February 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2020:0231-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 18 Feb '20

18 Feb '20

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0231-1 Rating: important References: #1162777 #1163368 Cross-References: CVE-2020-6792 CVE-2020-6793 CVE-2020-6794 CVE-2020-6795 CVE-2020-6797 CVE-2020-6798 CVE-2020-6800 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: - Mozilla Thunderbird 68.5 (bsc#1162777) MFSA 2020-07 (bsc#1163368) * CVE-2020-6793 (bmo#1608539) Out-of-bounds read when processing certain email messages * CVE-2020-6794 (bmo#1606619) Setting a master password post-Thunderbird 52 does not delete unencrypted previously stored passwords * CVE-2020-6795 (bmo#1611105) Crash processing S/MIME messages with multiple signatures * CVE-2020-6797 (bmo#1596668) Extensions granted downloads.open permission could open arbitrary applications on Mac OSX * CVE-2020-6798 (bmo#1602944) Incorrect parsing of template tag could result in JavaScript injection * CVE-2020-6792 (bmo#1609607) Message ID calculcation was based on uninitialized data * CVE-2020-6800 (bmo#1595786, bmo#1596706, bmo#1598543, bmo#1604851, bmo#1605777, bmo#1608580, bmo#1608785) Memory safety bugs fixed in Thunderbird 68.5 * new: Support for Client Identity IMAP/SMTP Service Extension (bmo#1532388) * new: Support for OAuth 2.0 authentication for POP3 accounts (bmo#1538409) * fixed: Status area goes blank during account setup (bmo#1593122) * fixed: Calendar: Could not remove color for default categories (bmo#1584853) * fixed: Calendar: Prevent calendar component loading multiple times (bmo#1606375) * fixed: Calendar: Today pane did not retain width between sessions (bmo#1610207) * unresolved: When upgrading from Thunderbird version 60 to version 68, add-ons are not automatically updated during the upgrade process. They will however be updated during the add- on update check. It is of course possible to reinstall compatible add-ons via the Add-ons Manager or via addons.thunderbird.net. (bmo#1574183) * changed: Calendar: Task and Event tree colours adjusted for the dark theme (bmo#1608344) * fixed: Retrieval of S/MIME certificates from LDAP failed (bmo#1604773) * fixed: Address-parsing crash on some IMAP servers when preference mail.imap.use_envelope_cmd was set (bmo#1609690) * fixed: Incorrect forwarding of HTML messages caused SMTP servers to respond with a timeout (bmo#1222046) * fixed: Calendar: Various parts of the calendar UI stopped working when a second Thunderbird window opened (bmo#1608407) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-231=1 Package List: - openSUSE Leap 15.1 (x86_64): MozillaThunderbird-68.5.0-lp151.2.25.1 MozillaThunderbird-debuginfo-68.5.0-lp151.2.25.1 MozillaThunderbird-debugsource-68.5.0-lp151.2.25.1 MozillaThunderbird-translations-common-68.5.0-lp151.2.25.1 MozillaThunderbird-translations-other-68.5.0-lp151.2.25.1 References: https://www.suse.com/security/cve/CVE-2020-6792.html https://www.suse.com/security/cve/CVE-2020-6793.html https://www.suse.com/security/cve/CVE-2020-6794.html https://www.suse.com/security/cve/CVE-2020-6795.html https://www.suse.com/security/cve/CVE-2020-6797.html https://www.suse.com/security/cve/CVE-2020-6798.html https://www.suse.com/security/cve/CVE-2020-6800.html https://bugzilla.suse.com/1162777 https://bugzilla.suse.com/1163368

1 0

openSUSE-SU-2020:0229-1: moderate: Security update for nextcloud
by opensuse-security＠opensuse.org 17 Feb '20

17 Feb '20

openSUSE Security Update: Security update for nextcloud ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0229-1 Rating: moderate References: #1162766 #1162775 #1162776 #1162781 #1162782 #1162784 Cross-References: CVE-2019-15613 CVE-2019-15621 CVE-2019-15623 CVE-2019-15624 CVE-2020-8118 CVE-2020-8119 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for nextcloud fixes the following issues: Nextcloud was updated to 15.0.14: - NC-SA-2020-002, CVE-2019-15613: workflow rules to depend their behaviour on the file extension when checking file mimetypes (boo#1162766) - NC-SA-2019-016, CVE-2019-15623: Exposure of Private Information caused the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled (boo#1162775) - NC-SA-2019-015, CVE-2019-15624: Improper Input Validation allowed group admins to create users with IDs of system folders (boo#1162776) - NC-SA-2019-012, CVE-2020-8119: Improper authorization caused leaking of previews and files when a file-drop share link is opened via the gallery app (boo#1162781) - NC-SA-2019-014, CVE-2020-8118: An authenticated server-side request forgery allowed to detect local and remote services when adding a new subscription in the calendar application (boo#1162782) - NC-SA-2020-012, CVE-2019-15621: Improper permissions preservation causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link (boo#1162784) - To many changes. For detail see: https://nextcloud.com/changelog/ nextcloud was updated to 13.0.12: - Fix NC-SA-2020-001 - To many changes. For detail see: https://nextcloud.com/changelog/ This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-229=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): nextcloud-15.0.14-bp151.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-15613.html https://www.suse.com/security/cve/CVE-2019-15621.html https://www.suse.com/security/cve/CVE-2019-15623.html https://www.suse.com/security/cve/CVE-2019-15624.html https://www.suse.com/security/cve/CVE-2020-8118.html https://www.suse.com/security/cve/CVE-2020-8119.html https://bugzilla.suse.com/1162766 https://bugzilla.suse.com/1162775 https://bugzilla.suse.com/1162776 https://bugzilla.suse.com/1162781 https://bugzilla.suse.com/1162782 https://bugzilla.suse.com/1162784

1 0

openSUSE-RU-2020:0228-1: moderate: Recommended update for gssproxy
by maintenance＠opensuse.org 16 Feb '20

16 Feb '20

openSUSE Recommended Update: Recommended update for gssproxy ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0228-1 Rating: moderate References: #1024309 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gssproxy fixes the following issues: - Fix paths in tests and replace python's f-string usage - Initial check-in of gssproxy is needed on the NFS server if krb5 is used for NFS authentication using an AD directory server. (bsc#1024309)(FATE#322526) - 'krb5' may need "auth_to_local = RULE:[1:$1@$0]" on the "realms" section when "winbind" is used for nsswitch.conf. (bsc#1024309)(FATE#322526) Also ding-libs was updated from 0.6.0 to 0.6.1 (jsc#ECO-248): - libini now supports validators that check for well-formed INI files. This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-228=1 Package List: - openSUSE Leap 15.1 (x86_64): gssproxy-0.8.2-lp151.3.3.1 gssproxy-debuginfo-0.8.2-lp151.3.3.1 gssproxy-debugsource-0.8.2-lp151.3.3.1 socket_wrapper-1.2.3-lp151.3.3.1 socket_wrapper-debuginfo-1.2.3-lp151.3.3.1 socket_wrapper-debugsource-1.2.3-lp151.3.3.1 References: https://bugzilla.suse.com/1024309

1 0

openSUSE-RU-2020:0227-1: moderate: Recommended update for python-typed-ast
by maintenance＠opensuse.org 16 Feb '20

16 Feb '20

openSUSE Recommended Update: Recommended update for python-typed-ast ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0227-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for python-typed-ast to version 1.4.1 fixes the following issues: Security issue fixed: - Fixed two out-of-bounds array reads (#99). Non-security issues fixed: - update to version 1.4.1: * Clean up old build scripts (#123) * Build artifacts for 3.8 (#127) * Fix build on cpython (3.9) master branch (#128) - version update to 1.4.0 * Fix compilation on Python 3.8 - Do not use the %pytest_arch call but expand it as the tests seem to need more verbosity otherwise they fail sometimes (fishy, but works) - Use %pytest_arch - Add missing fdupes call - version update to 1.3.5 * Counteract PyTuple_SetItem stealing reference in _PyObject_FastCall fallback (#104) - run tests - update to version 1.3.4: * Oops: add the pgenheaders files to the depends lists - update to version 1.3.3: * Don't rely on Python's pgenheaders.h (#101) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-227=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le x86_64): python3-typed-ast-1.4.1-bp151.2.3.1 References:

1 0

openSUSE-RU-2020:0226-1: moderate: Recommended update for calamares
by maintenance＠opensuse.org 16 Feb '20

16 Feb '20

openSUSE Recommended Update: Recommended update for calamares ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0226-1 Rating: moderate References: #1159739 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for calamares fixes the following issues: - Exclude /etc/dracut.conf.d/02-livecd.conf from copying into filesystem, otherwise installation may fail with with "Failed to run dracut on the target" error (boo#1159739) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-226=1 Package List: - openSUSE Leap 15.1 (x86_64): calamares-3.2.15-lp151.4.6.1 calamares-debuginfo-3.2.15-lp151.4.6.1 calamares-debugsource-3.2.15-lp151.4.6.1 calamares-webview-3.2.15-lp151.4.6.1 calamares-webview-debuginfo-3.2.15-lp151.4.6.1 - openSUSE Leap 15.1 (noarch): calamares-branding-upstream-3.2.15-lp151.4.6.1 References: https://bugzilla.suse.com/1159739

1 0

openSUSE-OU-2020:0225-1: Security update for moonjit
by maintenance＠opensuse.org 16 Feb '20

16 Feb '20

openSUSE Optional Update: Security update for moonjit ______________________________________________________________________________ Announcement ID: openSUSE-OU-2020:0225-1 Rating: low References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for moonjit fixes the following issues: - Ship fork of luajit with more active upstream - Obsolete/provide lua51-luajit as it was the old luajit name - Version 2.1.2 building on top of 2.1.0-beta3 with following goodies: * fix for CVE-2019-19391 * Support for ppc64 ppc64le s390 s390x - Still carry the patch luajit-lua-versioned.patch to mark it as compatible with lua 5.1, future 2.2 release should contain support for 5.2 and 5.3 release of LUA Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-225=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 s390x x86_64): libluajit-5_1-2-2.1.2-2.1 moonjit-2.1.2-2.1 moonjit-devel-2.1.2-2.1 References: https://www.suse.com/security/cve/CVE-2019-19391.html

1 0

openSUSE-RU-2020:0224-1: moderate: Recommended update for lxc
by maintenance＠opensuse.org 16 Feb '20

16 Feb '20

openSUSE Recommended Update: Recommended update for lxc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0224-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for lxc fixes the following issues: - BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to shortcut through the -mini flavors. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-224=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): liblxc-devel-3.2.1-bp151.5.9.1 liblxc1-3.2.1-bp151.5.9.1 lxc-3.2.1-bp151.5.9.1 pam_cgfs-3.2.1-bp151.5.9.1 - openSUSE Backports SLE-15-SP1 (noarch): lxc-bash-completion-3.2.1-bp151.5.9.1 References:

1 0

openSUSE-RU-2020:0221-1: moderate: Recommended update for python-imagesize
by maintenance＠opensuse.org 15 Feb '20

15 Feb '20

openSUSE Recommended Update: Recommended update for python-imagesize ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0221-1 Rating: moderate References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for python-imagesize fixes the following issues: This update ships the python-imagesize python module. - Fix python_module macro definition - Typographic corrections to descriptions - update for multipython build - initial version Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-221=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): python-imagesize-0.7.1-2.1 python3-imagesize-0.7.1-2.1 References:

1 0

openSUSE-SU-2020:0222-1: moderate: Security update for hostapd
by opensuse-security＠opensuse.org 15 Feb '20

15 Feb '20

openSUSE Security Update: Security update for hostapd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0222-1 Rating: moderate References: #1056061 Cross-References: CVE-2017-13082 CVE-2019-9494 CVE-2019-9495 CVE-2019-9496 CVE-2019-9497 CVE-2019-9498 CVE-2019-9499 Affected Products: openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for hostapd fixes the following issues: hostapd was updated to version 2.9: * SAE changes - disable use of groups using Brainpool curves - improved protection against side channel attacks [https://w1.fi/security/2019-6/] * EAP-pwd changes - disable use of groups using Brainpool curves - improved protection against side channel attacks [https://w1.fi/security/2019-6/] * fixed FT-EAP initial mobility domain association using PMKSA caching * added configuration of airtime policy * fixed FILS to and RSNE into (Re)Association Response frames * fixed DPP bootstrapping URI parser of channel list * added support for regulatory WMM limitation (for ETSI) * added support for MACsec Key Agreement using IEEE 802.1X/PSK * added experimental support for EAP-TEAP server (RFC 7170) * added experimental support for EAP-TLS server with TLS v1.3 * added support for two server certificates/keys (RSA/ECC) * added AKMSuiteSelector into "STA <addr>" control interface data to determine with AKM was used for an association * added eap_sim_id parameter to allow EAP-SIM/AKA server pseudonym and fast reauthentication use to be disabled * fixed an ECDH operation corner case with OpenSSL Update to version 2.8 * SAE changes - added support for SAE Password Identifier - changed default configuration to enable only group 19 (i.e., disable groups 20, 21, 25, 26 from default configuration) and disable all unsuitable groups completely based on REVmd changes - improved anti-clogging token mechanism and SAE authentication frame processing during heavy CPU load; this mitigates some issues with potential DoS attacks trying to flood an AP with large number of SAE messages - added Finite Cyclic Group field in status code 77 responses - reject use of unsuitable groups based on new implementation guidance in REVmd (allow only FFC groups with prime >= 3072 bits and ECC groups with prime >= 256) - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-1/] (CVE-2019-9494) - fixed confirm message validation in error cases [https://w1.fi/security/2019-3/] (CVE-2019-9496) * EAP-pwd changes - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-2/] (CVE-2019-9495) - verify peer scalar/element [https://w1.fi/security/2019-4/] (CVE-2019-9497 and CVE-2019-9498) - fix message reassembly issue with unexpected fragment [https://w1.fi/security/2019-5/] - enforce rand,mask generation rules more strictly - fix a memory leak in PWE derivation - disallow ECC groups with a prime under 256 bits (groups 25, 26, and 27) * Hotspot 2.0 changes - added support for release number 3 - reject release 2 or newer association without PMF * added support for RSN operating channel validation (CONFIG_OCV=y and configuration parameter ocv=1) * added Multi-AP protocol support * added FTM responder configuration * fixed build with LibreSSL * added FT/RRB workaround for short Ethernet frame padding * fixed KEK2 derivation for FILS+FT * added RSSI-based association rejection from OCE * extended beacon reporting functionality * VLAN changes - allow local VLAN management with remote RADIUS authentication - add WPA/WPA2 passphrase/PSK -based VLAN assignment * OpenSSL: allow systemwide policies to be overridden * extended PEAP to derive EMSK to enable use with ERP/FILS * extended WPS to allow SAE configuration to be added automatically for PSK (wps_cred_add_sae=1) * fixed FT and SA Query Action frame with AP-MLME-in-driver cases * OWE: allow Diffie-Hellman Parameter element to be included with DPP in preparation for DPP protocol extension * RADIUS server: started to accept ERP keyName-NAI as user identity automatically without matching EAP database entry * fixed PTK rekeying with FILS and FT wpa_supplicant: * SAE changes - added support for SAE Password Identifier - changed default configuration to enable only groups 19, 20, 21 (i.e., disable groups 25 and 26) and disable all unsuitable groups completely based on REVmd changes - do not regenerate PWE unnecessarily when the AP uses the anti-clogging token mechanisms - fixed some association cases where both SAE and FT-SAE were enabled on both the station and the selected AP - started to prefer FT-SAE over SAE AKM if both are enabled - started to prefer FT-SAE over FT-PSK if both are enabled - fixed FT-SAE when SAE PMKSA caching is used - reject use of unsuitable groups based on new implementation guidance in REVmd (allow only FFC groups with prime >= 3072 bits and ECC groups with prime >= 256) - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-1/] (CVE-2019-9494) * EAP-pwd changes - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-2/] (CVE-2019-9495) - verify server scalar/element [https://w1.fi/security/2019-4/] (CVE-2019-9499) - fix message reassembly issue with unexpected fragment [https://w1.fi/security/2019-5/] - enforce rand,mask generation rules more strictly - fix a memory leak in PWE derivation - disallow ECC groups with a prime under 256 bits (groups 25, 26, and 27) * fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y * Hotspot 2.0 changes - do not indicate release number that is higher than the one AP supports - added support for release number 3 - enable PMF automatically for network profiles created from credentials * fixed OWE network profile saving * fixed DPP network profile saving * added support for RSN operating channel validation (CONFIG_OCV=y and network profile parameter ocv=1) * added Multi-AP backhaul STA support * fixed build with LibreSSL * number of MKA/MACsec fixes and extensions * extended domain_match and domain_suffix_match to allow list of values * fixed dNSName matching in domain_match and domain_suffix_match when using wolfSSL * started to prefer FT-EAP-SHA384 over WPA-EAP-SUITE-B-192 AKM if both are enabled * extended nl80211 Connect and external authentication to support SAE, FT-SAE, FT-EAP-SHA384 * fixed KEK2 derivation for FILS+FT * extended client_cert file to allow loading of a chain of PEM encoded certificates * extended beacon reporting functionality * extended D-Bus interface with number of new properties * fixed a regression in FT-over-DS with mac80211-based drivers * OpenSSL: allow systemwide policies to be overridden * extended driver flags indication for separate 802.1X and PSK 4-way handshake offload capability * added support for random P2P Device/Interface Address use * extended PEAP to derive EMSK to enable use with ERP/FILS * extended WPS to allow SAE configuration to be added automatically for PSK (wps_cred_add_sae=1) * removed support for the old D-Bus interface (CONFIG_CTRL_IFACE_DBUS) * extended domain_match and domain_suffix_match to allow list of values * added a RSN workaround for misbehaving PMF APs that advertise IGTK/BIP KeyID using incorrect byte order * fixed PTK rekeying with FILS and FT - Enabled CLI editing and history support. Update to version 2.7 * fixed WPA packet number reuse with replayed messages and key reinstallation [http://w1.fi/security/2017-1/] (CVE-2017-13082) (boo#1056061) * added support for FILS (IEEE 802.11ai) shared key authentication * added support for OWE (Opportunistic Wireless Encryption, RFC 8110; and transition mode defined by WFA) * added support for DPP (Wi-Fi Device Provisioning Protocol) * FT: - added local generation of PMK-R0/PMK-R1 for FT-PSK (ft_psk_generate_local=1) - replaced inter-AP protocol with a cleaner design that is more easily extensible; this breaks backward compatibility and requires all APs in the ESS to be updated at the same time to maintain FT functionality - added support for wildcard R0KH/R1KH - replaced r0_key_lifetime (minutes) parameter with ft_r0_key_lifetime (seconds) - fixed wpa_psk_file use for FT-PSK - fixed FT-SAE PMKID matching - added expiration to PMK-R0 and PMK-R1 cache - added IEEE VLAN support (including tagged VLANs) - added support for SHA384 based AKM * SAE - fixed some PMKSA caching cases with SAE - added support for configuring SAE password separately of the WPA2 PSK/passphrase - added option to require MFP for SAE associations (sae_require_pmf=1) - fixed PTK and EAPOL-Key integrity and key-wrap algorithm selection for SAE; note: this is not backwards compatible, i.e., both the AP and station side implementations will need to be update at the same time to maintain interoperability - added support for Password Identifier * hostapd_cli: added support for command history and completion * added support for requesting beacon report * large number of other fixes, cleanup, and extensions * added option to configure EAPOL-Key retry limits (wpa_group_update_count and wpa_pairwise_update_count) * removed all PeerKey functionality * fixed nl80211 AP mode configuration regression with Linux 4.15 and newer * added support for using wolfSSL cryptographic library * fixed some 20/40 MHz coexistence cases where the BSS could drop to 20 MHz even when 40 MHz would be allowed * Hotspot 2.0 - added support for setting Venue URL ANQP-element (venue_url) - added support for advertising Hotspot 2.0 operator icons - added support for Roaming Consortium Selection element - added support for Terms and Conditions - added support for OSEN connection in a shared RSN BSS * added support for using OpenSSL 1.1.1 * added EAP-pwd server support for salted passwords Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-222=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-222=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2020-222=1 Package List: - openSUSE Leap 15.1 (x86_64): hostapd-2.9-lp151.4.3.1 hostapd-debuginfo-2.9-lp151.4.3.1 hostapd-debugsource-2.9-lp151.4.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): hostapd-2.9-bp151.5.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): hostapd-2.9-bp150.15.1 hostapd-debuginfo-2.9-bp150.15.1 hostapd-debugsource-2.9-bp150.15.1 References: https://www.suse.com/security/cve/CVE-2017-13082.html https://www.suse.com/security/cve/CVE-2019-9494.html https://www.suse.com/security/cve/CVE-2019-9495.html https://www.suse.com/security/cve/CVE-2019-9496.html https://www.suse.com/security/cve/CVE-2019-9497.html https://www.suse.com/security/cve/CVE-2019-9498.html https://www.suse.com/security/cve/CVE-2019-9499.html https://bugzilla.suse.com/1056061

1 0

openSUSE-SU-2020:0220-1: moderate: Security update for nextcloud
by opensuse-security＠opensuse.org 15 Feb '20

15 Feb '20

openSUSE Security Update: Security update for nextcloud ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0220-1 Rating: moderate References: #1162766 #1162775 #1162776 #1162781 #1162782 #1162784 Cross-References: CVE-2019-15613 CVE-2019-15621 CVE-2019-15623 CVE-2019-15624 CVE-2020-8118 CVE-2020-8119 Affected Products: openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for nextcloud fixes the following issues: Nextcloud was updated to 15.0.14: - NC-SA-2020-002, CVE-2019-15613: workflow rules to depend their behaviour on the file extension when checking file mimetypes (boo#1162766) - NC-SA-2019-016, CVE-2019-15623: Exposure of Private Information caused the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled (boo#1162775) - NC-SA-2019-015, CVE-2019-15624: Improper Input Validation allowed group admins to create users with IDs of system folders (boo#1162776) - NC-SA-2019-012, CVE-2020-8119: Improper authorization caused leaking of previews and files when a file-drop share link is opened via the gallery app (boo#1162781) - NC-SA-2019-014, CVE-2020-8118: An authenticated server-side request forgery allowed to detect local and remote services when adding a new subscription in the calendar application (boo#1162782) - NC-SA-2020-012, CVE-2019-15621: Improper permissions preservation causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link (boo#1162784) - To many changes. For detail see: https://nextcloud.com/changelog/ nextcloud was updated to 13.0.12: - Fix NC-SA-2020-001 - To many changes. For detail see: https://nextcloud.com/changelog/ Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-220=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-220=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2020-220=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-220=1 Package List: - openSUSE Leap 15.1 (noarch): nextcloud-15.0.14-lp151.2.3.1 - openSUSE Backports SLE-15-SP1 (noarch): nextcloud-15.0.14-bp151.3.3.1 - openSUSE Backports SLE-15 (noarch): nextcloud-13.0.12-bp150.19.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): nextcloud-13.0.12-19.1 References: https://www.suse.com/security/cve/CVE-2019-15613.html https://www.suse.com/security/cve/CVE-2019-15621.html https://www.suse.com/security/cve/CVE-2019-15623.html https://www.suse.com/security/cve/CVE-2019-15624.html https://www.suse.com/security/cve/CVE-2020-8118.html https://www.suse.com/security/cve/CVE-2020-8119.html https://bugzilla.suse.com/1162766 https://bugzilla.suse.com/1162775 https://bugzilla.suse.com/1162776 https://bugzilla.suse.com/1162781 https://bugzilla.suse.com/1162782 https://bugzilla.suse.com/1162784

1 0