November 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2019:2557-1: important: Security update for java-11-openjdk
by opensuse-security＠opensuse.org 24 Nov '19

24 Nov '19

openSUSE Security Update: Security update for java-11-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2557-1 Rating: important References: #1152856 #1154212 Cross-References: CVE-2019-2894 CVE-2019-2933 CVE-2019-2945 CVE-2019-2949 CVE-2019-2958 CVE-2019-2962 CVE-2019-2964 CVE-2019-2973 CVE-2019-2975 CVE-2019-2977 CVE-2019-2978 CVE-2019-2981 CVE-2019-2983 CVE-2019-2987 CVE-2019-2988 CVE-2019-2989 CVE-2019-2992 CVE-2019-2999 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: This update for java-11-openjdk to version jdk-11.0.5-10 fixes the following issues: Security issues fixed (October 2019 CPU bsc#1154212): - CVE-2019-2933: Windows file handling redux - CVE-2019-2945: Better socket support - CVE-2019-2949: Better Kerberos ccache handling - CVE-2019-2958: Build Better Processes - CVE-2019-2964: Better support for patterns - CVE-2019-2962: Better Glyph Images - CVE-2019-2973: Better pattern compilation - CVE-2019-2975: Unexpected exception in jjs - CVE-2019-2978: Improved handling of jar files - CVE-2019-2977: Improve String index handling - CVE-2019-2981: Better Path supports - CVE-2019-2983: Better serial attributes - CVE-2019-2987: Better rendering of native glyphs - CVE-2019-2988: Better Graphics2D drawing - CVE-2019-2989: Improve TLS connection support - CVE-2019-2992: Enhance font glyph mapping - CVE-2019-2999: Commentary on Javadoc comments - CVE-2019-2894: Enhance ECDSA operations (bsc#1152856). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2557=1 Package List: - openSUSE Leap 15.0 (x86_64): java-11-openjdk-11.0.5.0-lp150.2.28.1 java-11-openjdk-accessibility-11.0.5.0-lp150.2.28.1 java-11-openjdk-accessibility-debuginfo-11.0.5.0-lp150.2.28.1 java-11-openjdk-debuginfo-11.0.5.0-lp150.2.28.1 java-11-openjdk-debugsource-11.0.5.0-lp150.2.28.1 java-11-openjdk-demo-11.0.5.0-lp150.2.28.1 java-11-openjdk-devel-11.0.5.0-lp150.2.28.1 java-11-openjdk-headless-11.0.5.0-lp150.2.28.1 java-11-openjdk-jmods-11.0.5.0-lp150.2.28.1 java-11-openjdk-src-11.0.5.0-lp150.2.28.1 - openSUSE Leap 15.0 (noarch): java-11-openjdk-javadoc-11.0.5.0-lp150.2.28.1 References: https://www.suse.com/security/cve/CVE-2019-2894.html https://www.suse.com/security/cve/CVE-2019-2933.html https://www.suse.com/security/cve/CVE-2019-2945.html https://www.suse.com/security/cve/CVE-2019-2949.html https://www.suse.com/security/cve/CVE-2019-2958.html https://www.suse.com/security/cve/CVE-2019-2962.html https://www.suse.com/security/cve/CVE-2019-2964.html https://www.suse.com/security/cve/CVE-2019-2973.html https://www.suse.com/security/cve/CVE-2019-2975.html https://www.suse.com/security/cve/CVE-2019-2977.html https://www.suse.com/security/cve/CVE-2019-2978.html https://www.suse.com/security/cve/CVE-2019-2981.html https://www.suse.com/security/cve/CVE-2019-2983.html https://www.suse.com/security/cve/CVE-2019-2987.html https://www.suse.com/security/cve/CVE-2019-2988.html https://www.suse.com/security/cve/CVE-2019-2989.html https://www.suse.com/security/cve/CVE-2019-2992.html https://www.suse.com/security/cve/CVE-2019-2999.html https://bugzilla.suse.com/1152856 https://bugzilla.suse.com/1154212

1 0

openSUSE-RU-2019:2548-1: moderate: Recommended update for supportutils
by maintenance＠opensuse.org 23 Nov '19

23 Nov '19

openSUSE Recommended Update: Recommended update for supportutils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2548-1 Rating: moderate References: #1111029 #1127734 #1137336 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for supportutils fixes the following issues: - Removed LPM/DLPAR data for POWER. (bsc#1111029) - Prevent running 'systool -vb memory' by default on systems with 16TB or more. (bsc#1127734) - Added sed and gawk to spec requirements (bsc#1137336) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2548=1 Package List: - openSUSE Leap 15.0 (noarch): supportutils-3.1.4-lp150.4.13.1 References: https://bugzilla.suse.com/1111029 https://bugzilla.suse.com/1127734 https://bugzilla.suse.com/1137336

1 0

openSUSE-SU-2019:2549-1: moderate: Security update for apache2-mod_perl
by opensuse-security＠opensuse.org 23 Nov '19

23 Nov '19

openSUSE Security Update: Security update for apache2-mod_perl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2549-1 Rating: moderate References: #1091625 #1156944 Cross-References: CVE-2011-2767 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for apache2-mod_perl to version 2.0.11 fixes the following issues: Security issue fixed: - CVE-2011-2767: Fixed a vulnerability which could have allowed perl code execution in the context of user account (bsc#1156944). Other issue addressed: - Restore process name after sv_setpv_mg() call. (bsc#1091625) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2549=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2549=1 Package List: - openSUSE Leap 15.1 (x86_64): apache2-mod_perl-2.0.11-lp151.3.3.1 apache2-mod_perl-debuginfo-2.0.11-lp151.3.3.1 apache2-mod_perl-debugsource-2.0.11-lp151.3.3.1 apache2-mod_perl-devel-2.0.11-lp151.3.3.1 - openSUSE Leap 15.0 (x86_64): apache2-mod_perl-2.0.11-lp150.2.3.1 apache2-mod_perl-debuginfo-2.0.11-lp150.2.3.1 apache2-mod_perl-debugsource-2.0.11-lp150.2.3.1 apache2-mod_perl-devel-2.0.11-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2011-2767.html https://bugzilla.suse.com/1091625 https://bugzilla.suse.com/1156944

1 0

openSUSE-SU-2019:2556-1: moderate: Security update for haproxy
by opensuse-security＠opensuse.org 23 Nov '19

23 Nov '19

openSUSE Security Update: Security update for haproxy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2556-1 Rating: moderate References: #1142529 Cross-References: CVE-2019-14241 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for haproxy to version 2.0.5+git0.d905f49a fixes the following issues: Security issue fixed: - CVE-2019-14241: Fixed a cookie memory corruption problem. (bsc#1142529) The update to 2.0.5 brings lots of features and bugfixes: - new internal native HTTP representation called HTX, was already in 1.9 and is now enabled by default in 2.0 - end-to-end HTTP/2 support including trailers and continuation frames, as needed for gRPC ; HTTP/2 may also be upgraded from HTTP/1.1 using the H2 preface; - server connection pooling and more advanced reuse, with ALPN protocol negotiation (already in 1.9) - layer 7 retries, allowing to use 0-RTT and TCP Fast Open to the servers as well as on the frontend - much more scalable multi-threading, which is even enabled by default on platforms where it was successfully tested ; by default, as many threads are started as the number of CPUs haproxy is allowed to run on. This removes a lot of configuration burden in VMs and containers - automatic maxconn setting for the process and the frontends, directly based on the number of available FDs (easier configuration in containers and with systemd) - logging to stdout for use in containers and systemd (already in 1.9). Logs can now provide micro-second resolution for some events - peers now support SSL, declaration of multiple stick-tables directly in the peers section, and synchronization of server names, not just IDs - In master-worker mode, the master process now exposes its own CLI and can communicate with all other processes (including the stopping ones), even allowing to connect to their CLI and check their state. It is also possible to start some sidecar programs and monitor them from the master, and the master can automatically kill old processes that survived too many reloads - the incoming connections are load-balanced between all threads depending on their load to minimize the processing time and maximize the capacity (already in 1.9) - the SPOE connection load-balancing was significantly improved in order to reduce high percentiles of SPOA response time (already in 1.9) - the "random" load balancing algorithm and a power-of-two-choices variant were introduced - statistics improvements with per-thread counters for certain things, and a prometheus exporter for all our statistics; - lots of debugging help, it's easier to produce a core dump, there are new commands on the CLI to control various things, there is a watchdog to fail cleanly when a thread deadlock or a spinning task are detected, so overall it should provide a better experience in field and less round trips between users and developers (hence less stress during an incident). - all 3 device detection engines are now compatible with multi-threading and can be build-tested without any external dependencies - "do-resolve" http-request action to perform a DNS resolution on any, sample, and resolvers now support relying on /etc/resolv.conf to match the local resolver - log sampling and balancing : it's now possible to send 1 log every 10 to a server, or to spread the logging load over multiple log servers; - a new SPOA agent (spoa_server) allows to interface haproxy with Python and Lua programs - support for Solaris' event ports (equivalent of kqueue or epoll) which will significantly improve the performance there when dealing with numerous connections - some warnings are now reported for some deprecated options that will be removed in 2.1. Since 2.0 is long term supported, there's no emergency to convert them, however if you see these warnings, you need to understand that you're among their extremely rare users and just because of this you may be taking risks by keeping them - A new SOCKS4 server-side layer was provided ; it allows outgoing connections to be forwarded through a SOCKS4 proxy (such as ssh -D). - priority- and latency- aware server queues : it is possible now to assign priorities to certain requests and/or to give them a time bonus or penalty to refine control of the traffic and be able to engage on SLAs. - internally the architecture was significantly redesigned to allow to further improve performance and make it easier to implement protocols that span over multiple layers (such as QUIC). This work started in 1.9 and will continue with 2.1. - the I/O, applets and tasks now share the same multi-threaded scheduler, giving a much better responsiveness and fairness between all tasks as is visible with the CLI which always responds instantly even under extreme loads (started in 1.9) - the internal buffers were redesigned to ease zero-copy operations, so that it is possible to sustain a high bandwidth even when forwarding HTTP/1 to/from HTTP/2 (already in 1.9) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2556=1 Package List: - openSUSE Leap 15.1 (x86_64): haproxy-2.0.5+git0.d905f49a-lp151.2.3.1 haproxy-debuginfo-2.0.5+git0.d905f49a-lp151.2.3.1 haproxy-debugsource-2.0.5+git0.d905f49a-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-14241.html https://bugzilla.suse.com/1142529

1 0

openSUSE-SU-2019:2550-1: moderate: Security update for ncurses
by opensuse-security＠opensuse.org 23 Nov '19

23 Nov '19

openSUSE Security Update: Security update for ncurses ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2550-1 Rating: moderate References: #1103320 #1154036 #1154037 Cross-References: CVE-2019-17594 CVE-2019-17595 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for ncurses fixes the following issues: Security issues fixed: - CVE-2019-17594: Fixed a heap-based buffer over-read in the _nc_find_entry function (bsc#1154036). - CVE-2019-17595: Fixed a heap-based buffer over-read in the fmt_entry function (bsc#1154037). Non-security issue fixed: - Removed screen.xterm from terminfo database (bsc#1103320). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2550=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libncurses5-6.1-lp150.9.1 libncurses5-debuginfo-6.1-lp150.9.1 libncurses6-6.1-lp150.9.1 libncurses6-debuginfo-6.1-lp150.9.1 ncurses-debugsource-6.1-lp150.9.1 ncurses-devel-6.1-lp150.9.1 ncurses-devel-debuginfo-6.1-lp150.9.1 ncurses-utils-6.1-lp150.9.1 ncurses-utils-debuginfo-6.1-lp150.9.1 ncurses5-devel-6.1-lp150.9.1 tack-6.1-lp150.9.1 tack-debuginfo-6.1-lp150.9.1 terminfo-6.1-lp150.9.1 terminfo-base-6.1-lp150.9.1 terminfo-iterm-6.1-lp150.9.1 terminfo-screen-6.1-lp150.9.1 - openSUSE Leap 15.0 (x86_64): libncurses5-32bit-6.1-lp150.9.1 libncurses5-32bit-debuginfo-6.1-lp150.9.1 libncurses6-32bit-6.1-lp150.9.1 libncurses6-32bit-debuginfo-6.1-lp150.9.1 ncurses-devel-32bit-6.1-lp150.9.1 ncurses-devel-32bit-debuginfo-6.1-lp150.9.1 ncurses5-devel-32bit-6.1-lp150.9.1 References: https://www.suse.com/security/cve/CVE-2019-17594.html https://www.suse.com/security/cve/CVE-2019-17595.html https://bugzilla.suse.com/1103320 https://bugzilla.suse.com/1154036 https://bugzilla.suse.com/1154037

1 0

openSUSE-RU-2019:2553-1: moderate: Recommended update for supportutils
by maintenance＠opensuse.org 23 Nov '19

23 Nov '19

openSUSE Recommended Update: Recommended update for supportutils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2553-1 Rating: moderate References: #1111029 #1127734 #1137336 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for supportutils fixes the following issues: - Removed LPM/DLPAR data for POWER. (bsc#1111029) - Prevent running 'systool -vb memory' by default on systems with 16TB or more. (bsc#1127734) - Added sed and gawk to spec requirements (bsc#1137336) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2553=1 Package List: - openSUSE Leap 15.1 (noarch): supportutils-3.1.4-lp151.2.6.1 References: https://bugzilla.suse.com/1111029 https://bugzilla.suse.com/1127734 https://bugzilla.suse.com/1137336

1 0

openSUSE-RU-2019:2552-1: important: Recommended update for qemu
by maintenance＠opensuse.org 23 Nov '19

23 Nov '19

openSUSE Recommended Update: Recommended update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2552-1 Rating: important References: #1156642 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for qemu fixes the following issues: - Fix recently introduced migration incompatibility, due to including a kernel header change which impacts qemu's expectations of the size of the virtio-balloon device config size. (bsc#1156642) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2552=1 Package List: - openSUSE Leap 15.1 (x86_64): qemu-3.1.1.1-lp151.7.9.1 qemu-arm-3.1.1.1-lp151.7.9.1 qemu-arm-debuginfo-3.1.1.1-lp151.7.9.1 qemu-audio-alsa-3.1.1.1-lp151.7.9.1 qemu-audio-alsa-debuginfo-3.1.1.1-lp151.7.9.1 qemu-audio-oss-3.1.1.1-lp151.7.9.1 qemu-audio-oss-debuginfo-3.1.1.1-lp151.7.9.1 qemu-audio-pa-3.1.1.1-lp151.7.9.1 qemu-audio-pa-debuginfo-3.1.1.1-lp151.7.9.1 qemu-audio-sdl-3.1.1.1-lp151.7.9.1 qemu-audio-sdl-debuginfo-3.1.1.1-lp151.7.9.1 qemu-block-curl-3.1.1.1-lp151.7.9.1 qemu-block-curl-debuginfo-3.1.1.1-lp151.7.9.1 qemu-block-dmg-3.1.1.1-lp151.7.9.1 qemu-block-dmg-debuginfo-3.1.1.1-lp151.7.9.1 qemu-block-gluster-3.1.1.1-lp151.7.9.1 qemu-block-gluster-debuginfo-3.1.1.1-lp151.7.9.1 qemu-block-iscsi-3.1.1.1-lp151.7.9.1 qemu-block-iscsi-debuginfo-3.1.1.1-lp151.7.9.1 qemu-block-nfs-3.1.1.1-lp151.7.9.1 qemu-block-nfs-debuginfo-3.1.1.1-lp151.7.9.1 qemu-block-rbd-3.1.1.1-lp151.7.9.1 qemu-block-rbd-debuginfo-3.1.1.1-lp151.7.9.1 qemu-block-ssh-3.1.1.1-lp151.7.9.1 qemu-block-ssh-debuginfo-3.1.1.1-lp151.7.9.1 qemu-debuginfo-3.1.1.1-lp151.7.9.1 qemu-debugsource-3.1.1.1-lp151.7.9.1 qemu-extra-3.1.1.1-lp151.7.9.1 qemu-extra-debuginfo-3.1.1.1-lp151.7.9.1 qemu-guest-agent-3.1.1.1-lp151.7.9.1 qemu-guest-agent-debuginfo-3.1.1.1-lp151.7.9.1 qemu-ksm-3.1.1.1-lp151.7.9.1 qemu-kvm-3.1.1.1-lp151.7.9.1 qemu-lang-3.1.1.1-lp151.7.9.1 qemu-linux-user-3.1.1.1-lp151.7.9.1 qemu-linux-user-debuginfo-3.1.1.1-lp151.7.9.1 qemu-linux-user-debugsource-3.1.1.1-lp151.7.9.1 qemu-ppc-3.1.1.1-lp151.7.9.1 qemu-ppc-debuginfo-3.1.1.1-lp151.7.9.1 qemu-s390-3.1.1.1-lp151.7.9.1 qemu-s390-debuginfo-3.1.1.1-lp151.7.9.1 qemu-tools-3.1.1.1-lp151.7.9.1 qemu-tools-debuginfo-3.1.1.1-lp151.7.9.1 qemu-ui-curses-3.1.1.1-lp151.7.9.1 qemu-ui-curses-debuginfo-3.1.1.1-lp151.7.9.1 qemu-ui-gtk-3.1.1.1-lp151.7.9.1 qemu-ui-gtk-debuginfo-3.1.1.1-lp151.7.9.1 qemu-ui-sdl-3.1.1.1-lp151.7.9.1 qemu-ui-sdl-debuginfo-3.1.1.1-lp151.7.9.1 qemu-x86-3.1.1.1-lp151.7.9.1 qemu-x86-debuginfo-3.1.1.1-lp151.7.9.1 - openSUSE Leap 15.1 (noarch): qemu-ipxe-1.0.0+-lp151.7.9.1 qemu-seabios-1.12.0-lp151.7.9.1 qemu-sgabios-8-lp151.7.9.1 qemu-vgabios-1.12.0-lp151.7.9.1 References: https://bugzilla.suse.com/1156642

1 0

openSUSE-RU-2019:2554-1: moderate: Recommended update for tftp
by maintenance＠opensuse.org 23 Nov '19

23 Nov '19

openSUSE Recommended Update: Recommended update for tftp ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2554-1 Rating: moderate References: #1153625 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for tftp fixes the following issues: - Add tftp.socket requirement to the service unit section. (bsc#1153625) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2554=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): tftp-5.2-lp151.5.3.1 tftp-debuginfo-5.2-lp151.5.3.1 tftp-debugsource-5.2-lp151.5.3.1 References: https://bugzilla.suse.com/1153625

1 0

openSUSE-SU-2019:2555-1: moderate: Security update for haproxy
by opensuse-security＠opensuse.org 23 Nov '19

23 Nov '19

openSUSE Security Update: Security update for haproxy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2555-1 Rating: moderate References: #1142529 Cross-References: CVE-2019-14241 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for haproxy to version 2.0.5+git0.d905f49a fixes the following issues: Security issue fixed: - CVE-2019-14241: Fixed a cookie memory corruption problem. (bsc#1142529) The update to 2.0.5 brings lots of features and bugfixes: - new internal native HTTP representation called HTX, was already in 1.9 and is now enabled by default in 2.0 - end-to-end HTTP/2 support including trailers and continuation frames, as needed for gRPC ; HTTP/2 may also be upgraded from HTTP/1.1 using the H2 preface; - server connection pooling and more advanced reuse, with ALPN protocol negotiation (already in 1.9) - layer 7 retries, allowing to use 0-RTT and TCP Fast Open to the servers as well as on the frontend - much more scalable multi-threading, which is even enabled by default on platforms where it was successfully tested ; by default, as many threads are started as the number of CPUs haproxy is allowed to run on. This removes a lot of configuration burden in VMs and containers - automatic maxconn setting for the process and the frontends, directly based on the number of available FDs (easier configuration in containers and with systemd) - logging to stdout for use in containers and systemd (already in 1.9). Logs can now provide micro-second resolution for some events - peers now support SSL, declaration of multiple stick-tables directly in the peers section, and synchronization of server names, not just IDs - In master-worker mode, the master process now exposes its own CLI and can communicate with all other processes (including the stopping ones), even allowing to connect to their CLI and check their state. It is also possible to start some sidecar programs and monitor them from the master, and the master can automatically kill old processes that survived too many reloads - the incoming connections are load-balanced between all threads depending on their load to minimize the processing time and maximize the capacity (already in 1.9) - the SPOE connection load-balancing was significantly improved in order to reduce high percentiles of SPOA response time (already in 1.9) - the "random" load balancing algorithm and a power-of-two-choices variant were introduced - statistics improvements with per-thread counters for certain things, and a prometheus exporter for all our statistics; - lots of debugging help, it's easier to produce a core dump, there are new commands on the CLI to control various things, there is a watchdog to fail cleanly when a thread deadlock or a spinning task are detected, so overall it should provide a better experience in field and less round trips between users and developers (hence less stress during an incident). - all 3 device detection engines are now compatible with multi-threading and can be build-tested without any external dependencies - "do-resolve" http-request action to perform a DNS resolution on any, sample, and resolvers now support relying on /etc/resolv.conf to match the local resolver - log sampling and balancing : it's now possible to send 1 log every 10 to a server, or to spread the logging load over multiple log servers; - a new SPOA agent (spoa_server) allows to interface haproxy with Python and Lua programs - support for Solaris' event ports (equivalent of kqueue or epoll) which will significantly improve the performance there when dealing with numerous connections - some warnings are now reported for some deprecated options that will be removed in 2.1. Since 2.0 is long term supported, there's no emergency to convert them, however if you see these warnings, you need to understand that you're among their extremely rare users and just because of this you may be taking risks by keeping them - A new SOCKS4 server-side layer was provided ; it allows outgoing connections to be forwarded through a SOCKS4 proxy (such as ssh -D). - priority- and latency- aware server queues : it is possible now to assign priorities to certain requests and/or to give them a time bonus or penalty to refine control of the traffic and be able to engage on SLAs. - internally the architecture was significantly redesigned to allow to further improve performance and make it easier to implement protocols that span over multiple layers (such as QUIC). This work started in 1.9 and will continue with 2.1. - the I/O, applets and tasks now share the same multi-threaded scheduler, giving a much better responsiveness and fairness between all tasks as is visible with the CLI which always responds instantly even under extreme loads (started in 1.9) - the internal buffers were redesigned to ease zero-copy operations, so that it is possible to sustain a high bandwidth even when forwarding HTTP/1 to/from HTTP/2 (already in 1.9) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2555=1 Package List: - openSUSE Leap 15.0 (x86_64): haproxy-2.0.5+git0.d905f49a-lp150.2.13.1 haproxy-debuginfo-2.0.5+git0.d905f49a-lp150.2.13.1 haproxy-debugsource-2.0.5+git0.d905f49a-lp150.2.13.1 References: https://www.suse.com/security/cve/CVE-2019-14241.html https://bugzilla.suse.com/1142529

1 0

openSUSE-SU-2019:2551-1: moderate: Security update for ncurses
by opensuse-security＠opensuse.org 23 Nov '19

23 Nov '19

openSUSE Security Update: Security update for ncurses ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2551-1 Rating: moderate References: #1103320 #1154036 #1154037 Cross-References: CVE-2019-17594 CVE-2019-17595 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for ncurses fixes the following issues: Security issues fixed: - CVE-2019-17594: Fixed a heap-based buffer over-read in the _nc_find_entry function (bsc#1154036). - CVE-2019-17595: Fixed a heap-based buffer over-read in the fmt_entry function (bsc#1154037). Non-security issue fixed: - Removed screen.xterm from terminfo database (bsc#1103320). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2551=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libncurses5-6.1-lp151.6.3.1 libncurses5-debuginfo-6.1-lp151.6.3.1 libncurses6-6.1-lp151.6.3.1 libncurses6-debuginfo-6.1-lp151.6.3.1 ncurses-debugsource-6.1-lp151.6.3.1 ncurses-devel-6.1-lp151.6.3.1 ncurses-devel-debuginfo-6.1-lp151.6.3.1 ncurses-utils-6.1-lp151.6.3.1 ncurses-utils-debuginfo-6.1-lp151.6.3.1 ncurses5-devel-6.1-lp151.6.3.1 tack-6.1-lp151.6.3.1 tack-debuginfo-6.1-lp151.6.3.1 terminfo-6.1-lp151.6.3.1 terminfo-base-6.1-lp151.6.3.1 terminfo-iterm-6.1-lp151.6.3.1 terminfo-screen-6.1-lp151.6.3.1 - openSUSE Leap 15.1 (x86_64): libncurses5-32bit-6.1-lp151.6.3.1 libncurses5-32bit-debuginfo-6.1-lp151.6.3.1 libncurses6-32bit-6.1-lp151.6.3.1 libncurses6-32bit-debuginfo-6.1-lp151.6.3.1 ncurses-devel-32bit-6.1-lp151.6.3.1 ncurses-devel-32bit-debuginfo-6.1-lp151.6.3.1 ncurses5-devel-32bit-6.1-lp151.6.3.1 References: https://www.suse.com/security/cve/CVE-2019-17594.html https://www.suse.com/security/cve/CVE-2019-17595.html https://bugzilla.suse.com/1103320 https://bugzilla.suse.com/1154036 https://bugzilla.suse.com/1154037

1 0