October 2024

SUSE-SU-2024:3833-1: important: Security update for the Linux Kernel RT (Live Patch 16 for SLE 15 SP5)
by OPENSUSE-SECURITY-UPDATES 30 Oct '24

30 Oct '24

# Security update for the Linux Kernel RT (Live Patch 16 for SLE 15 SP5) Announcement ID: SUSE-SU-2024:3833-1 Release Date: 2024-10-30T18:34:21Z Rating: important References: * bsc#1223683 * bsc#1225099 * bsc#1225739 * bsc#1225819 * bsc#1227471 * bsc#1228349 * bsc#1228573 * bsc#1228786 Cross-References: * CVE-2021-47598 * CVE-2023-52752 * CVE-2023-52846 * CVE-2024-26923 * CVE-2024-36899 * CVE-2024-40909 * CVE-2024-40954 * CVE-2024-41059 CVSS … [View More]scores: * CVE-2021-47598 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2021-47598 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-52752 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-52752 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-52846 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-26923 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-36899 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-40909 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-40909 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-40954 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-40954 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-41059 ( SUSE ): 7.3 CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2024-41059 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-41059 ( NVD ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H Affected Products: * openSUSE Leap 15.5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Live Patching 15-SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves eight vulnerabilities can now be installed. ## Description: This update for the Linux Kernel 5.14.21-150500_13_58 fixes several issues. The following security issues were fixed: * CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1227471). * CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225819). * CVE-2024-36899: gpiolib: cdev: Fix use after free in lineinfo_changed_notify (bsc#1225739). * CVE-2024-40954: net: do not leave a dangling sk pointer, when socket creation fails (bsc#1227808) * CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228573). * CVE-2024-40909: bpf: Fix a potential use-after-free in bpf_link_free() (bsc#1228349). * CVE-2023-52846: hsr: Prevent use after free in prp_create_tagged_frame() (bsc#1225099). * CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Live Patching 15-SP5 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP5-2024-3833=1 * openSUSE Leap 15.5 zypper in -t patch SUSE-2024-3833=1 ## Package List: * SUSE Linux Enterprise Live Patching 15-SP5 (x86_64) * kernel-livepatch-5_14_21-150500_13_58-rt-5-150500.11.6.1 * kernel-livepatch-5_14_21-150500_13_58-rt-debuginfo-5-150500.11.6.1 * kernel-livepatch-SLE15-SP5-RT_Update_16-debugsource-5-150500.11.6.1 * openSUSE Leap 15.5 (x86_64) * kernel-livepatch-5_14_21-150500_13_58-rt-5-150500.11.6.1 * kernel-livepatch-5_14_21-150500_13_58-rt-debuginfo-5-150500.11.6.1 * kernel-livepatch-SLE15-SP5-RT_Update_16-debugsource-5-150500.11.6.1 ## References: * https://www.suse.com/security/cve/CVE-2021-47598.html * https://www.suse.com/security/cve/CVE-2023-52752.html * https://www.suse.com/security/cve/CVE-2023-52846.html * https://www.suse.com/security/cve/CVE-2024-26923.html * https://www.suse.com/security/cve/CVE-2024-36899.html * https://www.suse.com/security/cve/CVE-2024-40909.html * https://www.suse.com/security/cve/CVE-2024-40954.html * https://www.suse.com/security/cve/CVE-2024-41059.html * https://bugzilla.suse.com/show_bug.cgi?id=1223683 * https://bugzilla.suse.com/show_bug.cgi?id=1225099 * https://bugzilla.suse.com/show_bug.cgi?id=1225739 * https://bugzilla.suse.com/show_bug.cgi?id=1225819 * https://bugzilla.suse.com/show_bug.cgi?id=1227471 * https://bugzilla.suse.com/show_bug.cgi?id=1228349 * https://bugzilla.suse.com/show_bug.cgi?id=1228573 * https://bugzilla.suse.com/show_bug.cgi?id=1228786 [View Less]

1 0

SUSE-SU-2024:3836-1: important: Security update for the Linux Kernel (Live Patch 28 for SLE 15 SP4)
by OPENSUSE-SECURITY-UPDATES 30 Oct '24

30 Oct '24

# Security update for the Linux Kernel (Live Patch 28 for SLE 15 SP4) Announcement ID: SUSE-SU-2024:3836-1 Release Date: 2024-10-30T19:03:45Z Rating: important References: * bsc#1227471 * bsc#1228573 * bsc#1228786 * bsc#1231353 Cross-References: * CVE-2021-47598 * CVE-2024-40954 * CVE-2024-41059 CVSS scores: * CVE-2021-47598 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2021-47598 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H … [View More] * CVE-2024-40954 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-40954 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-41059 ( SUSE ): 7.3 CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2024-41059 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-41059 ( NVD ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H Affected Products: * openSUSE Leap 15.4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise Live Patching 15-SP4 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 An update that solves three vulnerabilities and has one security fix can now be installed. ## Description: This update for the Linux Kernel 5.14.21-150400_24_125 fixes several issues. The following security issues were fixed: * CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1227471). * Intermittent nfs mount failures (may be due to SUNRPC over UDP) (bsc#1231353) * CVE-2024-40954: net: do not leave a dangling sk pointer, when socket creation fails (bsc#1227808) * CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228573). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-3836=1 * SUSE Linux Enterprise Live Patching 15-SP4 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP4-2024-3836=1 ## Package List: * openSUSE Leap 15.4 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150400_24_125-default-3-150400.9.6.1 * kernel-livepatch-SLE15-SP4_Update_28-debugsource-3-150400.9.6.1 * kernel-livepatch-5_14_21-150400_24_125-default-debuginfo-3-150400.9.6.1 * SUSE Linux Enterprise Live Patching 15-SP4 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150400_24_125-default-3-150400.9.6.1 * kernel-livepatch-SLE15-SP4_Update_28-debugsource-3-150400.9.6.1 * kernel-livepatch-5_14_21-150400_24_125-default-debuginfo-3-150400.9.6.1 ## References: * https://www.suse.com/security/cve/CVE-2021-47598.html * https://www.suse.com/security/cve/CVE-2024-40954.html * https://www.suse.com/security/cve/CVE-2024-41059.html * https://bugzilla.suse.com/show_bug.cgi?id=1227471 * https://bugzilla.suse.com/show_bug.cgi?id=1228573 * https://bugzilla.suse.com/show_bug.cgi?id=1228786 * https://bugzilla.suse.com/show_bug.cgi?id=1231353 [View Less]

1 0

SUSE-SU-2024:3837-1: important: Security update for the Linux Kernel RT (Live Patch 11 for SLE 15 SP5)
by OPENSUSE-SECURITY-UPDATES 30 Oct '24

30 Oct '24

# Security update for the Linux Kernel RT (Live Patch 11 for SLE 15 SP5) Announcement ID: SUSE-SU-2024:3837-1 Release Date: 2024-10-30T19:03:55Z Rating: important References: * bsc#1220145 * bsc#1220832 * bsc#1221302 * bsc#1222685 * bsc#1223059 * bsc#1223363 * bsc#1223514 * bsc#1223521 * bsc#1223681 * bsc#1223683 * bsc#1225011 * bsc#1225012 * bsc#1225013 * bsc#1225099 * bsc#1225309 * bsc#1225310 * bsc#1225311 * bsc#1225312 * bsc#1225313 * bsc#… [View More]

1 0

openSUSE-SU-2024:0342-1: moderate: Security update for lxc
by opensuse-security＠opensuse.org 30 Oct '24

30 Oct '24

openSUSE Security Update: Security update for lxc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0342-1 Rating: moderate References: #1204842 #1206779 Cross-References: CVE-2022-47952 CVSS scores: CVE-2022-47952 (SUSE): 6.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N Affected Products: openSUSE Backports SLE-15-SP5 openSUSE Backports SLE-15-… [View More]SP6 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for lxc fixes the following issues: lxc was updated to 6.0.2: The LXC team is pleased to announce the release of LXC 6.0.2! This is the second bugfix release for LXC 6.0 which is supported until June 2029. As usual this bugfix releases focus on stability and hardening. * Some of the highlights for this release are: - Reduced log level on some common messages - Fix compilation error on aarch64 * Detailed changelog - Remove unused function - idmap: Lower logging level of newXidmap tools to INFO - Exit 0 when there's no error - doc: Fix definitions of get_config_path and set_config_path - README: Update security contact - fix possible clang compile error in AARCH Update to 6.0.1: The LXC team is pleased to announce the release of LXC 6.0.1! This is the first bugfix release for LXC 6.0 which is supported until June 2029. As usual this bugfix releases focus on stability and hardening. * Highlights - Fixed some build tooling issues - Fixed startup failures on system without IPv6 support - Updated AppArmor rules to avoid potential warnings Update to 6.0.0: The LXC team is pleased to announce the release of LXC 6.0 LTS! This is the result of two years of work since the LXC 5.0 release and is the sixth LTS release for the LXC project. This release will be supported until June 2029. * New multi-call binary¶ A new tools-multicall=true configuration option can be used to produce a single lxc binary which can then have all other lxc-XYZ commands be symlinked to. This allows for a massive disk space reduction, particularly useful for embedded platforms. * Add a set_timeout function to the library A new set_timeout function is available on the main lxc_container struct and allow for setting a global timeout for interactions with the LXC monitor. Prior to this, there was no timeout, leading to potential deadlocks as there's also no way to cancel an monitor request. As a result of adding this new symbol to the library, we have bumped the liblxc symbol version to 1.8.0. * LXC bridge now has IPV6 enabled The default lxcbr0 bridge now comes with IPv6 enabled by default, using an IPv6 ULA subnet. Support for uid/gid selection in lxc-usernsexec The lxc-usernsexec tool now has both -u and -g options to control what resulting UID and GID (respectively) the user wishes to use (defaulting to 0/0). * Improvements to lxc-checkconfig lxc-checkconfig now only shows the version if lxc-start is present (rather than failing). Additionally, it's seen a number of other cosmetic improvements as well as now listing the maximum number of allowed namespaces for every namespace type. * Support for squashfs OCI images The built-in oci container template can now handle squashfs compressed OCI images through the use of atomfs. * Switched from systemd's dbus to dbus-1 LXC now uses libdbus-1 for DBus interactions with systemd rather than using libsystemd. The reason for this change is that libdbus-1 is readily available for static builds. * Removed Upstart support Support for the Upstart init system has finally been removed from LXC. This shouldn't really affect anyone at this stage and allowed for cleaning up some logic and config files from our repository. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP6: zypper in -t patch openSUSE-2024-342=1 - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2024-342=1 Package List: - openSUSE Backports SLE-15-SP6 (aarch64 i586 ppc64le s390x x86_64): liblxc-devel-6.0.2-bp156.2.3.1 liblxc1-6.0.2-bp156.2.3.1 lxc-6.0.2-bp156.2.3.1 pam_cgfs-6.0.2-bp156.2.3.1 - openSUSE Backports SLE-15-SP6 (noarch): lxc-bash-completion-6.0.2-bp156.2.3.1 lxc-ja-doc-6.0.2-bp156.2.3.1 lxc-ko-doc-6.0.2-bp156.2.3.1 - openSUSE Backports SLE-15-SP5 (aarch64 i586 ppc64le s390x x86_64): liblxc-devel-6.0.2-bp155.4.3.1 liblxc1-6.0.2-bp155.4.3.1 liblxc1-debuginfo-6.0.2-bp155.4.3.1 lxc-6.0.2-bp155.4.3.1 lxc-debuginfo-6.0.2-bp155.4.3.1 lxc-debugsource-6.0.2-bp155.4.3.1 pam_cgfs-6.0.2-bp155.4.3.1 pam_cgfs-debuginfo-6.0.2-bp155.4.3.1 - openSUSE Backports SLE-15-SP5 (noarch): lxc-bash-completion-6.0.2-bp155.4.3.1 lxc-ja-doc-6.0.2-bp155.4.3.1 lxc-ko-doc-6.0.2-bp155.4.3.1 References: https://www.suse.com/security/cve/CVE-2022-47952.html https://bugzilla.suse.com/1204842 https://bugzilla.suse.com/1206779 [View Less]

1 0

openSUSE-SU-2024:0343-1: moderate: Security update for Botan
by opensuse-security＠opensuse.org 30 Oct '24

30 Oct '24

openSUSE Security Update: Security update for Botan ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0343-1 Rating: moderate References: #1232296 #1232297 #1232300 #1232301 Cross-References: CVE-2024-50382 CVE-2024-50383 CVSS scores: CVE-2024-50382 (SUSE): 6.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVE-2024-50383 (SUSE): 6.8 CVSS:4.0/AV:L/AC:… [View More]L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Affected Products: openSUSE Backports SLE-15-SP5 openSUSE Backports SLE-15-SP6 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for Botan fixes the following issues: - Fixed CVE-2024-50382, CVE-2024-50383 - various compiler-induced side channel in GHASH when certain LLVM/GCC versions are used to compile Botan. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP6: zypper in -t patch openSUSE-2024-343=1 - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2024-343=1 Package List: - openSUSE Backports SLE-15-SP6 (aarch64 i586 ppc64le s390x x86_64): Botan-2.19.5-bp156.3.6.1 Botan-debuginfo-2.19.5-bp156.3.6.1 Botan-debugsource-2.19.5-bp156.3.6.1 libbotan-2-19-2.19.5-bp156.3.6.1 libbotan-2-19-debuginfo-2.19.5-bp156.3.6.1 libbotan-devel-2.19.5-bp156.3.6.1 python3-botan-2.19.5-bp156.3.6.1 - openSUSE Backports SLE-15-SP6 (aarch64_ilp32): libbotan-2-19-64bit-2.19.5-bp156.3.6.1 libbotan-2-19-64bit-debuginfo-2.19.5-bp156.3.6.1 libbotan-devel-64bit-2.19.5-bp156.3.6.1 - openSUSE Backports SLE-15-SP6 (x86_64): libbotan-2-19-32bit-2.19.5-bp156.3.6.1 libbotan-2-19-32bit-debuginfo-2.19.5-bp156.3.6.1 libbotan-devel-32bit-2.19.5-bp156.3.6.1 - openSUSE Backports SLE-15-SP6 (noarch): Botan-doc-2.19.5-bp156.3.6.1 - openSUSE Backports SLE-15-SP5 (aarch64 i586 ppc64le s390x x86_64): Botan-2.19.5-bp155.2.6.1 libbotan-2-19-2.19.5-bp155.2.6.1 libbotan-devel-2.19.5-bp155.2.6.1 python3-botan-2.19.5-bp155.2.6.1 - openSUSE Backports SLE-15-SP5 (aarch64_ilp32): libbotan-2-19-64bit-2.19.5-bp155.2.6.1 libbotan-devel-64bit-2.19.5-bp155.2.6.1 - openSUSE Backports SLE-15-SP5 (noarch): Botan-doc-2.19.5-bp155.2.6.1 - openSUSE Backports SLE-15-SP5 (x86_64): libbotan-2-19-32bit-2.19.5-bp155.2.6.1 libbotan-devel-32bit-2.19.5-bp155.2.6.1 References: https://www.suse.com/security/cve/CVE-2024-50382.html https://www.suse.com/security/cve/CVE-2024-50383.html https://bugzilla.suse.com/1232296 https://bugzilla.suse.com/1232297 https://bugzilla.suse.com/1232300 https://bugzilla.suse.com/1232301 [View Less]

1 0

SUSE-SU-2024:3809-1: moderate: Security update for go1.21-openssl
by OPENSUSE-SECURITY-UPDATES 30 Oct '24

30 Oct '24

# Security update for go1.21-openssl Announcement ID: SUSE-SU-2024:3809-1 Release Date: 2024-10-30T15:08:02Z Rating: moderate References: * bsc#1230252 * bsc#1230253 * bsc#1230254 * jsc#SLE-18320 Cross-References: * CVE-2024-34155 * CVE-2024-34156 * CVE-2024-34158 CVSS scores: * CVE-2024-34155 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-34156 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-34156 ( NVD ): 7.… [View More]5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-34158 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-34158 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * Development Tools Module 15-SP5 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves three vulnerabilities and contains one feature can now be installed. ## Description: This update for go1.21-openssl fixes the following issues: * CVE-2024-34158: Fixed stack exhaustion in Parse in go/build/constraint (bsc#1230254). * CVE-2024-34156: Fixed stack exhaustion in Decoder.Decode in encoding/gob (bsc#1230253). * CVE-2024-34155: Fixed stack exhaustion in all Parse* functions (bsc#1230252). * Update to version 1.21.13.3 cut from the go1.21-fips-release (jsc#SLE-18320). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-3809=1 * Development Tools Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP5-2024-3809=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * go1.21-openssl-doc-1.21.13.4-150000.1.14.1 * go1.21-openssl-1.21.13.4-150000.1.14.1 * go1.21-openssl-race-1.21.13.4-150000.1.14.1 * Development Tools Module 15-SP5 (aarch64 ppc64le s390x x86_64) * go1.21-openssl-doc-1.21.13.4-150000.1.14.1 * go1.21-openssl-1.21.13.4-150000.1.14.1 * go1.21-openssl-race-1.21.13.4-150000.1.14.1 ## References: * https://www.suse.com/security/cve/CVE-2024-34155.html * https://www.suse.com/security/cve/CVE-2024-34156.html * https://www.suse.com/security/cve/CVE-2024-34158.html * https://bugzilla.suse.com/show_bug.cgi?id=1230252 * https://bugzilla.suse.com/show_bug.cgi?id=1230253 * https://bugzilla.suse.com/show_bug.cgi?id=1230254 * https://jira.suse.com/browse/SLE-18320 [View Less]

1 0

SUSE-SU-2024:3810-1: moderate: Security update for python-Werkzeug
by OPENSUSE-SECURITY-UPDATES 30 Oct '24

30 Oct '24

# Security update for python-Werkzeug Announcement ID: SUSE-SU-2024:3810-1 Release Date: 2024-10-30T15:33:55Z Rating: moderate References: * bsc#1232449 Cross-References: * CVE-2024-49767 CVSS scores: * CVE-2024-49767 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2024-49767 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/… [View More]S:U/C:N/I:N/A:L * CVE-2024-49767 ( NVD ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * openSUSE Leap 15.6 * Python 3 Module 15-SP5 * Python 3 Module 15-SP6 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 An update that solves one vulnerability can now be installed. ## Description: This update for python-Werkzeug fixes the following issues: * CVE-2024-49767: Fixed possible resource exhaustion when parsing file data in forms (bsc#1232449). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-3810=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-3810=1 * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2024-3810=1 * Python 3 Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Python3-15-SP5-2024-3810=1 * Python 3 Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Python3-15-SP6-2024-3810=1 ## Package List: * openSUSE Leap 15.4 (noarch) * python311-Werkzeug-2.3.6-150400.6.12.1 * openSUSE Leap 15.5 (noarch) * python311-Werkzeug-2.3.6-150400.6.12.1 * openSUSE Leap 15.6 (noarch) * python311-Werkzeug-2.3.6-150400.6.12.1 * Python 3 Module 15-SP5 (noarch) * python311-Werkzeug-2.3.6-150400.6.12.1 * Python 3 Module 15-SP6 (noarch) * python311-Werkzeug-2.3.6-150400.6.12.1 ## References: * https://www.suse.com/security/cve/CVE-2024-49767.html * https://bugzilla.suse.com/show_bug.cgi?id=1232449 [View Less]

1 0

SUSE-SU-2024:3811-1: moderate: Security update for govulncheck-vulndb
by OPENSUSE-SECURITY-UPDATES 30 Oct '24

30 Oct '24

# Security update for govulncheck-vulndb Announcement ID: SUSE-SU-2024:3811-1 Release Date: 2024-10-30T15:34:13Z Rating: moderate References: * jsc#PED-11136 Affected Products: * openSUSE Leap 15.5 * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Real Time 15 … [View More]SP6 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Package Hub 15 15-SP5 * SUSE Package Hub 15 15-SP6 An update that contains one feature can now be installed. ## Description: This update for govulncheck-vulndb fixes the following issues: * Update to version 0.0.20241028T152002 2024-10-28T15:20:02Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated: * GO-2024-3207 * GO-2024-3208 * GO-2024-3210 * GO-2024-3211 * GO-2024-3212 * GO-2024-3213 * GO-2024-3214 * GO-2024-3215 * GO-2024-3216 * GO-2024-3217 * GO-2024-3219 * GO-2024-3220 * GO-2024-3221 * GO-2024-3222 * GO-2024-3223 * GO-2024-3224 * Update to version 0.0.20241017T153730 date 2024-10-17T15:37:30Z. Go CVE Numbering Authority IDs added or updated: * GO-2024-3189 * GO-2024-3203 * GO-2024-3204 ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-3811=1 * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2024-3811=1 * SUSE Package Hub 15 15-SP5 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2024-3811=1 * SUSE Package Hub 15 15-SP6 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2024-3811=1 ## Package List: * openSUSE Leap 15.5 (noarch) * govulncheck-vulndb-0.0.20241028T152002-150000.1.6.1 * openSUSE Leap 15.6 (noarch) * govulncheck-vulndb-0.0.20241028T152002-150000.1.6.1 * SUSE Package Hub 15 15-SP5 (noarch) * govulncheck-vulndb-0.0.20241028T152002-150000.1.6.1 * SUSE Package Hub 15 15-SP6 (noarch) * govulncheck-vulndb-0.0.20241028T152002-150000.1.6.1 ## References: * https://jira.suse.com/browse/PED-11136 [View Less]

1 0

SUSE-SU-2024:3805-1: important: Security update for the Linux Kernel (Live Patch 22 for SLE 15 SP4)
by OPENSUSE-SECURITY-UPDATES 30 Oct '24

30 Oct '24

# Security update for the Linux Kernel (Live Patch 22 for SLE 15 SP4) Announcement ID: SUSE-SU-2024:3805-1 Release Date: 2024-10-30T13:33:56Z Rating: important References: * bsc#1225011 * bsc#1225012 * bsc#1225309 * bsc#1225311 * bsc#1225819 * bsc#1227471 * bsc#1231353 Cross-References: * CVE-2021-47598 * CVE-2023-52752 * CVE-2024-35862 * CVE-2024-35863 * CVE-2024-35864 * CVE-2024-35867 CVSS scores: * CVE-2021-47598 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/… [View More]PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2021-47598 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-52752 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-52752 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-35862 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-35863 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-35864 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-35867 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise Live Patching 15-SP4 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 An update that solves six vulnerabilities and has one security fix can now be installed. ## Description: This update for the Linux Kernel 5.14.21-150400_24_103 fixes several issues. The following security issues were fixed: * CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1227471). * CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1225011). * CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225819). * CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1225311). * CVE-2024-35867: Fixed potential UAF in cifs_stats_proc_show() (bsc#1225012). * CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1225309). * Intermittent nfs mount failures (may be due to SUNRPC over UDP) (bsc#1231353) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-3805=1 SUSE-2024-3801=1 * SUSE Linux Enterprise Live Patching 15-SP4 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP4-2024-3805=1 SUSE-SLE- Module-Live-Patching-15-SP4-2024-3801=1 ## Package List: * openSUSE Leap 15.4 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150400_24_88-default-debuginfo-15-150400.2.1 * kernel-livepatch-SLE15-SP4_Update_18-debugsource-15-150400.2.1 * kernel-livepatch-5_14_21-150400_24_103-default-11-150400.2.1 * kernel-livepatch-5_14_21-150400_24_88-default-15-150400.2.1 * kernel-livepatch-5_14_21-150400_24_103-default-debuginfo-11-150400.2.1 * kernel-livepatch-SLE15-SP4_Update_22-debugsource-11-150400.2.1 * SUSE Linux Enterprise Live Patching 15-SP4 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150400_24_88-default-debuginfo-15-150400.2.1 * kernel-livepatch-SLE15-SP4_Update_18-debugsource-15-150400.2.1 * kernel-livepatch-5_14_21-150400_24_103-default-11-150400.2.1 * kernel-livepatch-5_14_21-150400_24_88-default-15-150400.2.1 * kernel-livepatch-5_14_21-150400_24_103-default-debuginfo-11-150400.2.1 * kernel-livepatch-SLE15-SP4_Update_22-debugsource-11-150400.2.1 ## References: * https://www.suse.com/security/cve/CVE-2021-47598.html * https://www.suse.com/security/cve/CVE-2023-52752.html * https://www.suse.com/security/cve/CVE-2024-35862.html * https://www.suse.com/security/cve/CVE-2024-35863.html * https://www.suse.com/security/cve/CVE-2024-35864.html * https://www.suse.com/security/cve/CVE-2024-35867.html * https://bugzilla.suse.com/show_bug.cgi?id=1225011 * https://bugzilla.suse.com/show_bug.cgi?id=1225012 * https://bugzilla.suse.com/show_bug.cgi?id=1225309 * https://bugzilla.suse.com/show_bug.cgi?id=1225311 * https://bugzilla.suse.com/show_bug.cgi?id=1225819 * https://bugzilla.suse.com/show_bug.cgi?id=1227471 * https://bugzilla.suse.com/show_bug.cgi?id=1231353 [View Less]

1 0

SUSE-SU-2024:3804-1: important: Security update for the Linux Kernel (Live Patch 39 for SLE 15 SP3)
by OPENSUSE-SECURITY-UPDATES 30 Oct '24

30 Oct '24

# Security update for the Linux Kernel (Live Patch 39 for SLE 15 SP3) Announcement ID: SUSE-SU-2024:3804-1 Release Date: 2024-10-30T13:33:49Z Rating: important References: * bsc#1225309 * bsc#1225311 * bsc#1225819 * bsc#1227471 Cross-References: * CVE-2021-47598 * CVE-2023-52752 * CVE-2024-35862 * CVE-2024-35864 CVSS scores: * CVE-2021-47598 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2021-47598 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:… [View More]N/S:U/C:H/I:H/A:H * CVE-2023-52752 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-52752 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-35862 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-35864 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.3 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise Live Patching 15-SP3 * SUSE Linux Enterprise Micro 5.1 * SUSE Linux Enterprise Micro 5.2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 An update that solves four vulnerabilities can now be installed. ## Description: This update for the Linux Kernel 5.3.18-150300_59_144 fixes several issues. The following security issues were fixed: * CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1227471). * CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225819). * CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1225311). * CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1225309). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.3 zypper in -t patch SUSE-2024-3804=1 * SUSE Linux Enterprise Live Patching 15-SP3 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP3-2024-3804=1 ## Package List: * openSUSE Leap 15.3 (ppc64le s390x x86_64) * kernel-livepatch-5_3_18-150300_59_144-default-debuginfo-13-150300.2.1 * kernel-livepatch-5_3_18-150300_59_144-default-13-150300.2.1 * kernel-livepatch-SLE15-SP3_Update_39-debugsource-13-150300.2.1 * openSUSE Leap 15.3 (x86_64) * kernel-livepatch-5_3_18-150300_59_144-preempt-debuginfo-13-150300.2.1 * kernel-livepatch-5_3_18-150300_59_144-preempt-13-150300.2.1 * SUSE Linux Enterprise Live Patching 15-SP3 (ppc64le s390x x86_64) * kernel-livepatch-5_3_18-150300_59_144-default-13-150300.2.1 ## References: * https://www.suse.com/security/cve/CVE-2021-47598.html * https://www.suse.com/security/cve/CVE-2023-52752.html * https://www.suse.com/security/cve/CVE-2024-35862.html * https://www.suse.com/security/cve/CVE-2024-35864.html * https://bugzilla.suse.com/show_bug.cgi?id=1225309 * https://bugzilla.suse.com/show_bug.cgi?id=1225311 * https://bugzilla.suse.com/show_bug.cgi?id=1225819 * https://bugzilla.suse.com/show_bug.cgi?id=1227471 [View Less]

1 0

Main

Development

Information

Community

Social Media

Other

openSUSE Security Announce