March 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2020:0318-1: moderate: Recommended update for python3-ec2imgutils
by maintenance＠opensuse.org 08 Mar '20

08 Mar '20

openSUSE Recommended Update: Recommended update for python3-ec2imgutils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0318-1 Rating: moderate References: #1162712 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python3-ec2imgutils fixes the following issues: - Enabling ena-support for aarch64 automatically (bsc#1162712) - Fixes the cleanup procedure with --use-root-swap img upload - Fixes a race condition error on security group creation This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-318=1 Package List: - openSUSE Leap 15.1 (noarch): python3-ec2imgutils-7.0.8-lp151.2.6.1 References: https://bugzilla.suse.com/1162712

1 0

openSUSE-RU-2020:0317-1: moderate: Recommended update for cyrus-sasl
by maintenance＠opensuse.org 08 Mar '20

08 Mar '20

openSUSE Recommended Update: Recommended update for cyrus-sasl ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0317-1 Rating: moderate References: #1162518 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for cyrus-sasl fixes the following issues: - Added support for retrieving negotiated SSF in gssapi plugin (bsc#1162518) - Fixed GSS-SPNEGO to use flags negotiated by GSSAPI for SSF (bsc#1162518) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-317=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): cyrus-sasl-2.1.26-lp151.6.3.1 cyrus-sasl-crammd5-2.1.26-lp151.6.3.1 cyrus-sasl-crammd5-debuginfo-2.1.26-lp151.6.3.1 cyrus-sasl-debuginfo-2.1.26-lp151.6.3.1 cyrus-sasl-debugsource-2.1.26-lp151.6.3.1 cyrus-sasl-devel-2.1.26-lp151.6.3.1 cyrus-sasl-digestmd5-2.1.26-lp151.6.3.1 cyrus-sasl-digestmd5-debuginfo-2.1.26-lp151.6.3.1 cyrus-sasl-gs2-2.1.26-lp151.6.3.1 cyrus-sasl-gs2-debuginfo-2.1.26-lp151.6.3.1 cyrus-sasl-gssapi-2.1.26-lp151.6.3.1 cyrus-sasl-gssapi-debuginfo-2.1.26-lp151.6.3.1 cyrus-sasl-ntlm-2.1.26-lp151.6.3.1 cyrus-sasl-ntlm-debuginfo-2.1.26-lp151.6.3.1 cyrus-sasl-otp-2.1.26-lp151.6.3.1 cyrus-sasl-otp-debuginfo-2.1.26-lp151.6.3.1 cyrus-sasl-plain-2.1.26-lp151.6.3.1 cyrus-sasl-plain-debuginfo-2.1.26-lp151.6.3.1 cyrus-sasl-scram-2.1.26-lp151.6.3.1 cyrus-sasl-scram-debuginfo-2.1.26-lp151.6.3.1 libsasl2-3-2.1.26-lp151.6.3.1 libsasl2-3-debuginfo-2.1.26-lp151.6.3.1 - openSUSE Leap 15.1 (x86_64): cyrus-sasl-32bit-2.1.26-lp151.6.3.1 cyrus-sasl-32bit-debuginfo-2.1.26-lp151.6.3.1 cyrus-sasl-crammd5-32bit-2.1.26-lp151.6.3.1 cyrus-sasl-crammd5-32bit-debuginfo-2.1.26-lp151.6.3.1 cyrus-sasl-devel-32bit-2.1.26-lp151.6.3.1 cyrus-sasl-digestmd5-32bit-2.1.26-lp151.6.3.1 cyrus-sasl-digestmd5-32bit-debuginfo-2.1.26-lp151.6.3.1 cyrus-sasl-gssapi-32bit-2.1.26-lp151.6.3.1 cyrus-sasl-gssapi-32bit-debuginfo-2.1.26-lp151.6.3.1 cyrus-sasl-ldap-auxprop-2.1.26-lp151.6.3.1 cyrus-sasl-ldap-auxprop-debuginfo-2.1.26-lp151.6.3.1 cyrus-sasl-otp-32bit-2.1.26-lp151.6.3.1 cyrus-sasl-otp-32bit-debuginfo-2.1.26-lp151.6.3.1 cyrus-sasl-plain-32bit-2.1.26-lp151.6.3.1 cyrus-sasl-plain-32bit-debuginfo-2.1.26-lp151.6.3.1 cyrus-sasl-saslauthd-2.1.26-lp151.6.3.1 cyrus-sasl-saslauthd-debuginfo-2.1.26-lp151.6.3.1 cyrus-sasl-saslauthd-debugsource-2.1.26-lp151.6.3.1 cyrus-sasl-sqlauxprop-2.1.26-lp151.6.3.1 cyrus-sasl-sqlauxprop-debuginfo-2.1.26-lp151.6.3.1 libsasl2-3-32bit-2.1.26-lp151.6.3.1 libsasl2-3-32bit-debuginfo-2.1.26-lp151.6.3.1 References: https://bugzilla.suse.com/1162518

1 0

openSUSE-RU-2020:0316-1: moderate: Recommended update for ca-certificates-mozilla
by maintenance＠opensuse.org 08 Mar '20

08 Mar '20

openSUSE Recommended Update: Recommended update for ca-certificates-mozilla ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0316-1 Rating: moderate References: #1160160 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ca-certificates-mozilla to 2.40 fixes the following issues: Updated to 2.40 state of the Mozilla NSS Certificate store (bsc#1160160): Removed certificates: - Certplus Class 2 Primary CA - Deutsche Telekom Root CA 2 - CN=Swisscom Root CA 2 - UTN-USERFirst-Client Authentication and Email added certificates: - Entrust Root Certification Authority - G4 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-316=1 Package List: - openSUSE Leap 15.1 (noarch): ca-certificates-mozilla-2.40-lp151.2.6.1 References: https://bugzilla.suse.com/1160160

1 0

openSUSE-SU-2020:0314-1: moderate: Security update for ovmf
by opensuse-security＠opensuse.org 08 Mar '20

08 Mar '20

openSUSE Security Update: Security update for ovmf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0314-1 Rating: moderate References: #1153072 #1163927 #1163959 #1163969 Cross-References: CVE-2019-14553 CVE-2019-14559 CVE-2019-14563 CVE-2019-14575 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for ovmf fixes the following issues: Security issues fixed: - CVE-2019-14563: Fixed a memory corruption caused by insufficient numeric truncation (bsc#1163959). - CVE-2019-14553: Fixed the TLS certification verification in HTTPS-over-IPv6 boot sequences (bsc#1153072). - CVE-2019-14559: Fixed a remotely exploitable memory leak in the ARP handling code (bsc#1163927). - CVE-2019-14575: Fixed an insufficient signature check in the DxeImageVerificationHandler (bsc#1163969). - Enabled HTTPS-over-IPv6 (bsc#1153072). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-314=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): ovmf-2017+git1510945757.b2662641d5-lp151.11.3.1 ovmf-tools-2017+git1510945757.b2662641d5-lp151.11.3.1 - openSUSE Leap 15.1 (x86_64): qemu-ovmf-x86_64-debug-2017+git1510945757.b2662641d5-lp151.11.3.1 - openSUSE Leap 15.1 (noarch): qemu-ovmf-ia32-2017+git1510945757.b2662641d5-lp151.11.3.1 qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-lp151.11.3.1 References: https://www.suse.com/security/cve/CVE-2019-14553.html https://www.suse.com/security/cve/CVE-2019-14559.html https://www.suse.com/security/cve/CVE-2019-14563.html https://www.suse.com/security/cve/CVE-2019-14575.html https://bugzilla.suse.com/1153072 https://bugzilla.suse.com/1163927 https://bugzilla.suse.com/1163959 https://bugzilla.suse.com/1163969

1 0

openSUSE-RU-2020:0313-1: important: Recommended update for supportutils
by maintenance＠opensuse.org 08 Mar '20

08 Mar '20

openSUSE Recommended Update: Recommended update for supportutils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0313-1 Rating: important References: #1023308 #1089877 #1145233 #1154482 #1156837 #1162357 #1162539 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 7 recommended fixes can now be installed. Description: This update for supportutils fixes the following issues: - Exclude /proc/pagetypeinfo as it can be an expensive operation on some systems (bsc#1162357). - Readded LPM/DLPAR data for power (bsc#1162539). - Strip trailing commas from process names #64 (bsc#1156837). - Dynamically select compression method (bsc#1145233). - Updated detailed unit information fix in systemd.txt (bsc#1023308). - Include IPv6 routes (bsc#1089877). - Removed root .snapshots directory from full file list (bsc#1154482). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-313=1 Package List: - openSUSE Leap 15.1 (noarch): supportutils-3.1.7-lp151.2.9.1 References: https://bugzilla.suse.com/1023308 https://bugzilla.suse.com/1089877 https://bugzilla.suse.com/1145233 https://bugzilla.suse.com/1154482 https://bugzilla.suse.com/1156837 https://bugzilla.suse.com/1162357 https://bugzilla.suse.com/1162539

1 0

openSUSE-RU-2020:0311-1: moderate: Recommended update for mariadb-connector-c
by maintenance＠opensuse.org 07 Mar '20

07 Mar '20

openSUSE Recommended Update: Recommended update for mariadb-connector-c ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0311-1 Rating: moderate References: #1162388 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for mariadb-connector-c fixes the following issues: New upstream version 3.1.7 (bsc#1162388) - TLS/SSL: when the client doesn't provide a CA file and the option ssl_verify_server_cert was set, the peer certificate will be validated against the system CA. - ERROR 2026 (HY000): SSL connection error due to Certificate signature check failed - Provide error code and message for SChannel errors - SEC_E_INVALID_TOKEN when server sends large message during SSL handshake This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-311=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libmariadb-devel-3.1.7-lp151.3.9.1 libmariadb-devel-debuginfo-3.1.7-lp151.3.9.1 libmariadb3-3.1.7-lp151.3.9.1 libmariadb3-debuginfo-3.1.7-lp151.3.9.1 libmariadb_plugins-3.1.7-lp151.3.9.1 libmariadb_plugins-debuginfo-3.1.7-lp151.3.9.1 libmariadbprivate-3.1.7-lp151.3.9.1 libmariadbprivate-debuginfo-3.1.7-lp151.3.9.1 mariadb-connector-c-debugsource-3.1.7-lp151.3.9.1 - openSUSE Leap 15.1 (x86_64): libmariadb3-32bit-3.1.7-lp151.3.9.1 libmariadb3-32bit-debuginfo-3.1.7-lp151.3.9.1 References: https://bugzilla.suse.com/1162388

1 0

openSUSE-RU-2020:0309-1: moderate: Recommended update for 389-ds
by maintenance＠opensuse.org 07 Mar '20

07 Mar '20

openSUSE Recommended Update: Recommended update for 389-ds ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0309-1 Rating: moderate References: #1155951 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for 389-ds to version 1.4.2.2 fixes the following issues: 389-ds was updated to 1.4.2.6 (fate#326677, bsc#1155951), bringing many bug and stability fixes. Issue addressed: - Enabled python lib389 installer tooling to match upstream and suse documentation. More information for this release at: https://directory.fedoraproject.org/docs/389ds/releases/release-1-4-2-1.htm l This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-309=1 Package List: - openSUSE Leap 15.1 (noarch): python2-wheel-0.32.3-lp151.2.3.1 python3-wheel-0.32.3-lp151.2.3.1 yast2-auth-server-4.1.1-lp151.2.3.1 - openSUSE Leap 15.1 (x86_64): python-ldap-debuginfo-3.1.0-lp151.2.3.1 python-ldap-debugsource-3.1.0-lp151.2.3.1 python2-ldap-3.1.0-lp151.2.3.1 python2-ldap-debuginfo-3.1.0-lp151.2.3.1 python3-ldap-3.1.0-lp151.2.3.1 python3-ldap-debuginfo-3.1.0-lp151.2.3.1 References: https://bugzilla.suse.com/1155951

1 0

openSUSE-RU-2020:0310-1: moderate: Recommended update for keepassxc
by maintenance＠opensuse.org 07 Mar '20

07 Mar '20

openSUSE Recommended Update: Recommended update for keepassxc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0310-1 Rating: moderate References: #1165293 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for keepassxc fixes the following issues: - Fixed an issue where clicking the tray icon momentarily showed and immediately hid window(boo#1165293). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-310=1 Package List: - openSUSE Leap 15.1 (noarch): keepassxc-lang-2.5.3-lp151.2.15.1 - openSUSE Leap 15.1 (x86_64): keepassxc-2.5.3-lp151.2.15.1 keepassxc-debuginfo-2.5.3-lp151.2.15.1 keepassxc-debugsource-2.5.3-lp151.2.15.1 References: https://bugzilla.suse.com/1165293

1 0

openSUSE-SU-2020:0308-1: important: Security update for python-bleach
by opensuse-security＠opensuse.org 07 Mar '20

07 Mar '20

openSUSE Security Update: Security update for python-bleach ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0308-1 Rating: important References: #1165303 Cross-References: CVE-2020-6802 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-bleach to version 3.1.1 fixes the following issue: - Python-bleach was updated to 3.1.1 - CVE-2020-6802: Fixed mutation XSS vulnerabilities (boo#1165303). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-308=1 Package List: - openSUSE Leap 15.1 (noarch): python2-bleach-3.1.1-lp151.3.6.1 python3-bleach-3.1.1-lp151.3.6.1 References: https://www.suse.com/security/cve/CVE-2020-6802.html https://bugzilla.suse.com/1165303

1 0

openSUSE-SU-2020:0307-1: moderate: Security update for squid
by opensuse-security＠opensuse.org 06 Mar '20

06 Mar '20

openSUSE Security Update: Security update for squid ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0307-1 Rating: moderate References: #1162687 #1162689 #1162691 Cross-References: CVE-2019-12528 CVE-2020-8449 CVE-2020-8450 CVE-2020-8517 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for squid to version 4.10 fixes the following issues: Security issues fixed: - CVE-2019-12528: Fixed an information disclosure flaw in the FTP gateway (bsc#1162689). - CVE-2020-8449: Fixed a buffer overflow when squid is acting as reverse-proxy (bsc#1162687). - CVE-2020-8450: Fixed a buffer overflow when squid is acting as reverse-proxy (bsc#1162687). - CVE-2020-8517: Fixed a buffer overflow in ext_lm_group_acl when processing NTLM Authentication credentials (bsc#1162691). Non-security issue fixed: - Improved cache handling with chunked responses. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-307=1 Package List: - openSUSE Leap 15.1 (x86_64): squid-4.10-lp151.2.11.1 squid-debuginfo-4.10-lp151.2.11.1 squid-debugsource-4.10-lp151.2.11.1 References: https://www.suse.com/security/cve/CVE-2019-12528.html https://www.suse.com/security/cve/CVE-2020-8449.html https://www.suse.com/security/cve/CVE-2020-8450.html https://www.suse.com/security/cve/CVE-2020-8517.html https://bugzilla.suse.com/1162687 https://bugzilla.suse.com/1162689 https://bugzilla.suse.com/1162691

1 0