March 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2020:0404-1: moderate: Recommended update for metis
by maintenance＠opensuse.org 29 Mar '20

29 Mar '20

openSUSE Recommended Update: Recommended update for metis ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0404-1 Rating: moderate References: Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for metis fixes the following issues: - Add support for gcc8/9 building (jsc#SLE-8604). - Build HPC master package for 'examples'. This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-404=1 Package List: - openSUSE Leap 15.1 (x86_64): libmetis-gnu-hpc-5.1.0-lp151.5.3.1 libmetis5-5.1.0-lp151.5.3.1 libmetis5-debuginfo-5.1.0-lp151.5.3.1 libmetis_5_1_0-gnu-hpc-5.1.0-lp151.5.3.1 libmetis_5_1_0-gnu-hpc-debuginfo-5.1.0-lp151.5.3.1 metis-5.1.0-lp151.5.3.1 metis-debuginfo-5.1.0-lp151.5.3.1 metis-debugsource-5.1.0-lp151.5.3.1 metis-devel-5.1.0-lp151.5.3.1 metis_5_1_0-gnu-hpc-5.1.0-lp151.5.3.1 metis_5_1_0-gnu-hpc-debuginfo-5.1.0-lp151.5.3.1 metis_5_1_0-gnu-hpc-debugsource-5.1.0-lp151.5.3.1 metis_5_1_0-gnu-hpc-devel-5.1.0-lp151.5.3.1 - openSUSE Leap 15.1 (noarch): metis-doc-5.1.0-lp151.5.3.1 metis-examples-5.1.0-lp151.5.3.1 metis-gnu-hpc-5.1.0-lp151.5.3.1 metis-gnu-hpc-devel-5.1.0-lp151.5.3.1 metis-gnu-hpc-doc-5.1.0-lp151.5.3.1 metis-gnu-hpc-examples-5.1.0-lp151.5.3.1 metis_5_1_0-gnu-hpc-doc-5.1.0-lp151.5.3.1 metis_5_1_0-gnu-hpc-examples-5.1.0-lp151.5.3.1 References:

1 0

openSUSE-SU-2020:0405-1: moderate: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 29 Mar '20

29 Mar '20

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0405-1 Rating: moderate References: #1167335 #1167336 #1167337 Cross-References: CVE-2020-10802 CVE-2020-10803 CVE-2020-10804 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for phpMyAdmin to version 4.9.5 fixes the following issues: - phpmyadmin was updated to 4.9.5: - CVE-2020-10804: Fixed an SQL injection in the user accounts page, particularly when changing a password (boo#1167335 PMASA-2020-2). - CVE-2020-10802: Fixed an SQL injection in the search feature (boo#1167336 PMASA-2020-3). - CVE-2020-10803: Fixed an SQL injection and XSS when displaying results (boo#1167337 PMASA-2020-4). - Removed the "options" field for the external transformation. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-405=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): phpMyAdmin-4.9.5-43.1 References: https://www.suse.com/security/cve/CVE-2020-10802.html https://www.suse.com/security/cve/CVE-2020-10803.html https://www.suse.com/security/cve/CVE-2020-10804.html https://bugzilla.suse.com/1167335 https://bugzilla.suse.com/1167336 https://bugzilla.suse.com/1167337

1 0

openSUSE-RU-2020:0407-1: moderate: Recommended update for goaccess
by maintenance＠opensuse.org 29 Mar '20

29 Mar '20

openSUSE Recommended Update: Recommended update for goaccess ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0407-1 Rating: moderate References: #1156207 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for goaccess fixes the following issues: - build with libmaxminddb as GeoIP is discontinued (boo#1156207) - Fixed garbage in HTML reports. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-407=1 Package List: - openSUSE Leap 15.1 (x86_64): goaccess-1.3-lp151.2.3.1 goaccess-debuginfo-1.3-lp151.2.3.1 goaccess-debugsource-1.3-lp151.2.3.1 References: https://bugzilla.suse.com/1156207

1 0

openSUSE-SU-2020:0406-1: moderate: Security update for tor
by opensuse-security＠opensuse.org 29 Mar '20

29 Mar '20

openSUSE Security Update: Security update for tor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0406-1 Rating: moderate References: #1167013 #1167014 Cross-References: CVE-2020-10592 CVE-2020-10593 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for tor to version 0.3.5.10 fixes the following issues: - tor was updated to version 0.3.5.10: - CVE-2020-10592: Fixed a CPU consumption denial of service and timing patterns (boo#1167013) - CVE-2020-10593: Fixed a circuit padding memory leak (boo#1167014) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-406=1 Package List: - openSUSE Leap 15.1 (x86_64): tor-0.3.5.10-lp151.2.3.1 tor-debuginfo-0.3.5.10-lp151.2.3.1 tor-debugsource-0.3.5.10-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-10592.html https://www.suse.com/security/cve/CVE-2020-10593.html https://bugzilla.suse.com/1167013 https://bugzilla.suse.com/1167014

1 0

openSUSE-SU-2020:0409-1: moderate: Security update for python-mysql-connector-python
by opensuse-security＠opensuse.org 29 Mar '20

29 Mar '20

openSUSE Security Update: Security update for python-mysql-connector-python ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0409-1 Rating: moderate References: #1122204 Cross-References: CVE-2019-2435 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-mysql-connector-python fixes the following issues: python-mysql-connector-python was updated to 8.0.19 (boo#1122204 - CVE-2019-2435): - WL#13531: Remove xplugin namespace - WL#13372: DNS SRV support - WL#12738: Specify TLS ciphers to be used by a client or session - BUG#30270760: Fix reserved filed should have a length of 22 - BUG#29417117: Close file in handle load data infile - WL#13330: Single C/Python (Win) MSI installer - WL#13335: Connectors should handle expired password sandbox without SET operations - WL#13194: Add support for Python 3.8 - BUG#29909157: Table scans of floats causes memory leak with the C extension - BUG#25349794: Add read_default_file alias for option_files in connect() - WL#13155: Support new utf8mb4 bin collation - WL#12737: Add overlaps and not_overlaps as operator - WL#12735: Add README.rst and CONTRIBUTING.rst files - WL#12227: Indexing array fields - WL#12085: Support cursor prepared statements with C extension - BUG#29855733: Fix error during connection using charset and collation combination - BUG#29833590: Calling execute() should fetch active results - BUG#21072758: Support for connection attributes classic - WL#12864: Upgrade of Protobuf version to 3.6.1 - WL#12863: Drop support for Django versions older than 1.11 - WL#12489: Support new session reset functionality - WL#12488: Support for session-connect-attributes - WL#12297: Expose metadata about the source and binaries - WL#12225: Prepared statement support - BUG#29324966: Add missing username connection argument for driver compatibility - BUG#29278489: Fix wrong user and group for Solaris packages - BUG#29001628: Fix access by column label in Table.select() - BUG#28479054: Fix Python interpreter crash due to memory corruption - BUG#27897881: Empty LONG BLOB throws an IndexError - BUG#29260128: Disable load data local infile by default - WL#12607: Handling of Default Schema - WL#12493: Standardize count method - WL#12492: Be prepared for initial notice on connection - BUG#28646344: Remove expression parsing on values - BUG#28280321: Fix segmentation fault when using unicode characters in tables - BUG#27794178: Using use_pure=False should raise an error if cext is not available - BUG#27434751: Add a TLS/SSL option to verify server name - WL#12239: Add support for Python 3.7 - WL#12226: Implement connect timeout - WL#11897: Implement connection pooling for xprotocol - BUG#28278352: C extension mysqlx Collection.add() leaks memory in sequential calls - BUG#28037275: Missing bind parameters causes segfault or unclear error message - BUG#27528819: Support special characters in the user and password using URI - WL#11951: Consolidate discrepancies between pure and c extension - WL#11932: Remove Fabric support - WL#11898: Core API v1 alignment - BUG#28188883: Use utf8mb4 as the default character set - BUG#28133321: Fix incorrect columns names representing aggregate functions - BUG#27962293: Fix Django 2.0 and MySQL 8.0 compatibility issues - BUG#27567999: Fix wrong docstring in ModifyStatement.patch() - BUG#27277937: Fix confusing error message when using an unsupported collation - BUG#26834200: Deprecate Row.get_string() method - BUG#26660624: Fix missing install option in documentation - WL#11668: Add SHA256_MEMORY authentication mechanism - WL#11614: Enable C extension by default - WL#11448: New document _id generation support - WL#11282: Support new locking modes NOWAIT and SKIP LOCKED - BUG#27639119: Use a list of dictionaries to store warnings - BUG#27634885: Update error codes for MySQL 8.0.11 - BUG#27589450: Remove upsert functionality from WriteStatement class - BUG#27528842: Fix internal queries open for SQL injection - BUG#27364914: Cursor prepared statements do not convert strings - BUG#24953913: Fix failing unittests - BUG#24948205: Results from JSON_TYPE() are returned as bytearray - BUG#24948186: JSON type results are bytearray instead of corresponding python type - WL#11372: Remove configuration API - WL#11303: Remove CreateTable and CreateView - WL#11281: Transaction savepoints - WL#11278: Collection.create_index - WL#11149: Create Pylint test for mysqlx - WL#11142: Modify/MergePatch - WL#11079: Add support for Python 3.6 - WL#11073: Add caching_sha2_password authentication plugin - WL#10975: Add Single document operations - WL#10974: Add Row locking methods to find and select operations - WL#10973: Allow JSON types as operands for IN operator - WL#10899: Add support for pure Python implementation of Protobuf - WL#10771: Add SHA256 authentication - WL#10053: Configuration handling interface - WL#10772: Cleanup Drop APIs - WL#10770: Ensure all Session connections are secure by default - WL#10754: Forbid modify() and remove() with no condition - WL#10659: Support utf8mb4 as default charset - WL#10658: Remove concept of NodeSession - WL#10657: Move version number to 8.0 - WL#10198: Add Protobuf C++ extension implementation - WL#10004: Document UUID generation - BUG#26175003: Fix Session.sql() when using unicode SQL statements with Python 2.7 - BUG#26161838: Dropping an non-existing index should succeed silently - BUG#26160876: Fix issue when using empty condition in Collection.remove() and Table.delete() - BUG#26029811: Improve error thrown when using an invalid parameter in bind() - BUG#25991574: Fix Collection.remove() and Table.delete() missing filters - WL#10452: Add Protobuf C++ extension for Linux variants and Mac OSX - WL#10081: DevAPI: IPv6 support - BUG#25614860: Fix defined_as method in the view creation - BUG#25519251: SelectStatement does not implement order_by() method - BUG#25436568: Update available operators for XPlugin - BUG#24954006: Add missing items in CHANGES.txt - BUG#24578507: Fix import error using Python 2.6 - BUG#23636962: Fix improper error message when creating a Session - BUG#23568207: Fix default aliases for projection fields - BUG#23567724: Fix operator names - DevAPI: Schema.create_table - DevAPI: Flexible Parameter Lists - DevAPI: New transports: Unix domain socket - DevAPI: Core TLS/SSL options for the mysqlx URI scheme - DevAPI: View DDL with support for partitioning in a cluster / sharding - BUG#24520850: Fix unexpected behavior when using an empty collection name - Add support for Protocol Buffers 3 - Add View support (without DDL) - Implement get_default_schema() method in BaseSchema - DevAPI: Per ReplicaSet SQL execution - DevAPI: XSession accepts a list of routers - DevAPI: Define action on adding empty list of documents - BUG#23729357: Fix fetching BIT datatype - BUG#23583381: Add who_am_i and am_i_real methods to DatabaseObject - BUG#23568257: Add fetch_one method to mysqlx.result - BUG#23550743: Add close method to XSession and NodeSession - BUG#23550057: Add support for URI as connection data - Provide initial implementation of new DevAPI Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-409=1 Package List: - openSUSE Leap 15.1 (noarch): python2-mysql-connector-python-8.0.19-lp151.3.3.1 python3-mysql-connector-python-8.0.19-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-2435.html https://bugzilla.suse.com/1122204

1 0

openSUSE-RU-2020:0408-1: moderate: Recommended update for netsniff-ng
by maintenance＠opensuse.org 29 Mar '20

29 Mar '20

openSUSE Recommended Update: Recommended update for netsniff-ng ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0408-1 Rating: moderate References: Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for netsniff-ng fixes the following issues: GeoIP has been discontinued by Maxmind. Please see https://support.maxmind.com/geolite-legacy-discontinuation-notice/ for details. Without the database GeoIP is useless. Update to version 0.6.6: * implement rotating capture files in netsniff-ng * fixed '--in -' to work again with STDIN in trafgen * fixed -t 0 option to use sendto in trafgen * checksum calculation for ICMP and TCP in astraceroute * fix for reading mirrors from file in astraceroute * use GZIP_ENV instead of GZIP in build system * fixed manpage warnings * added error handling for mismatched address families in mausezahn. Update to version 0.6.5: * add DCCP support to netsniff-ng * fix segfault in mausezahn * add date format strings to --out in netsniff-ng * restore handling of raw hex string passed in on command line in mausezahn * support ICMPv6 checksums in trafgen * improve random mac address generation in mausezahn * man page updates and reformatting Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-408=1 Package List: - openSUSE Leap 15.1 (x86_64): netsniff-ng-0.6.6-lp151.4.3.1 netsniff-ng-debuginfo-0.6.6-lp151.4.3.1 netsniff-ng-debugsource-0.6.6-lp151.4.3.1 References:

1 0

openSUSE-SU-2020:0402-1: moderate: Security update for opera
by opensuse-security＠opensuse.org 29 Mar '20

29 Mar '20

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0402-1 Rating: moderate References: Affected Products: openSUSE Leap 15.1:NonFree ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for opera fixes the following issues: Update to version 67.0.3575.97 - DNA-84063 Open URL in new tab with ‘Go to web address’ in search/copy popup and right mouse click context menu - DNA-84780 Search in Search and Copy popup opens tab in wrong position from popup window - DNA-84786 Crash at Browser::PasteAndGo(std::__1::basic_string const&, WindowOpenDisposition) - DNA-84815 Crash at TabStripModel::GetIndexOfWebContents (content::WebContents const*) - DNA-84937 [Mac] Workspace switching is slow with a lot of tabs opened - DNA-85159 Sidebar-setup not refreshed correctly after signing out from sync Update to version 67.0.3575.79 - CHR-7804 Update chromium on desktop-stable-80-3575 to 80.0.3987.132 - DNA-83766 Opera Ad Blocker extension state is not updated when changing it - DNA-83966 Enable kFeatureSuggestionScoringImproved on all the streams - DNA-84159 Settings – list of workspaces in the settings isn’t updated after reordering - DNA-84396 Inline autocomplete not working when SD becomes the top-scored suggestion - DNA-84711 Wrong autocomplete address for https sites - DNA-84741 No amazon partner extension displayed - DNA-84743 Crash at ExtensionsToolbarContainer::UndoPopOut() - DNA-84776 Bookmarks not fully displayed in Bookmarks Panel - DNA-84817 Crash at Browser::IsSearchAndCopyPopupEnabled() - DNA-84836 Broken video playback in some cases - DNA-84837 Audio decoder broken although available on Windows 7 - DNA-84860 [Mac] Address field not highlighted on hover - DNA-84889 [desktop-stable-80-3575] There’re no basic settings - DNA-84910 Fix output type selection of SW H.264 decoder - DNA-84938 Prepare stable build with Yx 05 edition - DNA-84969 Address bar dropdown launches HTTP GETs for every autocomplete Update to version 67.0.3575.53 - CHR-7792 Update chromium on desktop-stable-80-3575 to 80.0.3987.122 - DNA-84024 ‘Save all Tabs in Speed Dial Folder’ doesn’t work on main context menu - DNA-84056 Submenus are not scrollable - DNA-84061 Expanded bookmark menu overlaps the whole toolbar - DNA-84277 Whole text should be visible - DNA-84412 Dragging tab to different place activates another tab - DNA-84492 Disable any notifications for “default browser” from sweetlabs builds - DNA-84691 Crash when trying to open sidebar context menu - Update to version 67.0.3575.31 - DNA-84077 Hide seek and timer controls in video pop-out for YouTube live streams - DNA-84639 Promote O67 to stable - Complete Opera 67.0 changelog at: https://blogs.opera.com/desktop/changelog-for-67/ Update to version 66.0.3515.103 - DNA-83528 UnpackTest.CanUnpackTarXzFile test fails on OSX 10.15+ - DNA-83568 Add test driver perftests - DNA-84335 [Linux] Widevine is not working due to changed path of libwidevinecdm.so - DNA-84439 Opera extensions update requests are sent to chrome instead of opera servers Update to version 66.0.3515.72 - DNA-79691 Unable to play video on Netflix right after Opera installation - DNA-82102 Wrong cursor and X color of the search fields on Bookmark/History sidebar panels - DNA-82722 Google Translator blocks PDF viewer - DNA-83407 Crash at static void `anonymous namespace”::PureCall() - DNA-83530 Bad colors in Personal news when dark theme turned on - DNA-83531 Dragging speed dial root folders in bookmarks sidebar makes duplicates - DNA-83542 Fix background tabs loading issues - DNA-83806 Crash at opera::RichHintDisplayHandlerViews:: OnWidgetDestroying(views::Widget*) - DNA-83882 Crash at base::Value::Clone() - DNA-84007 Accessibility elements visible on pages after first navigation on Mac Update to version 66.0.3515.44 - CHR-7734 Update chromium on desktop-stable-79-3515 to 79.0.3945.130 - DNA-82635 [Mac] Fix crash when opening power save popup twice - DNA-83587 Fix Crash at opera::ThumbnailHelper::ThumbnailRequest::PopNextFrameToPaint() - DNA-83698 Unregister extensions keybindings when sidebar is hidden - DNA-83757 Stop making thumbnail after history onboarding will show Update to version 66.0.3515.36 - CHR-7717 Update chromium on desktop-stable-79-3515 to 79.0.3945.117 - DNA-81359 Translate “Speed Dials” folder in bookmarks panel - DNA-82627 Unify & streamline tooltip color processing across Opera. - DNA-82800 Enable kFeatureTurnOnFeaturesDownloadedByInstallerOnUpdates on all streams - DNA-83190 Record SwitchToFullSite events on icon clicks. - DNA-83496 Check if history-panel is enabled before showing onboarding. - DNA-83545 Fix a crash in adblocker rule update - DNA-83583 [Mac] Bookmark popup too bright in dark mode - DNA-83608 Set “plat” metadata in crash reports from Linux. Update to version 66.0.3515.27 - DNA-82683 Bookmarks menu is not readable in dark mode after hovering - DNA-83139 [macOS] screenshot is resized - DNA-83204 [Mac] Anchor onboarding widget to history icon on sidebar - DNA-83205 [Mac] Popup looks bad with mode change - DNA-83351 Enable feature on stable/beta - DNA-83366 [Mac] Onboarding popup doesn’t follow the browser window - DNA-83402 Promote O66 to stable - Complete Opera 66.0 changelog at: https://blogs.opera.com/desktop/changelog-for-66/ Update to version 65.0.3467.69 - DNA-82647 Tab icons mixed after Tab closing - DNA-82919 Update wrapper to skip package types when creating repo - DNA-82967 [Mac] Opera crashes on dragging the SSL icon on the URL Bar Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1:NonFree: zypper in -t patch openSUSE-2020-402=1 Package List: - openSUSE Leap 15.1:NonFree (x86_64): opera-67.0.3575.97-lp151.2.12.1 References:

1 0

openSUSE-RU-2020:0401-1: moderate: Recommended update for grub2
by maintenance＠opensuse.org 29 Mar '20

29 Mar '20

openSUSE Recommended Update: Recommended update for grub2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0401-1 Rating: moderate References: #1161641 #1162403 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for grub2 fixes the following issues: - Fix for minix file system detection using grub2-install. (bsc#1161641, bsc#1162403) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-401=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): grub2-2.02-lp151.21.12.1 grub2-branding-upstream-2.02-lp151.21.12.1 grub2-debuginfo-2.02-lp151.21.12.1 grub2-debugsource-2.02-lp151.21.12.1 - openSUSE Leap 15.1 (noarch): grub2-i386-efi-2.02-lp151.21.12.1 grub2-i386-pc-2.02-lp151.21.12.1 grub2-i386-xen-2.02-lp151.21.12.1 grub2-snapper-plugin-2.02-lp151.21.12.1 grub2-systemd-sleep-plugin-2.02-lp151.21.12.1 grub2-x86_64-efi-2.02-lp151.21.12.1 grub2-x86_64-xen-2.02-lp151.21.12.1 References: https://bugzilla.suse.com/1161641 https://bugzilla.suse.com/1162403

1 0

openSUSE-SU-2020:0400-1: moderate: Security update for cloud-init
by opensuse-security＠opensuse.org 29 Mar '20

29 Mar '20

openSUSE Security Update: Security update for cloud-init ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0400-1 Rating: moderate References: #1162936 #1162937 #1163178 Cross-References: CVE-2020-8631 CVE-2020-8632 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for cloud-init fixes the following security issues: - CVE-2020-8631: Replaced the theoretically predictable deterministic RNG with the system RNG (bsc#1162937). - CVE-2020-8632: Increased the default random password length from 9 to 20 (bsc#1162936). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-400=1 Package List: - openSUSE Leap 15.1 (x86_64): cloud-init-19.4-lp151.2.15.1 cloud-init-config-suse-19.4-lp151.2.15.1 cloud-init-doc-19.4-lp151.2.15.1 References: https://www.suse.com/security/cve/CVE-2020-8631.html https://www.suse.com/security/cve/CVE-2020-8632.html https://bugzilla.suse.com/1162936 https://bugzilla.suse.com/1162937 https://bugzilla.suse.com/1163178

1 0

openSUSE-SU-2020:0395-1: important: Recommended update for ruby2.5
by opensuse-security＠opensuse.org 28 Mar '20

28 Mar '20

openSUSE Security Update: Recommended update for ruby2.5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0395-1 Rating: important References: #1140844 #1152990 #1152992 #1152994 #1152995 #1162396 #1164804 Cross-References: CVE-2012-6708 CVE-2015-9251 CVE-2019-15845 CVE-2019-16201 CVE-2019-16254 CVE-2019-16255 CVE-2020-8130 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for ruby2.5 toversion 2.5.7 fixes the following issues: ruby 2.5 was updated to version 2.5.7 - CVE-2020-8130: Fixed a command injection in intree copy of rake (bsc#1164804). - CVE-2019-16255: Fixed a code injection vulnerability of Shell#[] and Shell#test (bsc#1152990). - CVE-2019-16254: Fixed am HTTP response splitting in WEBrick (bsc#1152992). - CVE-2019-15845: Fixed a null injection vulnerability of File.fnmatch and File.fnmatch? (bsc#1152994). - CVE-2019-16201: Fixed a regular expression denial of service of WEBrick Digest access authentication (bsc#1152995). - CVE-2012-6708: Fixed an XSS in JQuery - CVE-2015-9251: Fixed an XSS in JQuery - Fixed unit tests (bsc#1140844) - Removed some unneeded test files (bsc#1162396). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-395=1 Package List: - openSUSE Leap 15.1 (noarch): ruby2.5-doc-ri-2.5.7-lp151.4.6.1 - openSUSE Leap 15.1 (x86_64): libruby2_5-2_5-2.5.7-lp151.4.6.1 libruby2_5-2_5-debuginfo-2.5.7-lp151.4.6.1 ruby2.5-2.5.7-lp151.4.6.1 ruby2.5-debuginfo-2.5.7-lp151.4.6.1 ruby2.5-debugsource-2.5.7-lp151.4.6.1 ruby2.5-devel-2.5.7-lp151.4.6.1 ruby2.5-devel-extra-2.5.7-lp151.4.6.1 ruby2.5-doc-2.5.7-lp151.4.6.1 ruby2.5-stdlib-2.5.7-lp151.4.6.1 ruby2.5-stdlib-debuginfo-2.5.7-lp151.4.6.1 References: https://www.suse.com/security/cve/CVE-2012-6708.html https://www.suse.com/security/cve/CVE-2015-9251.html https://www.suse.com/security/cve/CVE-2019-15845.html https://www.suse.com/security/cve/CVE-2019-16201.html https://www.suse.com/security/cve/CVE-2019-16254.html https://www.suse.com/security/cve/CVE-2019-16255.html https://www.suse.com/security/cve/CVE-2020-8130.html https://bugzilla.suse.com/1140844 https://bugzilla.suse.com/1152990 https://bugzilla.suse.com/1152992 https://bugzilla.suse.com/1152994 https://bugzilla.suse.com/1152995 https://bugzilla.suse.com/1162396 https://bugzilla.suse.com/1164804

1 0