April 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2020:0517-1: moderate: Security update for nagios
by opensuse-security＠opensuse.org 14 Apr '20

14 Apr '20

openSUSE Security Update: Security update for nagios ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0517-1 Rating: moderate References: #1028975 #1119832 #1156309 Cross-References: CVE-2018-13441 CVE-2018-13457 CVE-2018-13458 CVE-2018-18245 CVE-2019-3698 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for nagios to version 4.4.5 fixes the following issues: - CVE-2019-3698: Symbolic link following vulnerability in the cronjob allows local attackers to cause cause DoS or potentially escalate privileges. (boo#1156309) - CVE-2018-18245: Fixed XSS vulnerability in Alert Summary report (boo#1119832) - CVE-2018-13441, CVE-2018-13458, CVE-2018-13457: Fixed a few denial of service vulnerabilities caused by null pointer dereference (boo#1101293, boo#1101289, boo#1101290). This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-517=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): nagios-4.4.5-bp151.4.3.1 nagios-contrib-4.4.5-bp151.4.3.1 nagios-devel-4.4.5-bp151.4.3.1 nagios-www-4.4.5-bp151.4.3.1 nagios-www-dch-4.4.5-bp151.4.3.1 - openSUSE Backports SLE-15-SP1 (noarch): nagios-theme-exfoliation-4.4.5-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2018-13441.html https://www.suse.com/security/cve/CVE-2018-13457.html https://www.suse.com/security/cve/CVE-2018-13458.html https://www.suse.com/security/cve/CVE-2018-18245.html https://www.suse.com/security/cve/CVE-2019-3698.html https://bugzilla.suse.com/1028975 https://bugzilla.suse.com/1119832 https://bugzilla.suse.com/1156309

1 0

openSUSE-RU-2020:0515-1: moderate: Recommended update for rpmlint
by maintenance＠opensuse.org 14 Apr '20

14 Apr '20

openSUSE Recommended Update: Recommended update for rpmlint ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0515-1 Rating: moderate References: #1151418 #1157663 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for rpmlint contains the following fixes: - Whitelist sssd infopipe. (bsc#1157663) - Whitelist sysprof3 D-Bus services. (bsc#1151418) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-515=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): rpmlint-mini-1.10-lp151.5.10.1 rpmlint-mini-debuginfo-1.10-lp151.5.10.1 rpmlint-mini-debugsource-1.10-lp151.5.10.1 - openSUSE Leap 15.1 (x86_64): rpmlint-tests-debugsource-84.87+git20181018.60e0249-lp151.9.3.1 - openSUSE Leap 15.1 (noarch): rpmlint-1.10-lp151.9.3.1 References: https://bugzilla.suse.com/1151418 https://bugzilla.suse.com/1157663

1 0

openSUSE-RU-2020:0516-1: moderate: Recommended update for gn, re2
by maintenance＠opensuse.org 14 Apr '20

14 Apr '20

openSUSE Recommended Update: Recommended update for gn, re2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0516-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for gn, re2 fixes the following issues: chromium dependencies were updated: gn was updated to 0.1726: re2 was updated to version 2020-04-01: * Update Unicode data to 13.0.0 * Include the pattern length in "DFA out of memory" errorrs This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-516=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): gn-0.1726-bp151.3.3.1 libre2-6-20200401-bp151.6.15.1 libre2-6-debuginfo-20200401-bp151.6.15.1 re2-debugsource-20200401-bp151.6.15.1 re2-devel-20200401-bp151.6.15.1 - openSUSE Backports SLE-15-SP1 (aarch64_ilp32): libre2-6-64bit-20200401-bp151.6.15.1 libre2-6-64bit-debuginfo-20200401-bp151.6.15.1 References:

1 0

openSUSE-RU-2020:0514-1: moderate: Recommended update for lxc
by maintenance＠opensuse.org 13 Apr '20

13 Apr '20

openSUSE Recommended Update: Recommended update for lxc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0514-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for lxc fixes the following issues: - Fix mis-use of %suse_version when we actually want to check against %sle_version when determining whether lxc-user-nic should be setuid. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-514=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): liblxc-devel-4.0.0-bp151.5.15.1 liblxc1-4.0.0-bp151.5.15.1 lxc-4.0.0-bp151.5.15.1 pam_cgfs-4.0.0-bp151.5.15.1 - openSUSE Backports SLE-15-SP1 (noarch): lxc-bash-completion-4.0.0-bp151.5.15.1 References:

1 0

openSUSE-SU-2020:0513-1: moderate: Security update for ansible
by opensuse-security＠opensuse.org 13 Apr '20

13 Apr '20

openSUSE Security Update: Security update for ansible ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0513-1 Rating: moderate References: #1137479 #1142542 #1142690 #1144453 #1153452 #1154231 #1154232 #1154830 #1157968 #1157969 Cross-References: CVE-2019-10206 CVE-2019-10217 CVE-2019-14846 CVE-2019-14856 CVE-2019-14858 CVE-2019-14864 CVE-2019-14904 CVE-2019-14905 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves 8 vulnerabilities and has two fixes is now available. Description: This update for ansible to version 2.9.6 fixes the following issues: Security issues fixed: - CVE-2019-14904: Fixed a vulnerability in solaris_zone module via crafted solaris zone (boo#1157968). - CVE-2019-14905: Fixed an issue where malicious code could craft filename in nxos_file_copy module (boo#1157969). - CVE-2019-14864: Fixed Splunk and Sumologic callback plugins leak sensitive data in logs (boo#1154830). - CVE-2019-14846: Fixed secrets disclosure on logs due to display is hardcoded to DEBUG level (boo#1153452) - CVE-2019-14856: Fixed insufficient fix for CVE-2019-10206 (boo#1154232) - CVE-2019-14858: Fixed data in the sub parameter fields that will not be masked and will be displayed when run with increased verbosity (boo#1154231) - CVE-2019-10206: ansible-playbook -k and ansible cli tools prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent templates trigger and exposing them. (boo#1142690) - CVE-2019-10217: Fields managing sensitive data should be set as such by no_log feature. Some of these fields in GCP modules are not set properly. service_account_contents() which is common class for all gcp modules is not setting no_log to True. Any sensitive data managed by that function would be leak as an output when running ansible playbooks. (boo#1144453) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-513=1 Package List: - openSUSE Leap 15.1 (noarch): ansible-2.9.6-lp151.2.7.1 ansible-doc-2.9.6-lp151.2.7.1 ansible-test-2.9.6-lp151.2.7.1 References: https://www.suse.com/security/cve/CVE-2019-10206.html https://www.suse.com/security/cve/CVE-2019-10217.html https://www.suse.com/security/cve/CVE-2019-14846.html https://www.suse.com/security/cve/CVE-2019-14856.html https://www.suse.com/security/cve/CVE-2019-14858.html https://www.suse.com/security/cve/CVE-2019-14864.html https://www.suse.com/security/cve/CVE-2019-14904.html https://www.suse.com/security/cve/CVE-2019-14905.html https://bugzilla.suse.com/1137479 https://bugzilla.suse.com/1142542 https://bugzilla.suse.com/1142690 https://bugzilla.suse.com/1144453 https://bugzilla.suse.com/1153452 https://bugzilla.suse.com/1154231 https://bugzilla.suse.com/1154232 https://bugzilla.suse.com/1154830 https://bugzilla.suse.com/1157968 https://bugzilla.suse.com/1157969

1 0

openSUSE-RU-2020:0509-1: important: Recommended update for libstorage-ng
by maintenance＠opensuse.org 12 Apr '20

12 Apr '20

openSUSE Recommended Update: Recommended update for libstorage-ng ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0509-1 Rating: important References: #1161775 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libstorage-ng fixes the following issues: - Remove warning popup occured by clusterd VGs also in vgchange command. (bsc#1161775) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-509=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libstorage-ng-debuginfo-4.1.110-lp151.3.19.1 libstorage-ng-debugsource-4.1.110-lp151.3.19.1 libstorage-ng-devel-4.1.110-lp151.3.19.1 libstorage-ng-integration-tests-4.1.110-lp151.3.19.1 libstorage-ng-python3-4.1.110-lp151.3.19.1 libstorage-ng-python3-debuginfo-4.1.110-lp151.3.19.1 libstorage-ng-ruby-4.1.110-lp151.3.19.1 libstorage-ng-ruby-debuginfo-4.1.110-lp151.3.19.1 libstorage-ng-utils-4.1.110-lp151.3.19.1 libstorage-ng-utils-debuginfo-4.1.110-lp151.3.19.1 libstorage-ng1-4.1.110-lp151.3.19.1 libstorage-ng1-debuginfo-4.1.110-lp151.3.19.1 - openSUSE Leap 15.1 (noarch): libstorage-ng-lang-4.1.110-lp151.3.19.1 References: https://bugzilla.suse.com/1161775

1 0

openSUSE-SU-2020:0511-1: moderate: Security update for permissions
by opensuse-security＠opensuse.org 12 Apr '20

12 Apr '20

openSUSE Security Update: Security update for permissions ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0511-1 Rating: moderate References: #1168364 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for permissions fixes the following issues: - Fixed spelling of icinga group (bsc#1168364) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-511=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): permissions-20181116-lp151.4.18.1 permissions-debuginfo-20181116-lp151.4.18.1 permissions-debugsource-20181116-lp151.4.18.1 - openSUSE Leap 15.1 (noarch): permissions-zypp-plugin-20181116-lp151.4.18.1 References: https://bugzilla.suse.com/1168364

1 0

openSUSE-SU-2020:0512-1: important: Security update for chromium
by opensuse-security＠opensuse.org 12 Apr '20

12 Apr '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0512-1 Rating: important References: #1167465 #1168421 Cross-References: CVE-2020-6450 CVE-2020-6451 CVE-2020-6452 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for chromium fixes the following issues: chromium was updated to 80.0.3987.162 boo#1168421: * CVE-2020-6450: Use after free in WebAudio. * CVE-2020-6451: Use after free in WebAudio. * CVE-2020-6452: Heap buffer overflow in media. - Use a symbolic icon for GNOME Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-512=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 x86_64): chromedriver-80.0.3987.162-44.1 chromium-80.0.3987.162-44.1 References: https://www.suse.com/security/cve/CVE-2020-6450.html https://www.suse.com/security/cve/CVE-2020-6451.html https://www.suse.com/security/cve/CVE-2020-6452.html https://bugzilla.suse.com/1167465 https://bugzilla.suse.com/1168421

1 0

openSUSE-SU-2020:0510-1: moderate: Security update for libssh
by opensuse-security＠opensuse.org 12 Apr '20

12 Apr '20

openSUSE Security Update: Security update for libssh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0510-1 Rating: moderate References: #1168699 Cross-References: CVE-2020-1730 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libssh fixes the following issues: - CVE-2020-1730: Fixed a possible denial of service when using AES-CTR (bsc#1168699). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-510=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libssh-debugsource-0.8.7-lp151.2.12.1 libssh-devel-0.8.7-lp151.2.12.1 libssh4-0.8.7-lp151.2.12.1 libssh4-debuginfo-0.8.7-lp151.2.12.1 - openSUSE Leap 15.1 (x86_64): libssh4-32bit-0.8.7-lp151.2.12.1 libssh4-32bit-debuginfo-0.8.7-lp151.2.12.1 References: https://www.suse.com/security/cve/CVE-2020-1730.html https://bugzilla.suse.com/1168699

1 0

openSUSE-RU-2020:0508-1: moderate: Recommended update for gn, re2
by maintenance＠opensuse.org 12 Apr '20

12 Apr '20

openSUSE Recommended Update: Recommended update for gn, re2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0508-1 Rating: moderate References: Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for gn, re2 fixes the following issues: chromium dependencies were updated: gn was updated to 0.1726: re2 was updated to version 2020-04-01: * Update Unicode data to 13.0.0 * Include the pattern length in "DFA out of memory" errorrs Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-508=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libre2-6-20200401-lp151.10.9.1 libre2-6-debuginfo-20200401-lp151.10.9.1 re2-debugsource-20200401-lp151.10.9.1 re2-devel-20200401-lp151.10.9.1 - openSUSE Leap 15.1 (x86_64): gn-0.1726-lp151.2.3.1 gn-debuginfo-0.1726-lp151.2.3.1 gn-debugsource-0.1726-lp151.2.3.1 libre2-6-32bit-20200401-lp151.10.9.1 libre2-6-32bit-debuginfo-20200401-lp151.10.9.1 References:

1 0