218046 * https://bugzilla.suse.com/show_bug.cgi?id=1218050 * https://bugzilla.suse.com/show_bug.cgi?id=1218051 * https://bugzilla.suse.com/show_bug.cgi?id=1218053

1 0

SUSE-SU-2024:0279-1: important: Security update for slurm
by OPENSUSE-SECURITY-UPDATES 31 Jan '24

31 Jan '24

# Security update for slurm Announcement ID: SUSE-SU-2024:0279-1 Rating: important References: * bsc#1216207 * bsc#1216869 * bsc#1217711 * bsc#1218046 * bsc#1218050 * bsc#1218051 * bsc#1218053 Cross-References: * CVE-2023-41914 * CVE-2023-49933 * CVE-2023-49936 * CVE-2023-49937 * CVE-2023-49938 CVSS scores: * CVE-2023-41914 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-41914 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-49933 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2023-49933 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2023-49936 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H * CVE-2023-49936 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-49937 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H * CVE-2023-49937 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2023-49938 ( SUSE ): 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2023-49938 ( NVD ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N Affected Products: * openSUSE Leap 15.3 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 An update that solves five vulnerabilities and has two security fixes can now be installed. ## Description: This update for slurm fixes the following issues: Security fixes: * CVE-2023-41914: Prevent filesystem race conditions that could let an attacker take control of an arbitrary file, or remove entire directories' contents. (bsc#1216207) * CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046) * CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050) * CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051) * CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053) Other fixes: * Add missing service file for slurmrestd (bsc#1217711). * Fix slurm upgrading to incompatible versions (bsc#1216869). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.3 zypper in -t patch SUSE-2024-279=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-279=1 ## Package List: * openSUSE Leap 15.3 (aarch64 ppc64le x86_64) * slurm-debugsource-20.11.9-150300.4.12.1 * slurm-sql-debuginfo-20.11.9-150300.4.12.1 * slurm-config-man-20.11.9-150300.4.12.1 * slurm-sql-20.11.9-150300.4.12.1 * slurm-node-20.11.9-150300.4.12.1 * slurm-lua-20.11.9-150300.4.12.1 * slurm-torque-20.11.9-150300.4.12.1 * libnss_slurm2-debuginfo-20.11.9-150300.4.12.1 * slurm-doc-20.11.9-150300.4.12.1 * slurm-munge-debuginfo-20.11.9-150300.4.12.1 * libpmi0-20.11.9-150300.4.12.1 * slurm-slurmdbd-debuginfo-20.11.9-150300.4.12.1 * slurm-hdf5-20.11.9-150300.4.12.1 * slurm-devel-20.11.9-150300.4.12.1 * slurm-rest-20.11.9-150300.4.12.1 * slurm-hdf5-debuginfo-20.11.9-150300.4.12.1 * slurm-pam_slurm-debuginfo-20.11.9-150300.4.12.1 * slurm-rest-debuginfo-20.11.9-150300.4.12.1 * slurm-cray-20.11.9-150300.4.12.1 * slurm-seff-20.11.9-150300.4.12.1 * slurm-sview-debuginfo-20.11.9-150300.4.12.1 * slurm-plugins-20.11.9-150300.4.12.1 * perl-slurm-debuginfo-20.11.9-150300.4.12.1 * slurm-20.11.9-150300.4.12.1 * slurm-config-20.11.9-150300.4.12.1 * slurm-openlava-20.11.9-150300.4.12.1 * slurm-pam_slurm-20.11.9-150300.4.12.1 * slurm-auth-none-20.11.9-150300.4.12.1 * slurm-munge-20.11.9-150300.4.12.1 * slurm-webdoc-20.11.9-150300.4.12.1 * slurm-debuginfo-20.11.9-150300.4.12.1 * slurm-sjstat-20.11.9-150300.4.12.1 * slurm-lua-debuginfo-20.11.9-150300.4.12.1 * slurm-plugins-debuginfo-20.11.9-150300.4.12.1 * slurm-cray-debuginfo-20.11.9-150300.4.12.1 * slurm-node-debuginfo-20.11.9-150300.4.12.1 * libslurm36-debuginfo-20.11.9-150300.4.12.1 * slurm-sview-20.11.9-150300.4.12.1 * perl-slurm-20.11.9-150300.4.12.1 * libslurm36-20.11.9-150300.4.12.1 * libpmi0-debuginfo-20.11.9-150300.4.12.1 * slurm-testsuite-20.11.9-150300.4.12.1 * slurm-torque-debuginfo-20.11.9-150300.4.12.1 * slurm-auth-none-debuginfo-20.11.9-150300.4.12.1 * libnss_slurm2-20.11.9-150300.4.12.1 * slurm-slurmdbd-20.11.9-150300.4.12.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) * slurm-debugsource-20.11.9-150300.4.12.1 * slurm-sql-debuginfo-20.11.9-150300.4.12.1 * slurm-config-man-20.11.9-150300.4.12.1 * slurm-sql-20.11.9-150300.4.12.1 * slurm-node-20.11.9-150300.4.12.1 * slurm-lua-20.11.9-150300.4.12.1 * slurm-torque-20.11.9-150300.4.12.1 * libnss_slurm2-debuginfo-20.11.9-150300.4.12.1 * slurm-doc-20.11.9-150300.4.12.1 * slurm-munge-debuginfo-20.11.9-150300.4.12.1 * libpmi0-20.11.9-150300.4.12.1 * slurm-slurmdbd-debuginfo-20.11.9-150300.4.12.1 * slurm-rest-20.11.9-150300.4.12.1 * slurm-devel-20.11.9-150300.4.12.1 * slurm-pam_slurm-debuginfo-20.11.9-150300.4.12.1 * slurm-rest-debuginfo-20.11.9-150300.4.12.1 * slurm-sview-debuginfo-20.11.9-150300.4.12.1 * slurm-plugins-20.11.9-150300.4.12.1 * perl-slurm-debuginfo-20.11.9-150300.4.12.1 * slurm-20.11.9-150300.4.12.1 * slurm-config-20.11.9-150300.4.12.1 * slurm-pam_slurm-20.11.9-150300.4.12.1 * slurm-auth-none-20.11.9-150300.4.12.1 * slurm-munge-20.11.9-150300.4.12.1 * slurm-webdoc-20.11.9-150300.4.12.1 * slurm-debuginfo-20.11.9-150300.4.12.1 * slurm-lua-debuginfo-20.11.9-150300.4.12.1 * slurm-plugins-debuginfo-20.11.9-150300.4.12.1 * slurm-node-debuginfo-20.11.9-150300.4.12.1 * slurm-sview-20.11.9-150300.4.12.1 * libslurm36-debuginfo-20.11.9-150300.4.12.1 * perl-slurm-20.11.9-150300.4.12.1 * libslurm36-20.11.9-150300.4.12.1 * libpmi0-debuginfo-20.11.9-150300.4.12.1 * slurm-torque-debuginfo-20.11.9-150300.4.12.1 * slurm-auth-none-debuginfo-20.11.9-150300.4.12.1 * libnss_slurm2-20.11.9-150300.4.12.1 * slurm-slurmdbd-20.11.9-150300.4.12.1 ## References: * https://www.suse.com/security/cve/CVE-2023-41914.html * https://www.suse.com/security/cve/CVE-2023-49933.html * https://www.suse.com/security/cve/CVE-2023-49936.html * https://www.suse.com/security/cve/CVE-2023-49937.html * https://www.suse.com/security/cve/CVE-2023-49938.html * https://bugzilla.suse.com/show_bug.cgi?id=1216207 * https://bugzilla.suse.com/show_bug.cgi?id=1216869 * https://bugzilla.suse.com/show_bug.cgi?id=1217711 * https://bugzilla.suse.com/show_bug.cgi?id=1218046 * https://bugzilla.suse.com/show_bug.cgi?id=1218050 * https://bugzilla.suse.com/show_bug.cgi?id=1218051 * https://bugzilla.suse.com/show_bug.cgi?id=1218053

1 0

SUSE-SU-2024:0280-1: important: Security update for slurm_23_02
by OPENSUSE-SECURITY-UPDATES 31 Jan '24

31 Jan '24

# Security update for slurm_23_02 Announcement ID: SUSE-SU-2024:0280-1 Rating: important References: * bsc#1216869 * bsc#1217711 * bsc#1218046 * bsc#1218049 * bsc#1218050 * bsc#1218051 * bsc#1218053 Cross-References: * CVE-2023-49933 * CVE-2023-49935 * CVE-2023-49936 * CVE-2023-49937 * CVE-2023-49938 CVSS scores: * CVE-2023-49933 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2023-49933 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2023-49935 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2023-49935 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-49936 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H * CVE-2023-49936 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-49937 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H * CVE-2023-49937 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2023-49938 ( SUSE ): 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2023-49938 ( NVD ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N Affected Products: * openSUSE Leap 15.3 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 An update that solves five vulnerabilities and has two security fixes can now be installed. ## Description: This update for slurm_23_02 fixes the following issues: Update to slurm 23.02.6: Security fixes: * CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046) * CVE-2023-49935: Prevent message hash bypass in slurmd which can allow an attacker to reuse root-level MUNGE tokens and escalate permissions. (bsc#1218049) * CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050) * CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051) * CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053) Other fixes: * Add missing service file for slurmrestd (bsc#1217711). * Fix slurm upgrading to incompatible versions (bsc#1216869). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-280=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-280=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-280=1 * openSUSE Leap 15.3 zypper in -t patch SUSE-2024-280=1 ## Package List: * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) * slurm_23_02-slurmdbd-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-plugins-23.02.7-150300.7.17.1 * slurm_23_02-torque-23.02.7-150300.7.17.1 * libnss_slurm2_23_02-23.02.7-150300.7.17.1 * slurm_23_02-sview-23.02.7-150300.7.17.1 * slurm_23_02-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-auth-none-23.02.7-150300.7.17.1 * slurm_23_02-23.02.7-150300.7.17.1 * slurm_23_02-rest-23.02.7-150300.7.17.1 * slurm_23_02-plugin-ext-sensors-rrd-23.02.7-150300.7.17.1 * slurm_23_02-pam_slurm-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-lua-23.02.7-150300.7.17.1 * perl-slurm_23_02-23.02.7-150300.7.17.1 * slurm_23_02-munge-debuginfo-23.02.7-150300.7.17.1 * libslurm39-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-plugin-ext-sensors-rrd-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-debugsource-23.02.7-150300.7.17.1 * slurm_23_02-sview-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-devel-23.02.7-150300.7.17.1 * slurm_23_02-pam_slurm-23.02.7-150300.7.17.1 * slurm_23_02-rest-debuginfo-23.02.7-150300.7.17.1 * perl-slurm_23_02-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-sql-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-munge-23.02.7-150300.7.17.1 * slurm_23_02-node-23.02.7-150300.7.17.1 * libslurm39-23.02.7-150300.7.17.1 * slurm_23_02-cray-23.02.7-150300.7.17.1 * slurm_23_02-node-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-slurmdbd-23.02.7-150300.7.17.1 * slurm_23_02-torque-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-lua-debuginfo-23.02.7-150300.7.17.1 * libpmi0_23_02-23.02.7-150300.7.17.1 * libnss_slurm2_23_02-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-cray-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-sql-23.02.7-150300.7.17.1 * slurm_23_02-auth-none-debuginfo-23.02.7-150300.7.17.1 * libpmi0_23_02-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-plugins-debuginfo-23.02.7-150300.7.17.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch) * slurm_23_02-doc-23.02.7-150300.7.17.1 * slurm_23_02-config-23.02.7-150300.7.17.1 * slurm_23_02-webdoc-23.02.7-150300.7.17.1 * slurm_23_02-config-man-23.02.7-150300.7.17.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * slurm_23_02-slurmdbd-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-plugins-23.02.7-150300.7.17.1 * slurm_23_02-torque-23.02.7-150300.7.17.1 * libnss_slurm2_23_02-23.02.7-150300.7.17.1 * slurm_23_02-sview-23.02.7-150300.7.17.1 * slurm_23_02-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-auth-none-23.02.7-150300.7.17.1 * slurm_23_02-23.02.7-150300.7.17.1 * slurm_23_02-rest-23.02.7-150300.7.17.1 * slurm_23_02-plugin-ext-sensors-rrd-23.02.7-150300.7.17.1 * slurm_23_02-pam_slurm-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-lua-23.02.7-150300.7.17.1 * perl-slurm_23_02-23.02.7-150300.7.17.1 * slurm_23_02-munge-debuginfo-23.02.7-150300.7.17.1 * libslurm39-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-plugin-ext-sensors-rrd-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-debugsource-23.02.7-150300.7.17.1 * slurm_23_02-sview-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-devel-23.02.7-150300.7.17.1 * slurm_23_02-pam_slurm-23.02.7-150300.7.17.1 * slurm_23_02-rest-debuginfo-23.02.7-150300.7.17.1 * perl-slurm_23_02-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-sql-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-munge-23.02.7-150300.7.17.1 * slurm_23_02-node-23.02.7-150300.7.17.1 * libslurm39-23.02.7-150300.7.17.1 * slurm_23_02-cray-23.02.7-150300.7.17.1 * slurm_23_02-node-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-slurmdbd-23.02.7-150300.7.17.1 * slurm_23_02-torque-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-lua-debuginfo-23.02.7-150300.7.17.1 * libpmi0_23_02-23.02.7-150300.7.17.1 * libnss_slurm2_23_02-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-cray-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-sql-23.02.7-150300.7.17.1 * slurm_23_02-auth-none-debuginfo-23.02.7-150300.7.17.1 * libpmi0_23_02-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-plugins-debuginfo-23.02.7-150300.7.17.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch) * slurm_23_02-doc-23.02.7-150300.7.17.1 * slurm_23_02-config-23.02.7-150300.7.17.1 * slurm_23_02-webdoc-23.02.7-150300.7.17.1 * slurm_23_02-config-man-23.02.7-150300.7.17.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * slurm_23_02-slurmdbd-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-plugins-23.02.7-150300.7.17.1 * slurm_23_02-torque-23.02.7-150300.7.17.1 * libnss_slurm2_23_02-23.02.7-150300.7.17.1 * slurm_23_02-sview-23.02.7-150300.7.17.1 * slurm_23_02-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-auth-none-23.02.7-150300.7.17.1 * slurm_23_02-23.02.7-150300.7.17.1 * slurm_23_02-rest-23.02.7-150300.7.17.1 * slurm_23_02-plugin-ext-sensors-rrd-23.02.7-150300.7.17.1 * slurm_23_02-pam_slurm-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-lua-23.02.7-150300.7.17.1 * perl-slurm_23_02-23.02.7-150300.7.17.1 * slurm_23_02-munge-debuginfo-23.02.7-150300.7.17.1 * libslurm39-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-plugin-ext-sensors-rrd-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-debugsource-23.02.7-150300.7.17.1 * slurm_23_02-sview-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-devel-23.02.7-150300.7.17.1 * slurm_23_02-pam_slurm-23.02.7-150300.7.17.1 * slurm_23_02-rest-debuginfo-23.02.7-150300.7.17.1 * perl-slurm_23_02-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-sql-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-munge-23.02.7-150300.7.17.1 * slurm_23_02-node-23.02.7-150300.7.17.1 * libslurm39-23.02.7-150300.7.17.1 * slurm_23_02-cray-23.02.7-150300.7.17.1 * slurm_23_02-node-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-slurmdbd-23.02.7-150300.7.17.1 * slurm_23_02-torque-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-lua-debuginfo-23.02.7-150300.7.17.1 * libpmi0_23_02-23.02.7-150300.7.17.1 * libnss_slurm2_23_02-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-cray-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-sql-23.02.7-150300.7.17.1 * slurm_23_02-auth-none-debuginfo-23.02.7-150300.7.17.1 * libpmi0_23_02-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-plugins-debuginfo-23.02.7-150300.7.17.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch) * slurm_23_02-doc-23.02.7-150300.7.17.1 * slurm_23_02-config-23.02.7-150300.7.17.1 * slurm_23_02-webdoc-23.02.7-150300.7.17.1 * slurm_23_02-config-man-23.02.7-150300.7.17.1 * openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64) * slurm_23_02-slurmdbd-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-plugins-23.02.7-150300.7.17.1 * slurm_23_02-hdf5-23.02.7-150300.7.17.1 * slurm_23_02-torque-23.02.7-150300.7.17.1 * libnss_slurm2_23_02-23.02.7-150300.7.17.1 * slurm_23_02-sview-23.02.7-150300.7.17.1 * slurm_23_02-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-auth-none-23.02.7-150300.7.17.1 * slurm_23_02-23.02.7-150300.7.17.1 * slurm_23_02-rest-23.02.7-150300.7.17.1 * slurm_23_02-plugin-ext-sensors-rrd-23.02.7-150300.7.17.1 * slurm_23_02-pam_slurm-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-lua-23.02.7-150300.7.17.1 * perl-slurm_23_02-23.02.7-150300.7.17.1 * slurm_23_02-munge-debuginfo-23.02.7-150300.7.17.1 * libslurm39-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-hdf5-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-plugin-ext-sensors-rrd-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-debugsource-23.02.7-150300.7.17.1 * slurm_23_02-sview-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-devel-23.02.7-150300.7.17.1 * slurm_23_02-pam_slurm-23.02.7-150300.7.17.1 * slurm_23_02-rest-debuginfo-23.02.7-150300.7.17.1 * perl-slurm_23_02-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-sql-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-munge-23.02.7-150300.7.17.1 * slurm_23_02-node-23.02.7-150300.7.17.1 * libslurm39-23.02.7-150300.7.17.1 * slurm_23_02-cray-23.02.7-150300.7.17.1 * slurm_23_02-node-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-slurmdbd-23.02.7-150300.7.17.1 * slurm_23_02-testsuite-23.02.7-150300.7.17.1 * slurm_23_02-lua-debuginfo-23.02.7-150300.7.17.1 * libpmi0_23_02-23.02.7-150300.7.17.1 * slurm_23_02-torque-debuginfo-23.02.7-150300.7.17.1 * libnss_slurm2_23_02-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-cray-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-sql-23.02.7-150300.7.17.1 * slurm_23_02-auth-none-debuginfo-23.02.7-150300.7.17.1 * libpmi0_23_02-debuginfo-23.02.7-150300.7.17.1 * slurm_23_02-plugins-debuginfo-23.02.7-150300.7.17.1 * openSUSE Leap 15.3 (noarch) * slurm_23_02-config-23.02.7-150300.7.17.1 * slurm_23_02-seff-23.02.7-150300.7.17.1 * slurm_23_02-sjstat-23.02.7-150300.7.17.1 * slurm_23_02-openlava-23.02.7-150300.7.17.1 * slurm_23_02-webdoc-23.02.7-150300.7.17.1 * slurm_23_02-config-man-23.02.7-150300.7.17.1 * slurm_23_02-doc-23.02.7-150300.7.17.1 ## References: * https://www.suse.com/security/cve/CVE-2023-49933.html * https://www.suse.com/security/cve/CVE-2023-49935.html * https://www.suse.com/security/cve/CVE-2023-49936.html * https://www.suse.com/security/cve/CVE-2023-49937.html * https://www.suse.com/security/cve/CVE-2023-49938.html * https://bugzilla.suse.com/show_bug.cgi?id=1216869 * https://bugzilla.suse.com/show_bug.cgi?id=1217711 * https://bugzilla.suse.com/show_bug.cgi?id=1218046 * https://bugzilla.suse.com/show_bug.cgi?id=1218049 * https://bugzilla.suse.com/show_bug.cgi?id=1218050 * https://bugzilla.suse.com/show_bug.cgi?id=1218051 * https://bugzilla.suse.com/show_bug.cgi?id=1218053

1 0

SUSE-SU-2024:0268-1: moderate: Security update for xen
by OPENSUSE-SECURITY-UPDATES 30 Jan '24

30 Jan '24

# Security update for xen Announcement ID: SUSE-SU-2024:0268-1 Rating: moderate References: * bsc#1218851 Cross-References: * CVE-2023-46839 CVSS scores: * CVE-2023-46839 ( SUSE ): 4.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N Affected Products: * openSUSE Leap 15.4 * openSUSE Leap Micro 5.3 * openSUSE Leap Micro 5.4 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves one vulnerability can now be installed. ## Description: This update for xen fixes the following issues: * CVE-2023-46839: Fixed phantom functions assigned to incorrect contexts (XSA-449) (bsc#1218851) ## Special Instructions and Notes: * Please reboot the system after installing this update. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-268=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-268=1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-268=1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-268=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-268=1 * SUSE Manager Proxy 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2024-268=1 * SUSE Manager Retail Branch Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.3-2024-268=1 * SUSE Manager Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.3-2024-268=1 * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-268=1 * openSUSE Leap Micro 5.3 zypper in -t patch openSUSE-Leap-Micro-5.3-2024-268=1 * openSUSE Leap Micro 5.4 zypper in -t patch openSUSE-Leap-Micro-5.4-2024-268=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2024-268=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2024-268=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2024-268=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2024-268=1 ## Package List: * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (x86_64) * xen-4.16.5_12-150400.4.46.1 * xen-tools-4.16.5_12-150400.4.46.1 * xen-tools-debuginfo-4.16.5_12-150400.4.46.1 * xen-debugsource-4.16.5_12-150400.4.46.1 * xen-libs-4.16.5_12-150400.4.46.1 * xen-tools-domU-debuginfo-4.16.5_12-150400.4.46.1 * xen-devel-4.16.5_12-150400.4.46.1 * xen-libs-debuginfo-4.16.5_12-150400.4.46.1 * xen-tools-domU-4.16.5_12-150400.4.46.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch) * xen-tools-xendomains-wait-disk-4.16.5_12-150400.4.46.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (x86_64) * xen-4.16.5_12-150400.4.46.1 * xen-tools-4.16.5_12-150400.4.46.1 * xen-tools-debuginfo-4.16.5_12-150400.4.46.1 * xen-debugsource-4.16.5_12-150400.4.46.1 * xen-libs-4.16.5_12-150400.4.46.1 * xen-tools-domU-debuginfo-4.16.5_12-150400.4.46.1 * xen-devel-4.16.5_12-150400.4.46.1 * xen-libs-debuginfo-4.16.5_12-150400.4.46.1 * xen-tools-domU-4.16.5_12-150400.4.46.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch) * xen-tools-xendomains-wait-disk-4.16.5_12-150400.4.46.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (x86_64) * xen-debugsource-4.16.5_12-150400.4.46.1 * xen-libs-4.16.5_12-150400.4.46.1 * xen-tools-domU-debuginfo-4.16.5_12-150400.4.46.1 * xen-libs-debuginfo-4.16.5_12-150400.4.46.1 * xen-tools-domU-4.16.5_12-150400.4.46.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (x86_64) * xen-4.16.5_12-150400.4.46.1 * xen-tools-4.16.5_12-150400.4.46.1 * xen-tools-debuginfo-4.16.5_12-150400.4.46.1 * xen-debugsource-4.16.5_12-150400.4.46.1 * xen-libs-4.16.5_12-150400.4.46.1 * xen-tools-domU-debuginfo-4.16.5_12-150400.4.46.1 * xen-devel-4.16.5_12-150400.4.46.1 * xen-libs-debuginfo-4.16.5_12-150400.4.46.1 * xen-tools-domU-4.16.5_12-150400.4.46.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (noarch) * xen-tools-xendomains-wait-disk-4.16.5_12-150400.4.46.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (x86_64) * xen-4.16.5_12-150400.4.46.1 * xen-tools-4.16.5_12-150400.4.46.1 * xen-tools-debuginfo-4.16.5_12-150400.4.46.1 * xen-debugsource-4.16.5_12-150400.4.46.1 * xen-libs-4.16.5_12-150400.4.46.1 * xen-tools-domU-debuginfo-4.16.5_12-150400.4.46.1 * xen-devel-4.16.5_12-150400.4.46.1 * xen-libs-debuginfo-4.16.5_12-150400.4.46.1 * xen-tools-domU-4.16.5_12-150400.4.46.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch) * xen-tools-xendomains-wait-disk-4.16.5_12-150400.4.46.1 * SUSE Manager Proxy 4.3 (x86_64) * xen-4.16.5_12-150400.4.46.1 * xen-tools-4.16.5_12-150400.4.46.1 * xen-tools-debuginfo-4.16.5_12-150400.4.46.1 * xen-debugsource-4.16.5_12-150400.4.46.1 * xen-libs-4.16.5_12-150400.4.46.1 * xen-tools-domU-debuginfo-4.16.5_12-150400.4.46.1 * xen-devel-4.16.5_12-150400.4.46.1 * xen-libs-debuginfo-4.16.5_12-150400.4.46.1 * xen-tools-domU-4.16.5_12-150400.4.46.1 * SUSE Manager Proxy 4.3 (noarch) * xen-tools-xendomains-wait-disk-4.16.5_12-150400.4.46.1 * SUSE Manager Retail Branch Server 4.3 (x86_64) * xen-4.16.5_12-150400.4.46.1 * xen-tools-4.16.5_12-150400.4.46.1 * xen-tools-debuginfo-4.16.5_12-150400.4.46.1 * xen-debugsource-4.16.5_12-150400.4.46.1 * xen-libs-4.16.5_12-150400.4.46.1 * xen-tools-domU-debuginfo-4.16.5_12-150400.4.46.1 * xen-devel-4.16.5_12-150400.4.46.1 * xen-libs-debuginfo-4.16.5_12-150400.4.46.1 * xen-tools-domU-4.16.5_12-150400.4.46.1 * SUSE Manager Retail Branch Server 4.3 (noarch) * xen-tools-xendomains-wait-disk-4.16.5_12-150400.4.46.1 * SUSE Manager Server 4.3 (x86_64) * xen-4.16.5_12-150400.4.46.1 * xen-tools-4.16.5_12-150400.4.46.1 * xen-tools-debuginfo-4.16.5_12-150400.4.46.1 * xen-debugsource-4.16.5_12-150400.4.46.1 * xen-libs-4.16.5_12-150400.4.46.1 * xen-tools-domU-debuginfo-4.16.5_12-150400.4.46.1 * xen-devel-4.16.5_12-150400.4.46.1 * xen-libs-debuginfo-4.16.5_12-150400.4.46.1 * xen-tools-domU-4.16.5_12-150400.4.46.1 * SUSE Manager Server 4.3 (noarch) * xen-tools-xendomains-wait-disk-4.16.5_12-150400.4.46.1 * openSUSE Leap 15.4 (aarch64 x86_64 i586) * xen-debugsource-4.16.5_12-150400.4.46.1 * xen-libs-4.16.5_12-150400.4.46.1 * xen-tools-domU-debuginfo-4.16.5_12-150400.4.46.1 * xen-devel-4.16.5_12-150400.4.46.1 * xen-libs-debuginfo-4.16.5_12-150400.4.46.1 * xen-tools-domU-4.16.5_12-150400.4.46.1 * openSUSE Leap 15.4 (x86_64) * xen-libs-32bit-4.16.5_12-150400.4.46.1 * xen-libs-32bit-debuginfo-4.16.5_12-150400.4.46.1 * openSUSE Leap 15.4 (aarch64 x86_64) * xen-4.16.5_12-150400.4.46.1 * xen-tools-4.16.5_12-150400.4.46.1 * xen-tools-debuginfo-4.16.5_12-150400.4.46.1 * xen-doc-html-4.16.5_12-150400.4.46.1 * openSUSE Leap 15.4 (noarch) * xen-tools-xendomains-wait-disk-4.16.5_12-150400.4.46.1 * openSUSE Leap 15.4 (aarch64_ilp32) * xen-libs-64bit-debuginfo-4.16.5_12-150400.4.46.1 * xen-libs-64bit-4.16.5_12-150400.4.46.1 * openSUSE Leap Micro 5.3 (x86_64) * xen-debugsource-4.16.5_12-150400.4.46.1 * xen-libs-4.16.5_12-150400.4.46.1 * xen-libs-debuginfo-4.16.5_12-150400.4.46.1 * openSUSE Leap Micro 5.4 (x86_64) * xen-debugsource-4.16.5_12-150400.4.46.1 * xen-libs-4.16.5_12-150400.4.46.1 * xen-libs-debuginfo-4.16.5_12-150400.4.46.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (x86_64) * xen-debugsource-4.16.5_12-150400.4.46.1 * xen-libs-4.16.5_12-150400.4.46.1 * xen-libs-debuginfo-4.16.5_12-150400.4.46.1 * SUSE Linux Enterprise Micro 5.3 (x86_64) * xen-debugsource-4.16.5_12-150400.4.46.1 * xen-libs-4.16.5_12-150400.4.46.1 * xen-libs-debuginfo-4.16.5_12-150400.4.46.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (x86_64) * xen-debugsource-4.16.5_12-150400.4.46.1 * xen-libs-4.16.5_12-150400.4.46.1 * xen-libs-debuginfo-4.16.5_12-150400.4.46.1 * SUSE Linux Enterprise Micro 5.4 (x86_64) * xen-debugsource-4.16.5_12-150400.4.46.1 * xen-libs-4.16.5_12-150400.4.46.1 * xen-libs-debuginfo-4.16.5_12-150400.4.46.1 ## References: * https://www.suse.com/security/cve/CVE-2023-46839.html * https://bugzilla.suse.com/show_bug.cgi?id=1218851

1 0

SUSE-SU-2024:0249-1: moderate: Security update for xorg-x11-server
by OPENSUSE-SECURITY-UPDATES 26 Jan '24

26 Jan '24

# Security update for xorg-x11-server Announcement ID: SUSE-SU-2024:0249-1 Rating: moderate References: * bsc#1218845 * bsc#1218846 Cross-References: * CVE-2024-0408 * CVE-2024-0409 CVSS scores: * CVE-2024-0408 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N * CVE-2024-0409 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Affected Products: * Basesystem Module 15-SP5 * Development Tools Module 15-SP5 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves two vulnerabilities can now be installed. ## Description: This update for xorg-x11-server fixes the following issues: * CVE-2024-0408: Fixed SELinux unlabeled GLX PBuffer. (bsc#1218845) * CVE-2024-0409: Fixed SELinux context corruption. (bsc#1218846) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2024-249=1 * Development Tools Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP5-2024-249=1 * openSUSE Leap 15.5 zypper in -t patch SUSE-2024-249=1 openSUSE-SLE-15.5-2024-249=1 ## Package List: * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * xorg-x11-server-extra-debuginfo-21.1.4-150500.7.21.1 * xorg-x11-server-debugsource-21.1.4-150500.7.21.1 * xorg-x11-server-Xvfb-21.1.4-150500.7.21.1 * xorg-x11-server-debuginfo-21.1.4-150500.7.21.1 * xorg-x11-server-Xvfb-debuginfo-21.1.4-150500.7.21.1 * xorg-x11-server-21.1.4-150500.7.21.1 * xorg-x11-server-extra-21.1.4-150500.7.21.1 * Development Tools Module 15-SP5 (aarch64 ppc64le s390x x86_64) * xorg-x11-server-debuginfo-21.1.4-150500.7.21.1 * xorg-x11-server-debugsource-21.1.4-150500.7.21.1 * xorg-x11-server-sdk-21.1.4-150500.7.21.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * xorg-x11-server-extra-debuginfo-21.1.4-150500.7.21.1 * xorg-x11-server-sdk-21.1.4-150500.7.21.1 * xorg-x11-server-debugsource-21.1.4-150500.7.21.1 * xorg-x11-server-Xvfb-21.1.4-150500.7.21.1 * xorg-x11-server-source-21.1.4-150500.7.21.1 * xorg-x11-server-debuginfo-21.1.4-150500.7.21.1 * xorg-x11-server-Xvfb-debuginfo-21.1.4-150500.7.21.1 * xorg-x11-server-21.1.4-150500.7.21.1 * xorg-x11-server-extra-21.1.4-150500.7.21.1 ## References: * https://www.suse.com/security/cve/CVE-2024-0408.html * https://www.suse.com/security/cve/CVE-2024-0409.html * https://bugzilla.suse.com/show_bug.cgi?id=1218845 * https://bugzilla.suse.com/show_bug.cgi?id=1218846

1 0

SUSE-SU-2024:0247-1: important: Security update for rear23a
by OPENSUSE-SECURITY-UPDATES 26 Jan '24

26 Jan '24

# Security update for rear23a Announcement ID: SUSE-SU-2024:0247-1 Rating: important References: * bsc#1218728 Cross-References: * CVE-2024-23301 CVSS scores: * CVE-2024-23301 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-23301 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affected Products: * openSUSE Leap 15.3 * openSUSE Leap 15.5 * SUSE Linux Enterprise High Availability Extension 15 SP3 * SUSE Linux Enterprise High Availability Extension 15 SP4 * SUSE Linux Enterprise High Availability Extension 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 Business Critical Linux 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.2 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.2 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.2 * SUSE Manager Server 4.3 An update that solves one vulnerability can now be installed. ## Description: This update for rear23a fixes the following issues: * CVE-2024-23301: Fixed ReaR creates world-readable initrd with GRUB_RESCUE=Y. (bsc#1218728) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.3 zypper in -t patch SUSE-2024-247=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-247=1 * SUSE Linux Enterprise High Availability Extension 15 SP3 zypper in -t patch SUSE-SLE-Product-HA-15-SP3-2024-247=1 * SUSE Linux Enterprise High Availability Extension 15 SP4 zypper in -t patch SUSE-SLE-Product-HA-15-SP4-2024-247=1 * SUSE Linux Enterprise High Availability Extension 15 SP5 zypper in -t patch SUSE-SLE-Product-HA-15-SP5-2024-247=1 ## Package List: * openSUSE Leap 15.3 (ppc64le x86_64 i586) * rear23a-2.3.a-150300.21.3.1 * openSUSE Leap 15.5 (ppc64le x86_64) * rear23a-2.3.a-150300.21.3.1 * SUSE Linux Enterprise High Availability Extension 15 SP3 (ppc64le x86_64) * rear23a-2.3.a-150300.21.3.1 * SUSE Linux Enterprise High Availability Extension 15 SP4 (ppc64le x86_64) * rear23a-2.3.a-150300.21.3.1 * SUSE Linux Enterprise High Availability Extension 15 SP5 (ppc64le x86_64) * rear23a-2.3.a-150300.21.3.1 ## References: * https://www.suse.com/security/cve/CVE-2024-23301.html * https://bugzilla.suse.com/show_bug.cgi?id=1218728

1 0

SUSE-SU-2024:0250-1: important: Security update for sevctl
by OPENSUSE-SECURITY-UPDATES 26 Jan '24

26 Jan '24

# Security update for sevctl Announcement ID: SUSE-SU-2024:0250-1 Rating: important References: * bsc#1218499 * bsc#1218502 * jsc#PED-4981 Cross-References: * CVE-2023-50711 CVSS scores: * CVE-2023-50711 ( SUSE ): 5.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L * CVE-2023-50711 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.5 * Server Applications Module 15-SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves one vulnerability, contains one feature and has one security fix can now be installed. ## Description: This update for sevctl fixes the following issues: * CVE-2023-50711: Fixed out of bounds memory accesses in vmm-sys-util (bsc#1218502, bsc#1218499) Non-security fixes: * Updated to version 0.4.3 (jsc#PED-4981) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2024-250=1 openSUSE-SLE-15.5-2024-250=1 * Server Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP5-2024-250=1 ## Package List: * openSUSE Leap 15.5 (x86_64) * sevctl-debuginfo-0.4.3-150500.3.3.1 * sevctl-debugsource-0.4.3-150500.3.3.1 * sevctl-0.4.3-150500.3.3.1 * Server Applications Module 15-SP5 (x86_64) * sevctl-debuginfo-0.4.3-150500.3.3.1 * sevctl-debugsource-0.4.3-150500.3.3.1 * sevctl-0.4.3-150500.3.3.1 ## References: * https://www.suse.com/security/cve/CVE-2023-50711.html * https://bugzilla.suse.com/show_bug.cgi?id=1218499 * https://bugzilla.suse.com/show_bug.cgi?id=1218502 * https://jira.suse.com/browse/PED-4981

1 0

SUSE-SU-2024:0238-1: moderate: Security update for cpio
by OPENSUSE-SECURITY-UPDATES 26 Jan '24

26 Jan '24

# Security update for cpio Announcement ID: SUSE-SU-2024:0238-1 Rating: moderate References: * bsc#1218571 Cross-References: * CVE-2023-7207 CVSS scores: * CVE-2023-7207 ( SUSE ): 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * openSUSE Leap Micro 5.3 * openSUSE Leap Micro 5.4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves one vulnerability can now be installed. ## Description: This update for cpio fixes the following issues: * CVE-2023-7207: Fixed a path traversal issue that could lead to an arbitrary file write during archive extraction (bsc#1218571). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-238=1 * openSUSE Leap Micro 5.3 zypper in -t patch openSUSE-Leap-Micro-5.3-2024-238=1 * openSUSE Leap Micro 5.4 zypper in -t patch openSUSE-Leap-Micro-5.4-2024-238=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-238=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2024-238=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2024-238=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2024-238=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2024-238=1 * SUSE Linux Enterprise Micro 5.5 zypper in -t patch SUSE-SLE-Micro-5.5-2024-238=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2024-238=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * cpio-mt-debuginfo-2.13-150400.3.3.1 * cpio-mt-2.13-150400.3.3.1 * cpio-debuginfo-2.13-150400.3.3.1 * cpio-2.13-150400.3.3.1 * cpio-debugsource-2.13-150400.3.3.1 * openSUSE Leap 15.4 (noarch) * cpio-lang-2.13-150400.3.3.1 * openSUSE Leap Micro 5.3 (aarch64 x86_64) * cpio-debugsource-2.13-150400.3.3.1 * cpio-debuginfo-2.13-150400.3.3.1 * cpio-2.13-150400.3.3.1 * openSUSE Leap Micro 5.4 (aarch64 s390x x86_64) * cpio-debugsource-2.13-150400.3.3.1 * cpio-debuginfo-2.13-150400.3.3.1 * cpio-2.13-150400.3.3.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * cpio-mt-debuginfo-2.13-150400.3.3.1 * cpio-mt-2.13-150400.3.3.1 * cpio-debuginfo-2.13-150400.3.3.1 * cpio-2.13-150400.3.3.1 * cpio-debugsource-2.13-150400.3.3.1 * openSUSE Leap 15.5 (noarch) * cpio-lang-2.13-150400.3.3.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64) * cpio-debugsource-2.13-150400.3.3.1 * cpio-debuginfo-2.13-150400.3.3.1 * cpio-2.13-150400.3.3.1 * SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64) * cpio-debugsource-2.13-150400.3.3.1 * cpio-debuginfo-2.13-150400.3.3.1 * cpio-2.13-150400.3.3.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64) * cpio-debugsource-2.13-150400.3.3.1 * cpio-debuginfo-2.13-150400.3.3.1 * cpio-2.13-150400.3.3.1 * SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64) * cpio-debugsource-2.13-150400.3.3.1 * cpio-debuginfo-2.13-150400.3.3.1 * cpio-2.13-150400.3.3.1 * SUSE Linux Enterprise Micro 5.5 (aarch64 s390x x86_64) * cpio-debugsource-2.13-150400.3.3.1 * cpio-debuginfo-2.13-150400.3.3.1 * cpio-2.13-150400.3.3.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * cpio-mt-debuginfo-2.13-150400.3.3.1 * cpio-mt-2.13-150400.3.3.1 * cpio-debuginfo-2.13-150400.3.3.1 * cpio-2.13-150400.3.3.1 * cpio-debugsource-2.13-150400.3.3.1 * Basesystem Module 15-SP5 (noarch) * cpio-lang-2.13-150400.3.3.1 ## References: * https://www.suse.com/security/cve/CVE-2023-7207.html * https://bugzilla.suse.com/show_bug.cgi?id=1218571

1 0

SUSE-SU-2024:0241-1: moderate: Security update for jasper
by OPENSUSE-SECURITY-UPDATES 26 Jan '24

26 Jan '24

# Security update for jasper Announcement ID: SUSE-SU-2024:0241-1 Rating: moderate References: * bsc#1218802 Cross-References: * CVE-2023-51257 CVSS scores: * CVE-2023-51257 ( SUSE ): 4.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L * CVE-2023-51257 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * Basesystem Module 15-SP5 * Desktop Applications Module 15-SP5 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves one vulnerability can now be installed. ## Description: This update for jasper fixes the following issues: * CVE-2023-51257: Fixed an out of bounds write in the JPC encoder (bsc#1218802). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-241=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2024-241=1 * Desktop Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP5-2024-241=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * jasper-2.0.14-150000.3.31.1 * libjasper4-2.0.14-150000.3.31.1 * jasper-debugsource-2.0.14-150000.3.31.1 * libjasper-devel-2.0.14-150000.3.31.1 * libjasper4-debuginfo-2.0.14-150000.3.31.1 * jasper-debuginfo-2.0.14-150000.3.31.1 * openSUSE Leap 15.5 (x86_64) * libjasper4-32bit-2.0.14-150000.3.31.1 * libjasper4-32bit-debuginfo-2.0.14-150000.3.31.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * jasper-debugsource-2.0.14-150000.3.31.1 * libjasper4-debuginfo-2.0.14-150000.3.31.1 * libjasper4-2.0.14-150000.3.31.1 * jasper-debuginfo-2.0.14-150000.3.31.1 * Desktop Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64) * jasper-debugsource-2.0.14-150000.3.31.1 * libjasper-devel-2.0.14-150000.3.31.1 * jasper-debuginfo-2.0.14-150000.3.31.1 ## References: * https://www.suse.com/security/cve/CVE-2023-51257.html * https://bugzilla.suse.com/show_bug.cgi?id=1218802

1 0

SUSE-SU-2024:0224-1: important: Security update for apache-parent, apache-sshd
by OPENSUSE-SECURITY-UPDATES 25 Jan '24

25 Jan '24

# Security update for apache-parent, apache-sshd Announcement ID: SUSE-SU-2024:0224-1 Rating: important References: * bsc#1205463 * bsc#1218189 Cross-References: * CVE-2022-45047 * CVE-2023-48795 CVSS scores: * CVE-2022-45047 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2023-48795 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2023-48795 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Affected Products: * Development Tools Module 15-SP5 * openSUSE Leap 15.5 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves two vulnerabilities can now be installed. ## Description: This update for apache-parent, apache-sshd fixes the following issues: apache-parent was updated from version 28 to 31: * Version 31: * New Features: * Added maven-checkstyle-plugin to pluginManagement * Improvements: * Set minimalMavenBuildVersion to 3.6.3 - the minimum used by plugins * Using an SPDX identifier as the license name is recommended by Maven * Use properties to define the versions of plugins * Bugs fixed: * Updated documentation for previous changes apache-sshd was updated from version 2.7.0 to 2.12.0: * Security issues fixed: * CVE-2023-48795: Implemented OpenSSH "strict key exchange" protocol in apache-sshd version 2.12.0 (bsc#1218189) * CVE-2022-45047: Java unsafe deserialization vulnerability fixed in apache- sshd version 2.9.2 (bsc#1205463) * Other changes in version 2.12.0: * Bugs fixed: * SCP client fails silently when error signalled due to missing file or lacking permissions * Ignore unknown key types from agent or in OpenSSH host keys extension * New Features: * Support GIT protocol-v2 * Other changes in version 2.11.0: * Bugs fixed: * Added configurable timeout(s) to DefaultSftpClient * Compare file keys in ModifiableFileWatcher. * Fixed channel pool in SftpFileSystem. * Use correct default OpenOptions in SftpFileSystemProvider.newFileChannel(). * Use correct lock modes for SFTP FileChannel.lock(). * ScpClient: support issuing commands to a server that uses a non-UTF-8 locale. * SftpInputStreamAsync: fix reporting EOF on zero-length reads. * Work-around a bug in WS_FTP <= 12.9 SFTP clients. * (Regression in 2.10.0) SFTP performance fix: override FilterOutputStream.write(byte[], int, int). * Fixed a race condition to ensure SSH_MSG_CHANNEL_EOF is always sent before SSH_MSG_CHANNEL_CLOSE. * Fixed error handling while flushing queued packets at end of KEX. * Fixed wrong log level on closing an Nio2Session. * Fixed detection of Android O/S from system properties. * Consider all applicable host keys from the known_hosts files. * SftpFileSystem: do not close user session. * ChannelAsyncOutputStream: remove write future when done. * SSHD-1332 (Regression in 2.10.0) Resolve ~ in IdentityFile file names in HostConfigEntry. * New Features: * Use KeepAliveHandler global request instance in client as well * Publish snapshot maven artifacts to the Apache Snapshots maven repository. * Bundle sshd-contrib has support classes for the HAProxy protocol V2. * Other changes in version 2.10.0: * Bugs fixed: * Connection attempt not canceled when a connection timeout occurs * Possible OOM in ChannelPipedInputStream * SftpRemotePathChannel.transferFrom(...) ignores position argument * Rooted file system can leak informations * Failed to establish an SSH connection because the server identifier exceeds the int range * Improvements: * Password in clear in SSHD server's logs * Other changes in version 2.9.2: * Bugs fixed: * SFTP worker threads got stuck while processing PUT methods against one specific SFTP server * Use the maximum packet size of the communication partner * ExplicitPortForwardingTracker does not unbind auto-allocated one * Default SshClient FD leak because Selector not closed * Reading again from exhausted ChannelExec#getInvertedOut() throws IOException instead of returning -1 * Keeping error streams and input streams separate after ChannelExec#setRedirectErrorStream(true) is called * Nio2Session.shutdownOutput() should wait for writes in progress * Test: * Research intermittent failure in unit tests using various I/O service factories * Other changes in version 2.9.1: * Bugs fixed: * ClientSession.auth().verify() is terminated with timeout * 2.9.0 release broken on Java 8 * Infinite loop in org.apache.sshd.sftp.client.impl.SftpInputStreamAsync#doRead * Deadlock during session exit * Race condition is logged in ChannelAsyncOutputStream * Other changes in version 2.9.0: * Bugs fixed: * Deadlock on disconnection at the end of key-exchange * Remote port forwarding mode does not handle EOF properly * Public key authentication: wrong signature algorithm used (ed25519 key with ssh-rsa signature) * Client fails window adjust above Integer.MAX_VALUE * class loader fails to load org.apache.sshd.common.cipher.BaseGCMCipher * Shell is not getting closed if the command has already closed the OutputStream it is using. * Sometimes async write listener is not called * Unhandled SSH_MSG_CHANNEL_WINDOW_ADJUST leeds to SocketTimeoutException * different host key algorithm used on rekey than used for the initial connection * OpenSSH certificate is not properly encoded when critical options are included * TCP/IP remote port forwarding with wildcard IP addresses doesn't work with OpenSSH * UserAuthPublicKey: uses ssh-rsa signatures for RSA keys from an agent * New Features: * Added support for Argon2 encrypted PUTTY key files * Added support for merged inverted output and error streams of remote process * Improvements: * Added support for "limits(a)openssh.com" SFTP extension * Support host-based pubkey authentication in the client * Send environment variable and open subsystem at the same time for SSH session * Other changes in version 2.8.0: * Bugs fixed: * Fixed wrong server key algorithm choice * Expiration of OpenSshCertificates needs to compare timestamps as unsigned long * SFTP Get downloads empty file from servers which supports EOF indication after data * skip() doesn't work properly in SftpInputStreamAsync * OpenMode and CopyMode is not honored as expected in version > 4 of SFTP api * SftpTransferTest sometimes hangs (failure during rekeying) * Race condition in KEX * Fix the ciphers supported documentation * Update tarLongFileMode to use POSIX * WinsCP transfer failure to Apache SSHD Server * Pubkey auth: keys from ssh-agent are used even if HostConfigEntry.isIdentitiesOnly() is true * Support RSA SHA2 signatures via SSH agent * NOTICE: wrong copyright year range * Wrong creationTime in writeAttrs for SFTP * sshd-netty logs all traffic on INFO level * New Features: * Add support for chacha20-poly1305(a)openssh.com * Parsing of ~/.ssh/config Host patterns fails with extra whitespace * Support generating OpenSSH client certificates * Improvements: * Add support for curve25519-sha256(a)libssh.org key exchange * OpenSSH certificates: check certificate type * OpenSSHCertificatesTest: certificates expire in 2030 * Display IdleTimeOut in more user-friendly format * sendChunkIfRemoteWindowIsSmallerThanPacketSize flag in ChannelAsyncOutputStream constructor configurable from outside using variable/config file * Intercepting the server exception message from server in SSHD client * Implement RFC 8332 server-sig-algs on the server * Slow performance listing huge number of files on Apache SSHD server * SFTP: too many LSTAT calls * Support key constraints when adding a key to an SSH agent * Add SFTP server side file custom attributes hook ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-224=1 * Development Tools Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP5-2024-224=1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-224=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-224=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-224=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-224=1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-224=1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2024-224=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-224=1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-224=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2024-224=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-224=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-224=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2024-224=1 ## Package List: * openSUSE Leap 15.5 (noarch) * apache-parent-31-150200.3.12.1 * apache-sshd-javadoc-2.12.0-150200.5.8.1 * apache-sshd-2.12.0-150200.5.8.1 * Development Tools Module 15-SP5 (noarch) * apache-sshd-2.12.0-150200.5.8.1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (noarch) * apache-sshd-2.12.0-150200.5.8.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch) * apache-sshd-2.12.0-150200.5.8.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch) * apache-sshd-2.12.0-150200.5.8.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch) * apache-sshd-2.12.0-150200.5.8.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (noarch) * apache-sshd-2.12.0-150200.5.8.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (noarch) * apache-sshd-2.12.0-150200.5.8.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (noarch) * apache-sshd-2.12.0-150200.5.8.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (noarch) * apache-sshd-2.12.0-150200.5.8.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (noarch) * apache-sshd-2.12.0-150200.5.8.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (noarch) * apache-sshd-2.12.0-150200.5.8.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch) * apache-sshd-2.12.0-150200.5.8.1 * SUSE Enterprise Storage 7.1 (noarch) * apache-sshd-2.12.0-150200.5.8.1 ## References: * https://www.suse.com/security/cve/CVE-2022-45047.html * https://www.suse.com/security/cve/CVE-2023-48795.html * https://bugzilla.suse.com/show_bug.cgi?id=1205463 * https://bugzilla.suse.com/show_bug.cgi?id=1218189

1 0

SUSE-SU-2024:0229-1: important: Security update for MozillaFirefox
by OPENSUSE-SECURITY-UPDATES 25 Jan '24

25 Jan '24

# Security update for MozillaFirefox Announcement ID: SUSE-SU-2024:0229-1 Rating: important References: * bsc#1218955 Cross-References: * CVE-2024-0741 * CVE-2024-0742 * CVE-2024-0746 * CVE-2024-0747 * CVE-2024-0749 * CVE-2024-0750 * CVE-2024-0751 * CVE-2024-0753 * CVE-2024-0755 CVSS scores: Affected Products: * Desktop Applications Module 15-SP5 * openSUSE Leap 15.5 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves nine vulnerabilities can now be installed. ## Description: This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 115.7.0 ESR (MFSA2024-02) (bsc#1218955): * CVE-2024-0741: Out of bounds write in ANGLE * CVE-2024-0742: Failure to update user input timestamp * CVE-2024-0746: Crash when listing printers on Linux * CVE-2024-0747: Bypass of Content Security Policy when directive unsafe- inline was set * CVE-2024-0749: Phishing site popup could show local origin in address bar * CVE-2024-0750: Potential permissions request bypass via clickjacking * CVE-2024-0751: Privilege escalation through devtools * CVE-2024-0753: HSTS policy on subdomain could bypass policy of upper domain * CVE-2024-0755: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7 ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-229=1 * Desktop Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP5-2024-229=1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-229=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-229=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-229=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-229=1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-229=1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2024-229=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-229=1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-229=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2024-229=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-229=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-229=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2024-229=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * MozillaFirefox-115.7.0-150200.152.123.1 * MozillaFirefox-debugsource-115.7.0-150200.152.123.1 * MozillaFirefox-debuginfo-115.7.0-150200.152.123.1 * MozillaFirefox-translations-other-115.7.0-150200.152.123.1 * MozillaFirefox-translations-common-115.7.0-150200.152.123.1 * MozillaFirefox-branding-upstream-115.7.0-150200.152.123.1 * openSUSE Leap 15.5 (noarch) * MozillaFirefox-devel-115.7.0-150200.152.123.1 * Desktop Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64) * MozillaFirefox-115.7.0-150200.152.123.1 * MozillaFirefox-debugsource-115.7.0-150200.152.123.1 * MozillaFirefox-debuginfo-115.7.0-150200.152.123.1 * MozillaFirefox-translations-other-115.7.0-150200.152.123.1 * MozillaFirefox-translations-common-115.7.0-150200.152.123.1 * Desktop Applications Module 15-SP5 (noarch) * MozillaFirefox-devel-115.7.0-150200.152.123.1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (aarch64 x86_64) * MozillaFirefox-115.7.0-150200.152.123.1 * MozillaFirefox-debugsource-115.7.0-150200.152.123.1 * MozillaFirefox-debuginfo-115.7.0-150200.152.123.1 * MozillaFirefox-translations-other-115.7.0-150200.152.123.1 * MozillaFirefox-translations-common-115.7.0-150200.152.123.1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (noarch) * MozillaFirefox-devel-115.7.0-150200.152.123.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) * MozillaFirefox-115.7.0-150200.152.123.1 * MozillaFirefox-debugsource-115.7.0-150200.152.123.1 * MozillaFirefox-debuginfo-115.7.0-150200.152.123.1 * MozillaFirefox-translations-other-115.7.0-150200.152.123.1 * MozillaFirefox-translations-common-115.7.0-150200.152.123.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch) * MozillaFirefox-devel-115.7.0-150200.152.123.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * MozillaFirefox-115.7.0-150200.152.123.1 * MozillaFirefox-debugsource-115.7.0-150200.152.123.1 * MozillaFirefox-debuginfo-115.7.0-150200.152.123.1 * MozillaFirefox-translations-other-115.7.0-150200.152.123.1 * MozillaFirefox-translations-common-115.7.0-150200.152.123.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch) * MozillaFirefox-devel-115.7.0-150200.152.123.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * MozillaFirefox-115.7.0-150200.152.123.1 * MozillaFirefox-debugsource-115.7.0-150200.152.123.1 * MozillaFirefox-debuginfo-115.7.0-150200.152.123.1 * MozillaFirefox-translations-other-115.7.0-150200.152.123.1 * MozillaFirefox-translations-common-115.7.0-150200.152.123.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch) * MozillaFirefox-devel-115.7.0-150200.152.123.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (x86_64) * MozillaFirefox-115.7.0-150200.152.123.1 * MozillaFirefox-debugsource-115.7.0-150200.152.123.1 * MozillaFirefox-debuginfo-115.7.0-150200.152.123.1 * MozillaFirefox-translations-other-115.7.0-150200.152.123.1 * MozillaFirefox-translations-common-115.7.0-150200.152.123.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (noarch) * MozillaFirefox-devel-115.7.0-150200.152.123.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (aarch64 ppc64le s390x x86_64) * MozillaFirefox-115.7.0-150200.152.123.1 * MozillaFirefox-debugsource-115.7.0-150200.152.123.1 * MozillaFirefox-debuginfo-115.7.0-150200.152.123.1 * MozillaFirefox-translations-other-115.7.0-150200.152.123.1 * MozillaFirefox-translations-common-115.7.0-150200.152.123.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (noarch) * MozillaFirefox-devel-115.7.0-150200.152.123.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x x86_64) * MozillaFirefox-115.7.0-150200.152.123.1 * MozillaFirefox-debugsource-115.7.0-150200.152.123.1 * MozillaFirefox-debuginfo-115.7.0-150200.152.123.1 * MozillaFirefox-translations-other-115.7.0-150200.152.123.1 * MozillaFirefox-translations-common-115.7.0-150200.152.123.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (noarch) * MozillaFirefox-devel-115.7.0-150200.152.123.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (aarch64 ppc64le s390x x86_64) * MozillaFirefox-115.7.0-150200.152.123.1 * MozillaFirefox-debugsource-115.7.0-150200.152.123.1 * MozillaFirefox-debuginfo-115.7.0-150200.152.123.1 * MozillaFirefox-translations-other-115.7.0-150200.152.123.1 * MozillaFirefox-translations-common-115.7.0-150200.152.123.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (noarch) * MozillaFirefox-devel-115.7.0-150200.152.123.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (ppc64le x86_64) * MozillaFirefox-115.7.0-150200.152.123.1 * MozillaFirefox-debugsource-115.7.0-150200.152.123.1 * MozillaFirefox-debuginfo-115.7.0-150200.152.123.1 * MozillaFirefox-translations-other-115.7.0-150200.152.123.1 * MozillaFirefox-translations-common-115.7.0-150200.152.123.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (noarch) * MozillaFirefox-devel-115.7.0-150200.152.123.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64) * MozillaFirefox-115.7.0-150200.152.123.1 * MozillaFirefox-debugsource-115.7.0-150200.152.123.1 * MozillaFirefox-debuginfo-115.7.0-150200.152.123.1 * MozillaFirefox-translations-other-115.7.0-150200.152.123.1 * MozillaFirefox-translations-common-115.7.0-150200.152.123.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (noarch) * MozillaFirefox-devel-115.7.0-150200.152.123.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * MozillaFirefox-115.7.0-150200.152.123.1 * MozillaFirefox-debugsource-115.7.0-150200.152.123.1 * MozillaFirefox-debuginfo-115.7.0-150200.152.123.1 * MozillaFirefox-translations-other-115.7.0-150200.152.123.1 * MozillaFirefox-translations-common-115.7.0-150200.152.123.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch) * MozillaFirefox-devel-115.7.0-150200.152.123.1 * SUSE Enterprise Storage 7.1 (aarch64 x86_64) * MozillaFirefox-115.7.0-150200.152.123.1 * MozillaFirefox-debugsource-115.7.0-150200.152.123.1 * MozillaFirefox-debuginfo-115.7.0-150200.152.123.1 * MozillaFirefox-translations-other-115.7.0-150200.152.123.1 * MozillaFirefox-translations-common-115.7.0-150200.152.123.1 * SUSE Enterprise Storage 7.1 (noarch) * MozillaFirefox-devel-115.7.0-150200.152.123.1 ## References: * https://www.suse.com/security/cve/CVE-2024-0741.html * https://www.suse.com/security/cve/CVE-2024-0742.html * https://www.suse.com/security/cve/CVE-2024-0746.html * https://www.suse.com/security/cve/CVE-2024-0747.html * https://www.suse.com/security/cve/CVE-2024-0749.html * https://www.suse.com/security/cve/CVE-2024-0750.html * https://www.suse.com/security/cve/CVE-2024-0751.html * https://www.suse.com/security/cve/CVE-2024-0753.html * https://www.suse.com/security/cve/CVE-2024-0755.html * https://bugzilla.suse.com/show_bug.cgi?id=1218955

1 0

openSUSE-SU-2024:0033-1: important: Security update for opera
by opensuse-security＠opensuse.org 24 Jan '24

24 Jan '24

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0033-1 Rating: important References: Cross-References: CVE-2024-0517 CVE-2024-0518 CVE-2024-0519 CVSS scores: CVE-2024-0517 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-0518 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-0519 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.5:NonFree ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for opera fixes the following issues: Update to 106.0.4998.52 * CHR-9580 Update Chromium on desktop-stable-120-4998 to 120.0.6099.234 * DNA-113175 Can not merge folders on start page * DNA-113341 Implement 'special' menus * DNA-113811 Removing icons in sidepanel heading * DNA-114059 [Move to context menu] Workspaces icons always displayed in 1 line * DNA-114361 "Move to workspace" submenu shows icons vertically * The update to chromium 120.0.6099.234 fixes following issues: CVE-2024-0517, CVE-2024-0518, CVE-2024-0519 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.5:NonFree: zypper in -t patch openSUSE-2024-33=1 Package List: - openSUSE Leap 15.5:NonFree (x86_64): opera-106.0.4998.52-lp155.3.33.1 References: https://www.suse.com/security/cve/CVE-2024-0517.html https://www.suse.com/security/cve/CVE-2024-0518.html https://www.suse.com/security/cve/CVE-2024-0519.html

1 0

openSUSE-SU-2024:0031-1: important: Security update for cacti, cacti-spine
by opensuse-security＠opensuse.org 24 Jan '24

24 Jan '24

openSUSE Security Update: Security update for cacti, cacti-spine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0031-1 Rating: important References: #1218360 #1218366 #1218378 #1218379 #1218380 #1218381 Cross-References: CVE-2023-49084 CVE-2023-49085 CVE-2023-49086 CVE-2023-49088 CVE-2023-50250 CVE-2023-51448 CVSS scores: CVE-2023-49084 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-49085 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-49086 (NVD) : 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVE-2023-49088 (NVD) : 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVE-2023-50250 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2023-51448 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP4 SUSE Linux Enterprise Server 12-SP5 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12-SP3 SUSE Linux Enterprise Server for SAP Applications 12-SP4 SUSE Linux Enterprise Server for SAP Applications 12-SP5 SUSE Package Hub for SUSE Linux Enterprise 12 openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for cacti, cacti-spine fixes the following issues: cacti-spine 1.2.26: * Fix: Errors when uptime OID is not present * Fix: MySQL reconnect option is depreciated * Fix: Spine does not check a host with no poller items * Fix: Poller may report the wrong number of devices polled * Feature: Allow users to override the threads setting at the command line * Feature: Allow spine to run in ping-only mode cacti 1.2.26: * CVE-2023-50250: XSS vulnerability when importing a template file (boo#1218380) * CVE-2023-49084: RCE vulnerability when managing links (boo#1218360) * CVE-2023-49085: SQL Injection vulnerability when managing poller devices (boo#1218378) * CVE-2023-49086: XSS vulnerability when adding new devices (boo#1218366) * CVE-2023-49088: XSS vulnerability when viewing data sources in debug mode (boo#1218379) * CVE-2023-51448: SQL Injection vulnerability when managing SNMP Notification Receivers (boo#1218381) * When viewing data sources, an undefined variable error may be seen * Improvements for Poller Last Run Date * Attempting to edit a Data Query that does not exist throws warnings and not an GUI error * Improve PHP 8.1 support when adding devices * Viewing Data Query Cache can cause errors to be logged * Preserve option is not properly honoured when removing devices at command line * Infinite recursion is possible during a database failure * Monitoring Host CPU's does not always work on Windows endpoints * Multi select drop down list box not rendered correctly in Chrome and Edge * Selective Plugin Debugging may not always work as intended * During upgrades, Plugins may be falsely reported as incompatible * Plugin management at command line does not work with multiple plugins * Improve PHP 8.1 support for incrementing only numbers * Allow the renaming of guest and template accounts * DS Stats issues warnings when the RRDfile has not been initialized * When upgrading, missing data source profile can cause errors to be logged * When deleting a single Data Source, purge historical debug data * Improvements to form element warnings * Some interface aliases do not appear correctly * Aggregate graph does not show other percentiles * Settings table updates for large values reverted by database repair * When obtaining graph records, error messages may be recorded * Unable to change a device's community at command line * Increase timeout for RRDChecker * When viewing a graph, option to edit template may lead to incorrect URL * When upgrading, failures may occur due to missing color table keys * On installation, allow a more appropriate template to be used as the default * When data input parameters are allowed to be null, allow null * CSV Exports may not always output data correctly * When debugging a graph, long CDEF's can cause undesirable scrolling * Secondary LDAP server not evaluated when the first one has failed * When adding a device, using the bulk walk option can make version information appear * When parsing a Data Query resource, an error can be reported if no direction is specified * Database reconnection can cause errors to be reported incorrectly * fix returned value if $sau is empty * Add Aruba switch, Aruba controller and HPE iLO templates * Add OSCX 6x00 templates Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2024-31=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2024-31=1 Package List: - openSUSE Backports SLE-15-SP5 (aarch64 i586 ppc64le s390x x86_64): cacti-spine-1.2.26-bp155.2.6.1 - openSUSE Backports SLE-15-SP5 (noarch): cacti-1.2.26-bp155.2.6.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): cacti-spine-1.2.26-32.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): cacti-1.2.26-38.1 References: https://www.suse.com/security/cve/CVE-2023-49084.html https://www.suse.com/security/cve/CVE-2023-49085.html https://www.suse.com/security/cve/CVE-2023-49086.html https://www.suse.com/security/cve/CVE-2023-49088.html https://www.suse.com/security/cve/CVE-2023-50250.html https://www.suse.com/security/cve/CVE-2023-51448.html https://bugzilla.suse.com/1218360 https://bugzilla.suse.com/1218366 https://bugzilla.suse.com/1218378 https://bugzilla.suse.com/1218379 https://bugzilla.suse.com/1218380 https://bugzilla.suse.com/1218381

1 0

openSUSE-SU-2024:0031-1: important: Security update for cacti, cacti-spine
by opensuse-security＠opensuse.org 24 Jan '24

24 Jan '24

openSUSE Security Update: Security update for cacti, cacti-spine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0031-1 Rating: important References: #1218360 #1218366 #1218378 #1218379 #1218380 #1218381 Cross-References: CVE-2023-49084 CVE-2023-49085 CVE-2023-49086 CVE-2023-49088 CVE-2023-50250 CVE-2023-51448 CVSS scores: CVE-2023-49084 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-49085 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-49086 (NVD) : 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVE-2023-49088 (NVD) : 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVE-2023-50250 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2023-51448 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP4 SUSE Linux Enterprise Server 12-SP5 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12-SP3 SUSE Linux Enterprise Server for SAP Applications 12-SP4 SUSE Linux Enterprise Server for SAP Applications 12-SP5 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for cacti, cacti-spine fixes the following issues: cacti-spine 1.2.26: * Fix: Errors when uptime OID is not present * Fix: MySQL reconnect option is depreciated * Fix: Spine does not check a host with no poller items * Fix: Poller may report the wrong number of devices polled * Feature: Allow users to override the threads setting at the command line * Feature: Allow spine to run in ping-only mode cacti 1.2.26: * CVE-2023-50250: XSS vulnerability when importing a template file (boo#1218380) * CVE-2023-49084: RCE vulnerability when managing links (boo#1218360) * CVE-2023-49085: SQL Injection vulnerability when managing poller devices (boo#1218378) * CVE-2023-49086: XSS vulnerability when adding new devices (boo#1218366) * CVE-2023-49088: XSS vulnerability when viewing data sources in debug mode (boo#1218379) * CVE-2023-51448: SQL Injection vulnerability when managing SNMP Notification Receivers (boo#1218381) * When viewing data sources, an undefined variable error may be seen * Improvements for Poller Last Run Date * Attempting to edit a Data Query that does not exist throws warnings and not an GUI error * Improve PHP 8.1 support when adding devices * Viewing Data Query Cache can cause errors to be logged * Preserve option is not properly honoured when removing devices at command line * Infinite recursion is possible during a database failure * Monitoring Host CPU's does not always work on Windows endpoints * Multi select drop down list box not rendered correctly in Chrome and Edge * Selective Plugin Debugging may not always work as intended * During upgrades, Plugins may be falsely reported as incompatible * Plugin management at command line does not work with multiple plugins * Improve PHP 8.1 support for incrementing only numbers * Allow the renaming of guest and template accounts * DS Stats issues warnings when the RRDfile has not been initialized * When upgrading, missing data source profile can cause errors to be logged * When deleting a single Data Source, purge historical debug data * Improvements to form element warnings * Some interface aliases do not appear correctly * Aggregate graph does not show other percentiles * Settings table updates for large values reverted by database repair * When obtaining graph records, error messages may be recorded * Unable to change a device's community at command line * Increase timeout for RRDChecker * When viewing a graph, option to edit template may lead to incorrect URL * When upgrading, failures may occur due to missing color table keys * On installation, allow a more appropriate template to be used as the default * When data input parameters are allowed to be null, allow null * CSV Exports may not always output data correctly * When debugging a graph, long CDEF's can cause undesirable scrolling * Secondary LDAP server not evaluated when the first one has failed * When adding a device, using the bulk walk option can make version information appear * When parsing a Data Query resource, an error can be reported if no direction is specified * Database reconnection can cause errors to be reported incorrectly * fix returned value if $sau is empty * Add Aruba switch, Aruba controller and HPE iLO templates * Add OSCX 6x00 templates Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2024-31=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): cacti-spine-1.2.26-32.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): cacti-1.2.26-38.1 References: https://www.suse.com/security/cve/CVE-2023-49084.html https://www.suse.com/security/cve/CVE-2023-49085.html https://www.suse.com/security/cve/CVE-2023-49086.html https://www.suse.com/security/cve/CVE-2023-49088.html https://www.suse.com/security/cve/CVE-2023-50250.html https://www.suse.com/security/cve/CVE-2023-51448.html https://bugzilla.suse.com/1218360 https://bugzilla.suse.com/1218366 https://bugzilla.suse.com/1218378 https://bugzilla.suse.com/1218379 https://bugzilla.suse.com/1218380 https://bugzilla.suse.com/1218381

1 0

SUSE-SU-2024:0208-1: moderate: Security update for tomcat10
by OPENSUSE-SECURITY-UPDATES 24 Jan '24

24 Jan '24

# Security update for tomcat10 Announcement ID: SUSE-SU-2024:0208-1 Rating: moderate References: * bsc#1217649 Cross-References: * CVE-2023-46589 CVSS scores: * CVE-2023-46589 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2023-46589 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Affected Products: * openSUSE Leap 15.5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * Web and Scripting Module 15-SP5 An update that solves one vulnerability can now be installed. ## Description: This update for tomcat10 fixes the following issues: Updated to Tomcat 10.1.18 * CVE-2023-46589: Fixed HTTP request smuggling due to incorrect headers parsing (bsc#1217649) Find the full release notes at: https://tomcat.apache.org/tomcat-9.0-doc/changelog.html ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-208=1 * Web and Scripting Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP5-2024-208=1 ## Package List: * openSUSE Leap 15.5 (noarch) * tomcat10-el-5_0-api-10.1.18-150200.5.8.1 * tomcat10-jsp-3_1-api-10.1.18-150200.5.8.1 * tomcat10-servlet-6_0-api-10.1.18-150200.5.8.1 * tomcat10-embed-10.1.18-150200.5.8.1 * tomcat10-admin-webapps-10.1.18-150200.5.8.1 * tomcat10-docs-webapp-10.1.18-150200.5.8.1 * tomcat10-10.1.18-150200.5.8.1 * tomcat10-jsvc-10.1.18-150200.5.8.1 * tomcat10-lib-10.1.18-150200.5.8.1 * tomcat10-webapps-10.1.18-150200.5.8.1 * Web and Scripting Module 15-SP5 (noarch) * tomcat10-el-5_0-api-10.1.18-150200.5.8.1 * tomcat10-jsp-3_1-api-10.1.18-150200.5.8.1 * tomcat10-servlet-6_0-api-10.1.18-150200.5.8.1 * tomcat10-admin-webapps-10.1.18-150200.5.8.1 * tomcat10-10.1.18-150200.5.8.1 * tomcat10-lib-10.1.18-150200.5.8.1 * tomcat10-webapps-10.1.18-150200.5.8.1 ## References: * https://www.suse.com/security/cve/CVE-2023-46589.html * https://bugzilla.suse.com/show_bug.cgi?id=1217649

1 0

SUSE-SU-2024:0204-1: important: Security update for bluez
by OPENSUSE-SECURITY-UPDATES 24 Jan '24

24 Jan '24

# Security update for bluez Announcement ID: SUSE-SU-2024:0204-1 Rating: important References: * bsc#1218300 * bsc#1218301 Cross-References: * CVE-2023-50229 * CVE-2023-50230 CVSS scores: * CVE-2023-50229 ( SUSE ): 7.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-50230 ( SUSE ): 7.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.4 * openSUSE Leap Micro 5.3 * openSUSE Leap Micro 5.4 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves two vulnerabilities can now be installed. ## Description: This update for bluez fixes the following issues: * CVE-2023-50229: Fixed an out of bounds write in the primary version counter for the Phone Book Access Profile implementation (bsc#1218300). * CVE-2023-50230: Fixed an out of bounds write in the secondary version counter for the Phone Book Access Profile implementation (bsc#1218301). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-204=1 * openSUSE Leap Micro 5.3 zypper in -t patch openSUSE-Leap-Micro-5.3-2024-204=1 * openSUSE Leap Micro 5.4 zypper in -t patch openSUSE-Leap-Micro-5.4-2024-204=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2024-204=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2024-204=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2024-204=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2024-204=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-204=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-204=1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-204=1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-204=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-204=1 * SUSE Manager Proxy 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2024-204=1 * SUSE Manager Retail Branch Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.3-2024-204=1 * SUSE Manager Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.3-2024-204=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * libbluetooth3-5.62-150400.4.19.1 * bluez-test-debuginfo-5.62-150400.4.19.1 * bluez-cups-5.62-150400.4.19.1 * bluez-devel-5.62-150400.4.19.1 * bluez-deprecated-5.62-150400.4.19.1 * bluez-cups-debuginfo-5.62-150400.4.19.1 * bluez-debuginfo-5.62-150400.4.19.1 * bluez-test-5.62-150400.4.19.1 * bluez-debugsource-5.62-150400.4.19.1 * libbluetooth3-debuginfo-5.62-150400.4.19.1 * bluez-deprecated-debuginfo-5.62-150400.4.19.1 * bluez-5.62-150400.4.19.1 * openSUSE Leap 15.4 (noarch) * bluez-auto-enable-devices-5.62-150400.4.19.1 * openSUSE Leap 15.4 (x86_64) * libbluetooth3-32bit-debuginfo-5.62-150400.4.19.1 * bluez-devel-32bit-5.62-150400.4.19.1 * libbluetooth3-32bit-5.62-150400.4.19.1 * openSUSE Leap 15.4 (aarch64_ilp32) * libbluetooth3-64bit-debuginfo-5.62-150400.4.19.1 * bluez-devel-64bit-5.62-150400.4.19.1 * libbluetooth3-64bit-5.62-150400.4.19.1 * openSUSE Leap Micro 5.3 (aarch64 s390x x86_64) * libbluetooth3-5.62-150400.4.19.1 * libbluetooth3-debuginfo-5.62-150400.4.19.1 * openSUSE Leap Micro 5.4 (aarch64 s390x x86_64) * libbluetooth3-5.62-150400.4.19.1 * bluez-debuginfo-5.62-150400.4.19.1 * libbluetooth3-debuginfo-5.62-150400.4.19.1 * bluez-debugsource-5.62-150400.4.19.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64) * libbluetooth3-5.62-150400.4.19.1 * libbluetooth3-debuginfo-5.62-150400.4.19.1 * SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64) * libbluetooth3-5.62-150400.4.19.1 * libbluetooth3-debuginfo-5.62-150400.4.19.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64) * libbluetooth3-5.62-150400.4.19.1 * bluez-debuginfo-5.62-150400.4.19.1 * libbluetooth3-debuginfo-5.62-150400.4.19.1 * bluez-debugsource-5.62-150400.4.19.1 * SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64) * libbluetooth3-5.62-150400.4.19.1 * bluez-debuginfo-5.62-150400.4.19.1 * libbluetooth3-debuginfo-5.62-150400.4.19.1 * bluez-debugsource-5.62-150400.4.19.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * libbluetooth3-5.62-150400.4.19.1 * bluez-devel-5.62-150400.4.19.1 * bluez-deprecated-5.62-150400.4.19.1 * bluez-debuginfo-5.62-150400.4.19.1 * bluez-debugsource-5.62-150400.4.19.1 * libbluetooth3-debuginfo-5.62-150400.4.19.1 * bluez-deprecated-debuginfo-5.62-150400.4.19.1 * bluez-5.62-150400.4.19.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * libbluetooth3-5.62-150400.4.19.1 * bluez-devel-5.62-150400.4.19.1 * bluez-deprecated-5.62-150400.4.19.1 * bluez-debuginfo-5.62-150400.4.19.1 * bluez-debugsource-5.62-150400.4.19.1 * libbluetooth3-debuginfo-5.62-150400.4.19.1 * bluez-deprecated-debuginfo-5.62-150400.4.19.1 * bluez-5.62-150400.4.19.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (x86_64) * libbluetooth3-5.62-150400.4.19.1 * bluez-cups-5.62-150400.4.19.1 * bluez-devel-5.62-150400.4.19.1 * bluez-deprecated-5.62-150400.4.19.1 * bluez-cups-debuginfo-5.62-150400.4.19.1 * bluez-debuginfo-5.62-150400.4.19.1 * bluez-debugsource-5.62-150400.4.19.1 * libbluetooth3-debuginfo-5.62-150400.4.19.1 * bluez-deprecated-debuginfo-5.62-150400.4.19.1 * bluez-5.62-150400.4.19.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (aarch64 ppc64le s390x x86_64) * libbluetooth3-5.62-150400.4.19.1 * bluez-devel-5.62-150400.4.19.1 * bluez-deprecated-5.62-150400.4.19.1 * bluez-debuginfo-5.62-150400.4.19.1 * bluez-debugsource-5.62-150400.4.19.1 * libbluetooth3-debuginfo-5.62-150400.4.19.1 * bluez-deprecated-debuginfo-5.62-150400.4.19.1 * bluez-5.62-150400.4.19.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * libbluetooth3-5.62-150400.4.19.1 * bluez-devel-5.62-150400.4.19.1 * bluez-deprecated-5.62-150400.4.19.1 * bluez-debuginfo-5.62-150400.4.19.1 * bluez-debugsource-5.62-150400.4.19.1 * libbluetooth3-debuginfo-5.62-150400.4.19.1 * bluez-deprecated-debuginfo-5.62-150400.4.19.1 * bluez-5.62-150400.4.19.1 * SUSE Manager Proxy 4.3 (x86_64) * libbluetooth3-5.62-150400.4.19.1 * bluez-deprecated-5.62-150400.4.19.1 * bluez-debuginfo-5.62-150400.4.19.1 * bluez-debugsource-5.62-150400.4.19.1 * libbluetooth3-debuginfo-5.62-150400.4.19.1 * bluez-deprecated-debuginfo-5.62-150400.4.19.1 * bluez-5.62-150400.4.19.1 * SUSE Manager Retail Branch Server 4.3 (x86_64) * libbluetooth3-5.62-150400.4.19.1 * bluez-deprecated-5.62-150400.4.19.1 * bluez-debuginfo-5.62-150400.4.19.1 * bluez-debugsource-5.62-150400.4.19.1 * libbluetooth3-debuginfo-5.62-150400.4.19.1 * bluez-deprecated-debuginfo-5.62-150400.4.19.1 * bluez-5.62-150400.4.19.1 * SUSE Manager Server 4.3 (ppc64le s390x x86_64) * libbluetooth3-5.62-150400.4.19.1 * bluez-deprecated-5.62-150400.4.19.1 * bluez-debuginfo-5.62-150400.4.19.1 * bluez-debugsource-5.62-150400.4.19.1 * libbluetooth3-debuginfo-5.62-150400.4.19.1 * bluez-deprecated-debuginfo-5.62-150400.4.19.1 * bluez-5.62-150400.4.19.1 ## References: * https://www.suse.com/security/cve/CVE-2023-50229.html * https://www.suse.com/security/cve/CVE-2023-50230.html * https://bugzilla.suse.com/show_bug.cgi?id=1218300 * https://bugzilla.suse.com/show_bug.cgi?id=1218301

1 0

SUSE-SU-2024:0205-1: important: Security update for python-Pillow
by OPENSUSE-SECURITY-UPDATES 24 Jan '24

24 Jan '24

# Security update for python-Pillow Announcement ID: SUSE-SU-2024:0205-1 Rating: important References: * bsc#1219048 Cross-References: * CVE-2023-50447 CVSS scores: * CVE-2023-50447 ( SUSE ): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * Python 3 Module 15-SP5 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves one vulnerability can now be installed. ## Description: This update for python-Pillow fixes the following issues: * CVE-2023-50447: Fixed arbitrary code execution via the environment parameter. (bsc#1219048) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-205=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-205=1 * Python 3 Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Python3-15-SP5-2024-205=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-205=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-205=1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-205=1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-205=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-205=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * python-Pillow-debugsource-9.5.0-150400.5.9.1 * python311-Pillow-debuginfo-9.5.0-150400.5.9.1 * python-Pillow-debuginfo-9.5.0-150400.5.9.1 * python311-Pillow-tk-9.5.0-150400.5.9.1 * python311-Pillow-9.5.0-150400.5.9.1 * python311-Pillow-tk-debuginfo-9.5.0-150400.5.9.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * python-Pillow-debugsource-9.5.0-150400.5.9.1 * python311-Pillow-debuginfo-9.5.0-150400.5.9.1 * python-Pillow-debuginfo-9.5.0-150400.5.9.1 * python311-Pillow-tk-9.5.0-150400.5.9.1 * python311-Pillow-9.5.0-150400.5.9.1 * python311-Pillow-tk-debuginfo-9.5.0-150400.5.9.1 * Python 3 Module 15-SP5 (aarch64 ppc64le s390x x86_64) * python-Pillow-debugsource-9.5.0-150400.5.9.1 * python311-Pillow-debuginfo-9.5.0-150400.5.9.1 * python-Pillow-debuginfo-9.5.0-150400.5.9.1 * python311-Pillow-tk-9.5.0-150400.5.9.1 * python311-Pillow-9.5.0-150400.5.9.1 * python311-Pillow-tk-debuginfo-9.5.0-150400.5.9.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * python-Pillow-debugsource-9.5.0-150400.5.9.1 * python311-Pillow-debuginfo-9.5.0-150400.5.9.1 * python-Pillow-debuginfo-9.5.0-150400.5.9.1 * python311-Pillow-tk-9.5.0-150400.5.9.1 * python311-Pillow-9.5.0-150400.5.9.1 * python311-Pillow-tk-debuginfo-9.5.0-150400.5.9.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * python-Pillow-debugsource-9.5.0-150400.5.9.1 * python311-Pillow-debuginfo-9.5.0-150400.5.9.1 * python-Pillow-debuginfo-9.5.0-150400.5.9.1 * python311-Pillow-tk-9.5.0-150400.5.9.1 * python311-Pillow-9.5.0-150400.5.9.1 * python311-Pillow-tk-debuginfo-9.5.0-150400.5.9.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (x86_64) * python-Pillow-debugsource-9.5.0-150400.5.9.1 * python311-Pillow-debuginfo-9.5.0-150400.5.9.1 * python-Pillow-debuginfo-9.5.0-150400.5.9.1 * python311-Pillow-tk-9.5.0-150400.5.9.1 * python311-Pillow-9.5.0-150400.5.9.1 * python311-Pillow-tk-debuginfo-9.5.0-150400.5.9.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (aarch64 ppc64le s390x x86_64) * python-Pillow-debugsource-9.5.0-150400.5.9.1 * python311-Pillow-debuginfo-9.5.0-150400.5.9.1 * python-Pillow-debuginfo-9.5.0-150400.5.9.1 * python311-Pillow-tk-9.5.0-150400.5.9.1 * python311-Pillow-9.5.0-150400.5.9.1 * python311-Pillow-tk-debuginfo-9.5.0-150400.5.9.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * python-Pillow-debugsource-9.5.0-150400.5.9.1 * python311-Pillow-debuginfo-9.5.0-150400.5.9.1 * python-Pillow-debuginfo-9.5.0-150400.5.9.1 * python311-Pillow-tk-9.5.0-150400.5.9.1 * python311-Pillow-9.5.0-150400.5.9.1 * python311-Pillow-tk-debuginfo-9.5.0-150400.5.9.1 ## References: * https://www.suse.com/security/cve/CVE-2023-50447.html * https://bugzilla.suse.com/show_bug.cgi?id=1219048

1 0

SUSE-SU-2024:0212-1: moderate: Security update for xwayland
by OPENSUSE-SECURITY-UPDATES 24 Jan '24

24 Jan '24

# Security update for xwayland Announcement ID: SUSE-SU-2024:0212-1 Rating: moderate References: * bsc#1218845 * bsc#1218846 Cross-References: * CVE-2024-0408 * CVE-2024-0409 CVSS scores: * CVE-2024-0408 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N * CVE-2024-0409 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Affected Products: * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Workstation Extension 15 SP5 An update that solves two vulnerabilities can now be installed. ## Description: This update for xwayland fixes the following issues: * CVE-2024-0408: Fixed SELinux unlabeled GLX PBuffer. (bsc#1218845) * CVE-2024-0409: Fixed SELinux context corruption. (bsc#1218846) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2024-212=1 openSUSE-SLE-15.5-2024-212=1 * SUSE Linux Enterprise Workstation Extension 15 SP5 zypper in -t patch SUSE-SLE-Product-WE-15-SP5-2024-212=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * xwayland-devel-22.1.5-150500.7.17.1 * xwayland-22.1.5-150500.7.17.1 * xwayland-debuginfo-22.1.5-150500.7.17.1 * xwayland-debugsource-22.1.5-150500.7.17.1 * SUSE Linux Enterprise Workstation Extension 15 SP5 (x86_64) * xwayland-22.1.5-150500.7.17.1 * xwayland-debuginfo-22.1.5-150500.7.17.1 * xwayland-debugsource-22.1.5-150500.7.17.1 ## References: * https://www.suse.com/security/cve/CVE-2024-0408.html * https://www.suse.com/security/cve/CVE-2024-0409.html * https://bugzilla.suse.com/show_bug.cgi?id=1218845 * https://bugzilla.suse.com/show_bug.cgi?id=1218846

1 0

SUSE-SU-2024:0200-1: important: Security update for redis7
by OPENSUSE-SECURITY-UPDATES 23 Jan '24

23 Jan '24

# Security update for redis7 Announcement ID: SUSE-SU-2024:0200-1 Rating: important References: * bsc#1212119 * bsc#1216376 Cross-References: * CVE-2023-45145 CVSS scores: * CVE-2023-45145 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-45145 ( NVD ): 3.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N Affected Products: * openSUSE Leap 15.5 * Server Applications Module 15-SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves one vulnerability and has one security fix can now be installed. ## Description: This update for redis7 fixes the following issues: * CVE-2023-45145: Fixed a potential permission bypass due to a race condition during UNIX socket creation (bsc#1216376). The following non-security issues were fixed: * Redis services are no longer disabled after an upgrade (bsc#1212119). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2024-200=1 openSUSE-SLE-15.5-2024-200=1 * Server Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP5-2024-200=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * redis7-debugsource-7.0.8-150500.3.9.1 * redis7-7.0.8-150500.3.9.1 * redis7-debuginfo-7.0.8-150500.3.9.1 * Server Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64) * redis7-debugsource-7.0.8-150500.3.9.1 * redis7-7.0.8-150500.3.9.1 * redis7-debuginfo-7.0.8-150500.3.9.1 ## References: * https://www.suse.com/security/cve/CVE-2023-45145.html * https://bugzilla.suse.com/show_bug.cgi?id=1212119 * https://bugzilla.suse.com/show_bug.cgi?id=1216376

1 0