November 2020 - openSUSE Updates - openSUSE Mailing Lists

[opensuse-updates] openSUSE-RU-2020:2066-1: Recommended update for bind
by maintenance＠opensuse.org 27 Nov '20

27 Nov '20

openSUSE Recommended Update: Recommended update for bind ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:2066-1 Rating: low References: #1177983 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for bind fixes the following issue: - Build the "Administrator Reference Manual" which is built using python3-Sphinx (bsc#1177983) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2066=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): bind-9.16.6-lp152.14.9.1 bind-chrootenv-9.16.6-lp152.14.9.1 bind-debuginfo-9.16.6-lp152.14.9.1 bind-debugsource-9.16.6-lp152.14.9.1 bind-devel-9.16.6-lp152.14.9.1 bind-utils-9.16.6-lp152.14.9.1 bind-utils-debuginfo-9.16.6-lp152.14.9.1 libbind9-1600-9.16.6-lp152.14.9.1 libbind9-1600-debuginfo-9.16.6-lp152.14.9.1 libdns1605-9.16.6-lp152.14.9.1 libdns1605-debuginfo-9.16.6-lp152.14.9.1 libirs-devel-9.16.6-lp152.14.9.1 libirs1601-9.16.6-lp152.14.9.1 libirs1601-debuginfo-9.16.6-lp152.14.9.1 libisc1606-9.16.6-lp152.14.9.1 libisc1606-debuginfo-9.16.6-lp152.14.9.1 libisccc1600-9.16.6-lp152.14.9.1 libisccc1600-debuginfo-9.16.6-lp152.14.9.1 libisccfg1600-9.16.6-lp152.14.9.1 libisccfg1600-debuginfo-9.16.6-lp152.14.9.1 libns1604-9.16.6-lp152.14.9.1 libns1604-debuginfo-9.16.6-lp152.14.9.1 - openSUSE Leap 15.2 (noarch): bind-doc-9.16.6-lp152.14.9.1 python3-bind-9.16.6-lp152.14.9.1 - openSUSE Leap 15.2 (x86_64): bind-devel-32bit-9.16.6-lp152.14.9.1 libbind9-1600-32bit-9.16.6-lp152.14.9.1 libbind9-1600-32bit-debuginfo-9.16.6-lp152.14.9.1 libdns1605-32bit-9.16.6-lp152.14.9.1 libdns1605-32bit-debuginfo-9.16.6-lp152.14.9.1 libirs1601-32bit-9.16.6-lp152.14.9.1 libirs1601-32bit-debuginfo-9.16.6-lp152.14.9.1 libisc1606-32bit-9.16.6-lp152.14.9.1 libisc1606-32bit-debuginfo-9.16.6-lp152.14.9.1 libisccc1600-32bit-9.16.6-lp152.14.9.1 libisccc1600-32bit-debuginfo-9.16.6-lp152.14.9.1 libisccfg1600-32bit-9.16.6-lp152.14.9.1 libisccfg1600-32bit-debuginfo-9.16.6-lp152.14.9.1 libns1604-32bit-9.16.6-lp152.14.9.1 libns1604-32bit-debuginfo-9.16.6-lp152.14.9.1 References: https://bugzilla.suse.com/1177983

1 0

[opensuse-updates] openSUSE-RU-2020:2061-1: moderate: Recommended update for pam and sudo
by maintenance＠opensuse.org 27 Nov '20

27 Nov '20

openSUSE Recommended Update: Recommended update for pam and sudo ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:2061-1 Rating: moderate References: #1174593 #1177858 #1178727 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for pam and sudo fixes the following issue: pam: - pam_xauth: do not *free* a string which has been successfully passed to *putenv*. (bsc#1177858) - Initialize the local variable *daysleft* to avoid a misleading warning for password expire days. (bsc#1178727) - Run /usr/bin/xauth using the old user's and group's identifiers. (bsc#1174593) sudo: - Fix a problem with pam_xauth which checks effective and real uids to get the real identity of the user. (bsc#1174593) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2061=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): pam-1.3.0-lp152.11.3.1 pam-debuginfo-1.3.0-lp152.11.3.1 pam-debugsource-1.3.0-lp152.11.3.1 pam-devel-1.3.0-lp152.11.3.1 pam-extra-1.3.0-lp152.11.3.1 pam-extra-debuginfo-1.3.0-lp152.11.3.1 sudo-1.8.22-lp152.8.3.1 sudo-debuginfo-1.8.22-lp152.8.3.1 sudo-debugsource-1.8.22-lp152.8.3.1 sudo-devel-1.8.22-lp152.8.3.1 sudo-test-1.8.22-lp152.8.3.1 - openSUSE Leap 15.2 (noarch): pam-doc-1.3.0-lp152.11.3.1 - openSUSE Leap 15.2 (x86_64): pam-32bit-1.3.0-lp152.11.3.1 pam-32bit-debuginfo-1.3.0-lp152.11.3.1 pam-devel-32bit-1.3.0-lp152.11.3.1 pam-extra-32bit-1.3.0-lp152.11.3.1 pam-extra-32bit-debuginfo-1.3.0-lp152.11.3.1 References: https://bugzilla.suse.com/1174593 https://bugzilla.suse.com/1177858 https://bugzilla.suse.com/1178727

1 0

[opensuse-updates] openSUSE-RU-2020:2060-1: moderate: Recommended update for hawk-apiserver
by maintenance＠opensuse.org 27 Nov '20

27 Nov '20

openSUSE Recommended Update: Recommended update for hawk-apiserver ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:2060-1 Rating: moderate References: #1178228 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for hawk-apiserver fixes the following issues: - Update from version 0.0.2 to version 0.0.4: - various enhancement security https related (bsc#1178228) - update to go modules - add -version flag to show build version This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2060=1 Package List: - openSUSE Leap 15.2 (x86_64): hawk-apiserver-0.0.4+git.1604696958.cd5cdf1-lp152.4.3.1 References: https://bugzilla.suse.com/1178228

1 0

[opensuse-updates] openSUSE-RU-2020:2069-1: moderate: Recommended update for tomcat
by maintenance＠opensuse.org 27 Nov '20

27 Nov '20

openSUSE Recommended Update: Recommended update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:2069-1 Rating: moderate References: #1178396 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for tomcat fixes the following issues: - Fixes an issue when after removing package rest remained in 'examples'. - Remove 'tomcat-9.0.init' and '/usr/lib/tmpfiles.d/tomcat.conf' because of using systemd. (bsc#1178396) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2069=1 Package List: - openSUSE Leap 15.2 (noarch): tomcat-9.0.36-lp152.2.13.1 tomcat-admin-webapps-9.0.36-lp152.2.13.1 tomcat-docs-webapp-9.0.36-lp152.2.13.1 tomcat-el-3_0-api-9.0.36-lp152.2.13.1 tomcat-embed-9.0.36-lp152.2.13.1 tomcat-javadoc-9.0.36-lp152.2.13.1 tomcat-jsp-2_3-api-9.0.36-lp152.2.13.1 tomcat-jsvc-9.0.36-lp152.2.13.1 tomcat-lib-9.0.36-lp152.2.13.1 tomcat-servlet-4_0-api-9.0.36-lp152.2.13.1 tomcat-webapps-9.0.36-lp152.2.13.1 References: https://bugzilla.suse.com/1178396

1 0

[opensuse-updates] openSUSE-OU-2020:2072-1: Optional update for brp-check-suse
by maintenance＠opensuse.org 27 Nov '20

27 Nov '20

openSUSE Optional Update: Optional update for brp-check-suse ______________________________________________________________________________ Announcement ID: openSUSE-OU-2020:2072-1 Rating: low References: #1074711 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update for brp-check-suse doesn't fix any runtime specific errors, but improves the packaging related build procedure (bsc#1074711) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2072=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): brp-check-suse-84.87+git20181106.224b37d-lp152.2.3.1 References: https://bugzilla.suse.com/1074711

1 0

[opensuse-updates] openSUSE-SU-2020:2065-1: moderate: Security update for dash
by opensuse-security＠opensuse.org 27 Nov '20

27 Nov '20

openSUSE Security Update: Security update for dash ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2065-1 Rating: moderate References: #1178978 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for dash fixes the following issues: - Fixed an issue where code was executed even if noexec ("-n") was specified (bsc#1178978). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2065=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): dash-0.5.11.2-lp152.4.6.1 dash-debuginfo-0.5.11.2-lp152.4.6.1 dash-debugsource-0.5.11.2-lp152.4.6.1 References: https://bugzilla.suse.com/1178978

1 0

[opensuse-updates] openSUSE-SU-2020:2075-1: important: Security update for ucode-intel
by opensuse-security＠opensuse.org 27 Nov '20

27 Nov '20

openSUSE Security Update: Security update for ucode-intel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2075-1 Rating: important References: #1170446 #1173592 #1173594 #1178971 Cross-References: CVE-2020-8695 CVE-2020-8696 CVE-2020-8698 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for ucode-intel fixes the following issues: - Updated Intel CPU Microcode to 20201118 official release. (bsc#1178971) - Removed TGL/06-8c-01/80 due to functional issues with some OEM platforms. - Updated Intel CPU Microcode to 20201110 official release. - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX) (bsc#1170446) - CVE-2020-8698: Fixed Fast Store Forward Predictor INTEL-SA-00381 (bsc#1173594) - CVE-2020-8696: Vector Register Sampling Active INTEL-SA-00381 (bsc#1173592) - Release notes: - Security updates for [INTEL-SA-00381](https://www.intel.com/content/www/us/en/security-center/ad visory/intel-sa-00381.html). - Security updates for [INTEL-SA-00389](https://www.intel.com/content/www/us/en/security-center/ad visory/intel-sa-00389.html). - Update for functional issues. Refer to [Second Generation Intel�� Xeon�� Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel�� Xeon�� Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [Intel�� Xeon�� Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3- spec-update.html?wapkw=processor+spec+update+e5) for details. - Update for functional issues. Refer to [10th Gen Intel�� Core�� Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/co re/10th-gen-core-families-specification-update.html) for details. - Update for functional issues. Refer to [8th and 9th Gen Intel�� Core�� Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/co re/8th-gen-core-spec-update.html) for details. - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel�� Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-cor e-family-spec-update.html) for details. - Update for functional issues. Refer to [6th Gen Intel�� Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details. - Update for functional issues. Refer to [Intel�� Xeon�� E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-120 0v6-spec-update.html) for details. - Update for functional issues. Refer to [Intel�� Xeon�� E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xe on/xeon-e-2100-specification-update.html) for details. ### New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CPX-SP | A1 | 06-55-0b/bf | | 0700001e | Xeon Scalable Gen3 | LKF | B2/B3 | 06-8a-01/10 | | 00000028 | Core w/Hybrid Technology | TGL | B1 | 06-8c-01/80 | | 00000068 | Core Gen11 Mobile | CML-H | R1 | 06-a5-02/20 | | 000000e0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | | 000000e0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | | 000000e0 | Core Gen10 | CML-U62 V2 | K0 | 06-a6-01/80 | | 000000e0 | Core Gen10 Mobile ### Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKX-SP | B1 | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2 | APL | D0 | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5 | GKL-R | R0 | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile | CML-U62 | A0 | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2075=1 Package List: - openSUSE Leap 15.2 (x86_64): ucode-intel-20201118-lp152.2.8.1 References: https://www.suse.com/security/cve/CVE-2020-8695.html https://www.suse.com/security/cve/CVE-2020-8696.html https://www.suse.com/security/cve/CVE-2020-8698.html https://bugzilla.suse.com/1170446 https://bugzilla.suse.com/1173592 https://bugzilla.suse.com/1173594 https://bugzilla.suse.com/1178971

1 0

[opensuse-updates] openSUSE-SU-2020:2059-1: moderate: Security update for wpa_supplicant
by opensuse-security＠opensuse.org 27 Nov '20

27 Nov '20

openSUSE Security Update: Security update for wpa_supplicant ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2059-1 Rating: moderate References: #1131644 #1131868 #1131870 #1131871 #1131872 #1131874 #1133640 #1144443 #1150934 #1156920 #1166933 #1167331 #930077 #930078 #930079 Cross-References: CVE-2015-4141 CVE-2015-4142 CVE-2015-4143 CVE-2015-8041 CVE-2017-13077 CVE-2017-13078 CVE-2017-13079 CVE-2017-13080 CVE-2017-13081 CVE-2017-13082 CVE-2017-13086 CVE-2017-13087 CVE-2017-13088 CVE-2018-14526 CVE-2019-11555 CVE-2019-13377 CVE-2019-16275 CVE-2019-9494 CVE-2019-9495 CVE-2019-9497 CVE-2019-9498 CVE-2019-9499 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 22 vulnerabilities is now available. Description: This update for wpa_supplicant fixes the following issues: Security issue fixed: - CVE-2019-16275: Fixed an AP mode PMF disconnection protection bypass (bsc#1150934). Non-security issues fixed: - Enable SAE support (jsc#SLE-14992). - Limit P2P_DEVICE name to appropriate ifname size. - Fix wicked wlan (bsc#1156920) - Restore fi.epitest.hostap.WPASupplicant.service (bsc#1167331) - With v2.9 fi.epitest.hostap.WPASupplicant.service is obsolete (bsc#1167331) - Fix WLAN config on boot with wicked. (bsc#1166933) - Update to 2.9 release: * SAE changes - disable use of groups using Brainpool curves - improved protection against side channel attacks [https://w1.fi/security/2019-6/] * EAP-pwd changes - disable use of groups using Brainpool curves - allow the set of groups to be configured (eap_pwd_groups) - improved protection against side channel attacks [https://w1.fi/security/2019-6/] * fixed FT-EAP initial mobility domain association using PMKSA caching (disabled by default for backwards compatibility; can be enabled with ft_eap_pmksa_caching=1) * fixed a regression in OpenSSL 1.1+ engine loading * added validation of RSNE in (Re)Association Response frames * fixed DPP bootstrapping URI parser of channel list * extended EAP-SIM/AKA fast re-authentication to allow use with FILS * extended ca_cert_blob to support PEM format * improved robustness of P2P Action frame scheduling * added support for EAP-SIM/AKA using anonymous@realm identity * fixed Hotspot 2.0 credential selection based on roaming consortium to ignore credentials without a specific EAP method * added experimental support for EAP-TEAP peer (RFC 7170) * added experimental support for EAP-TLS peer with TLS v1.3 * fixed a regression in WMM parameter configuration for a TDLS peer * fixed a regression in operation with drivers that offload 802.1X 4-way handshake * fixed an ECDH operation corner case with OpenSSL * SAE changes - added support for SAE Password Identifier - changed default configuration to enable only groups 19, 20, 21 (i.e., disable groups 25 and 26) and disable all unsuitable groups completely based on REVmd changes - do not regenerate PWE unnecessarily when the AP uses the anti-clogging token mechanisms - fixed some association cases where both SAE and FT-SAE were enabled on both the station and the selected AP - started to prefer FT-SAE over SAE AKM if both are enabled - started to prefer FT-SAE over FT-PSK if both are enabled - fixed FT-SAE when SAE PMKSA caching is used - reject use of unsuitable groups based on new implementation guidance in REVmd (allow only FFC groups with prime >= 3072 bits and ECC groups with prime >= 256) - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-1/] (CVE-2019-9494, bsc#1131868) * EAP-pwd changes - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-2/] (CVE-2019-9495, bsc#1131870) - verify server scalar/element [https://w1.fi/security/2019-4/] (CVE-2019-9497, CVE-2019-9498, CVE-2019-9499, bsc#1131874, bsc#1131872, bsc#1131871, bsc#1131644) - fix message reassembly issue with unexpected fragment [https://w1.fi/security/2019-5/] (CVE-2019-11555, bsc#1133640) - enforce rand,mask generation rules more strictly - fix a memory leak in PWE derivation - disallow ECC groups with a prime under 256 bits (groups 25, 26, and 27) - SAE/EAP-pwd side-channel attack update [https://w1.fi/security/2019-6/] (CVE-2019-13377, bsc#1144443) * fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y * Hotspot 2.0 changes - do not indicate release number that is higher than the one AP supports - added support for release number 3 - enable PMF automatically for network profiles created from credentials * fixed OWE network profile saving * fixed DPP network profile saving * added support for RSN operating channel validation (CONFIG_OCV=y and network profile parameter ocv=1) * added Multi-AP backhaul STA support * fixed build with LibreSSL * number of MKA/MACsec fixes and extensions * extended domain_match and domain_suffix_match to allow list of values * fixed dNSName matching in domain_match and domain_suffix_match when using wolfSSL * started to prefer FT-EAP-SHA384 over WPA-EAP-SUITE-B-192 AKM if both are enabled * extended nl80211 Connect and external authentication to support SAE, FT-SAE, FT-EAP-SHA384 * fixed KEK2 derivation for FILS+FT * extended client_cert file to allow loading of a chain of PEM encoded certificates * extended beacon reporting functionality * extended D-Bus interface with number of new properties * fixed a regression in FT-over-DS with mac80211-based drivers * OpenSSL: allow systemwide policies to be overridden * extended driver flags indication for separate 802.1X and PSK 4-way handshake offload capability * added support for random P2P Device/Interface Address use * extended PEAP to derive EMSK to enable use with ERP/FILS * extended WPS to allow SAE configuration to be added automatically for PSK (wps_cred_add_sae=1) * removed support for the old D-Bus interface (CONFIG_CTRL_IFACE_DBUS) * extended domain_match and domain_suffix_match to allow list of values * added a RSN workaround for misbehaving PMF APs that advertise IGTK/BIP KeyID using incorrect byte order * fixed PTK rekeying with FILS and FT * fixed WPA packet number reuse with replayed messages and key reinstallation [https://w1.fi/security/2017-1/] (CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086, CVE-2017-13087, CVE-2017-13088) * fixed unauthenticated EAPOL-Key decryption in wpa_supplicant [https://w1.fi/security/2018-1/] (CVE-2018-14526) * added support for FILS (IEEE 802.11ai) shared key authentication * added support for OWE (Opportunistic Wireless Encryption, RFC 8110; and transition mode defined by WFA) * added support for DPP (Wi-Fi Device Provisioning Protocol) * added support for RSA 3k key case with Suite B 192-bit level * fixed Suite B PMKSA caching not to update PMKID during each 4-way handshake * fixed EAP-pwd pre-processing with PasswordHashHash * added EAP-pwd client support for salted passwords * fixed a regression in TDLS prohibited bit validation * started to use estimated throughput to avoid undesired signal strength based roaming decision * MACsec/MKA: - new macsec_linux driver interface support for the Linux kernel macsec module - number of fixes and extensions * added support for external persistent storage of PMKSA cache (PMKSA_GET/PMKSA_ADD control interface commands; and MESH_PMKSA_GET/MESH_PMKSA_SET for the mesh case) * fixed mesh channel configuration pri/sec switch case * added support for beacon report * large number of other fixes, cleanup, and extensions * added support for randomizing local address for GAS queries (gas_rand_mac_addr parameter) * fixed EAP-SIM/AKA/AKA' ext auth cases within TLS tunnel * added option for using random WPS UUID (auto_uuid=1) * added SHA256-hash support for OCSP certificate matching * fixed EAP-AKA' to add AT_KDF into Synchronization-Failure * fixed a regression in RSN pre-authentication candidate selection * added option to configure allowed group management cipher suites (group_mgmt network profile parameter) * removed all PeerKey functionality * fixed nl80211 AP and mesh mode configuration regression with Linux 4.15 and newer * added ap_isolate configuration option for AP mode * added support for nl80211 to offload 4-way handshake into the driver * added support for using wolfSSL cryptographic library * SAE - added support for configuring SAE password separately of the WPA2 PSK/passphrase - fixed PTK and EAPOL-Key integrity and key-wrap algorithm selection for SAE; note: this is not backwards compatible, i.e., both the AP and station side implementations will need to be update at the same time to maintain interoperability - added support for Password Identifier - fixed FT-SAE PMKID matching * Hotspot 2.0 - added support for fetching of Operator Icon Metadata ANQP-element - added support for Roaming Consortium Selection element - added support for Terms and Conditions - added support for OSEN connection in a shared RSN BSS - added support for fetching Venue URL information * added support for using OpenSSL 1.1.1 * FT - disabled PMKSA caching with FT since it is not fully functional - added support for SHA384 based AKM - added support for BIP ciphers BIP-CMAC-256, BIP-GMAC-128, BIP-GMAC-256 in addition to previously supported BIP-CMAC-128 - fixed additional IE inclusion in Reassociation Request frame when using FT protocol - Changed service-files for start after network (systemd-networkd). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2059=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): wpa_supplicant-2.9-lp152.8.3.1 wpa_supplicant-debuginfo-2.9-lp152.8.3.1 wpa_supplicant-debugsource-2.9-lp152.8.3.1 wpa_supplicant-gui-2.9-lp152.8.3.1 wpa_supplicant-gui-debuginfo-2.9-lp152.8.3.1 References: https://www.suse.com/security/cve/CVE-2015-4141.html https://www.suse.com/security/cve/CVE-2015-4142.html https://www.suse.com/security/cve/CVE-2015-4143.html https://www.suse.com/security/cve/CVE-2015-8041.html https://www.suse.com/security/cve/CVE-2017-13077.html https://www.suse.com/security/cve/CVE-2017-13078.html https://www.suse.com/security/cve/CVE-2017-13079.html https://www.suse.com/security/cve/CVE-2017-13080.html https://www.suse.com/security/cve/CVE-2017-13081.html https://www.suse.com/security/cve/CVE-2017-13082.html https://www.suse.com/security/cve/CVE-2017-13086.html https://www.suse.com/security/cve/CVE-2017-13087.html https://www.suse.com/security/cve/CVE-2017-13088.html https://www.suse.com/security/cve/CVE-2018-14526.html https://www.suse.com/security/cve/CVE-2019-11555.html https://www.suse.com/security/cve/CVE-2019-13377.html https://www.suse.com/security/cve/CVE-2019-16275.html https://www.suse.com/security/cve/CVE-2019-9494.html https://www.suse.com/security/cve/CVE-2019-9495.html https://www.suse.com/security/cve/CVE-2019-9497.html https://www.suse.com/security/cve/CVE-2019-9498.html https://www.suse.com/security/cve/CVE-2019-9499.html https://bugzilla.suse.com/1131644 https://bugzilla.suse.com/1131868 https://bugzilla.suse.com/1131870 https://bugzilla.suse.com/1131871 https://bugzilla.suse.com/1131872 https://bugzilla.suse.com/1131874 https://bugzilla.suse.com/1133640 https://bugzilla.suse.com/1144443 https://bugzilla.suse.com/1150934 https://bugzilla.suse.com/1156920 https://bugzilla.suse.com/1166933 https://bugzilla.suse.com/1167331 https://bugzilla.suse.com/930077 https://bugzilla.suse.com/930078 https://bugzilla.suse.com/930079

1 0

[opensuse-updates] openSUSE-RU-2020:2058-1: moderate: Recommended update for yast2-cluster
by maintenance＠opensuse.org 27 Nov '20

27 Nov '20

openSUSE Recommended Update: Recommended update for yast2-cluster ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:2058-1 Rating: moderate References: #1178373 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-cluster fixes the following issues: - Include '/etc/sysconfig/nfs' into 'csync2.cfg' for bootstrap of crmsh and yast2-cluster. (bsc#1178373) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2058=1 Package List: - openSUSE Leap 15.2 (noarch): yast2-cluster-4.2.8-lp152.2.6.1 References: https://bugzilla.suse.com/1178373

1 0

[opensuse-updates] openSUSE-SU-2020:2062-1: moderate: Security update for krb5
by opensuse-security＠opensuse.org 27 Nov '20

27 Nov '20

openSUSE Security Update: Security update for krb5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2062-1 Rating: moderate References: #1178512 Cross-References: CVE-2020-28196 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for krb5 fixes the following security issue: - CVE-2020-28196: Fixed an unbounded recursion via an ASN.1-encoded Kerberos message (bsc#1178512). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2062=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): krb5-1.16.3-lp152.5.13.1 krb5-client-1.16.3-lp152.5.13.1 krb5-client-debuginfo-1.16.3-lp152.5.13.1 krb5-debuginfo-1.16.3-lp152.5.13.1 krb5-debugsource-1.16.3-lp152.5.13.1 krb5-devel-1.16.3-lp152.5.13.1 krb5-mini-1.16.3-lp152.5.13.1 krb5-mini-debuginfo-1.16.3-lp152.5.13.1 krb5-mini-debugsource-1.16.3-lp152.5.13.1 krb5-mini-devel-1.16.3-lp152.5.13.1 krb5-plugin-kdb-ldap-1.16.3-lp152.5.13.1 krb5-plugin-kdb-ldap-debuginfo-1.16.3-lp152.5.13.1 krb5-plugin-preauth-otp-1.16.3-lp152.5.13.1 krb5-plugin-preauth-otp-debuginfo-1.16.3-lp152.5.13.1 krb5-plugin-preauth-pkinit-1.16.3-lp152.5.13.1 krb5-plugin-preauth-pkinit-debuginfo-1.16.3-lp152.5.13.1 krb5-server-1.16.3-lp152.5.13.1 krb5-server-debuginfo-1.16.3-lp152.5.13.1 - openSUSE Leap 15.2 (x86_64): krb5-32bit-1.16.3-lp152.5.13.1 krb5-32bit-debuginfo-1.16.3-lp152.5.13.1 krb5-devel-32bit-1.16.3-lp152.5.13.1 References: https://www.suse.com/security/cve/CVE-2020-28196.html https://bugzilla.suse.com/1178512

1 0