May 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2020:0696-1: moderate: Security update for python
by opensuse-security＠opensuse.org 22 May '20

22 May '20

openSUSE Security Update: Security update for python ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0696-1 Rating: moderate References: #1155094 #1162825 Cross-References: CVE-2019-18348 CVE-2019-9674 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for python fixes the following issues: Security issues fixed: - CVE-2019-18348: Fixed a CRLF injection via the host part of the url passed to urlopen(). Now an InvalidURL exception is raised (bsc#1155094). - CVE-2019-9674: Improved the documentation to reflect the dangers of zip-bombs (bsc#1162825). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-696=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libpython2_7-1_0-2.7.17-lp151.10.17.1 libpython2_7-1_0-debuginfo-2.7.17-lp151.10.17.1 python-2.7.17-lp151.10.17.1 python-base-2.7.17-lp151.10.17.1 python-base-debuginfo-2.7.17-lp151.10.17.1 python-base-debugsource-2.7.17-lp151.10.17.1 python-curses-2.7.17-lp151.10.17.1 python-curses-debuginfo-2.7.17-lp151.10.17.1 python-debuginfo-2.7.17-lp151.10.17.1 python-debugsource-2.7.17-lp151.10.17.1 python-demo-2.7.17-lp151.10.17.1 python-devel-2.7.17-lp151.10.17.1 python-gdbm-2.7.17-lp151.10.17.1 python-gdbm-debuginfo-2.7.17-lp151.10.17.1 python-idle-2.7.17-lp151.10.17.1 python-tk-2.7.17-lp151.10.17.1 python-tk-debuginfo-2.7.17-lp151.10.17.1 python-xml-2.7.17-lp151.10.17.1 python-xml-debuginfo-2.7.17-lp151.10.17.1 - openSUSE Leap 15.1 (x86_64): libpython2_7-1_0-32bit-2.7.17-lp151.10.17.1 libpython2_7-1_0-32bit-debuginfo-2.7.17-lp151.10.17.1 python-32bit-2.7.17-lp151.10.17.1 python-32bit-debuginfo-2.7.17-lp151.10.17.1 python-base-32bit-2.7.17-lp151.10.17.1 python-base-32bit-debuginfo-2.7.17-lp151.10.17.1 - openSUSE Leap 15.1 (noarch): python-doc-2.7.17-lp151.10.17.1 python-doc-pdf-2.7.17-lp151.10.17.1 References: https://www.suse.com/security/cve/CVE-2019-18348.html https://www.suse.com/security/cve/CVE-2019-9674.html https://bugzilla.suse.com/1155094 https://bugzilla.suse.com/1162825

1 0

openSUSE-RU-2020:0695-1: moderate: Recommended update for shorewall
by maintenance＠opensuse.org 22 May '20

22 May '20

openSUSE Recommended Update: Recommended update for shorewall ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0695-1 Rating: moderate References: #1047218 #1166114 #833999 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for shorewall to 5.2.4.4 fixes the following issues: - Update to bugfix version 5.2.4.4 + When DYNAMIC_BLACKLIST=ipset... or when SAVE_IPSETS=Yes in shorewall[6].conf, 'shorewall[6] start' could hang. Fixed. + 'shorewall[6] start' would not automatically create dynamic blacklisting ipsets. That has been corrected. - Update to version 5.2.4.2 https://shorewall.org/pub/shorewall/5.2/shorewall-5.2.4/releasenotes.txt - Update to version 5.2.4.1 + Fixes for openSUSE shorewall-init will now ignore 'start' and 'stop' commands, for running firewalls + Spurious messages have been removed - To fix boo#1166114 never restart shorewall-init.service macro service_del_postun is replaced by simpler systemd_postun - Remove conflict between main and lite package. A managing station need main to build configuration and can use -lite to execute it. Users are in charge of choosing which service has to be started and used. - Update to version 5.2.4 https://shorewall.org/pub/shorewall/5.2/shorewall-5.2.4/releasenotes.txt + Previously, when a Shorewall6 firewall was placed into the 'stopped' state, ICMP6 packets required by RFC 4890 were not automatically accepted by the generated ruleset. Beginning with this release, those packets are automatically accepted. + Previously, the output of 'shorewall[6] help' displayed the superseded 'load' command. That text has been deleted. + The QOSExample.html file in the documentation and on the web site previously showed tcrules content for the /etc/shorewall/mangle file (recall that 'mangle' superseded 'tcrules'). That page has been corrected. + The 'Starting and Stopping' and 'Configuration file basics' documents have been updated to align them with the current product behavior. + The 'ipsets' document has been updated to clarify the use of ipsets in the stoppedrules file. - Packaging + shorewall-init package has a removed %service_del_postun macro to close bug boo#1166114 Restarting this service can lock down admin out of the system. + shorewall(6) and shorewall(6)-lite conflict has they shouldn't be installed together on the same system. - Add version to requires in -lite version - Update to minor bugfix version 5.2.3.7 + When DOCKER=Yes, if both the DOCKER-ISOLATE and DOCKER-ISOLATE-STAGE-1 existed then the DOCKER-ISOLATE-STAGE-* chains were not preserved through shorewall state changes. That has been corrected so that both chains are preserved if present. + Previously, the compiler always detected the OLD_CONNTRACK_MATCH capability as being available in IPv6. When OLD_CONNTRACK_MATCH was available, the compiler also mishandled inversion ('!') in the ORIGDEST columns, leading to an assertion failure. Both the incorrect capability detection and the mishandled inversion have been corrected. + During 'enable' processing, if address variables associated with the interface have values different than those when the firewall was last started/restarted/reloaded, then a 'reload' is performed rather than a simple 'enable'. The logic that checks for those changes was incorrect in some configurations, leading to unneeded reload operations. That has been corrected. + When MANGLE_ENABLED=No in shorewall[6].conf, some features requiring use of the mangle table can be allowed, even though the mangle table is not updated. That has been corrected such that use of such features will raise an error. + When the IfEvent(...,reset) action was invoked, the compiler previously emitted a spurious "Resetting..." message. That message has been suppressed. - Packaging + Introduce define conf_need_update to track when we activate the post update warning for users when there's minor or major version update of shorewall boo#1166114 - Update to bugfix minor 5.2.3.6 + Fix for possible start failure when both Docker containers and Libvirt VMs were in use. - Update to bugfix minor 5.2.3.5 + A typo in the FTP documentation has been corrected. + The recommended mss setting when using IPSec with ipcomp has been corrected. + A number of incorrect links in the manpages have been corrected. + The 'bypass' option is now allowed when specifying an NFQUEUE policy. Previously, specifying that option resulted in an error. + Corrected IPv6 Address Range parsing. + Previously, such ranges were required to be of the form [<addr1>-<addr2>] rather than the more standard form [<addr1>]-[<addr2>]. In the snat file (and in nat actions), the latter form was actually flagged as an error while in other contexts, it resulted in a less obvious error being raised. + The manpages have been updated to refer to https://shorewall.org rather than http://www.shorewall.org. - Refresh spec file - Update to bugfix minor 5.2.3.4 + Update release documents. + Correct handling of multi-queue NFQUEUE as a policy. + Correct handling of multi-queue NFQUEUE as a macro parameter. + Correct the description of the 'bypass' NFQUEUE option in shorewall-rules(5). - Update to bugfix minor 5.2.3.3 Previously, if an ipset was specified in an SPORT column, the compiler would raise an error similar to: ERROR: Invalid ipset name () /etc/shorewall/rules (line 44) - Update to bugfix minor 5.2.3.2 Shorewall 5.2 automatically converts an existing 'masq' file to an equivalent 'snat' file. Regrettably, Shorewall 5.2.3 broke that automatic update, such that the following error message was issued: Use of uninitialized value $Shorewall::Nat::raw::currentline in pattern match (m//) at /usr/share/shorewall/Shorewall/Nat.pm line 511, <$currentfile> line nnn. and the generated 'masq' file contains only initial comments. That has been corrected. - Update to bugfix minor 5.2.3.1 release + An issue in the implementation of policy file zone exclusion, released in 5.2.3 has been resolved. In the original release, if more than one zone was excluded then the following error was raised: ERROR: 'all' is not allowed in a source zone list etc/shorewall/policy (line ...) - Update to new 5.2.3 bugfix release http://www.shorewall.net/pub/shorewall/5.2/shorewall-5.2.3/releasenotes.txt This is the retirement of Tom Eastep see. https://sourceforge.net/p/shorewall/mailman/message/36589782/ - Removed module* in file section - Clean-up changes and spec (trailing slashes) - Update to new 5.2.2 bugfix release http://www.shorewall.net/pub/shorewall/5.2/shorewall-5.2.2/releasenotes.txt - Packaging: + As seen with upstream recommend running shorewall update on all version update - Update to major version 5.2.1.4 A lot of changes occurs since last package please consult http://www.shorewall.net/pub/shorewall/5.2/shorewall-5.2.1/releasenotes.txt and the know problem list at http://www.shorewall.net/pub/shorewall/5.2/shorewall-5.2.1/known_problems.t xt - Update your configuration shorewall update Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-695=1 Package List: - openSUSE Leap 15.1 (noarch): shorewall-5.2.4.4-lp151.3.3.1 shorewall-core-5.2.4.4-lp151.3.3.1 shorewall-docs-5.2.4.4-lp151.3.3.1 shorewall-init-5.2.4.4-lp151.3.3.1 shorewall-lite-5.2.4.4-lp151.3.3.1 shorewall6-5.2.4.4-lp151.3.3.1 shorewall6-lite-5.2.4.4-lp151.3.3.1 References: https://bugzilla.suse.com/1047218 https://bugzilla.suse.com/1166114 https://bugzilla.suse.com/833999

1 0

openSUSE-RU-2020:0690-1: moderate: Recommended update for psmisc
by maintenance＠opensuse.org 22 May '20

22 May '20

openSUSE Recommended Update: Recommended update for psmisc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0690-1 Rating: moderate References: #1170247 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for psmisc fixes the following issues: - Allow not unique mounts as well as not unique mountpoint. (bsc#1170247) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-690=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): psmisc-23.0-lp151.7.4.1 psmisc-debuginfo-23.0-lp151.7.4.1 psmisc-debugsource-23.0-lp151.7.4.1 - openSUSE Leap 15.1 (noarch): psmisc-lang-23.0-lp151.7.4.1 References: https://bugzilla.suse.com/1170247

1 0

openSUSE-SU-2020:0670-1: moderate: Security update for nextcloud
by opensuse-security＠opensuse.org 22 May '20

22 May '20

openSUSE Security Update: Security update for nextcloud ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0670-1 Rating: moderate References: #1171572 #1171579 Cross-References: CVE-2020-8154 CVE-2020-8155 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for nextcloud to 18.0.4 fixes the following issues: Security issues fixed: - CVE-2020-8154: Fixed an XSS vulnerability when opening malicious PDFs (NC-SA-2020-018 boo#1171579). - CVE-2020-8155: Fixed a direct object reference vulnerability that allowed attackers to remotely wipe devices of other users (NC-SA-2020-019 boo#1171572). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-670=1 Package List: - openSUSE Leap 15.1 (noarch): nextcloud-18.0.4-lp151.2.6.1 References: https://www.suse.com/security/cve/CVE-2020-8154.html https://www.suse.com/security/cve/CVE-2020-8155.html https://bugzilla.suse.com/1171572 https://bugzilla.suse.com/1171579

1 0

openSUSE-SU-2020:0694-1: moderate: Security update for openconnect
by opensuse-security＠opensuse.org 22 May '20

22 May '20

openSUSE Security Update: Security update for openconnect ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0694-1 Rating: moderate References: #1170452 Cross-References: CVE-2020-12105 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openconnect fixes the following issues: Security issue fixed: - CVE-2020-12105: Fixed the improper handling of negative return values from X509_check_ function calls that might have allowed MITM attacks (bsc#1170452). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-694=1 Package List: - openSUSE Leap 15.1 (noarch): openconnect-lang-7.08-lp151.6.6.1 - openSUSE Leap 15.1 (x86_64): openconnect-7.08-lp151.6.6.1 openconnect-debuginfo-7.08-lp151.6.6.1 openconnect-debugsource-7.08-lp151.6.6.1 openconnect-devel-7.08-lp151.6.6.1 openconnect-doc-7.08-lp151.6.6.1 References: https://www.suse.com/security/cve/CVE-2020-12105.html https://bugzilla.suse.com/1170452

1 0

openSUSE-RU-2020:0671-1: moderate: Recommended update for ocr
by maintenance＠opensuse.org 22 May '20

22 May '20

openSUSE Recommended Update: Recommended update for ocr ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0671-1 Rating: moderate References: #1171636 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ocr fixes the following issues: - Enable openmpi3 build for all SLE versions. (bsc#1171636) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-671=1 Package List: - openSUSE Leap 15.1 (x86_64): ocr_1_0_1-gnu-hpc-1.0.1-lp151.2.6.1 ocr_1_0_1-gnu-hpc-debuginfo-1.0.1-lp151.2.6.1 ocr_1_0_1-gnu-hpc-debugsource-1.0.1-lp151.2.6.1 ocr_1_0_1-gnu-hpc-devel-1.0.1-lp151.2.6.1 ocr_1_0_1-gnu-hpc-doc-1.0.1-lp151.2.6.1 ocr_1_0_1-gnu-hpc-examples-1.0.1-lp151.2.6.1 ocr_1_0_1-gnu-mpich-hpc-1.0.1-lp151.2.6.1 ocr_1_0_1-gnu-mpich-hpc-debuginfo-1.0.1-lp151.2.6.1 ocr_1_0_1-gnu-mpich-hpc-debugsource-1.0.1-lp151.2.6.1 ocr_1_0_1-gnu-mpich-hpc-devel-1.0.1-lp151.2.6.1 ocr_1_0_1-gnu-mpich-hpc-doc-1.0.1-lp151.2.6.1 ocr_1_0_1-gnu-mpich-hpc-examples-1.0.1-lp151.2.6.1 ocr_1_0_1-gnu-mvapich2-hpc-1.0.1-lp151.2.6.1 ocr_1_0_1-gnu-mvapich2-hpc-debuginfo-1.0.1-lp151.2.6.1 ocr_1_0_1-gnu-mvapich2-hpc-debugsource-1.0.1-lp151.2.6.1 ocr_1_0_1-gnu-mvapich2-hpc-devel-1.0.1-lp151.2.6.1 ocr_1_0_1-gnu-mvapich2-hpc-doc-1.0.1-lp151.2.6.1 ocr_1_0_1-gnu-mvapich2-hpc-examples-1.0.1-lp151.2.6.1 ocr_1_0_1-gnu-openmpi1-hpc-1.0.1-lp151.2.6.1 ocr_1_0_1-gnu-openmpi1-hpc-debuginfo-1.0.1-lp151.2.6.1 ocr_1_0_1-gnu-openmpi1-hpc-debugsource-1.0.1-lp151.2.6.1 ocr_1_0_1-gnu-openmpi1-hpc-devel-1.0.1-lp151.2.6.1 ocr_1_0_1-gnu-openmpi1-hpc-doc-1.0.1-lp151.2.6.1 ocr_1_0_1-gnu-openmpi1-hpc-examples-1.0.1-lp151.2.6.1 ocr_1_0_1-gnu-openmpi2-hpc-1.0.1-lp151.2.6.1 ocr_1_0_1-gnu-openmpi2-hpc-debuginfo-1.0.1-lp151.2.6.1 ocr_1_0_1-gnu-openmpi2-hpc-debugsource-1.0.1-lp151.2.6.1 ocr_1_0_1-gnu-openmpi2-hpc-devel-1.0.1-lp151.2.6.1 ocr_1_0_1-gnu-openmpi2-hpc-doc-1.0.1-lp151.2.6.1 ocr_1_0_1-gnu-openmpi2-hpc-examples-1.0.1-lp151.2.6.1 ocr_1_0_1-gnu-openmpi3-hpc-1.0.1-lp151.2.6.1 ocr_1_0_1-gnu-openmpi3-hpc-debuginfo-1.0.1-lp151.2.6.1 ocr_1_0_1-gnu-openmpi3-hpc-debugsource-1.0.1-lp151.2.6.1 ocr_1_0_1-gnu-openmpi3-hpc-devel-1.0.1-lp151.2.6.1 ocr_1_0_1-gnu-openmpi3-hpc-doc-1.0.1-lp151.2.6.1 ocr_1_0_1-gnu-openmpi3-hpc-examples-1.0.1-lp151.2.6.1 - openSUSE Leap 15.1 (noarch): ocr-gnu-hpc-1.0.1-lp151.2.6.1 ocr-gnu-hpc-devel-1.0.1-lp151.2.6.1 ocr-gnu-hpc-doc-1.0.1-lp151.2.6.1 ocr-gnu-hpc-examples-1.0.1-lp151.2.6.1 ocr-gnu-mpich-hpc-1.0.1-lp151.2.6.1 ocr-gnu-mpich-hpc-devel-1.0.1-lp151.2.6.1 ocr-gnu-mpich-hpc-doc-1.0.1-lp151.2.6.1 ocr-gnu-mpich-hpc-examples-1.0.1-lp151.2.6.1 ocr-gnu-mvapich2-hpc-1.0.1-lp151.2.6.1 ocr-gnu-mvapich2-hpc-devel-1.0.1-lp151.2.6.1 ocr-gnu-mvapich2-hpc-doc-1.0.1-lp151.2.6.1 ocr-gnu-mvapich2-hpc-examples-1.0.1-lp151.2.6.1 ocr-gnu-openmpi1-hpc-1.0.1-lp151.2.6.1 ocr-gnu-openmpi1-hpc-devel-1.0.1-lp151.2.6.1 ocr-gnu-openmpi1-hpc-doc-1.0.1-lp151.2.6.1 ocr-gnu-openmpi1-hpc-examples-1.0.1-lp151.2.6.1 ocr-gnu-openmpi2-hpc-1.0.1-lp151.2.6.1 ocr-gnu-openmpi2-hpc-devel-1.0.1-lp151.2.6.1 ocr-gnu-openmpi2-hpc-doc-1.0.1-lp151.2.6.1 ocr-gnu-openmpi2-hpc-examples-1.0.1-lp151.2.6.1 ocr-gnu-openmpi3-hpc-1.0.1-lp151.2.6.1 ocr-gnu-openmpi3-hpc-devel-1.0.1-lp151.2.6.1 ocr-gnu-openmpi3-hpc-doc-1.0.1-lp151.2.6.1 ocr-gnu-openmpi3-hpc-examples-1.0.1-lp151.2.6.1 References: https://bugzilla.suse.com/1171636

1 0

openSUSE-SU-2020:0668-1: moderate: Security update for nextcloud
by opensuse-security＠opensuse.org 17 May '20

17 May '20

openSUSE Security Update: Security update for nextcloud ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0668-1 Rating: moderate References: #1171572 #1171579 Cross-References: CVE-2020-8154 CVE-2020-8155 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for nextcloud to 18.0.4 fixes the following issues: Security issues fixed: - CVE-2020-8154: Fixed an XSS vulnerability when opening malicious PDFs (NC-SA-2020-018 boo#1171579). - CVE-2020-8155: Fixed a direct object reference vulnerability that allowed attackers to remotely wipe devices of other users (NC-SA-2020-019 boo#1171572). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-668=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): nextcloud-18.0.4-bp151.3.9.1 References: https://www.suse.com/security/cve/CVE-2020-8154.html https://www.suse.com/security/cve/CVE-2020-8155.html https://bugzilla.suse.com/1171572 https://bugzilla.suse.com/1171579

1 0

openSUSE-SU-2020:0667-1: moderate: Security update for nextcloud
by opensuse-security＠opensuse.org 17 May '20

17 May '20

openSUSE Security Update: Security update for nextcloud ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0667-1 Rating: moderate References: #1084320 #1171572 #1171579 Cross-References: CVE-2020-8154 CVE-2020-8155 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for nextcloud to 18.0.4 fixes the following issues: Security issues fixed: - CVE-2020-8154: Fixed an XSS vulnerability when opening malicious PDFs (NC-SA-2020-018 boo#1171579). - CVE-2020-8155: Fixed a direct object reference vulnerability that allowed attackers to remotely wipe devices of other users (NC-SA-2020-019 boo#1171572). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-667=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): nextcloud-18.0.4-22.1 References: https://www.suse.com/security/cve/CVE-2020-8154.html https://www.suse.com/security/cve/CVE-2020-8155.html https://bugzilla.suse.com/1084320 https://bugzilla.suse.com/1171572 https://bugzilla.suse.com/1171579

1 0

openSUSE-RU-2020:0666-1: moderate: Recommended update for paraview
by maintenance＠opensuse.org 17 May '20

17 May '20

openSUSE Recommended Update: Recommended update for paraview ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0666-1 Rating: moderate References: #1171061 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for paraview fixes the following issues: Update to version 5.6.3 (boo#1171061): * Bug-fix release: No changelog available from upstream. Changes from version 5.6.1: * See https://blog.kitware.com/paraview-5-6-1-release-notes/ This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-666=1 Package List: - openSUSE Backports SLE-15-SP1 (ppc64le s390x x86_64): paraview-5.6.3-bp151.3.3.1 paraview-devel-5.6.3-bp151.3.3.1 References: https://bugzilla.suse.com/1171061

1 0

openSUSE-RU-2020:0665-1: moderate: Recommended update for dracut
by maintenance＠opensuse.org 16 May '20

16 May '20

openSUSE Recommended Update: Recommended update for dracut ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0665-1 Rating: moderate References: #1165024 #1167656 #1169030 #1169997 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for dracut fixes the following issues: - Solve bringing up network interface prematurely. (bsc#1169030) - shutdown: guard against read-only /run (bsc#1167656) - dracut-init: when is it not possible to load a module, prompt a warning message for dracut instead of a fatal error. (bsc#1169997) - Backport upstream typo fix in dmsquash-live-root.sh so that FSIMG variable is correctly set. (bsc#1165024) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-665=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): dracut-044.2-lp151.2.15.1 dracut-debuginfo-044.2-lp151.2.15.1 dracut-debugsource-044.2-lp151.2.15.1 dracut-fips-044.2-lp151.2.15.1 dracut-ima-044.2-lp151.2.15.1 dracut-tools-044.2-lp151.2.15.1 References: https://bugzilla.suse.com/1165024 https://bugzilla.suse.com/1167656 https://bugzilla.suse.com/1169030 https://bugzilla.suse.com/1169997

1 0

openSUSE-RU-2020:0664-1: moderate: Recommended update for jq
by maintenance＠opensuse.org 16 May '20

16 May '20

openSUSE Recommended Update: Recommended update for jq ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0664-1 Rating: moderate References: #1170838 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for jq fixes the following issues: jq was updated to version 1.6: * Destructuring Alternation * many new builtins (see docs) * Add support for ASAN and UBSAN * Make it easier to use jq with shebangs * Add $ENV builtin variable to access environment * Add JQ_COLORS env var for configuring the output colors * change: Calling jq without a program argument now always assumes "." for the program, regardless of stdin/stdout * fix: Make sorting stable regardless of qsort. - Make jq depend on libjq1, so upgrading jq upgrades both This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-664=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): jq-1.6-lp151.3.3.1 jq-debuginfo-1.6-lp151.3.3.1 jq-debugsource-1.6-lp151.3.3.1 libjq-devel-1.6-lp151.3.3.1 libjq1-1.6-lp151.3.3.1 libjq1-debuginfo-1.6-lp151.3.3.1 References: https://bugzilla.suse.com/1170838

1 0

openSUSE-RU-2020:0663-1: moderate: Recommended update for hawk2
by maintenance＠opensuse.org 16 May '20

16 May '20

openSUSE Recommended Update: Recommended update for hawk2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0663-1 Rating: moderate References: #1054027 #1068942 #1069217 #1069296 #1071481 #1074856 #1076421 #1080439 #1085318 #1085343 #1085515 #1089709 #1089802 #1090562 #1090657 #1090667 #1092108 #1092122 #1093420 #1098637 #1137891 #1158681 #1162221 #1165587 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 24 recommended fixes can now be installed. Description: This update for hawk2 fixes the following issues: WIP * Implement mechanism to switch binaries in case (bsc#1165587) * Work around the removal of Dir::Tmpname#make_tmpname (bsc#1162221) * Fix cib.xml parsing for acl_version (bsc#1158681) * Fix mime type issue in MS windows (bsc#1098637) * Fix nameless cluster display (bsc#1137891) * High: Set secure flag to enforce https (bsc#1090657) * Medium: Improve hawk-server side cookie handling (bsc#1090667) * Medium: Set Symmetrical to False when score is Serialize (bsc#1085515) * Medium: Make resource stop/start icon dependent on target-role (bsc#1076421) * Api: Add advance resource type(group|clone|master|bundle) in resource route(fate#323437) * Api: return nil if elem is nil(fate#323437) in some case, param in determine_online_status_fencing is nil, this will cause NoMethodError * Medium: Fix acl_version check (bsc#1089802) * High: Fetch correct meta data (bsc#1092122) * Medium: Fix history explorer views (bsc#1093420) * High: Update links to release notes and documentation (bsc#1089709) * High: Return after redirect in reports (bsc#1090562) * Medium: Comply routes' id with resources' ID (bsc#1092108) * Api: Add registration route (fate#323437) * High: Calculate guest node state correctly (bsc#1074856) * Use Promotable etc. (bsc#1085318) (bsc#1085343) * High: Fix remote nodes iteration (bsc#1080439) * High: Support guest nodes (bsc#1074856) * Ensure certificate/key is group readable (bsc#1071481) * Test: Add test suit for (bsc#1069296) * Dev: Fix acl_enabled? (bsc#1069296) * Dev: Dev: Handle redirection correctly after renaming resources (bsc#1068942) * Dev: Handle redirection correctly after renaming constraints (bsc#1068942) * Dev: Dev: split rename action for constraints to edit/update (bsc#1068942) * Dev: Refactor resouces.js (bsc#1068942) * Dev: Change the rename path for resources (#bsc#1068942) * Dev: split rename action to edit/update (bsc#1068942) * Fix node/resource event injection in simulator (bsc#1069217) * Show descriptions in cluster config (bsc#1054027) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-663=1 Package List: - openSUSE Leap 15.1 (x86_64): hawk2-2.1.1+git.1585238036.fab19246-lp151.2.9.1 hawk2-debuginfo-2.1.1+git.1585238036.fab19246-lp151.2.9.1 hawk2-debugsource-2.1.1+git.1585238036.fab19246-lp151.2.9.1 References: https://bugzilla.suse.com/1054027 https://bugzilla.suse.com/1068942 https://bugzilla.suse.com/1069217 https://bugzilla.suse.com/1069296 https://bugzilla.suse.com/1071481 https://bugzilla.suse.com/1074856 https://bugzilla.suse.com/1076421 https://bugzilla.suse.com/1080439 https://bugzilla.suse.com/1085318 https://bugzilla.suse.com/1085343 https://bugzilla.suse.com/1085515 https://bugzilla.suse.com/1089709 https://bugzilla.suse.com/1089802 https://bugzilla.suse.com/1090562 https://bugzilla.suse.com/1090657 https://bugzilla.suse.com/1090667 https://bugzilla.suse.com/1092108 https://bugzilla.suse.com/1092122 https://bugzilla.suse.com/1093420 https://bugzilla.suse.com/1098637 https://bugzilla.suse.com/1137891 https://bugzilla.suse.com/1158681 https://bugzilla.suse.com/1162221 https://bugzilla.suse.com/1165587

1 0

openSUSE-RU-2020:0662-1: moderate: Recommended update for hwdata
by maintenance＠opensuse.org 16 May '20

16 May '20

openSUSE Recommended Update: Recommended update for hwdata ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0662-1 Rating: moderate References: #1168806 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for hwdata fixes the following issues: Update from version 0.320 to version 0.324 (bsc#1168806) - Updated pci, usb and vendor ids. - Replace pciutils-ids package providing compatibility symbolic link This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-662=1 Package List: - openSUSE Leap 15.1 (noarch): hwdata-0.334-lp151.2.3.1 References: https://bugzilla.suse.com/1168806

1 0

openSUSE-SU-2020:0661-1: moderate: Security update for mailman
by opensuse-security＠opensuse.org 15 May '20

15 May '20

openSUSE Security Update: Security update for mailman ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0661-1 Rating: moderate References: #1171363 #682920 Cross-References: CVE-2020-12108 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for mailman fixes the following issues: Security issue fixed: - CVE-2020-12108: Fixed a content injection bug (boo#1171363). Non-security issue fixed: - Don't default to invalid hosts for DEFAULT_EMAIL_HOST (boo#682920) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-661=1 Package List: - openSUSE Leap 15.1 (x86_64): mailman-2.1.29-lp151.3.11.1 mailman-debuginfo-2.1.29-lp151.3.11.1 mailman-debugsource-2.1.29-lp151.3.11.1 References: https://www.suse.com/security/cve/CVE-2020-12108.html https://bugzilla.suse.com/1171363 https://bugzilla.suse.com/682920

1 0

openSUSE-RU-2020:0660-1: moderate: Recommended update for salt
by maintenance＠opensuse.org 14 May '20

14 May '20

openSUSE Recommended Update: Recommended update for salt ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0660-1 Rating: moderate References: #1138952 #1167556 #1169800 #1170042 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for salt fixes the following issues: - Fix partition.mkpart to work without fstype. (bsc#1169800) - Fix typo in 'minion_runner' for AESFuncs exposed methods. - Avoid "NameError: name '__salt_system_encoding__' is not defined". (bsc#1138952) - Fix load cached grain "osrelease_info" to prevent exceptions on "pkg.info_installed" on Debian and Ubuntu minion. (bsc#1170042) - Add new custom SUSE capability for saltutil state module. - Backport saltutil state module to 2019.2 codebase. (bsc#1167556) - virt._get_domain: don't raise an exception if there is no VM. This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-660=1 Package List: - openSUSE Leap 15.1 (x86_64): python2-salt-2019.2.0-lp151.5.18.1 python3-salt-2019.2.0-lp151.5.18.1 salt-2019.2.0-lp151.5.18.1 salt-api-2019.2.0-lp151.5.18.1 salt-cloud-2019.2.0-lp151.5.18.1 salt-doc-2019.2.0-lp151.5.18.1 salt-master-2019.2.0-lp151.5.18.1 salt-minion-2019.2.0-lp151.5.18.1 salt-proxy-2019.2.0-lp151.5.18.1 salt-ssh-2019.2.0-lp151.5.18.1 salt-standalone-formulas-configuration-2019.2.0-lp151.5.18.1 salt-syndic-2019.2.0-lp151.5.18.1 - openSUSE Leap 15.1 (noarch): salt-bash-completion-2019.2.0-lp151.5.18.1 salt-fish-completion-2019.2.0-lp151.5.18.1 salt-zsh-completion-2019.2.0-lp151.5.18.1 References: https://bugzilla.suse.com/1138952 https://bugzilla.suse.com/1167556 https://bugzilla.suse.com/1169800 https://bugzilla.suse.com/1170042

1 0

openSUSE-RU-2020:0659-1: moderate: Recommended update for yast2
by maintenance＠opensuse.org 14 May '20

14 May '20

openSUSE Recommended Update: Recommended update for yast2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0659-1 Rating: moderate References: #1146020 #1166778 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for yast2 fixes the following issues: - Fix for removing ip aliases that were marked to be deleted from the interface configuration files. (bsc#1146020) - Reread network interfaces configuration after writing it avoiding wrong values when reopen network configuration dialog during an installation. (bsc#1166778) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-659=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): yast2-4.1.77-lp151.2.19.1 yast2-logs-4.1.77-lp151.2.19.1 References: https://bugzilla.suse.com/1146020 https://bugzilla.suse.com/1166778

1 0

openSUSE-RU-2020:0658-1: moderate: Recommended update for go1.10
by maintenance＠opensuse.org 14 May '20

14 May '20

openSUSE Recommended Update: Recommended update for go1.10 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0658-1 Rating: moderate References: #1098017 #1113978 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for go1.10 fixes the following issues: - Fix build error with gcc on ppc64le. (bsc#1113978, bsc#1098017) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-658=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): go1.10-1.10.8-lp151.2.3.1 go1.10-doc-1.10.8-lp151.2.3.1 - openSUSE Leap 15.1 (x86_64): go1.10-race-1.10.8-lp151.2.3.1 References: https://bugzilla.suse.com/1098017 https://bugzilla.suse.com/1113978

1 0

openSUSE-RU-2020:0657-1: moderate: Recommended update for strawberry
by maintenance＠opensuse.org 13 May '20

13 May '20

openSUSE Recommended Update: Recommended update for strawberry ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0657-1 Rating: moderate References: Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for strawberry fixes the following issues: strawberry was updated to version 0.6.10: * Bugfixes: + Fixed Subsonic album covers not working for albums with non ASCII charcters. + Fixed reading date and genre from individual tracks in CUE sheets. + Fixed resume playback on startup for CUE songs. + Fixed album cover manager not showing complete album titles in the list of album covers. + Fixed save album cover to file saving "no cover" image instead of actual album cover. + Fixed device state text color in devices not being visible when using a dark theme. + Fixed engine and device in context using too large icons when icons were loaded from the system theme. + Fixed "Secure connection setup failed" problem on Windows when playing streams. + Fixed margin for song title text in context. + Fixed UNC paths with non ASCII charcters not working. * Enhancements: + Allowing all characters except slash and backslash when organising music unless options to strip characters is checked. + New option in organising music to remove problematic filename characters that removes less characters than the FAT option. + General improvements to the album cover loader and album cover providers code. + Fixed loading album cover images from album directory for songs added to the playlist from outside of the collection. + Made automatic album cover search work for songs outside of the collection and for streams. + Made album cover search work based on artist + title if album title is not present for providers supporting song/track search. + Update art manual in playlist for local files, devices and CDDA to avoid loading covers multiple times. + Made lyrics search work for streams. + Added "add stream" to menu. + Only showing song length in context when available. + Sort album cover search results by score and pick the best 3 first before trying others to improve album cover search speed. + Make scrobbler work for streams. + Added search for lyrics as a seperate option in context. + Made font and font sizes in context configurable. + Splitting artist and song title to the relevant metadata when artist and song title is sent as title seperated by a dash in streams. + Added label to show collection pixmap disk cache used in settings. + Icreased default collection pixmap disk cache to 360. * New features: + Added back Tidal streaming support. + Added Qobuz album cover provider. * Removed features: + Removed Phonon engine support. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-657=1 Package List: - openSUSE Leap 15.1 (x86_64): strawberry-0.6.10-lp151.2.18.1 strawberry-debuginfo-0.6.10-lp151.2.18.1 strawberry-debugsource-0.6.10-lp151.2.18.1 References:

1 0

openSUSE-RU-2020:0655-1: moderate: Recommended update for cluster-glue
by maintenance＠opensuse.org 12 May '20

12 May '20

openSUSE Recommended Update: Recommended update for cluster-glue ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0655-1 Rating: moderate References: #1131545 #1169784 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for cluster-glue fixes the following issues: - Fix for profile parameter handling EC2 stonith plugin to avoid possible cluster resource failures. (bsc#1169784) - Fix for handling in 'stonith' command by creating '/var/run/heartbeat/rsctmp' directory. (bsc#1131545) This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-655=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): cluster-glue-1.0.12+v1.git.1587474580.a5fda2bc-bp151.2.6.1 libglue-devel-1.0.12+v1.git.1587474580.a5fda2bc-bp151.2.6.1 libglue2-1.0.12+v1.git.1587474580.a5fda2bc-bp151.2.6.1 - openSUSE Backports SLE-15-SP1 (aarch64_ilp32): libglue-devel-64bit-1.0.12+v1.git.1587474580.a5fda2bc-bp151.2.6.1 libglue2-64bit-1.0.12+v1.git.1587474580.a5fda2bc-bp151.2.6.1 References: https://bugzilla.suse.com/1131545 https://bugzilla.suse.com/1169784

1 0

openSUSE-SU-2020:0656-1: moderate: Security update for python-markdown2
by opensuse-security＠opensuse.org 12 May '20

12 May '20

openSUSE Security Update: Security update for python-markdown2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0656-1 Rating: moderate References: #1171379 Cross-References: CVE-2020-11888 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-markdown2 fixes the following issues: - CVE-2020-11888: Fixed unsanitized input for cross-site scripting (boo#1171379) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-656=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): python2-markdown2-2.3.7-bp151.2.3.1 python3-markdown2-2.3.7-bp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-11888.html https://bugzilla.suse.com/1171379

1 0

openSUSE-SU-2020:0653-1: important: Security update for ghostscript
by opensuse-security＠opensuse.org 11 May '20

11 May '20

openSUSE Security Update: Security update for ghostscript ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0653-1 Rating: important References: #1170603 Cross-References: CVE-2020-12268 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ghostscript to version 9.52 fixes the following issues: - CVE-2020-12268: Fixed a heap-based buffer overflow in jbig2_image_compose (bsc#1170603). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-653=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): ghostscript-9.52-lp151.3.12.1 ghostscript-debuginfo-9.52-lp151.3.12.1 ghostscript-debugsource-9.52-lp151.3.12.1 ghostscript-devel-9.52-lp151.3.12.1 ghostscript-mini-9.52-lp151.3.12.1 ghostscript-mini-debuginfo-9.52-lp151.3.12.1 ghostscript-mini-debugsource-9.52-lp151.3.12.1 ghostscript-mini-devel-9.52-lp151.3.12.1 ghostscript-x11-9.52-lp151.3.12.1 ghostscript-x11-debuginfo-9.52-lp151.3.12.1 - openSUSE Leap 15.1 (x86_64): libspectre-debugsource-0.2.8-lp151.3.3.1 libspectre-devel-0.2.8-lp151.3.3.1 libspectre1-0.2.8-lp151.3.3.1 libspectre1-debuginfo-0.2.8-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-12268.html https://bugzilla.suse.com/1170603

1 0

openSUSE-SU-2020:0654-1: moderate: Security update for cacti, cacti-spine
by opensuse-security＠opensuse.org 11 May '20

11 May '20

openSUSE Security Update: Security update for cacti, cacti-spine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0654-1 Rating: moderate References: #1163749 Cross-References: CVE-2020-7106 Affected Products: openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cacti, cacti-spine fixes the following issues: cacti-spine and cacti were updated to 1.2.12: cacti fixes: * CVE-2020-7106: Lack of escaping of color items can lead to XSS exposure (boo#1163749) * Fix multiple graphing bugs and web UI issues * Fix multiple warnings, PHP Exceptions and errors * Content-Security-Policy prevents External Links from being opened * Prevent runtime memory issues by increasing memory limit * Improve SNMPv3 handling cacti-spine fixes: * Failed host lookup causes spine to crash Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-654=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-654=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-654=1 Package List: - openSUSE Leap 15.1 (noarch): cacti-1.2.12-lp151.3.9.1 - openSUSE Leap 15.1 (x86_64): cacti-spine-1.2.12-lp151.3.9.1 cacti-spine-debuginfo-1.2.12-lp151.3.9.1 cacti-spine-debugsource-1.2.12-lp151.3.9.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): cacti-spine-1.2.12-bp151.4.9.1 - openSUSE Backports SLE-15-SP1 (noarch): cacti-1.2.12-bp151.4.9.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): cacti-spine-1.2.12-5.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): cacti-1.2.12-8.1 References: https://www.suse.com/security/cve/CVE-2020-7106.html https://bugzilla.suse.com/1163749

1 0

openSUSE-RU-2020:0652-1: moderate: Recommended update for aws-cli, python-boto3, python-botocore, python-s3transfer, python-aws-sam-translator, python-cfn-lint, python-nose2, python-parameterized
by maintenance＠opensuse.org 11 May '20

11 May '20

openSUSE Recommended Update: Recommended update for aws-cli, python-boto3, python-botocore, python-s3transfer, python-aws-sam-translator, python-cfn-lint, python-nose2, python-parameterized ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0652-1 Rating: moderate References: #1122669 #1136184 #1146853 #1146854 #1159018 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for aws-cli, python-aws-sam-translator, python-cfn-lint, python-nose2, python-parameterized, python-boto3, python-botocore, python-s3transfer fixes the following issues: python-aws-sam-translator was updated to 1.11.0 (bsc#1159018, jsc#PM-1507): Upgrade to 1.11.0: * Add ReservedConcurrentExecutions to globals * Fix ElasticsearchHttpPostPolicy resource reference * Support using AWS::Region in Ref and Sub * Documentation and examples updates * Add VersionDescription property to Serverless::Function * Update ServerlessRepoReadWriteAccessPolicy * Add additional template validation Upgrade to 1.10.0: * Add GSIs to DynamoDBReadPolicy and DynamoDBCrudPolicy * Add DynamoDBReconfigurePolicy * Add CostExplorerReadOnlyPolicy and OrganizationsListAccountsPolicy * Add EKSDescribePolicy * Add SESBulkTemplatedCrudPolicy * Add FilterLogEventsPolicy * Add SSMParameterReadPolicy * Add SESEmailTemplateCrudPolicy * Add s3:PutObjectAcl to S3CrudPolicy * Add allow_credentials CORS option * Add support for AccessLogSetting and CanarySetting Serverless::Api properties * Add support for X-Ray in Serverless::Api * Add support for MinimumCompressionSize in Serverless::Api * Add Auth to Serverless::Api globals * Remove trailing slashes from APIGW permissions * Add SNS FilterPolicy and an example application * Add Enabled property to Serverless::Function event sources * Add support for PermissionsBoundary in Serverless::Function * Fix boto3 client initialization * Add PublicAccessBlockConfiguration property to S3 bucket resource * Make PAY_PER_REQUEST default mode for Serverless::SimpleTable * Add limited support for resolving intrinsics in Serverless::LayerVersion * SAM now uses Flake8 * Add example application for S3 Events written in Go * Updated several example applications python-cfn-lint was added in version 0.21.4: - Add upstream patch to fix EOL dates for lambda runtimes - Add upstream patch to fix test_config_expand_paths test - Rename to python-cfn-lint. This package has a python API, which is required by python-moto. Update to version 0.21.4: + Features * Include more resource types in W3037 + CloudFormation Specifications * Add Resource Type `AWS::CDK::Metadata` + Fixes * Uncap requests dependency in setup.py * Check Join functions have lists in the correct sections * Pass a parameter value for AutoPublishAlias when doing a Transform * Show usage examples when displaying the help Update to version 0.21.3 + Fixes * Support dumping strings for datetime objects when doing a Transform Update to version 0.21.2 + CloudFormation Specifications * Update CloudFormation specs to 3.3.0 * Update instance types from pricing API as of 2019.05.23 Update to version 0.21.1 + Features * Add `Info` logging capability and set the default logging to `NotSet` + Fixes * Only do rule logging (start/stop/time) when the rule is going to be called * Update rule E1019 to allow `Fn::Transform` inside a `Fn::Sub` * Update rule W2001 to not break when `Fn::Transform` inside a `Fn::Sub` * Update rule E2503 to allow conditions to be used and to not default to `network` load balancer when an object is used for the Load Balancer type Update to version 0.21.0 + Features * New rule E3038 to check if a Serverless resource includes the appropriate Transform * New rule E2531 to validate a Lambda's runtime against the deprecated dates * New rule W2531 to validate a Lambda's runtime against the EOL dates * Update rule E2541 to include updates to Code Pipeline capabilities * Update rule E2503 to include checking of values for load balancer attributes + CloudFormation Specifications * Update CloudFormation specs to 3.2.0 * Update instance types from pricing API as of 2019.05.20 + Fixes * Include setuptools in setup.py requires Update to version 0.20.3 + CloudFormation Specifications * Update instance types from pricing API as of 2019.05.16 + Fixes * Update E7001 to allow float/doubles for mapping values * Update W1020 to check pre-transformed Fn::Sub(s) to determine if a Sub is needed * Pin requests to be below or equal to 2.21.0 to prevent issues with botocore Update to version 0.20.2 + Features * Add support for List<String> Parameter types + CloudFormation Specifications * Add allowed values for AWS::EC2 EIP, FlowLog, CustomerGateway, DHCPOptions, EC2Fleet * Create new property type for Security Group IDs or Names * Add new Lambda runtime environment for NodeJs 10.x * Move AWS::ServiceDiscovery::Service Health checks from Only One to Exclusive * Update Glue Crawler Role to take an ARN or a name * Remove PrimitiveType from MaintenanceWindowTarget Targets * Add Min/Max values for Load Balancer Ports to be between 1-65535 + Fixes * Include License file in the pypi package to help with downstream projects * Filter out dynamic references from rule E3031 and E3030 * Convert Python linting and Code Coverage from Python 3.6 to 3.7 Update to version 0.20.1 + Fixes * Update rule E8003 to support more functions inside a Fn::Equals Update to version 0.20.0 + Features * Allow a rule's exception to be defined in a resource's metadata * Add rule configuration capabilities * Update rule E3012 to allow for non strict property checking * Add rule E8003 to test Fn::Equals structure and syntax * Add rule E8004 to test Fn::And structure and syntax * Add rule E8005 to test Fn::Not structure and syntax * Add rule E8006 to test Fn::Or structure and syntax * Include Path to error in the JSON output * Update documentation to describe how to install cfn-lint from brew + CloudFormation Specifications * Update CloudFormation specs to version 3.0.0 * Add new region ap-east-1 * Add list min/max and string min/max for CloudWatch Alarm Actions * Add allowed values for EC2::LaunchTemplate * Add allowed values for EC2::Host * Update allowed values for Amazon MQ to include 5.15.9 * Add AWS::Greengrass::ResourceDefinition to GreenGrass supported regions * Add AWS::EC2::VPCEndpointService to all regions * Update AWS::ECS::TaskDefinition ExecutionRoleArn to be a IAM Role ARN * Patch spec files for SSM MaintenanceWindow to look for Target and not Targets * Update ManagedPolicyArns list size to be 20 which is the hard limit. 10 is the soft limit. + Fixes * Fix rule E3033 to check the string size when the string is inside a list * Fix an issue in which AWS::NotificationARNs was not a list * Add AWS::EC2::Volume to rule W3010 * Fix an issue with W2001 where SAM translate would remove the Ref to a parameter causing this error to falsely trigger * Fix rule W3010 to not error when the availability zone is 'all' Update to version 0.19.1 + Fixes * Fix core Condition processing to support direct Condition in another Condition * Fix the W2030 to check numbers against string allowed values Update to version 0.19.0 + Features * Add NS and PTR Route53 record checking to rule E3020 * New rule E3050 to check if a Ref to IAM Role has a Role path of '/' * New rule E3037 to look for duplicates in a list that doesn't support duplicates * New rule I3037 to look for duplicates in a list when duplicates are allowed + CloudFormation Specifications * Add Min/Max values to AWS::ElasticLoadBalancingV2::TargetGroup HealthCheckTimeoutSeconds * Add Max JSON size to AWS::IAM::ManagedPolicy PolicyDocument * Add allowed values for AWS::EC2 SpotFleet, TransitGateway, NetworkAcl NetworkInterface, PlacementGroup, and Volume * Add Min/max values to AWS::Budgets::Budget.Notification Threshold * Update RDS Instance types by database engine and license definitions using the pricing API * Update AWS::CodeBuild::Project ServiceRole to support Role Name or ARN * Update AWS::ECS::Service Role to support Role Name or ARN + Fixes * Update E3025 to support the new structure of data in the RDS instance type json * Update E2540 to remove all nested conditions from the object * Update E3030 to not do strict type checking * Update E3020 to support conditions nested in the record sets * Update E3008 to better handle CloudFormation sub stacks with different GetAtt formats Update to version 0.18.1 + CloudFormation Specifications * Update CloudFormation Specs to 2.30.0 * Fix IAM Regex Path to support more character types * Update AWS::Batch::ComputeEnvironment.ComputeResources InstanceRole to reference an InstanceProfile or GetAtt the InstanceProfile Arn * Allow VPC IDs to Ref a Parameter of type String + Fixes * Fix E3502 to check the size of the property instead of the parent object Update to version 0.18.0 + Features * New rule E3032 to check the size of lists * New rule E3502 to check JSON Object Size using definitions in the spec file * New rule E3033 to test the minimum and maximum length of a string * New rule E3034 to validate the min and max of a number * Remove Ebs Iops check from E2504 and use rule E3034 instead * Remove rule E2509 and use rule E3033 instead * Remove rule E2508 as it replaced by E3032 and E3502 * Update rule E2503 to check that there are at least two 2 Subnets or SubnetMappings for ALBs * SAM requirement upped to minimal version of 1.10.0 + CloudFormation Specifications * Extend specs to include: > `ListMin` and `ListMax` for the minimum and maximum size of a list > `JsonMax` to check the max size of a JSON Object > `StringMin` and `StringMax` to check the minimum and maximum length of a String > `NumberMin` and `NumberMax` to check the minimum and maximum value of a Number, Float, Long * Update State and ExecutionRoleArn to be required on AWS::DLM::LifecyclePolicy * Add AllowedValues for PerformanceInsightsRetentionPeriod for AWS::RDS::Instance * Add AllowedValues for the AWS::GuardDuty Resources * Add AllowedValues for AWS::EC2 VPC and VPN Resources * Switch IAM Instance Profiles for certain resources to the type that only takes the name * Add regex pattern for IAM Instance Profile when a name (not Arn) is used * Add regex pattern for IAM Paths * Add Regex pattern for IAM Role Arn * Update OnlyOne spec to require require at least one of Subnets or SubnetMappings with ELB v2 + Fixes * Fix serverless transform to use DefinitionBody when Auth is in the API definition * Fix rule W2030 to not error when checking SSM or List Parameters Update to version 0.17.1 + Features * Update rule E2503 to make sure NLBs don't have a Security Group configured + CloudFormation Specifications * Add all the allowed values of the `AWS::Glue` Resources * Update OnlyOne check for `AWS::CloudWatch::Alarm` to only `MetricName` or `Metrics` * Update Exclusive check for `AWS::CloudWatch::Alarm` for properties mixed with `Metrics` and `Statistic` * Update CloudFormation specs to 2.29.0 * Fix type with MariaDB in the AllowedValues * Update pricing information for data available on 2018.3.29 + Fixes * Fix rule E1029 to not look for a sub is needed when looking for iot strings in policies * Fix rule E2541 to allow for ActionId Versions of length 1-9 and meets regex `[0-9A-Za-z_-]+` * Fix rule E2532 to allow for `Parameters` inside a `Pass` action * Fix an issue when getting the location of an error in which numbers are causing an attribute error Update to version 0.17.0 + Features * Add new rule E3026 to validate Redis cluster settings including AutomaticFailoverEnabled and NumCacheClusters. Status: Released * Add new rule W3037 to validate IAM resource policies. Status: Experimental * Add new parameter `-e/--include-experimental` to allow for new rules in that aren't ready to be fully released + CloudFormation Specifications * Update Spec files to 2.28.0 * Add all the allowed values of the AWS::Redshift::* Resources * Add all the allowed values of the AWS::Neptune::* Resources * Patch spec to make AWS::CloudFront::Distribution.LambdaFunctionAssociation.LambdaFunctionARN r equired * Patch spec to make AWS::DynamoDB::Table AttributeDefinitions required + Fixes * Remove extra blank lines when there is no errors in the output * Add exception to rule E1029 to have exceptions for EMR CloudWatchAlarmDefinition * Update rule E1029 to allow for literals in a Sub * Remove sub checks from rule E3031 as it won't match in all cases of an allowed pattern regex check * Correct typos for errors in rule W1001 * Switch from parsing a template as Yaml to Json when finding an escape character * Fix an issue with SAM related to transforming templates with Serverless Application and Lambda Layers * Fix an issue with rule E2541 when non strings were used for Stage Names Update to version 0.16.0 + Features * Add rule E3031 to look for regex patterns based on the patched spec file * Remove regex checks from rule E2509 * Add parameter `ignore-templates` to allow the ignoring of templates when doing bulk linting + CloudFormation Specifications * Update Spec files to 2.26.0 * Add all the allowed values of the AWS::DirectoryService::* Resources * Add all the allowed values of the AWS::DynamoDB::* Resources * Added AWS::Route53Resolver resources to the Spec Patches of ap-southeast-2 * Patch the spec file with regex patterns * Add all the allowed values of the AWS::DocDb::* Resources + Fixes * Update rule E2504 to have '20000' as the max value * Update rule E1016 to not allow ImportValue inside of Conditions * Update rule E2508 to check conditions when providing limit checks on managed policies * Convert unicode to strings when in Py 3.4/3.5 and updating specs * Convert from `awslabs` to `aws-cloudformation` organization * Remove suppression of logging that was removed from samtranslator >1.7.0 and incompatibility with samtranslator 1.10.0 Update to version 0.15.0 + Features * Add scaffolding for arbitrary Match attributes, adding attributes for Type checks * Add rule E3024 to validate that ProvisionedThroughput is not specified with BillingMode PAY_PER_REQUEST + CloudFormation Specifications * Update Spec files to 2.24.0 * Update OnlyOne spec to have BlockDeviceMapping to include NoDevice with Ebs and VirtualName * Add all the allowed values of the AWS::CloudFront::* Resources * Add all the allowed values of the AWS::DAX::* Resources + Fixes * Update config parsing to use the builtin Yaml decoder * Add condition support for Inclusive E2521, Exclusive E2520, and AtLeastOne E2522 rules * Update rule E1029 to better check Resource strings inside IAM Policies * Improve the line/column information of a Match with array support Update to version 0.14.1 + CloudFormation Specifications * Update CloudFormation Specs to version 2.23.0 * Add allowed values for AWS::Config::* resources * Add allowed values for AWS::ServiceDiscovery::* resources * Fix allowed values for Apache MQ + Fixes * Update rule E3008 to not error when using a list from a custom resource * Support simple types in the CloudFormation spec * Add tests for the formatters Update to version 0.14.0 + Features * Add rule E3035 to check the values of DeletionPolicy * Add rule E3036 to check the values of UpdateReplacePolicy * Add rule E2014 to check that there are no REFs in the Parameter section * Update rule E2503 to support TLS on NLBs + CloudFormation Specifications * Update CloudFormation spec to version 2.22.0 * Add allowed values for AWS::Cognito::* resources + Fixes * Update rule E3002 to allow GetAtts to Custom Resources under a Condition Update to version 0.13.2 + Features * Introducing the cfn-lint logo! * Update SAM dependency version + Fixes * Fix CloudWatchAlarmComparisonOperator allowed values. * Fix typo resoruce_type_spec in several files * Better support for nested And, Or, and Not when processing Conditions Update to version 0.13.1 + CloudFormation Specifications * Add allowed values for AWS::CloudTrail::Trail resources * Patch spec to have AWS::CodePipeline::CustomActionType Version included + Fixes * Fix conditions logic to use AllowedValues when REFing a Parameter that has AllowedValues specified Update to version 0.13.0 + Features * New rule W1011 to check if a FindInMap is using the correct map name and keys * New rule W1001 to check if a Ref/GetAtt to a resource that exists when Conditions are used * Removed logic in E1011 and moved it to W1011 for validating keys * Add property relationships for AWS::ApplicationAutoScaling::ScalingPolicy into Inclusive, Exclusive, and AtLeastOne * Update rule E2505 to check the netmask bit * Include the ability to update the CloudFormation Specs using the Pricing API + CloudFormation Specifications * Update to version 2.21.0 * Add allowed values for AWS::Budgets::Budget * Add allowed values for AWS::CertificateManager resources * Add allowed values for AWS::CodePipeline resources * Add allowed values for AWS::CodeCommit resources * Add allowed values for EC2 InstanceTypes from pricing API * Add allowed values for RedShift InstanceTypes from pricing API * Add allowed values for MQ InstanceTypes from pricing API * Add allowed values for RDS InstanceTypes from pricing API + Fixes * Fixed README indentation issue with .pre-commit-config.yaml * Fixed rule E2541 to allow for multiple inputs/outputs in a CodeBuild task * Fixed rule E3020 to allow for a period or no period at the end of a ACM registration record * Update rule E3001 to support UpdateReplacePolicy * Fix a cli issue where `--template` wouldn't be used when a .cfnlintrc was in the same folder * Update rule E3002 and E1024 to support packaging of AWS::Lambda::LayerVersion content - Initial build + Version 0.12.1 Update to 0.9.1 * the prof plugin now uses cProfile instead of hotshot for profiling * skipped tests now include the user's reason in junit XML's message field * the prettyassert plugin mishandled multi-line function definitions * Using a plugin's CLI flag when the plugin is already enabled via config no longer errors * nose2.plugins.prettyassert, enabled with --pretty-assert * Cleanup code for EOLed python versions * Dropped support for distutils. * Result reporter respects failure status set by other plugins * JUnit XML plugin now includes the skip reason in its output Upgrade to 0.8.0: - List of changes is too long to show here, see https://github.com/nose-devs/nose2/blob/master/docs/changelog.rst changes between 0.6.5 and 0.8.0 Update to 0.7.0: * Added parameterized_class feature, for parameterizing entire test classes (many thanks to @TobyLL for their suggestions and help testing!) * Fix DeprecationWarning on `inspect.getargs` (thanks @brettdh; https://github.com/wolever/parameterized/issues/67) * Make sure that `setUp` and `tearDown` methods work correctly (#40) * Raise a ValueError when input is empty (thanks @danielbradburn; https://github.com/wolever/parameterized/pull/48) * Fix the order when number of cases exceeds 10 (thanks @ntflc; https://github.com/wolever/parameterized/pull/49) aws-cli was updated to version 1.16.223: For detailed changes see the changes entries: https://github.com/aws/aws-cli/blob/1.16.223/CHANGELOG.rst https://github.com/aws/aws-cli/blob/1.16.189/CHANGELOG.rst https://github.com/aws/aws-cli/blob/1.16.182/CHANGELOG.rst https://github.com/aws/aws-cli/blob/1.16.176/CHANGELOG.rst https://github.com/aws/aws-cli/blob/1.16.103/CHANGELOG.rst https://github.com/aws/aws-cli/blob/1.16.94/CHANGELOG.rst https://github.com/aws/aws-cli/blob/1.16.84/CHANGELOG.rst python-boto3 was updated to 1.9.213, python-botocore was updated to 1.9.188, and python-s3transfer was updated to 1.12.74, fixing lots of bugs and adding features (bsc#1146853, bsc#1146854) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-652=1 Package List: - openSUSE Leap 15.1 (noarch): azure-cli-core-2.0.45-lp151.2.9.1 azure-cli-interactive-0.3.28-lp151.2.9.1 References: https://bugzilla.suse.com/1122669 https://bugzilla.suse.com/1136184 https://bugzilla.suse.com/1146853 https://bugzilla.suse.com/1146854 https://bugzilla.suse.com/1159018

1 0

openSUSE-SU-2020:0654-1: moderate: Security update for cacti, cacti-spine
by opensuse-security＠opensuse.org 11 May '20

11 May '20

openSUSE Security Update: Security update for cacti, cacti-spine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0654-1 Rating: moderate References: #1163749 Cross-References: CVE-2020-7106 Affected Products: openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cacti, cacti-spine fixes the following issues: cacti-spine and cacti were updated to 1.2.12: cacti fixes: * CVE-2020-7106: Lack of escaping of color items can lead to XSS exposure (boo#1163749) * Fix multiple graphing bugs and web UI issues * Fix multiple warnings, PHP Exceptions and errors * Content-Security-Policy prevents External Links from being opened * Prevent runtime memory issues by increasing memory limit * Improve SNMPv3 handling cacti-spine fixes: * Failed host lookup causes spine to crash Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-654=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-654=1 Package List: - openSUSE Leap 15.1 (x86_64): cacti-spine-1.2.12-lp151.3.9.1 cacti-spine-debuginfo-1.2.12-lp151.3.9.1 cacti-spine-debugsource-1.2.12-lp151.3.9.1 - openSUSE Leap 15.1 (noarch): cacti-1.2.12-lp151.3.9.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): cacti-spine-1.2.12-bp151.4.9.1 - openSUSE Backports SLE-15-SP1 (noarch): cacti-1.2.12-bp151.4.9.1 References: https://www.suse.com/security/cve/CVE-2020-7106.html https://bugzilla.suse.com/1163749

1 0

openSUSE-RU-2020:0650-1: moderate: Recommended update for python-azure-agent
by maintenance＠opensuse.org 11 May '20

11 May '20

openSUSE Recommended Update: Recommended update for python-azure-agent ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0650-1 Rating: moderate References: #1167601 #1167602 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for python-azure-agent fixes the following issues: - Set the hostname using hostnamectl to ensure setting is properly applied (bsc#1167601, bsc#1167602) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-650=1 Package List: - openSUSE Leap 15.1 (noarch): python-azure-agent-2.2.45-lp151.2.6.1 python-azure-agent-test-2.2.45-lp151.2.6.1 References: https://bugzilla.suse.com/1167601 https://bugzilla.suse.com/1167602

1 0