November 2020 - openSUSE Updates - openSUSE Mailing Lists

[opensuse-updates] openSUSE-RU-2020:1925-1: moderate: Recommended update for findutils
by maintenance＠opensuse.org 14 Nov '20

14 Nov '20

openSUSE Recommended Update: Recommended update for findutils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1925-1 Rating: moderate References: #1174232 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for findutils fixes the following issues: - Do not unconditionally use leaf optimization for NFS. (bsc#1174232) NFS st_nlink are not accurate on all implementations, leading to aborts() if that assumption is made. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1925=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): findutils-4.6.0-lp151.4.3.1 findutils-debuginfo-4.6.0-lp151.4.3.1 findutils-debugsource-4.6.0-lp151.4.3.1 - openSUSE Leap 15.1 (noarch): findutils-lang-4.6.0-lp151.4.3.1 References: https://bugzilla.suse.com/1174232

1 0

[opensuse-updates] openSUSE-RU-2020:1926-1: moderate: Recommended update for grub2
by maintenance＠opensuse.org 14 Nov '20

14 Nov '20

openSUSE Recommended Update: Recommended update for grub2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1926-1 Rating: moderate References: #1172952 #1176062 #1177957 #1178278 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for grub2 fixes the following issues: - Fixed an issue, where the https boot was interrupted by an unrecognized network address error message (bsc#1172952) - Improve the error handling when grub2-install fails with short mbr gap (bsc#1176062) - Fixed an error in grub2-install where it exited with "failed to get canonical path of `/boot/grub2/i386-pc'." (bsc#1177957) - Fixed a boot failure issue on blocklist installations (bsc#1178278) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1926=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): grub2-2.02-lp151.21.30.1 grub2-branding-upstream-2.02-lp151.21.30.1 grub2-debuginfo-2.02-lp151.21.30.1 grub2-debugsource-2.02-lp151.21.30.1 - openSUSE Leap 15.1 (noarch): grub2-i386-efi-2.02-lp151.21.30.1 grub2-i386-pc-2.02-lp151.21.30.1 grub2-i386-xen-2.02-lp151.21.30.1 grub2-snapper-plugin-2.02-lp151.21.30.1 grub2-systemd-sleep-plugin-2.02-lp151.21.30.1 grub2-x86_64-efi-2.02-lp151.21.30.1 grub2-x86_64-xen-2.02-lp151.21.30.1 References: https://bugzilla.suse.com/1172952 https://bugzilla.suse.com/1176062 https://bugzilla.suse.com/1177957 https://bugzilla.suse.com/1178278

1 0

[opensuse-updates] openSUSE-RU-2020:1924-1: moderate: Recommended update for raspberrypi-firmware, u-boot
by maintenance＠opensuse.org 14 Nov '20

14 Nov '20

openSUSE Recommended Update: Recommended update for raspberrypi-firmware, u-boot ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1924-1 Rating: moderate References: #1088356 #1157822 #1160566 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for raspberrypi-firmware, u-boot fixes the following issues: The raspberrypi-firmware was updated to 6e4a7232c (2019-11-19): - Added support for CM3+ (bsc#1157822) - Allow user defined config options (bsc#1088356) - Move HDMI workaround to rpi3 section (fixes RPi2 HDMI output) The u-boot bootloader was updated: - Fixed the USB keyboard in grub on the RasperryPi (bsc#1160566): - Added support for Raspberry Pi Compute Module 3+ (bsc#1157822) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1924=1 Package List: - openSUSE Leap 15.1 (x86_64): u-boot-tools-2019.01-lp151.6.9.1 u-boot-tools-debuginfo-2019.01-lp151.6.9.1 - openSUSE Leap 15.1 (noarch): raspberrypi-firmware-2019.11.19-lp151.4.6.1 raspberrypi-firmware-config-2019.11.19-lp151.4.6.1 raspberrypi-firmware-extra-2019.11.19-lp151.4.6.1 References: https://bugzilla.suse.com/1088356 https://bugzilla.suse.com/1157822 https://bugzilla.suse.com/1160566

1 0

[opensuse-updates] openSUSE-SU-2020:1922-1: moderate: Security update for python-waitress
by opensuse-security＠opensuse.org 14 Nov '20

14 Nov '20

openSUSE Security Update: Security update for python-waitress ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1922-1 Rating: moderate References: #1160790 #1161088 #1161089 #1161670 Cross-References: CVE-2019-16785 CVE-2019-16786 CVE-2019-16789 CVE-2019-16792 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for python-waitress to 1.4.3 fixes the following security issues: - CVE-2019-16785: HTTP request smuggling through LF vs CRLF handling (bsc#1161088). - CVE-2019-16786: HTTP request smuggling through invalid Transfer-Encoding (bsc#1161089). - CVE-2019-16789: HTTP request smuggling through invalid whitespace characters (bsc#1160790). - CVE-2019-16792: HTTP request smuggling by sending the Content-Length header twice (bsc#1161670). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1922=1 Package List: - openSUSE Leap 15.1 (noarch): python2-waitress-1.4.3-lp151.3.3.1 python3-waitress-1.4.3-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-16785.html https://www.suse.com/security/cve/CVE-2019-16786.html https://www.suse.com/security/cve/CVE-2019-16789.html https://www.suse.com/security/cve/CVE-2019-16792.html https://bugzilla.suse.com/1160790 https://bugzilla.suse.com/1161088 https://bugzilla.suse.com/1161089 https://bugzilla.suse.com/1161670

1 0

[opensuse-updates] openSUSE-RU-2020:1921-1: moderate: Recommended update for bind
by maintenance＠opensuse.org 14 Nov '20

14 Nov '20

openSUSE Recommended Update: Recommended update for bind ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1921-1 Rating: moderate References: #1175894 #1177603 #1177790 #1177913 #1177915 #1178078 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 6 recommended fixes can now be installed. Description: This update for bind fixes the following issues: - Add '/usr/lib64/named' to the files and directories in bind config to include external plugins for chroot. (bsc#1178078) - Replaced named's dependency on time-sync with a dependency on time-set in 'named.service' to avoid a dependency-loop. (bsc#1177790) - Removed "dnssec-enable" from named.conf as it has been obsoleted and may break. (bsc#1177915) - Added a comment for reference which should be removed in the future. (bsc#1177603) - Added a comment to the "dnssec-validation" in named.conf with a reference to forwarders which do not return signed responses. (bsc#1175894) - Replaced an INSIST macro which calls abort with a test and a diagnostic output. (bsc#1177913) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1921=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): bind-9.16.6-lp151.11.12.1 bind-chrootenv-9.16.6-lp151.11.12.1 bind-debuginfo-9.16.6-lp151.11.12.1 bind-debugsource-9.16.6-lp151.11.12.1 bind-devel-9.16.6-lp151.11.12.1 bind-utils-9.16.6-lp151.11.12.1 bind-utils-debuginfo-9.16.6-lp151.11.12.1 libbind9-1600-9.16.6-lp151.11.12.1 libbind9-1600-debuginfo-9.16.6-lp151.11.12.1 libdns1605-9.16.6-lp151.11.12.1 libdns1605-debuginfo-9.16.6-lp151.11.12.1 libirs-devel-9.16.6-lp151.11.12.1 libirs1601-9.16.6-lp151.11.12.1 libirs1601-debuginfo-9.16.6-lp151.11.12.1 libisc1606-9.16.6-lp151.11.12.1 libisc1606-debuginfo-9.16.6-lp151.11.12.1 libisccc1600-9.16.6-lp151.11.12.1 libisccc1600-debuginfo-9.16.6-lp151.11.12.1 libisccfg1600-9.16.6-lp151.11.12.1 libisccfg1600-debuginfo-9.16.6-lp151.11.12.1 libns1604-9.16.6-lp151.11.12.1 libns1604-debuginfo-9.16.6-lp151.11.12.1 - openSUSE Leap 15.1 (x86_64): bind-devel-32bit-9.16.6-lp151.11.12.1 libbind9-1600-32bit-9.16.6-lp151.11.12.1 libbind9-1600-32bit-debuginfo-9.16.6-lp151.11.12.1 libdns1605-32bit-9.16.6-lp151.11.12.1 libdns1605-32bit-debuginfo-9.16.6-lp151.11.12.1 libirs1601-32bit-9.16.6-lp151.11.12.1 libirs1601-32bit-debuginfo-9.16.6-lp151.11.12.1 libisc1606-32bit-9.16.6-lp151.11.12.1 libisc1606-32bit-debuginfo-9.16.6-lp151.11.12.1 libisccc1600-32bit-9.16.6-lp151.11.12.1 libisccc1600-32bit-debuginfo-9.16.6-lp151.11.12.1 libisccfg1600-32bit-9.16.6-lp151.11.12.1 libisccfg1600-32bit-debuginfo-9.16.6-lp151.11.12.1 libns1604-32bit-9.16.6-lp151.11.12.1 libns1604-32bit-debuginfo-9.16.6-lp151.11.12.1 - openSUSE Leap 15.1 (noarch): bind-doc-9.16.6-lp151.11.12.1 python3-bind-9.16.6-lp151.11.12.1 References: https://bugzilla.suse.com/1175894 https://bugzilla.suse.com/1177603 https://bugzilla.suse.com/1177790 https://bugzilla.suse.com/1177913 https://bugzilla.suse.com/1177915 https://bugzilla.suse.com/1178078

1 0

[opensuse-updates] openSUSE-SU-2020:1918-1: important: Security update for openldap2
by opensuse-security＠opensuse.org 14 Nov '20

14 Nov '20

openSUSE Security Update: Security update for openldap2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1918-1 Rating: important References: #1178387 Cross-References: CVE-2020-25692 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openldap2 fixes the following issues: - CVE-2020-25692: Fixed an unauthenticated remote denial of service due to incorrect validation of modrdn equality rules (bsc#1178387). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1918=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libldap-2_4-2-2.4.46-lp152.14.12.1 libldap-2_4-2-debuginfo-2.4.46-lp152.14.12.1 openldap2-2.4.46-lp152.14.12.1 openldap2-back-meta-2.4.46-lp152.14.12.1 openldap2-back-meta-debuginfo-2.4.46-lp152.14.12.1 openldap2-back-perl-2.4.46-lp152.14.12.1 openldap2-back-perl-debuginfo-2.4.46-lp152.14.12.1 openldap2-back-sock-2.4.46-lp152.14.12.1 openldap2-back-sock-debuginfo-2.4.46-lp152.14.12.1 openldap2-back-sql-2.4.46-lp152.14.12.1 openldap2-back-sql-debuginfo-2.4.46-lp152.14.12.1 openldap2-client-2.4.46-lp152.14.12.1 openldap2-client-debuginfo-2.4.46-lp152.14.12.1 openldap2-contrib-2.4.46-lp152.14.12.1 openldap2-contrib-debuginfo-2.4.46-lp152.14.12.1 openldap2-debuginfo-2.4.46-lp152.14.12.1 openldap2-debugsource-2.4.46-lp152.14.12.1 openldap2-devel-2.4.46-lp152.14.12.1 openldap2-devel-static-2.4.46-lp152.14.12.1 openldap2-ppolicy-check-password-1.2-lp152.14.12.1 openldap2-ppolicy-check-password-debuginfo-1.2-lp152.14.12.1 - openSUSE Leap 15.2 (noarch): libldap-data-2.4.46-lp152.14.12.1 openldap2-doc-2.4.46-lp152.14.12.1 - openSUSE Leap 15.2 (x86_64): libldap-2_4-2-32bit-2.4.46-lp152.14.12.1 libldap-2_4-2-32bit-debuginfo-2.4.46-lp152.14.12.1 openldap2-devel-32bit-2.4.46-lp152.14.12.1 References: https://www.suse.com/security/cve/CVE-2020-25692.html https://bugzilla.suse.com/1178387

1 0

[opensuse-updates] openSUSE-SU-2020:1919-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 14 Nov '20

14 Nov '20

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1919-1 Rating: important References: #1178588 Cross-References: CVE-2020-26950 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for MozillaFirefox fixes the following issues: - Firefox Extended Support Release 78.4.1 ESR * Fixed: Security fix MFSA 2020-49 (bsc#1178588) * CVE-2020-26950 (bmo#1675905) Write side effects in MCallGetProperty opcode not accounted for This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1919=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaFirefox-78.4.1-lp152.2.27.1 MozillaFirefox-branding-upstream-78.4.1-lp152.2.27.1 MozillaFirefox-buildsymbols-78.4.1-lp152.2.27.1 MozillaFirefox-debuginfo-78.4.1-lp152.2.27.1 MozillaFirefox-debugsource-78.4.1-lp152.2.27.1 MozillaFirefox-devel-78.4.1-lp152.2.27.1 MozillaFirefox-translations-common-78.4.1-lp152.2.27.1 MozillaFirefox-translations-other-78.4.1-lp152.2.27.1 References: https://www.suse.com/security/cve/CVE-2020-26950.html https://bugzilla.suse.com/1178588

1 0

[opensuse-updates] openSUSE-SU-2020:1920-1: important: Security update for openldap2
by opensuse-security＠opensuse.org 14 Nov '20

14 Nov '20

openSUSE Security Update: Security update for openldap2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1920-1 Rating: important References: #1178387 Cross-References: CVE-2020-25692 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openldap2 fixes the following issues: - CVE-2020-25692: Fixed an unauthenticated remote denial of service due to incorrect validation of modrdn equality rules (bsc#1178387). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1920=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libldap-2_4-2-2.4.46-lp151.10.21.1 libldap-2_4-2-debuginfo-2.4.46-lp151.10.21.1 openldap2-2.4.46-lp151.10.21.1 openldap2-back-meta-2.4.46-lp151.10.21.1 openldap2-back-meta-debuginfo-2.4.46-lp151.10.21.1 openldap2-back-perl-2.4.46-lp151.10.21.1 openldap2-back-perl-debuginfo-2.4.46-lp151.10.21.1 openldap2-back-sock-2.4.46-lp151.10.21.1 openldap2-back-sock-debuginfo-2.4.46-lp151.10.21.1 openldap2-back-sql-2.4.46-lp151.10.21.1 openldap2-back-sql-debuginfo-2.4.46-lp151.10.21.1 openldap2-client-2.4.46-lp151.10.21.1 openldap2-client-debuginfo-2.4.46-lp151.10.21.1 openldap2-contrib-2.4.46-lp151.10.21.1 openldap2-contrib-debuginfo-2.4.46-lp151.10.21.1 openldap2-debuginfo-2.4.46-lp151.10.21.1 openldap2-debugsource-2.4.46-lp151.10.21.1 openldap2-devel-2.4.46-lp151.10.21.1 openldap2-devel-static-2.4.46-lp151.10.21.1 openldap2-ppolicy-check-password-1.2-lp151.10.21.1 openldap2-ppolicy-check-password-debuginfo-1.2-lp151.10.21.1 - openSUSE Leap 15.1 (x86_64): libldap-2_4-2-32bit-2.4.46-lp151.10.21.1 libldap-2_4-2-32bit-debuginfo-2.4.46-lp151.10.21.1 openldap2-devel-32bit-2.4.46-lp151.10.21.1 - openSUSE Leap 15.1 (noarch): libldap-data-2.4.46-lp151.10.21.1 openldap2-doc-2.4.46-lp151.10.21.1 References: https://www.suse.com/security/cve/CVE-2020-25692.html https://bugzilla.suse.com/1178387

1 0

[opensuse-updates] openSUSE-RU-2020:1917-1: moderate: Recommended update for dehydrated
by maintenance＠opensuse.org 14 Nov '20

14 Nov '20

openSUSE Recommended Update: Recommended update for dehydrated ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1917-1 Rating: moderate References: #1091216 #1110697 #1139408 #1154167 #1169834 SLE-11727 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 5 recommended fixes and contains one feature can now be installed. Description: This update for dehydrated fixes the following issues: Update to dehydrated 0.6.5: * Fixed broken APIv1 compatibility from last update Update to dehydrated 0.6.4: * Fetch account ID from Location header instead of account json (boo#1139408) Update to dehydrated 0.6.3: * OCSP refresh interval is now configurable * Implemented POST-as-GET * Call exit_hook on errors (with error-message as first parameter) * Initial support for tls-alpn-01 validation * New hook: sync_cert (for syncing certificate files to disk, see example hook description) * Fetch account information after registration to avoid missing account id - Remove RandomizedDelaySec attribute for distros with older systemd (boo#1110697) Update to dehydrated 0.6.2: Added * New deploy_ocsp hook * Allow account registration with custom key Changed * Don't walk certificate chain for ACMEv2 (certificate contains chain by default) * Improved documentation on wildcards Fixes * Added workaround for compatibility with filesystem ACLs * Close unwanted external file-descriptors * Fixed JSON parsing on force-renewal (boo#1091216) * Fixed cleanup of challenge files/dns-entries on validation errors * A few more minor fixes - Reenable nginx subpackage for factory - Update maintainer file and package description, remove features that are better described in the (upstream maintained) man page. - Remove potentially harmful scriptlet (boo#1154167). Documented transition case in the maintainer README. Unlikely enough. The versions that have not transitioned yet would be broken for more than two years now. - Removed lighttpd 1.x integration package. If you still would like to use lighttpd with dehydrated, follow the instructions in the README.maintainers file. - Fix lighttpd config file (boo#1169834) - Behavioral change: Use cron only for older RHEL/CentOS versions (along with SLE < 12.0). Everything else now uses systemd. Please adopt accordingly! Refer to README.md for Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-1917=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): dehydrated-0.6.5-5.1 dehydrated-apache2-0.6.5-5.1 References: https://bugzilla.suse.com/1091216 https://bugzilla.suse.com/1110697 https://bugzilla.suse.com/1139408 https://bugzilla.suse.com/1154167 https://bugzilla.suse.com/1169834

1 0

[opensuse-updates] openSUSE-SU-2020:1916-1: moderate: Security update for SDL
by opensuse-security＠opensuse.org 14 Nov '20

14 Nov '20

openSUSE Security Update: Security update for SDL ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1916-1 Rating: moderate References: #1141844 Cross-References: CVE-2019-13616 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for SDL fixes the following issues: Security issue fixed: - CVE-2019-13616: Fixed heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit (bsc#1141844). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1916=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): SDL-debugsource-1.2.15-lp152.5.3.1 libSDL-1_2-0-1.2.15-lp152.5.3.1 libSDL-1_2-0-debuginfo-1.2.15-lp152.5.3.1 libSDL-devel-1.2.15-lp152.5.3.1 - openSUSE Leap 15.2 (x86_64): libSDL-1_2-0-32bit-1.2.15-lp152.5.3.1 libSDL-1_2-0-32bit-debuginfo-1.2.15-lp152.5.3.1 libSDL-devel-32bit-1.2.15-lp152.5.3.1 References: https://www.suse.com/security/cve/CVE-2019-13616.html https://bugzilla.suse.com/1141844

1 0