February 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2019:0171-1: Security update for uriparser
by opensuse-security＠opensuse.org 13 Feb '19

13 Feb '19

openSUSE Security Update: Security update for uriparser ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0171-1 Rating: low References: #1115722 #1115723 #1115724 #1122193 Cross-References: CVE-2018-19198 CVE-2018-19199 CVE-2018-19200 CVE-2018-20721 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for uriparser fixes the following issues: Security issues fixed: - CVE-2018-20721: Fixed an out-of-bounds read for incomplete URIs with IPv6 addresses with embedded IPv4 address (bsc#1122193). - CVE-2018-19198: Fixed an out-of-bounds write that was possible via the uriComposeQuery* or uriComposeQueryEx* function (bsc#1115722). - CVE-2018-19199: Fixed an integer overflow caused by an unchecked multiplication via the uriComposeQuery* or uriComposeQueryEx* function (bsc#1115723). - CVE-2018-19200: Fixed a operation attempted on NULL input via a uriResetUri* function (bsc#1115724). This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-171=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): liburiparser1-0.8.5-bp150.2.3.1 uriparser-0.8.5-bp150.2.3.1 uriparser-devel-0.8.5-bp150.2.3.1 - openSUSE Backports SLE-15 (aarch64_ilp32): liburiparser1-64bit-0.8.5-bp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-19198.html https://www.suse.com/security/cve/CVE-2018-19199.html https://www.suse.com/security/cve/CVE-2018-19200.html https://www.suse.com/security/cve/CVE-2018-20721.html https://bugzilla.suse.com/1115722 https://bugzilla.suse.com/1115723 https://bugzilla.suse.com/1115724 https://bugzilla.suse.com/1122193

1 0

openSUSE-RU-2019:0172-1: moderate: Recommended update for Certbot Python modules
by maintenance＠opensuse.org 13 Feb '19

13 Feb '19

openSUSE Recommended Update: Recommended update for Certbot Python modules ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0172-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for various CertBot modules fixes the following issues: python-acme was updated to 0.30.2: * Remove josepy helpers that are no longer needed * WIP External Account Binding (#6059) * Implement POST-as-GET requests (#6522) * ignore erroneously no-member lint error * Revert acme/acme/client.py * Bump version to 0.29.0 * remove unused six imports * Remove module-level ignore::ResourceWarnings * bring requests back down to 2.4.1 in setup and oldest constraints * Requests no longer vendorizes urllib3 * Use a newer version of requests because of the upcoming Callable import Deprecation in Python 3.8 that warns in Python 3.7 * Cover is run on 2.7, so mark 3-only lines as no cover * Ignore ResourceWarnings in various modules in a 2-compatible way. * ignore ResourceWarnings in acme tests * s/assertEquals/assertEqual * Use the ACMEv2 newNonce endpoint when a new nonce is needed, and newNonce is available in the directory. * Warn when using deprecated acme.challenges.TLSSNI01 * acme client now raises an error when you try to create an ACME account with a key that has already been used * you can now call query_registration without having to first call new_account python-certbot was updated to 0.30.2: * Update the version of setuptools pinned in certbot-auto to 40.6.3 to solve installation problems on newer OSes. * Always download the pinned version of pip in pipstrap to address breakages * Rename old,default.conf to old-and-default.conf to address commas in filenames breaking recent versions of pip. * Add VIRTUALENV_NO_DOWNLOAD=1 to all calls to virtualenv to address breakages from venv downloading the latest pip * Added the `update_account` subcommand for account management commands. * The default work and log directories have been changed back to /var/lib/letsencrypt and /var/log/letsencrypt respectively. * Noninteractive renewals with `certbot renew` (those not started from a terminal) now randomly sleep 1-480 seconds before beginning work in order to spread out load spikes on the server side. * Added External Account Binding support in cli and acme library. Command line arguments --eab-kid and --eab-hmac-key added. * Private key permissioning changes: Renewal preserves existing group mode & gid of previous private key material. Private keys for new lineages (i.e. new certs, not renewed) default to 0o600. * Update code and dependencies to clean up Resource and Deprecation Warnings. * Only depend on imgconverter extension for Sphinx >= 1.6 * revoke accepts --cert-name, and doesn't accept both --cert-name and --cert-path * Do not conflict with Certbot as now we provide/obsolete it * Provide and obsolete certbot main package too to ensure we can migrate to the new split setup directly * Conflict with certbot package to allow easy migration * the documentation can be built using Sphinx 1.6+ python-certbot-apache was updated to 0.30.2: * Various small fixes * Stop preferring TLS-SNI. * The grammar used by Augeas parser in Apache plugin was updated to fix various parsing errors. * parameter name in OpenSUSE overrides for default parameters * several other fixes python-certbot-dns-cloudflare was updated to 0.30.2. python-certbot-dns-cloudxns was updated to 0.30.2: * Lockstep with main certbot package * The CloudXNS plugin is now compatible with Lexicon 3.0+. * Add runtime requirements. python-certbot-dns-digitalocean was updated to 0.30.2: * lockstep with main certbot pkg python-certbot-dns-dnsimple was updated to 0.30.2: * lockstep with main certbot package * The DNSimple plugin is now compatible with Lexicon 3.0+. python-certbot-dns-dnsmadeeasy was updated to 0.30.2: * The DNS Made Easy plugin is now compatible with Lexicon 3.0+. python-certbot-dns-google was updated to 0.30.2: * Minor logging fixes python-certbot-dns-luadns was updated to 0.30.2: * The LuaDNS plugin is now compatible with Lexicon 3.0+. python-certbot-dns-nsone was updated to 0.30.2: * The NS1 plugin is now compatible with Lexicon 3.0+. python-certbot-dns-rfc2136 was updated to 0.30.2. python-certbot-dns-route53 was updated to 0.30.2: * Test fix for Route53 plugin to prevent boto3 making outgoing connections. python-cloudflare: * Add the package cloudflare needed by python-certbot subpackage python-digitalocean: * Added python-digitalocean version 1.13.2 needed by python-certbot-dns-digitalocean python-certbot-nginx was updated to version 0.30.2: * Stop preferring TLS-SNI. * Match Nginx parser update in allowing variable names to start with ${. * Fix ranking of vhosts in Nginx so that all port-matching vhosts come first. python-jsonlines was added as version 1.2.0. python-jsonpickle was added as version 0.9.6. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-172=1 Package List: - openSUSE Backports SLE-15 (noarch): python2-acme-0.30.2-bp150.2.3.1 python3-acme-0.30.2-bp150.2.3.1 References:

1 0

openSUSE-SU-2019:0169-1: Security update for python-slixmpp
by opensuse-security＠opensuse.org 13 Feb '19

13 Feb '19

openSUSE Security Update: Security update for python-slixmpp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0169-1 Rating: low References: #1124322 Cross-References: CVE-2019-1000021 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-slixmpp fixes the following issue: Security issue fixed: - CVE-2019-1000021: Fixed incorrect Access Control vulnerability in XEP-0223 plugin (bsc#1124322) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-169=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): python3-slixmpp-1.3.0-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-1000021.html https://bugzilla.suse.com/1124322

1 0

openSUSE-SU-2019:0170-1: important: Security update for runc
by opensuse-security＠opensuse.org 13 Feb '19

13 Feb '19

openSUSE Security Update: Security update for runc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0170-1 Rating: important References: #1095817 #1118897 #1118898 #1118899 #1121967 Cross-References: CVE-2018-16873 CVE-2018-16874 CVE-2018-16875 CVE-2019-5736 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update for runc fixes the following issues: Security vulnerabilities addressed: - CVE-2019-5736: Effectively copying /proc/self/exe during re-exec to avoid write attacks to the host runc binary, which could lead to a container breakout (bsc#1121967) - CVE-2018-16873: Fix a remote command execution during "go get -u" (boo#1118897) - CVE-2018-16874: Fix a directory traversal in "go get" via curly braces in import paths (boo#1118898) - CVE-2018-16875: Fix a CPU denial of service issue (boo#1118899) Other changes and bug fixes: - Update go requirements to >= go1.10 - Create a symlink in /usr/bin/runc to enable rootless Podman and Buildah. - Make use of %license macro - Remove 'go test' from %check section, as it has only ever caused us problems and hasn't (as far as I remember) ever caught a release-blocking issue. Smoke testing has been far more useful. (boo#1095817) - Upgrade to runc v1.0.0~rc6. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc6 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-170=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): runc-1.0.0~rc6-bp150.2.3.1 - openSUSE Backports SLE-15 (noarch): runc-test-1.0.0~rc6-bp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-16873.html https://www.suse.com/security/cve/CVE-2018-16874.html https://www.suse.com/security/cve/CVE-2018-16875.html https://www.suse.com/security/cve/CVE-2019-5736.html https://bugzilla.suse.com/1095817 https://bugzilla.suse.com/1118897 https://bugzilla.suse.com/1118898 https://bugzilla.suse.com/1118899 https://bugzilla.suse.com/1121967

1 0

openSUSE-RU-2019:0168-1: moderate: Recommended update for skiboot
by maintenance＠opensuse.org 13 Feb '19

13 Feb '19

openSUSE Recommended Update: Recommended update for skiboot ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0168-1 Rating: moderate References: #1124931 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for skiboot fixes the following issues: - Fix opal-prd crash when buildt with -pie (boo#1124931). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-168=1 Package List: - openSUSE Backports SLE-15 (ppc64le): opal-prd-5.10-bp150.2.6.1 opal-utils-5.10-bp150.2.6.1 References: https://bugzilla.suse.com/1124931

1 0

openSUSE-SU-2019:0166-1: important: Security update for haproxy
by opensuse-security＠opensuse.org 13 Feb '19

13 Feb '19

openSUSE Security Update: Security update for haproxy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0166-1 Rating: important References: #1121283 Cross-References: CVE-2018-20615 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for haproxy version 1.8.17 fixes the following issues: Security issues fixed: - CVE-2018-20615: Fixed a denial of service, triggered by mishandling the priority flag on short HEADERS frame in the HTTP/2 decoder (bsc#1121283) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-166=1 Package List: - openSUSE Leap 15.0 (x86_64): haproxy-1.8.17~git0.e89d25b2-lp150.2.9.1 haproxy-debuginfo-1.8.17~git0.e89d25b2-lp150.2.9.1 haproxy-debugsource-1.8.17~git0.e89d25b2-lp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2018-20615.html https://bugzilla.suse.com/1121283

1 0

openSUSE-SU-2019:0167-1: important: Security update for spice
by opensuse-security＠opensuse.org 13 Feb '19

13 Feb '19

openSUSE Security Update: Security update for spice ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0167-1 Rating: important References: #1109044 #1122706 Cross-References: CVE-2019-3813 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for spice fixes the following issues: Security issue fixed: - CVE-2019-3813: Fixed a out-of-bounds read in the memslot_get_virt function that could lead to denial-of-service or code-execution (bsc#1122706). Non-security issue fixed: - Include spice-server tweak to compensate for performance issues with Windows guests (bsc#1109044). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-167=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libspice-server-devel-0.14.0-lp150.3.6.1 libspice-server1-0.14.0-lp150.3.6.1 libspice-server1-debuginfo-0.14.0-lp150.3.6.1 spice-debugsource-0.14.0-lp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-3813.html https://bugzilla.suse.com/1109044 https://bugzilla.suse.com/1122706

1 0

openSUSE-SU-2019:0165-1: Security update for uriparser
by opensuse-security＠opensuse.org 13 Feb '19

13 Feb '19

openSUSE Security Update: Security update for uriparser ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0165-1 Rating: low References: #1115722 #1115723 #1115724 #1122193 Cross-References: CVE-2018-19198 CVE-2018-19199 CVE-2018-19200 CVE-2018-20721 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for uriparser fixes the following issues: Security issues fixed: - CVE-2018-20721: Fixed an out-of-bounds read for incomplete URIs with IPv6 addresses with embedded IPv4 address (bsc#1122193). - CVE-2018-19198: Fixed an out-of-bounds write that was possible via the uriComposeQuery* or uriComposeQueryEx* function (bsc#1115722). - CVE-2018-19199: Fixed an integer overflow caused by an unchecked multiplication via the uriComposeQuery* or uriComposeQueryEx* function (bsc#1115723). - CVE-2018-19200: Fixed a operation attempted on NULL input via a uriResetUri* function (bsc#1115724). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-165=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): liburiparser1-0.8.5-lp150.2.3.1 liburiparser1-debuginfo-0.8.5-lp150.2.3.1 uriparser-0.8.5-lp150.2.3.1 uriparser-debuginfo-0.8.5-lp150.2.3.1 uriparser-debugsource-0.8.5-lp150.2.3.1 uriparser-devel-0.8.5-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): liburiparser1-32bit-0.8.5-lp150.2.3.1 liburiparser1-32bit-debuginfo-0.8.5-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-19198.html https://www.suse.com/security/cve/CVE-2018-19199.html https://www.suse.com/security/cve/CVE-2018-19200.html https://www.suse.com/security/cve/CVE-2018-20721.html https://bugzilla.suse.com/1115722 https://bugzilla.suse.com/1115723 https://bugzilla.suse.com/1115724 https://bugzilla.suse.com/1122193

1 0

openSUSE-RU-2019:0164-1: moderate: Recommended update for kernel-firmware
by maintenance＠opensuse.org 13 Feb '19

13 Feb '19

openSUSE Recommended Update: Recommended update for kernel-firmware ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0164-1 Rating: moderate References: #1104289 #1110720 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for kernel-firmware fixes the following issues: Update to version 20190118 (bsc#1110720,FATE#325946,bsc#1104289): - brcm: Add BCM43455 NVRAM for Raspberry Pi 3 B+ - brcm: Fix filename for BCM43430 NVRAM for the Raspberry Pi 3 Model B - amdgpu: add raven2 fw for 18.50 release - amdgpu: add picasso fw for 18.50 release - Revert "brcm: Add BCM43455 NVRAM for Raspberry Pi 3 B+" - Update firmware file for Intel Bluetooth 8265 - Update firmware file for Intel Bluetooth 8260 - Update firmware file for Intel Bluetooth 9260 - Update firmware file for Intel Bluetooth 9560 - brcm: Add BCM43430 NVRAM for the Raspberry Pi 3 Model B - brcm: Add BCM43455 NVRAM for Raspberry Pi 3 B+ - update Marvell USB8801 B0 firmware image - iwlwifi: update firmwares for 9000 series - cxgb4: update firmware to revision 1.22.9.0 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-164=1 Package List: - openSUSE Leap 15.0 (noarch): kernel-firmware-20190118-lp150.2.12.1 ucode-amd-20190118-lp150.2.12.1 References: https://bugzilla.suse.com/1104289 https://bugzilla.suse.com/1110720

1 0

openSUSE-SU-2019:0163-1: Security update for python-slixmpp
by opensuse-security＠opensuse.org 13 Feb '19

13 Feb '19

openSUSE Security Update: Security update for python-slixmpp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0163-1 Rating: low References: #1124322 Cross-References: CVE-2019-1000021 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-slixmpp fixes the following issue: Security issue fixed: - CVE-2019-1000021: Fixed incorrect Access Control vulnerability in XEP-0223 plugin (bsc#1124322) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-163=1 Package List: - openSUSE Leap 15.0 (x86_64): python-slixmpp-debugsource-1.3.0-lp150.2.3.1 python3-slixmpp-1.3.0-lp150.2.3.1 python3-slixmpp-debuginfo-1.3.0-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-1000021.html https://bugzilla.suse.com/1124322

1 0