October 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2018:3520-1: moderate: Recommended update for timezone, timezone-java
by maintenance＠opensuse.org 26 Oct '18

26 Oct '18

openSUSE Recommended Update: Recommended update for timezone, timezone-java ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3520-1 Rating: moderate References: #1104700 #1112310 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for timezone, timezone-java fixes the following issues: The timezone database was updated to 2018f: - Volgograd moves from +03 to +04 on 2018-10-28. - Fiji ends DST 2019-01-13, not 2019-01-20. - Most of Chile changes DST dates, effective 2019-04-06 (bsc#1104700) - Corrections to past timestamps of DST transitions - Use "PST" and "PDT" for Philippine time - minor code changes to zic handling of the TZif format - documentation updates Other bugfixes: - Fixed a zic problem with the 1948-1951 DST transition in Japan (bsc#1112310) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1298=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): timezone-2018f-lp150.2.9.1 timezone-debuginfo-2018f-lp150.2.9.1 timezone-debugsource-2018f-lp150.2.9.1 - openSUSE Leap 15.0 (noarch): timezone-java-2018f-lp150.2.9.1 References: https://bugzilla.suse.com/1104700 https://bugzilla.suse.com/1112310

1 0

openSUSE-SU-2018:3519-1: moderate: Security update for libgit2
by opensuse-security＠opensuse.org 26 Oct '18

26 Oct '18

openSUSE Security Update: Security update for libgit2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3519-1 Rating: moderate References: #1085256 #1095219 #1100612 #1100613 #1104641 Cross-References: CVE-2018-10887 CVE-2018-10888 CVE-2018-11235 CVE-2018-15501 CVE-2018-8099 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for libgit2 fixes the following issues: - CVE-2018-8099: Fixed possible denial of service attack via different vectors by not being able to differentiate between these status codes (bsc#1085256). - CVE-2018-11235: With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server. (bsc#1095219) - CVE-2018-10887: It has been discovered that an unexpected sign extension in git_delta_apply function in delta.c file may have lead to an integer overflow which in turn leads to an out of bound read, allowing to read before the base object. An attacker could have used this flaw to leak memory addresses or cause a Denial of Service. (bsc#1100613) - CVE-2018-10888: A missing check in git_delta_apply function in delta.c file, may lead to an out-of-bound read while reading a binary delta file. An attacker may use this flaw to cause a Denial of Service. (bsc#1100612) - CVE-2018-15501: A remote attacker can send a crafted smart-protocol "ng" packet that lacks a '\0' byte to trigger an out-of-bounds read that leads to DoS. (bsc#1104641) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1314=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libgit2-24-0.24.1-10.3.1 libgit2-24-debuginfo-0.24.1-10.3.1 libgit2-debugsource-0.24.1-10.3.1 libgit2-devel-0.24.1-10.3.1 - openSUSE Leap 42.3 (x86_64): libgit2-24-32bit-0.24.1-10.3.1 libgit2-24-debuginfo-32bit-0.24.1-10.3.1 References: https://www.suse.com/security/cve/CVE-2018-10887.html https://www.suse.com/security/cve/CVE-2018-10888.html https://www.suse.com/security/cve/CVE-2018-11235.html https://www.suse.com/security/cve/CVE-2018-15501.html https://www.suse.com/security/cve/CVE-2018-8099.html https://bugzilla.suse.com/1085256 https://bugzilla.suse.com/1095219 https://bugzilla.suse.com/1100612 https://bugzilla.suse.com/1100613 https://bugzilla.suse.com/1104641

1 0

openSUSE-RU-2018:3518-1: Recommended update for Regina-REXX, THE, ooRexx
by maintenance＠opensuse.org 26 Oct '18

26 Oct '18

openSUSE Recommended Update: Recommended update for Regina-REXX, THE, ooRexx ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3518-1 Rating: low References: #1012847 #1017668 #1083875 #985384 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for Regina-REXX, THE, ooRexx fixes the following issues: * Allow alternative Rexx (ooRexx and Regina-REXX) implementations to be installed in parallel (boo#1083875) * Do not ship any preset file in ooRexx (boo#1012847) * Leftower process running at end of build of ooRexx (boo#1017668) * Fix building of ooRexx gcc6 and later (boo#985384) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-1294=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le x86_64): Regina-REXX-3.9.1-5.2 Regina-REXX-devel-3.9.1-5.2 Regina-REXX-doc-3.9.1-5.2 libregina3-3.9.1-5.2 - SUSE Package Hub for SUSE Linux Enterprise 12 (s390x): Regina-REXX-3.9.1-5.1 Regina-REXX-devel-3.9.1-5.1 Regina-REXX-doc-3.9.1-5.1 libregina3-3.9.1-5.1 References: https://bugzilla.suse.com/1012847 https://bugzilla.suse.com/1017668 https://bugzilla.suse.com/1083875 https://bugzilla.suse.com/985384

1 0

openSUSE-SU-2018:3517-1: moderate: Security update for mercurial
by opensuse-security＠opensuse.org 26 Oct '18

26 Oct '18

openSUSE Security Update: Security update for mercurial ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3517-1 Rating: moderate References: #1110899 Cross-References: CVE-2018-17983 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mercurial fixes the following issues: - CVE-2018-17983: Fix an out-of-bounds read during parsing of a malformed manifest entry (bsc#1110899). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1297=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): mercurial-4.5.2-lp150.2.6.1 mercurial-debuginfo-4.5.2-lp150.2.6.1 mercurial-debugsource-4.5.2-lp150.2.6.1 - openSUSE Leap 15.0 (noarch): mercurial-lang-4.5.2-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-17983.html https://bugzilla.suse.com/1110899

1 0

openSUSE-RU-2018:3516-1: moderate: Recommended update for python-pyOpenSSL
by maintenance＠opensuse.org 26 Oct '18

26 Oct '18

openSUSE Recommended Update: Recommended update for python-pyOpenSSL ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3516-1 Rating: moderate References: #1110435 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-pyOpenSSL fixes the following issues: - Handle duplicate certificate addition using X509_STORE_add_cert so it works after upgrading to openssl 1.1.1. (bsc#1110435) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1311=1 Package List: - openSUSE Leap 15.0 (noarch): python-pyOpenSSL-doc-17.5.0-lp150.2.3.1 python2-pyOpenSSL-17.5.0-lp150.2.3.1 python3-pyOpenSSL-17.5.0-lp150.2.3.1 References: https://bugzilla.suse.com/1110435

1 0

openSUSE-RU-2018:3515-1: Recommended update for yast2-core
by maintenance＠opensuse.org 26 Oct '18

26 Oct '18

openSUSE Recommended Update: Recommended update for yast2-core ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3515-1 Rating: low References: #1103076 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-core fixes the following issues: - Reduced risk of race condition between getenv and setenv while logging (bsc#1103076) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1295=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): yast2-core-3.2.3-7.3.1 yast2-core-debuginfo-3.2.3-7.3.1 yast2-core-debugsource-3.2.3-7.3.1 yast2-core-devel-3.2.3-7.3.1 References: https://bugzilla.suse.com/1103076

1 0

openSUSE-RU-2018:3514-1: moderate: Recommended update for a2ps
by maintenance＠opensuse.org 26 Oct '18

26 Oct '18

openSUSE Recommended Update: Recommended update for a2ps ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3514-1 Rating: moderate References: #1112014 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for a2ps fixes the following issues: - Make a2ps handle inode numbers larger than 32bit (bsc#1112014) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1299=1 Package List: - openSUSE Leap 42.3 (x86_64): a2ps-4.14-5.3.1 a2ps-debuginfo-4.14-5.3.1 a2ps-debugsource-4.14-5.3.1 a2ps-devel-4.14-5.3.1 References: https://bugzilla.suse.com/1112014

1 0

openSUSE-RU-2018:3513-1: moderate: Recommended update for python-msrestazure and it's dependencies
by maintenance＠opensuse.org 26 Oct '18

26 Oct '18

openSUSE Recommended Update: Recommended update for python-msrestazure and it's dependencies ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3513-1 Rating: moderate References: #1109694 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-adal, python-isodate, python-msrest, python-msrestazure fixes the following issues: python-msrestazure: - Update to version 0.5.0 + Features * Implementation is now using ADAL and not request-oauthlib. This allows more AD scenarios (like federated). * Add additionalInfo parsing for CloudError. * Implement new LRO options of Autorest. * Improve MSI for VM token polling algorithm. * MSIAuthentication now uses IMDS endpoint if available. * MSIAuthentication can be used in any environment that defines MSI_ENDPOINT env variable. * CloudError now includes the "innererror" attribute to match OData v4. * Introduces ARMPolling implementation of Azure Resource Management LRO. * Add support for WebApp/Functions in MSIAuthentication classes. * Add parse_resource_id(), resource_id(), validate_resource_id() to parse ARM ids. * Retry strategy now n reach 24 seconds (instead of 12 seconds). * Add Managed Service Integrated (MSI) authentication. * Add "timeout" to ServicePrincipalCredentials and UserPasswordCredentials. * Threads created by AzureOperationPoller have now a name prefixed by "AzureOperationPoller" to help identify them. * Improve MSIAuthentication to support User Assigned Identity. + Bugfixes * MSIAuthentication regression for KeyVault since IMDS support. * MSIAuthentication should initialize the token attribute on creation. * Fixes refreshToken in UserPassCredentials and AADTokenCredentials. * Fix US government cloud definition. * Reduce max MSI polling time for VM. * IMDS/MSI: Retry on more error codes. * IMDS/MSI: Fix a boundary case on timeout. * Fix parse_resource_id() tool to be case*insensitive to keywords when matching. * Add missing baseclass init call for AdalAuthentication. * Fix LRO result if POST uses AsyncOperation header. * Remove a possible infinite loop with MSIAuthentication. * Fix session obj for cloudmetadata endpoint. * Fix authentication resource node for AzureSatck. * Better detection of AppService with MSIAuthentication. * get_cloud_from_metadata_endpoint incorrect on AzureStack. * get_cloud_from_metadata_endpoint certificate issue. * Fix AttributeError if error JSON from ARM does not follow ODatav4 (as it should). * Fix AttributeError if input JSON is not a dict. * Fix AdalError handling in some scenarios. * Update Azure Gov login endpoint. * Update metadata ARM endpoint parser. + Incompatible changes * Remove unused auth_uri, state, client and token_uri attributes in ServicePrincipalCredentials, UserPassCredentials and AADTokenCredentials. * Remove token caching based on "keyring". Token caching should be implemented using ADAL now. * Remove InteractiveCredentials. This class was deprecated and unusable. Use ADAL device code instead. python-msrest - Update to version 0.5.0 + Require python-enum32 and python-typing. + Features * Support additionalProperties and XML. * Deserialize/from_dict now accepts a content*type parameter to parse XML strings. * Add XML support * Add many type hints, and MyPY testing on CI. * HTTP calls are made through a HTTPDriver API. Only implementation is `requests` for now. This driver API is *not* considered stable and you should pin your msrest version if you want to provide a personal implementation. * msrest is now able to keep the "requests.Session" alive for performance. * All Authentication classes now define `signed_session` and `refresh_session` with an optional `session` parameter. * Disable HTTP log by default (security), add `enable_http_log` to restore it. * Add TopicCredentials for EventGrid client. * Add LROPoller class. This is a customizable LRO engine. * Model now accept kwargs in constructor for future kwargs models. * Add support for additional_properties. * The interpretation of Swagger 2.0 "discriminator" is now lenient. * Add ApiKeyCredentials class. This can be used to support OpenAPI ApiKey feature. * Add CognitiveServicesAuthentication class. Pre*declared ApiKeyCredentials class for Cognitive Services. * Add Configuration.session_configuration_callback to customize the requests.Session if necessary. * Add a flag to Serializer to disable client*side*validation. * Remove "import requests" from "exceptions.py" for apps that require fast loading time. * Input is now more lenient. * Model have a "validate" method to check content constraints. * Model have now new methods for serialize, as_dict, deserialize and from_dict. + Bugfixes * Fix a serialization issue if additional_properties is declared, and "automatic model" syntax is used ("automatic model" being the ability to pass a dict to command and have the model auto*created). * Better parse empty node and not string types. * Improve "object" XML parsing. * Fix some XML serialization subtle scenarios. * Fix some complex XML Swagger definitions. * Lower Accept header overwrite logging message. * Fix 'object' type and XML format. * Incorrect milliseconds serialization for some datetime object. * Improve `SDKClient.__exit__` to take exc_details as optional parameters and not required. * Refresh_session should also use the permanent HTTP session if available. * Fix incorrect date parsing if ms precision is over 6 digits. * Fix minimal dependency of isodate. * Fix serialisation from dict if datetime provided. * Date parsing is now compliant with Autorest / Swagger 2.0 specification (less lenient). * Accept to deserialize enum of different type if content string match. * Stop failing on deserialization if enum string is unkwon. Return the string instead. * Do not validate additional_properties. * Improve validation error if expected type is dict, but actual type is not. * Fix additional_properties if Swagger was flatten. * Optional formdata parameters were raising an exception. * "application/x*www*form*urlencoded" form was sent using "multipart/form*data". * Fix regression: accept "set<str>" as a valid "[str]" * Always log response body. * Improved exception message if error JSON is Odata v4. * Refuse "str" as a valid "[str]" type. * Better exception handling if input from server is not JSON valid. * Fix regression introduced in msrest 0.4.12 * dict syntax with enum modeled as string and enum used. * Fix regression introduced in msrest 0.4.12 * dict syntax using isodate.Duration. * Better Enum checking. + Internal optimisation * Call that does not return a streamable object are now executed in requests stream mode False (was True whatever the type of the call). This should reduce the number of leaked opened session and allow urllib3 to manage connection pooling more efficiently. Only clients generated with Autorest.Python >= 2.1.31 (not impacted otherwise, fully backward compatible) + Deprecation * Trigger DeprecationWarning for _client.add_header and _client.send_formdata. python-adal - Update to version 1.0.2 python-isodate - Update to version 0.6.0 + Support incomplete month date. + Rely on duck typing when doing duration maths. + Support ':' as separator in fractional time zones. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1315=1 Package List: - openSUSE Leap 15.0 (noarch): python2-adal-1.0.2-lp150.3.3.1 python2-isodate-0.6.0-lp150.2.3.1 python2-msrest-0.5.5-lp150.3.3.1 python2-msrestazure-0.5.0-lp150.3.3.1 python3-adal-1.0.2-lp150.3.3.1 python3-isodate-0.6.0-lp150.2.3.1 python3-msrest-0.5.5-lp150.3.3.1 python3-msrestazure-0.5.0-lp150.3.3.1 References: https://bugzilla.suse.com/1109694

1 0

openSUSE-RU-2018:3512-1: moderate: Recommended update for libyui-qt-pkg
by maintenance＠opensuse.org 26 Oct '18

26 Oct '18

openSUSE Recommended Update: Recommended update for libyui-qt-pkg ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3512-1 Rating: moderate References: #991090 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libyui-qt-pkg provides the following fixes: - Do not display "out of disk space" error at start when such a large disk (bigger than 8EiB) is present in the system. (bsc#991090) - Fix displaying negative disk sizes in the disk usage dialog. (bsc#991090) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1309=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libyui-qt-pkg-debugsource-2.45.13.1-2.3.1 libyui-qt-pkg-devel-2.45.13.1-2.3.1 libyui-qt-pkg7-2.45.13.1-2.3.1 libyui-qt-pkg7-debuginfo-2.45.13.1-2.3.1 - openSUSE Leap 42.3 (noarch): libyui-qt-pkg-doc-2.45.13.1-2.3.1 References: https://bugzilla.suse.com/991090

1 0

openSUSE-RU-2018:3511-1: Recommended update for rsync
by maintenance＠opensuse.org 26 Oct '18

26 Oct '18

openSUSE Recommended Update: Recommended update for rsync ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3511-1 Rating: low References: #1083017 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for rsync provides the following fix: - Do not send useless keepalive messages to sender if the file list is still being sent. This may cause a crash in older versions of rsync. (bsc#1083017) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1296=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): rsync-3.1.0-16.1 rsync-debuginfo-3.1.0-16.1 rsync-debugsource-3.1.0-16.1 References: https://bugzilla.suse.com/1083017

1 0