November 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2020:1883-1: moderate: Recommended update for drbd-utils
by maintenance＠opensuse.org 09 Nov '20

09 Nov '20

openSUSE Recommended Update: Recommended update for drbd-utils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1883-1 Rating: moderate References: #1177531 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for drbd-utils fixes the following issue: - Move block-drbd back to /etc/xen/scripts (bsc#1177531) The change in xen.spec was reverted, but the revert was not applied to this pkg. This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1883=1 Package List: - openSUSE Leap 15.2 (x86_64): drbd-utils-9.13.0-lp152.2.6.1 drbd-utils-debuginfo-9.13.0-lp152.2.6.1 drbd-utils-debugsource-9.13.0-lp152.2.6.1 References: https://bugzilla.suse.com/1177531

1 0

openSUSE-SU-2020:1880-1: moderate: Security update for bluez
by opensuse-security＠opensuse.org 09 Nov '20

09 Nov '20

openSUSE Security Update: Security update for bluez ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1880-1 Rating: moderate References: #1177895 Cross-References: CVE-2020-27153 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bluez fixes the following issues: - CVE-2020-27153: Fixed possible crash on disconnect (bsc#1177895). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1880=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): bluez-5.48-lp152.12.6.1 bluez-cups-5.48-lp152.12.6.1 bluez-cups-debuginfo-5.48-lp152.12.6.1 bluez-debuginfo-5.48-lp152.12.6.1 bluez-debugsource-5.48-lp152.12.6.1 bluez-devel-5.48-lp152.12.6.1 bluez-test-5.48-lp152.12.6.1 bluez-test-debuginfo-5.48-lp152.12.6.1 libbluetooth3-5.48-lp152.12.6.1 libbluetooth3-debuginfo-5.48-lp152.12.6.1 - openSUSE Leap 15.2 (x86_64): bluez-devel-32bit-5.48-lp152.12.6.1 libbluetooth3-32bit-5.48-lp152.12.6.1 libbluetooth3-32bit-debuginfo-5.48-lp152.12.6.1 - openSUSE Leap 15.2 (noarch): bluez-auto-enable-devices-5.48-lp152.12.6.1 References: https://www.suse.com/security/cve/CVE-2020-27153.html https://bugzilla.suse.com/1177895

1 0

openSUSE-RU-2020:1879-1: moderate: Recommended update for yast2-firstboot and yast2-country
by maintenance＠opensuse.org 09 Nov '20

09 Nov '20

openSUSE Recommended Update: Recommended update for yast2-firstboot and yast2-country ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1879-1 Rating: moderate References: #1174856 #1177797 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for yast2-firstboot and yast2-country fixes the following issues: - Fixes an issue with firstboot_keyboard in AutoYaST profiles (bsc#1174856) yast2-firstboot fixes only: - Fixed a crash in combination with ntp-client (bsc#1177797) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1879=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): yast2-country-4.2.20-lp152.2.3.1 yast2-country-data-4.2.20-lp152.2.3.1 - openSUSE Leap 15.2 (noarch): yast2-firstboot-4.2.18-lp152.2.6.1 References: https://bugzilla.suse.com/1174856 https://bugzilla.suse.com/1177797

1 0

openSUSE-SU-2020:1878-1: moderate: Security update for wireshark
by opensuse-security＠opensuse.org 08 Nov '20

08 Nov '20

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1878-1 Rating: moderate References: #1175204 #1176908 #1176909 #1176910 Cross-References: CVE-2020-17498 CVE-2020-25862 CVE-2020-25863 CVE-2020-25866 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for wireshark fixes the following issues: - Update to wireshark 3.2.7: * CVE-2020-25863: MIME Multipart dissector crash (bsc#1176908) * CVE-2020-25862: TCP dissector crash (bsc#1176909) * CVE-2020-25866: BLIP dissector crash (bsc#1176910) * CVE-2020-17498: Kafka dissector crash (bsc#1175204) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1878=1 Package List: - openSUSE Leap 15.1 (x86_64): libwireshark13-3.2.7-lp151.2.15.1 libwireshark13-debuginfo-3.2.7-lp151.2.15.1 libwiretap10-3.2.7-lp151.2.15.1 libwiretap10-debuginfo-3.2.7-lp151.2.15.1 libwsutil11-3.2.7-lp151.2.15.1 libwsutil11-debuginfo-3.2.7-lp151.2.15.1 wireshark-3.2.7-lp151.2.15.1 wireshark-debuginfo-3.2.7-lp151.2.15.1 wireshark-debugsource-3.2.7-lp151.2.15.1 wireshark-devel-3.2.7-lp151.2.15.1 wireshark-ui-qt-3.2.7-lp151.2.15.1 wireshark-ui-qt-debuginfo-3.2.7-lp151.2.15.1 References: https://www.suse.com/security/cve/CVE-2020-17498.html https://www.suse.com/security/cve/CVE-2020-25862.html https://www.suse.com/security/cve/CVE-2020-25863.html https://www.suse.com/security/cve/CVE-2020-25866.html https://bugzilla.suse.com/1175204 https://bugzilla.suse.com/1176908 https://bugzilla.suse.com/1176909 https://bugzilla.suse.com/1176910

1 0

openSUSE-SU-2020:1876-1: moderate: Security update for bluez
by opensuse-security＠opensuse.org 08 Nov '20

08 Nov '20

openSUSE Security Update: Security update for bluez ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1876-1 Rating: moderate References: #1177895 Cross-References: CVE-2020-27153 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bluez fixes the following issues: - CVE-2020-27153: Fixed possible crash on disconnect (bsc#1177895). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1876=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): bluez-5.48-lp151.8.15.1 bluez-cups-5.48-lp151.8.15.1 bluez-cups-debuginfo-5.48-lp151.8.15.1 bluez-debuginfo-5.48-lp151.8.15.1 bluez-debugsource-5.48-lp151.8.15.1 bluez-devel-5.48-lp151.8.15.1 bluez-test-5.48-lp151.8.15.1 bluez-test-debuginfo-5.48-lp151.8.15.1 libbluetooth3-5.48-lp151.8.15.1 libbluetooth3-debuginfo-5.48-lp151.8.15.1 - openSUSE Leap 15.1 (x86_64): bluez-devel-32bit-5.48-lp151.8.15.1 libbluetooth3-32bit-5.48-lp151.8.15.1 libbluetooth3-32bit-debuginfo-5.48-lp151.8.15.1 - openSUSE Leap 15.1 (noarch): bluez-auto-enable-devices-5.48-lp151.8.15.1 References: https://www.suse.com/security/cve/CVE-2020-27153.html https://bugzilla.suse.com/1177895

1 0

openSUSE-RU-2020:1877-1: moderate: Recommended update for crmsh
by maintenance＠opensuse.org 08 Nov '20

08 Nov '20

openSUSE Recommended Update: Recommended update for crmsh ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1877-1 Rating: moderate References: #1122391 #1148874 #1165644 #1175708 #1177980 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for crmsh fixes the following issues: - Converting deprecated 'score' in rsc_order to 'kind' (bsc#1122391) - Fixed a bug where crmsh exited with an error, even if the 'error' is actually a warning (bsc#1122391) - Fixed an issue where 'crm cluster remove node' didn't stop nor disable the hawk service on that node (bsc#1175708) - Checks now whether pacemaker.service and corosync.service are already running/stopped (bsc#1177980) - Fixed a bug where the node address was not removed from the corosync.conf file on node removal (bsc#1165644) - Collecting corosync.log in hb_report if it is defined in config file (bsc#1148874) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1877=1 Package List: - openSUSE Leap 15.1 (noarch): crmsh-4.2.0+git.1604052559.2a348644-lp151.2.39.1 crmsh-scripts-4.2.0+git.1604052559.2a348644-lp151.2.39.1 crmsh-test-4.2.0+git.1604052559.2a348644-lp151.2.39.1 References: https://bugzilla.suse.com/1122391 https://bugzilla.suse.com/1148874 https://bugzilla.suse.com/1165644 https://bugzilla.suse.com/1175708 https://bugzilla.suse.com/1177980

1 0

openSUSE-RU-2020:1874-1: moderate: Recommended update for icewm
by maintenance＠opensuse.org 08 Nov '20

08 Nov '20

openSUSE Recommended Update: Recommended update for icewm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1874-1 Rating: moderate References: #1170420 #1173441 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for icewm fixes the following issues: - Fixes an issue where icewm updates could no longer be installed (bsc#1173441, bsc#1170420) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1874=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): icewm-1.4.2-lp152.12.6.1 icewm-debuginfo-1.4.2-lp152.12.6.1 icewm-debugsource-1.4.2-lp152.12.6.1 icewm-default-1.4.2-lp152.12.6.1 icewm-default-debuginfo-1.4.2-lp152.12.6.1 icewm-lite-1.4.2-lp152.12.6.1 icewm-lite-debuginfo-1.4.2-lp152.12.6.1 - openSUSE Leap 15.2 (noarch): icewm-config-upstream-1.4.2-lp152.12.6.1 icewm-lang-1.4.2-lp152.12.6.1 References: https://bugzilla.suse.com/1170420 https://bugzilla.suse.com/1173441

1 0

openSUSE-SU-2020:1875-1: important: Security update for apache-commons-httpclient
by opensuse-security＠opensuse.org 08 Nov '20

08 Nov '20

openSUSE Security Update: Security update for apache-commons-httpclient ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1875-1 Rating: important References: #1178171 #945190 Cross-References: CVE-2014-3577 CVE-2015-5262 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for apache-commons-httpclient fixes the following issues: - http/conn/ssl/SSLConnectionSocketFactory.java ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors. [bsc#945190, CVE-2015-5262] - org.apache.http.conn.ssl.AbstractVerifier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows MITM attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate. [bsc#1178171, CVE-2014-3577] This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1875=1 Package List: - openSUSE Leap 15.2 (noarch): apache-commons-httpclient-3.1-lp152.6.3.1 apache-commons-httpclient-demo-3.1-lp152.6.3.1 apache-commons-httpclient-javadoc-3.1-lp152.6.3.1 apache-commons-httpclient-manual-3.1-lp152.6.3.1 References: https://www.suse.com/security/cve/CVE-2014-3577.html https://www.suse.com/security/cve/CVE-2015-5262.html https://bugzilla.suse.com/1178171 https://bugzilla.suse.com/945190

1 0

openSUSE-RU-2020:1871-1: moderate: Recommended update for yast2-nis-client
by maintenance＠opensuse.org 07 Nov '20

07 Nov '20

openSUSE Recommended Update: Recommended update for yast2-nis-client ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1871-1 Rating: moderate References: #1174603 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-nis-client fixes the following issue: - Fixed the mechanism used to ensure the usage of "compat" for certain databases. (bsc#1174603) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1871=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): yast2-nis-client-4.2.4-lp152.2.3.1 yast2-nis-client-debuginfo-4.2.4-lp152.2.3.1 yast2-nis-client-debugsource-4.2.4-lp152.2.3.1 References: https://bugzilla.suse.com/1174603

1 0

openSUSE-RU-2020:1872-1: critical: Recommended update for salt
by maintenance＠opensuse.org 07 Nov '20

07 Nov '20

openSUSE Recommended Update: Recommended update for salt ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1872-1 Rating: critical References: #1178485 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for salt fixes the following issue: - Avoid regression on "salt-master": set passphrase for salt-ssh keys to empty string (bsc#1178485) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1872=1 Package List: - openSUSE Leap 15.2 (noarch): salt-bash-completion-3000-lp152.3.18.1 salt-fish-completion-3000-lp152.3.18.1 salt-zsh-completion-3000-lp152.3.18.1 - openSUSE Leap 15.2 (x86_64): python2-salt-3000-lp152.3.18.1 python3-salt-3000-lp152.3.18.1 salt-3000-lp152.3.18.1 salt-api-3000-lp152.3.18.1 salt-cloud-3000-lp152.3.18.1 salt-doc-3000-lp152.3.18.1 salt-master-3000-lp152.3.18.1 salt-minion-3000-lp152.3.18.1 salt-proxy-3000-lp152.3.18.1 salt-ssh-3000-lp152.3.18.1 salt-standalone-formulas-configuration-3000-lp152.3.18.1 salt-syndic-3000-lp152.3.18.1 References: https://bugzilla.suse.com/1178485

1 0