August 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2019:1874-1: moderate: Recommended update for python-relatorio
by maintenance＠opensuse.org 14 Aug '19

14 Aug '19

openSUSE Recommended Update: Recommended update for python-relatorio ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1874-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for python-relatorio fixes the following issues: - python-magic added to requirements Update to version 0.8.1: * Add support for Python 3.7 * Escape invalid XML characters * Enforce closing tag to be the same directive as the opening * Use compression for zip file * Write mimetype as first file of the zip file This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-1874=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): python2-relatorio-0.8.1-bp151.4.3.1 python3-relatorio-0.8.1-bp151.4.3.1 References:

1 0

openSUSE-SU-2019:1872-1: moderate: Security update for python-Django
by opensuse-security＠opensuse.org 14 Aug '19

14 Aug '19

openSUSE Security Update: Security update for python-Django ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1872-1 Rating: moderate References: #1136468 #1139945 #1142880 #1142882 #1142883 #1142885 Cross-References: CVE-2019-11358 CVE-2019-12308 CVE-2019-12781 CVE-2019-14232 CVE-2019-14233 CVE-2019-14234 CVE-2019-14235 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for python-Django fixes the following issues: Security issues fixed: - CVE-2019-11358: Fixed prototype pollution. - CVE-2019-12308: Fixed XSS in AdminURLFieldWidget (bsc#1136468) - CVE-2019-12781: Fixed incorrect HTTP detection with reverse-proxy connecting via HTTPS (bsc#1139945). - CVE-2019-14232: Fixed denial-of-service possibility in ``django.utils.text.Truncator`` (bsc#1142880). - CVE-2019-14233: Fixed denial-of-service possibility in ``strip_tags()`` (bsc#1142882). - CVE-2019-14234: Fixed SQL injection possibility in key and index lookups for ``JSONField``/``HStoreField`` (bsc#1142883). - CVE-2019-14235: Fixed potential memory exhaustion in ``django.utils.encoding.uri_to_iri()`` (bsc#1142885). Non-security issues fixed: - Fixed a migration crash on PostgreSQL when adding a check constraint with a contains lookup on DateRangeField or DateTimeRangeField, if the right hand side of an expression is the same type. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-1872=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): python3-Django-2.2.4-bp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-11358.html https://www.suse.com/security/cve/CVE-2019-12308.html https://www.suse.com/security/cve/CVE-2019-12781.html https://www.suse.com/security/cve/CVE-2019-14232.html https://www.suse.com/security/cve/CVE-2019-14233.html https://www.suse.com/security/cve/CVE-2019-14234.html https://www.suse.com/security/cve/CVE-2019-14235.html https://bugzilla.suse.com/1136468 https://bugzilla.suse.com/1139945 https://bugzilla.suse.com/1142880 https://bugzilla.suse.com/1142882 https://bugzilla.suse.com/1142883 https://bugzilla.suse.com/1142885

1 0

openSUSE-RU-2019:1877-1: moderate: Recommended update for yubioath-desktop
by maintenance＠opensuse.org 14 Aug '19

14 Aug '19

openSUSE Recommended Update: Recommended update for yubioath-desktop ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1877-1 Rating: moderate References: #1137070 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yubioath-desktop fixes the following issues: - Version 4.3.6 (released 2019-05-29) (boo#1137070) - Windows: improve support for YubiKey NEO on Windows 10 - Version 4.3.5 (released 2019-01-02) - Bugfix: Show correct message when YubiKey doesn’t have the correct transport enabled - Improve error handling in Slot Mode - Linux: Add experimental support for .AppImage - Version 4.3.4 (released 2018-05-07) - Support YubiKey Preview - Add credential: allow space in secret key. - Bugfix: Don’t show "No credentials found..." incorrectly. - Bugfix: Forget the password when removing the device. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-1877=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): yubioath-desktop-4.3.6-bp151.4.3.1 References: https://bugzilla.suse.com/1137070

1 0

openSUSE-RU-2019:1873-1: important: Recommended update for dehydrated
by maintenance＠opensuse.org 14 Aug '19

14 Aug '19

openSUSE Recommended Update: Recommended update for dehydrated ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1873-1 Rating: important References: #1110697 #1139408 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for dehydrated fixes the following issues: - Update to dehydrated 0.6.5 * Fetch account ID from Location header instead of account json (bsc#1139408) * OCSP refresh interval is now configurable * Implemented POST-as-GET * Call exit_hook on errors (with error-message as first parameter) * Initial support for tls-alpn-01 validation * New hook: sync_cert (for syncing certificate files to disk, see example hook description) * Fetch account information after registration to avoid missing account id - Remove RandomizedDelaySec attribute for distros with older systemd (bsc#1110697) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1873=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1873=1 Package List: - openSUSE Leap 15.1 (noarch): dehydrated-0.6.5-lp151.3.3.1 dehydrated-apache2-0.6.5-lp151.3.3.1 dehydrated-lighttpd-0.6.5-lp151.3.3.1 dehydrated-nginx-0.6.5-lp151.3.3.1 - openSUSE Leap 15.0 (noarch): dehydrated-0.6.5-lp150.2.3.1 dehydrated-apache2-0.6.5-lp150.2.3.1 dehydrated-lighttpd-0.6.5-lp150.2.3.1 dehydrated-nginx-0.6.5-lp150.2.3.1 References: https://bugzilla.suse.com/1110697 https://bugzilla.suse.com/1139408

1 0

openSUSE-SU-2019:1880-1: moderate: Security update for live555
by opensuse-security＠opensuse.org 14 Aug '19

14 Aug '19

openSUSE Security Update: Security update for live555 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1880-1 Rating: moderate References: #1121995 #1124159 #1127341 Cross-References: CVE-2019-7314 CVE-2019-9215 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for live555 fixes the following issues: - CVE-2019-9215: Malformed headers could have lead to invalid memory access in the parseAuthorizationHeader function. (boo#1127341) - CVE-2019-7314: Mishandled termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up could have lead to a Use-After-Free error causing the RTSP server to crash or possibly have unspecified other impact. (boo#1124159) - Update to version 2019.06.28, - Convert to dynamic libraries (boo#1121995): + Use make ilinux-with-shared-libraries: build the dynamic libs instead of the static one. + Use make install instead of a manual file copy script: this also reveals that we missed quite a bit of code to be installed before. + Split out shared library packages according the SLPP. - Use FAT LTO objects in order to provide proper static library. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-1880=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): libBasicUsageEnvironment1-2019.06.28-bp151.3.3.1 libUsageEnvironment3-2019.06.28-bp151.3.3.1 libgroupsock8-2019.06.28-bp151.3.3.1 libliveMedia66-2019.06.28-bp151.3.3.1 live555-2019.06.28-bp151.3.3.1 live555-devel-2019.06.28-bp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-7314.html https://www.suse.com/security/cve/CVE-2019-9215.html https://bugzilla.suse.com/1121995 https://bugzilla.suse.com/1124159 https://bugzilla.suse.com/1127341

1 0

openSUSE-SU-2019:1876-1: moderate: Security update for mumble
by opensuse-security＠opensuse.org 14 Aug '19

14 Aug '19

openSUSE Security Update: Security update for mumble ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1876-1 Rating: moderate References: #1123334 Cross-References: CVE-2018-20743 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mumble fixes the following issues: CVE-2018-20743: murmur mishandled multiple concurrent requests that were persisted in the database, which allowed remote attackers to cause a denial of service (daemon hang or crash) via a message flood. (boo#1123334) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-1876=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): mumble-1.2.19-bp151.6.3.1 mumble-server-1.2.19-bp151.6.3.1 - openSUSE Backports SLE-15-SP1 (aarch64_ilp32): mumble-64bit-1.2.19-bp151.6.3.1 References: https://www.suse.com/security/cve/CVE-2018-20743.html https://bugzilla.suse.com/1123334

1 0

openSUSE-OU-2019:1878-1: Optional update for osc, openSUSE-release-tools
by maintenance＠opensuse.org 14 Aug '19

14 Aug '19

openSUSE Optional Update: Optional update for osc, openSUSE-release-tools ______________________________________________________________________________ Announcement ID: openSUSE-OU-2019:1878-1 Rating: low References: #1112920 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update for osc, openSUSE-release-tools fixes the following issues: - Add new package openSUSE-release-tools in version 20190603.49a5e95b: * Support licensedigger as reviewer for SUSE and openSUSE * [ttm] remove ppc64 (BE) for TW bypass boo#1112920 - osc was updated to 0.165.1: * add Provides: %{use_python}-osc so that other packages can require the correct version (either python2-osc or python3-osc) * fix oscssl "urldefrag is not defined error" * osc release command now python3 compatible * add more decode logic in get_commitlog * osc add <dir> in compressed mode now works with python3 * osc getbinaries now prints the output instead of using the quiet mode as a default This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-1878=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): openSUSE-release-tools-20190603.49a5e95b-bp151.3.3.1 openSUSE-release-tools-abichecker-20190603.49a5e95b-bp151.3.3.1 openSUSE-release-tools-announcer-20190603.49a5e95b-bp151.3.3.1 openSUSE-release-tools-check-source-20190603.49a5e95b-bp151.3.3.1 openSUSE-release-tools-devel-20190603.49a5e95b-bp151.3.3.1 openSUSE-release-tools-leaper-20190603.49a5e95b-bp151.3.3.1 openSUSE-release-tools-maintenance-20190603.49a5e95b-bp151.3.3.1 openSUSE-release-tools-metrics-20190603.49a5e95b-bp151.3.3.1 openSUSE-release-tools-metrics-access-20190603.49a5e95b-bp151.3.3.1 openSUSE-release-tools-obs-operator-20190603.49a5e95b-bp151.3.3.1 openSUSE-release-tools-origin-manager-20190603.49a5e95b-bp151.3.3.1 openSUSE-release-tools-pkglistgen-20190603.49a5e95b-bp151.3.3.1 openSUSE-release-tools-repo-checker-20190603.49a5e95b-bp151.3.3.1 openSUSE-release-tools-staging-bot-20190603.49a5e95b-bp151.3.3.1 osc-plugin-cycle-20190603.49a5e95b-bp151.3.3.1 osc-plugin-origin-20190603.49a5e95b-bp151.3.3.1 osc-plugin-staging-20190603.49a5e95b-bp151.3.3.1 osc-plugin-vdelreq-20190603.49a5e95b-bp151.3.3.1 osclib-20190603.49a5e95b-bp151.3.3.1 References: https://bugzilla.suse.com/1112920

1 0

openSUSE-RU-2019:1875-1: Recommended update for lxqt-sudo
by maintenance＠opensuse.org 14 Aug '19

14 Aug '19

openSUSE Recommended Update: Recommended update for lxqt-sudo ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1875-1 Rating: low References: #1100871 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for lxqt-sudo fixes the following issues: Fixes layout problem with CJK by setting the locale to C (boo#1100871). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-1875=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): lxqt-sudo-0.12.0-bp151.4.3.1 References: https://bugzilla.suse.com/1100871

1 0

openSUSE-RU-2019:1879-1: moderate: Recommended update for rclone
by maintenance＠opensuse.org 14 Aug '19

14 Aug '19

openSUSE Recommended Update: Recommended update for rclone ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1879-1 Rating: moderate References: #1137685 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for rclone fixes the following issues: rclone was updated to version 1.47.0. boo#1137685: - New backends - Backend for Koofr cloud storage service. (jaKa) - New Features - Resume downloads if the reader fails in copy (Nick Craig-Wood) - Use `--fast-list` for listing operations where it won't use more memory (Nick Craig-Wood) - Make `--files-from` traverse the destination unless `--no-traverse` is set (Nick Craig-Wood) - Make server side copy account bytes and obey `--max-transfer` (Nick Craig-Wood) - Add `--create-empty-src-dirs` flag and default to not creating empty dirs (ishuah) - Add client side TLS/SSL flags `--ca-cert`/`--client-cert`/`--client-key` (Nick Craig-Wood) - Implement `--suffix-keep-extension` for use with `--suffix` (Nick Craig-Wood) - serve dlna: Add connection manager service description to improve compatibility (Dan Walters) - lsf: Add 'e' format to show encrypted names and 'o' for original IDs (Nick Craig-Wood) - lsjson: Added `--files-only` and `--dirs-only` flags (calistri) - rc: Implement operations/publiclink the equivalent of `rclone link` (Nick Craig-Wood) - Bug Fixes - accounting: Fix total ETA when `--stats-unit bits` is in effect (Nick Craig-Wood) - Bash TAB completion - Use private custom func to fix clash between rclone and kubectl (Nick Craig-Wood) - Fix for remotes with underscores in their names (Six) - Fix completion of remotes (Florian Gamböck) - Fix autocompletion of remote paths with spaces (Danil Semelenov) - serve dlna: Fix root XML service descriptor (Dan Walters) - ncdu: Fix display corruption with Chinese characters (Nick Craig-Wood) - Add SIGTERM to signals which run the exit handlers on unix (Nick Craig-Wood) - rc: Reload filter when the options are set via the rc (Nick Craig-Wood) - VFS / Mount - Fix FreeBSD: Ignore Truncate if called with no readers and already the correct size (Nick Craig-Wood) - Read directory and check for a file before mkdir (Nick Craig-Wood) - Shorten the locking window for vfs/refresh (Nick Craig-Wood) - Azure Blob - Enable MD5 checksums when uploading files bigger than the "Cutoff" (Dr.Rx) - Fix SAS URL support (Nick Craig-Wood) - B2 - Allow manual configuration of backblaze downloadUrl (Vince) - Ignore already_hidden error on remove (Nick Craig-Wood) - Ignore malformed `src_last_modified_millis` (Nick Craig-Wood) - Drive - Add `--skip-checksum-gphotos` to ignore incorrect checksums on Google Photos (Nick Craig-Wood) - Allow server side move/copy between different remotes. (Fionera) - Add docs on team drives and `--fast-list` eventual consistency (Nestar47) - Fix imports of text files (Nick Craig-Wood) - Fix range requests on 0 length files (Nick Craig-Wood) - Fix creation of duplicates with server side copy (Nick Craig-Wood) - Dropbox - Retry blank errors to fix long listings (Nick Craig-Wood) - FTP - Add `--ftp-concurrency` to limit maximum number of connections (Nick Craig-Wood) - Google Cloud Storage - Fall back to default application credentials (marcintustin) - Allow bucket policy only buckets (Nick Craig-Wood) - HTTP - Add `--http-no-slash` for websites with directories with no slashes (Nick Craig-Wood) - Remove duplicates from listings (Nick Craig-Wood) - Fix socket leak on 404 errors (Nick Craig-Wood) - Jottacloud - Fix token refresh (Sebastian Bünger) - Add device registration (Oliver Heyme) - Onedrive - Implement graceful cancel of multipart uploads if rclone is interrupted (Cnly) - Always add trailing colon to path when addressing items, (Cnly) - Return errors instead of panic for invalid uploads (Fabian Möller) - S3 - Add support for "Glacier Deep Archive" storage class (Manu) - Update Dreamhost endpoint (Nick Craig-Wood) - Note incompatibility with CEPH Jewel (Nick Craig-Wood) - SFTP - Allow custom ssh client config (Alexandru Bumbacea) - Swift - Obey Retry-After to enable OVH restore from cold storage (Nick Craig-Wood) - Work around token expiry on CEPH (Nick Craig-Wood) - WebDAV - Allow IsCollection property to be integer or boolean (Nick Craig-Wood) - Fix race when creating directories (Nick Craig-Wood) - Fix About/df when reading the available/total returns 0 (Nick Craig-Wood) - Add bash-completion and zsh-completion support. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-1879=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): rclone-1.47.0-bp151.4.3.1 - openSUSE Backports SLE-15-SP1 (noarch): rclone-bash-completion-1.47.0-bp151.4.3.1 rclone-zsh-completion-1.47.0-bp151.4.3.1 References: https://bugzilla.suse.com/1137685

1 0

openSUSE-RU-2019:1869-1: moderate: Recommended update for plasma-framework
by maintenance＠opensuse.org 14 Aug '19

14 Aug '19

openSUSE Recommended Update: Recommended update for plasma-framework ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1869-1 Rating: moderate References: #1136473 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for plasma-framework fixes the following issues: - Fixed another incompatibility with Qt 5.9 (boo#1136473) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-1869=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): libKF5Plasma5-5.55.0-bp151.3.3.2 plasma-framework-5.55.0-bp151.3.3.2 plasma-framework-components-5.55.0-bp151.3.3.2 plasma-framework-devel-5.55.0-bp151.3.3.2 - openSUSE Backports SLE-15-SP1 (aarch64_ilp32): libKF5Plasma5-64bit-5.55.0-bp151.3.3.2 plasma-framework-64bit-5.55.0-bp151.3.3.2 plasma-framework-components-64bit-5.55.0-bp151.3.3.2 plasma-framework-devel-64bit-5.55.0-bp151.3.3.2 - openSUSE Backports SLE-15-SP1 (noarch): plasma-framework-lang-5.55.0-bp151.3.3.2 References: https://bugzilla.suse.com/1136473

1 0