May 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2020:0579-1: important: Recommended update for pacemaker
by maintenance＠opensuse.org 01 May '20

01 May '20

openSUSE Recommended Update: Recommended update for pacemaker ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0579-1 Rating: important References: #1154881 #1155290 #1160410 #1168771 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for pacemaker fixes the following issues: - libcrmcluster: use uint64_t type for corosync ringid (membership id) when updating node state (bsc#1168771) - get ready for implicit -fno-common with upcoming GCC 10 (bsc#1160410) - attrd: properly declare global variables as extern in header (bsc#1160410) - scheduler: make sure cluster-wide maintenance-mode=true overrides per-resource settings (bsc#1154881) - tools: Clear all prefer constraints when performing a move (bsc#1155290) - tools: Fix moving a resource with a lifetime constraint (bsc#1155290) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-579=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libpacemaker-devel-2.0.1+20190417.13d370ca9-lp151.2.9.2 libpacemaker3-2.0.1+20190417.13d370ca9-lp151.2.9.2 libpacemaker3-debuginfo-2.0.1+20190417.13d370ca9-lp151.2.9.2 pacemaker-2.0.1+20190417.13d370ca9-lp151.2.9.2 pacemaker-cli-2.0.1+20190417.13d370ca9-lp151.2.9.2 pacemaker-cli-debuginfo-2.0.1+20190417.13d370ca9-lp151.2.9.2 pacemaker-debuginfo-2.0.1+20190417.13d370ca9-lp151.2.9.2 pacemaker-debugsource-2.0.1+20190417.13d370ca9-lp151.2.9.2 pacemaker-remote-2.0.1+20190417.13d370ca9-lp151.2.9.2 pacemaker-remote-debuginfo-2.0.1+20190417.13d370ca9-lp151.2.9.2 - openSUSE Leap 15.1 (noarch): pacemaker-cts-2.0.1+20190417.13d370ca9-lp151.2.9.2 References: https://bugzilla.suse.com/1154881 https://bugzilla.suse.com/1155290 https://bugzilla.suse.com/1160410 https://bugzilla.suse.com/1168771

1 0

openSUSE-SU-2020:0599-1: important: Security update for xen
by opensuse-security＠opensuse.org 01 May '20

01 May '20

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0599-1 Rating: important References: #1027519 #1134506 #1155200 #1157490 #1160932 #1165206 #1167007 #1167152 #1168140 #1168142 #1168143 #1169392 Cross-References: CVE-2020-11739 CVE-2020-11740 CVE-2020-11741 CVE-2020-11742 CVE-2020-11743 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has 7 fixes is now available. Description: This update for xen fixes the following issues: Security issues fixed: - CVE-2020-11742: Bad continuation handling in GNTTABOP_copy (bsc#1169392). - CVE-2020-11740, CVE-2020-11741: xen: XSA-313 multiple xenoprof issues (bsc#1168140). - CVE-2020-11739: Missing memory barriers in read-write unlock paths (bsc#1168142). - CVE-2020-11743: Bad error path in GNTTABOP_map_grant (bsc#1168143). - arm: a CPU may speculate past the ERET instruction (bsc#1160932). Non-security issues fixed: - Xenstored Crashed during VM install (bsc#1167152) - DomU hang: soft lockup CPU #0 stuck under high load (bsc#1165206, bsc#1134506) - Update API compatibility versions, fixes issues for libvirt. (bsc#1167007, bsc#1157490) - aacraid blocks xen commands (bsc#1155200) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-599=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): xen-debugsource-4.12.2_04-lp151.2.15.1 xen-devel-4.12.2_04-lp151.2.15.1 xen-libs-4.12.2_04-lp151.2.15.1 xen-libs-debuginfo-4.12.2_04-lp151.2.15.1 xen-tools-domU-4.12.2_04-lp151.2.15.1 xen-tools-domU-debuginfo-4.12.2_04-lp151.2.15.1 - openSUSE Leap 15.1 (x86_64): xen-4.12.2_04-lp151.2.15.1 xen-doc-html-4.12.2_04-lp151.2.15.1 xen-libs-32bit-4.12.2_04-lp151.2.15.1 xen-libs-32bit-debuginfo-4.12.2_04-lp151.2.15.1 xen-tools-4.12.2_04-lp151.2.15.1 xen-tools-debuginfo-4.12.2_04-lp151.2.15.1 References: https://www.suse.com/security/cve/CVE-2020-11739.html https://www.suse.com/security/cve/CVE-2020-11740.html https://www.suse.com/security/cve/CVE-2020-11741.html https://www.suse.com/security/cve/CVE-2020-11742.html https://www.suse.com/security/cve/CVE-2020-11743.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1134506 https://bugzilla.suse.com/1155200 https://bugzilla.suse.com/1157490 https://bugzilla.suse.com/1160932 https://bugzilla.suse.com/1165206 https://bugzilla.suse.com/1167007 https://bugzilla.suse.com/1167152 https://bugzilla.suse.com/1168140 https://bugzilla.suse.com/1168142 https://bugzilla.suse.com/1168143 https://bugzilla.suse.com/1169392

1 0

openSUSE-RU-2020:0584-1: moderate: Recommended update for python-scandir
by maintenance＠opensuse.org 01 May '20

01 May '20

openSUSE Recommended Update: Recommended update for python-scandir ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0584-1 Rating: moderate References: #1122668 #1167207 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for python-scandir fixes the following issues: - Include the package in SLE-12 (fate#326950, bsc#1122668, jsc#PM-1447) - Replace %fdupes -s with plain %fdupes using hardlinks instead of softlinks. - Update to 1.10.0: * remove support for pyton 2.6 and <3.3 - Allow building on Python 3.5+. (bsc#1167207) It is useful for testing and it should exist when packages list it as a runtime dependency, and it will add backports of enhancements to scandir since Python 3.5. This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-584=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): python-scandir-debuginfo-1.10.0-lp151.2.3.1 python-scandir-debugsource-1.10.0-lp151.2.3.1 python2-scandir-1.10.0-lp151.2.3.1 python2-scandir-debuginfo-1.10.0-lp151.2.3.1 python3-scandir-1.10.0-lp151.2.3.1 python3-scandir-debuginfo-1.10.0-lp151.2.3.1 References: https://bugzilla.suse.com/1122668 https://bugzilla.suse.com/1167207

1 0

openSUSE-SU-2020:0585-1: important: Security update for resource-agents
by opensuse-security＠opensuse.org 01 May '20

01 May '20

openSUSE Security Update: Security update for resource-agents ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0585-1 Rating: important References: #1021689 #1146687 #1146690 #1146691 #1146692 #1146766 #1146776 #1146784 #1146785 #1146787 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for resource-agents fixes the following issues: - Fixed multiple vulnerabilities related to unsafe tempfile usage. (bsc#1146690 bsc#1146691 bsc#1146692 bsc#1146766 bsc#1146776 bsc#1146784 bsc#1146785 bsc#1146787) - Fixed issues where the ocfmon user was created with a default password (bsc#1021689, bsc#1146687). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-585=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): ldirectord-4.3.0184.6ee15eb2-lp151.3.18.1 resource-agents-4.3.0184.6ee15eb2-lp151.3.18.1 resource-agents-debuginfo-4.3.0184.6ee15eb2-lp151.3.18.1 resource-agents-debugsource-4.3.0184.6ee15eb2-lp151.3.18.1 - openSUSE Leap 15.1 (noarch): monitoring-plugins-metadata-4.3.0184.6ee15eb2-lp151.3.18.1 References: https://bugzilla.suse.com/1021689 https://bugzilla.suse.com/1146687 https://bugzilla.suse.com/1146690 https://bugzilla.suse.com/1146691 https://bugzilla.suse.com/1146692 https://bugzilla.suse.com/1146766 https://bugzilla.suse.com/1146776 https://bugzilla.suse.com/1146784 https://bugzilla.suse.com/1146785 https://bugzilla.suse.com/1146787

1 0

openSUSE-RU-2020:0588-1: moderate: Recommended update for strongswan
by maintenance＠opensuse.org 01 May '20

01 May '20

openSUSE Recommended Update: Recommended update for strongswan ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0588-1 Rating: moderate References: #1164493 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for strongswan fixes the following issue: - Resolve multiple definition of swanctl_dir (bsc#1164493) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-588=1 Package List: - openSUSE Leap 15.1 (noarch): strongswan-doc-5.8.2-lp151.4.9.1 - openSUSE Leap 15.1 (x86_64): strongswan-5.8.2-lp151.4.9.1 strongswan-debuginfo-5.8.2-lp151.4.9.1 strongswan-debugsource-5.8.2-lp151.4.9.1 strongswan-hmac-5.8.2-lp151.4.9.1 strongswan-ipsec-5.8.2-lp151.4.9.1 strongswan-ipsec-debuginfo-5.8.2-lp151.4.9.1 strongswan-libs0-5.8.2-lp151.4.9.1 strongswan-libs0-debuginfo-5.8.2-lp151.4.9.1 strongswan-mysql-5.8.2-lp151.4.9.1 strongswan-mysql-debuginfo-5.8.2-lp151.4.9.1 strongswan-nm-5.8.2-lp151.4.9.1 strongswan-nm-debuginfo-5.8.2-lp151.4.9.1 strongswan-sqlite-5.8.2-lp151.4.9.1 strongswan-sqlite-debuginfo-5.8.2-lp151.4.9.1 References: https://bugzilla.suse.com/1164493

1 0

openSUSE-SU-2020:0586-1: moderate: Security update for ruby2.5
by opensuse-security＠opensuse.org 01 May '20

01 May '20

openSUSE Security Update: Security update for ruby2.5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0586-1 Rating: moderate References: #1167244 #1168938 Cross-References: CVE-2020-10663 CVE-2020-10933 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for ruby2.5 to version 2.5.8 fixes the following issues: - CVE-2020-10663: Unsafe Object Creation Vulnerability in JSON (bsc#1167244). - CVE-2020-10933: Heap exposure vulnerability in the socket library (bsc#1168938). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-586=1 Package List: - openSUSE Leap 15.1 (x86_64): libruby2_5-2_5-2.5.8-lp151.4.9.1 libruby2_5-2_5-debuginfo-2.5.8-lp151.4.9.1 ruby2.5-2.5.8-lp151.4.9.1 ruby2.5-debuginfo-2.5.8-lp151.4.9.1 ruby2.5-debugsource-2.5.8-lp151.4.9.1 ruby2.5-devel-2.5.8-lp151.4.9.1 ruby2.5-devel-extra-2.5.8-lp151.4.9.1 ruby2.5-doc-2.5.8-lp151.4.9.1 ruby2.5-stdlib-2.5.8-lp151.4.9.1 ruby2.5-stdlib-debuginfo-2.5.8-lp151.4.9.1 - openSUSE Leap 15.1 (noarch): ruby2.5-doc-ri-2.5.8-lp151.4.9.1 References: https://www.suse.com/security/cve/CVE-2020-10663.html https://www.suse.com/security/cve/CVE-2020-10933.html https://bugzilla.suse.com/1167244 https://bugzilla.suse.com/1168938

1 0

openSUSE-RU-2020:0568-1: moderate: Recommended update for go1.11
by maintenance＠opensuse.org 01 May '20

01 May '20

openSUSE Recommended Update: Recommended update for go1.11 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0568-1 Rating: moderate References: #1167874 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for go1.11 fixes the following issue: - ARMv7 build hangs with gcc7-go on Leap 15.2, so use go1.4 (bsc#1167874) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-568=1 Package List: - openSUSE Leap 15.1 (x86_64): go1.11-1.11.13-lp151.2.15.1 go1.11-doc-1.11.13-lp151.2.15.1 go1.11-race-1.11.13-lp151.2.15.1 References: https://bugzilla.suse.com/1167874

1 0

openSUSE-RU-2020:0592-1: moderate: Recommended update for ucode-intel
by maintenance＠opensuse.org 01 May '20

01 May '20

openSUSE Recommended Update: Recommended update for ucode-intel ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0592-1 Rating: moderate References: #1169570 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ucode-intel fixes the following issues: - updated Intel Skylake microcode to the current version. (bsc#1169570) - 02000064->02006901 This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-592=1 Package List: - openSUSE Leap 15.1 (x86_64): ucode-intel-20191115-lp151.2.21.1 References: https://bugzilla.suse.com/1169570

1 0

openSUSE-RU-2020:0589-1: important: Recommended update for supportutils
by maintenance＠opensuse.org 01 May '20

01 May '20

openSUSE Recommended Update: Recommended update for supportutils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0589-1 Rating: important References: #1162539 #1165475 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for supportutils fixes the following issues: - Replaced Novell with SUSE FTP servers (bsc#1165475) - Added missed Power collection (bsc#1162539) - Added core file validation (bsc#1166126) - Changed filename prefixes from nts_ to scc_ referencing the SUSE Customer Center (SLE-8702, SLE-6762) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-589=1 Package List: - openSUSE Leap 15.1 (noarch): supportutils-3.1.9-lp151.2.12.1 References: https://bugzilla.suse.com/1162539 https://bugzilla.suse.com/1165475

1 0

openSUSE-RU-2020:0595-1: moderate: Recommended update for inxi
by maintenance＠opensuse.org 01 May '20

01 May '20

openSUSE Recommended Update: Recommended update for inxi ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0595-1 Rating: moderate References: Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for inxi fixes the following issues: inxi was update to version 3.1.00: * See /usr/share/doc/packages/inxi/inxi.changelog Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-595=1 Package List: - openSUSE Leap 15.1 (noarch): inxi-3.1.00-lp151.3.6.1 References:

1 0

openSUSE-RU-2020:0590-1: moderate: Recommended update for suse-build-key
by maintenance＠opensuse.org 01 May '20

01 May '20

openSUSE Recommended Update: Recommended update for suse-build-key ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0590-1 Rating: moderate References: #1170347 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for suse-build-key fixes the following issues: - add a /usr/share/container-keys/ directory for GPG based Container verification. - Add the SUSE build key as "suse-container-key.asc". (PM-1845 bsc#1170347) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-590=1 Package List: - openSUSE Leap 15.1 (noarch): suse-build-key-12.0-lp151.5.6.1 References: https://bugzilla.suse.com/1170347

1 0

openSUSE-RU-2020:0571-1: moderate: Recommended update for grub2
by maintenance＠opensuse.org 01 May '20

01 May '20

openSUSE Recommended Update: Recommended update for grub2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0571-1 Rating: moderate References: #1166409 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for grub2 fixes the following issues: - Implement support searching for specific config files for netboot. (bsc#1166409) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-571=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): grub2-2.02-lp151.21.15.1 grub2-branding-upstream-2.02-lp151.21.15.1 grub2-debuginfo-2.02-lp151.21.15.1 grub2-debugsource-2.02-lp151.21.15.1 - openSUSE Leap 15.1 (noarch): grub2-i386-efi-2.02-lp151.21.15.1 grub2-i386-pc-2.02-lp151.21.15.1 grub2-i386-xen-2.02-lp151.21.15.1 grub2-snapper-plugin-2.02-lp151.21.15.1 grub2-systemd-sleep-plugin-2.02-lp151.21.15.1 grub2-x86_64-efi-2.02-lp151.21.15.1 grub2-x86_64-xen-2.02-lp151.21.15.1 References: https://bugzilla.suse.com/1166409

1 0

openSUSE-RU-2020:0600-1: important: Recommended update for yast2-installation
by maintenance＠opensuse.org 01 May '20

01 May '20

openSUSE Recommended Update: Recommended update for yast2-installation ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0600-1 Rating: important References: #1169017 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-installation fixes the following issues: - Fix for detecting and configuring network with firstboot. (bsc#1169017) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-600=1 Package List: - openSUSE Leap 15.1 (noarch): yast2-installation-4.1.49-lp151.2.12.1 References: https://bugzilla.suse.com/1169017

1 0

openSUSE-RU-2020:0596-1: moderate: Recommended update for sar2
by maintenance＠opensuse.org 01 May '20

01 May '20

openSUSE Recommended Update: Recommended update for sar2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0596-1 Rating: moderate References: Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for sar2 fixes the following issues: Update to version 2.4.0: * Improvements to the Joystick system, adding new Rudder+Brakes mode, moving to libSDL2 and cleaning up unused menu settings. * Fix lagging when aircraft is landed. * Honor wheel brake coefficient. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-596=1 Package List: - openSUSE Leap 15.1 (noarch): sar2-data-2.4.0-lp151.3.3.1 - openSUSE Leap 15.1 (x86_64): sar2-2.4.0-lp151.3.3.1 sar2-debuginfo-2.4.0-lp151.3.3.1 sar2-debugsource-2.4.0-lp151.3.3.1 References:

1 0

openSUSE-RU-2020:0574-1: moderate: Recommended update for munge
by maintenance＠opensuse.org 01 May '20

01 May '20

openSUSE Recommended Update: Recommended update for munge ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0574-1 Rating: moderate References: #1167968 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for munge fixes the following issues: - Update from version 0.5.13 to version 0.5.14 * Added mungekey command for key generation via HKDF. * Added negative caching of user lookups for processing supplementary groups. * Added munged --origin and --stop cmdline opt. * Added unmunge --numeric cmdline opt. * Added several new configuration options. * Added systemd EnvironmentFile to set sysconfig options. * Added systemd RuntimeDirectory to replace tmpfiles.d conf. * Changed logging of non-existent users to only log once for a given user. * Changed default name of munged seedfile. * Fixed pidfile corruption when starting new daemon while socket still in use. * Fixed munged signal handlers to be async-signal-safe. * Fixed "Logging stopped due to error" behavior for transient errors. * Fixed misleading "Lockfile not found" error message. * Fixed conversion-specifier / argument mismatch in error message. * Removed autotools-generated files from version control. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-574=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libmunge2-0.5.14-lp151.4.9.1 libmunge2-debuginfo-0.5.14-lp151.4.9.1 munge-0.5.14-lp151.4.9.1 munge-debuginfo-0.5.14-lp151.4.9.1 munge-debugsource-0.5.14-lp151.4.9.1 munge-devel-0.5.14-lp151.4.9.1 - openSUSE Leap 15.1 (x86_64): libmunge2-32bit-0.5.14-lp151.4.9.1 libmunge2-32bit-debuginfo-0.5.14-lp151.4.9.1 munge-devel-32bit-0.5.14-lp151.4.9.1 References: https://bugzilla.suse.com/1167968

1 0

openSUSE-RU-2020:0572-1: moderate: Recommended update for libgcrypt
by maintenance＠opensuse.org 01 May '20

01 May '20

openSUSE Recommended Update: Recommended update for libgcrypt ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0572-1 Rating: moderate References: #1165539 #1169569 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for libgcrypt fixes the following issues: This update for libgcrypt fixes the following issues: - FIPS: Switch the PCT to use the new signature operation (bsc#1165539) - FIPS: Verify that the generated signature and the original input differ in test_keys function for RSA, DSA and ECC (bsc#1165539) - Add zero-padding when qx and qy have different lengths when assembling the Q point from affine coordinates. - Ship the FIPS checksum file in the shared library package and create a separate trigger file for the FIPS selftests (bsc#1169569) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-572=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libgcrypt-cavs-1.8.2-lp151.9.19.1 libgcrypt-cavs-debuginfo-1.8.2-lp151.9.19.1 libgcrypt-debugsource-1.8.2-lp151.9.19.1 libgcrypt-devel-1.8.2-lp151.9.19.1 libgcrypt-devel-debuginfo-1.8.2-lp151.9.19.1 libgcrypt20-1.8.2-lp151.9.19.1 libgcrypt20-debuginfo-1.8.2-lp151.9.19.1 libgcrypt20-hmac-1.8.2-lp151.9.19.1 - openSUSE Leap 15.1 (x86_64): libgcrypt-devel-32bit-1.8.2-lp151.9.19.1 libgcrypt-devel-32bit-debuginfo-1.8.2-lp151.9.19.1 libgcrypt20-32bit-1.8.2-lp151.9.19.1 libgcrypt20-32bit-debuginfo-1.8.2-lp151.9.19.1 libgcrypt20-hmac-32bit-1.8.2-lp151.9.19.1 References: https://bugzilla.suse.com/1165539 https://bugzilla.suse.com/1169569

1 0

openSUSE-SU-2020:0598-1: moderate: Security update for git
by opensuse-security＠opensuse.org 01 May '20

01 May '20

openSUSE Security Update: Security update for git ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0598-1 Rating: moderate References: #1063412 #1095218 #1095219 #1110949 #1112230 #1114225 #1132350 #1149792 #1156651 #1158785 #1158787 #1158788 #1158789 #1158790 #1158791 #1158792 #1158793 #1158795 #1167890 #1168930 #1169605 #1169786 #1169936 Cross-References: CVE-2017-15298 CVE-2018-11233 CVE-2018-11235 CVE-2018-17456 CVE-2019-1348 CVE-2019-1349 CVE-2019-1350 CVE-2019-1351 CVE-2019-1352 CVE-2019-1353 CVE-2019-1354 CVE-2019-1387 CVE-2019-19604 CVE-2020-11008 CVE-2020-5260 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves 15 vulnerabilities and has 8 fixes is now available. Description: This update for git fixes the following issues: Security issues fixed: * CVE-2020-11008: Specially crafted URLs may have tricked the credentials helper to providing credential information that is not appropriate for the protocol in use and host being contacted (bsc#1169936) git was updated to 2.26.1 (bsc#1169786, jsc#ECO-1628, bsc#1149792) - Fix git-daemon not starting after conversion from sysvinit to systemd service (bsc#1169605). * CVE-2020-5260: Specially crafted URLs with newline characters could have been used to make the Git client to send credential information for a wrong host to the attacker's site bsc#1168930 git 2.26.0 (bsc#1167890, jsc#SLE-11608): * "git rebase" now uses a different backend that is based on the 'merge' machinery by default. The 'rebase.backend' configuration variable reverts to old behaviour when set to 'apply' * Improved handling of sparse checkouts * Improvements to many commands and internal features git 2.25.2: * bug fixes to various subcommands in specific operations git 2.25.1: * "git commit" now honors advise.statusHints * various updates, bug fixes and documentation updates git 2.25.0 * The branch description ("git branch --edit-description") has been used to fill the body of the cover letters by the format-patch command; this has been enhanced so that the subject can also be filled. * A few commands learned to take the pathspec from the standard input or a named file, instead of taking it as the command line arguments, with the "--pathspec-from-file" option. * Test updates to prepare for SHA-2 transition continues. * Redo "git name-rev" to avoid recursive calls. * When all files from some subdirectory were renamed to the root directory, the directory rename heuristics would fail to detect that as a rename/merge of the subdirectory to the root directory, which has been corrected. * HTTP transport had possible allocator/deallocator mismatch, which has been corrected. git 2.24.1: * CVE-2019-1348: The --export-marks option of fast-import is exposed also via the in-stream command feature export-marks=... and it allows overwriting arbitrary paths (bsc#1158785) * CVE-2019-1349: on Windows, when submodules are cloned recursively, under certain circumstances Git could be fooled into using the same Git directory twice (bsc#1158787) * CVE-2019-1350: Incorrect quoting of command-line arguments allowed remote code execution during a recursive clone in conjunction with SSH URLs (bsc#1158788) * CVE-2019-1351: on Windows mistakes drive letters outside of the US-English alphabet as relative paths (bsc#1158789) * CVE-2019-1352: on Windows was unaware of NTFS Alternate Data Streams (bsc#1158790) * CVE-2019-1353: when run in the Windows Subsystem for Linux while accessing a working directory on a regular Windows drive, none of the NTFS protections were active (bsc#1158791) * CVE-2019-1354: on Windows refuses to write tracked files with filenames that contain backslashes (bsc#1158792) * CVE-2019-1387: Recursive clones vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones (bsc#1158793) * CVE-2019-19604: a recursive clone followed by a submodule update could execute code contained within the repository without the user explicitly having asked for that (bsc#1158795) git 2.24.0 * The command line parser learned "--end-of-options" notation. * A mechanism to affect the default setting for a (related) group of configuration variables is introduced. * "git fetch" learned "--set-upstream" option to help those who first clone from their private fork they intend to push to, add the true upstream via "git remote add" and then "git fetch" from it. * fixes and improvements to UI, workflow and features, bash completion fixes git 2.23.0: * The "--base" option of "format-patch" computed the patch-ids for prerequisite patches in an unstable way, which has been updated to compute in a way that is compatible with "git patch-id --stable". * The "git log" command by default behaves as if the --mailmap option was given. * fixes and improvements to UI, workflow and features git 2.22.1 * A relative pathname given to "git init --template=<path> <repo>" ought to be relative to the directory "git init" gets invoked in, but it instead was made relative to the repository, which has been corrected. * "git worktree add" used to fail when another worktree connected to the same repository was corrupt, which has been corrected. * "git am -i --resolved" segfaulted after trying to see a commit as if it were a tree, which has been corrected. * "git merge --squash" is designed to update the working tree and the index without creating the commit, and this cannot be countermanded by adding the "--commit" option; the command now refuses to work when both options are given. * Update to Unicode 12.1 width table. * "git request-pull" learned to warn when the ref we ask them to pull from in the local repository and in the published repository are different. * "git fetch" into a lazy clone forgot to fetch base objects that are necessary to complete delta in a thin packfile, which has been corrected. * The URL decoding code has been updated to avoid going past the end of the string while parsing %-<hex>-<hex> sequence. * "git clean" silently skipped a path when it cannot lstat() it; now it gives a warning. * "git rm" to resolve a conflicted path leaked an internal message "needs merge" before actually removing the path, which was confusing. This has been corrected. * Many more bugfixes and code cleanups. - removal of SuSEfirewall2 service, since SuSEfirewall2 has been replaced by firewalld. - partial fix for git instaweb giving 500 error (bsc#1112230) git 2.22.0 * The filter specification "--filter=sparse:path=<path>" used to create a lazy/partial clone has been removed. Using a blob that is part of the project as sparse specification is still supported with the "--filter=sparse:oid=<blob>" option * "git checkout --no-overlay" can be used to trigger a new mode of checking out paths out of the tree-ish, that allows paths that match the pathspec that are in the current index and working tree and are not in the tree-ish. * Four new configuration variables {author,committer}.{name,email} have been introduced to override user.{name,email} in more specific cases. * "git branch" learned a new subcommand "--show-current". * The command line completion (in contrib/) has been taught to complete more subcommand parameters. * The completion helper code now pays attention to repository-local configuration (when available), which allows --list-cmds to honour a repository specific setting of completion.commands, for example. * The list of conflicted paths shown in the editor while concluding a conflicted merge was shown above the scissors line when the clean-up mode is set to "scissors", even though it was commented out just like the list of updated paths and other information to help the user explain the merge better. * "git rebase" that was reimplemented in C did not set ORIG_HEAD correctly, which has been corrected. * "git worktree add" used to do a "find an available name with stat and then mkdir", which is race-prone. This has been fixed by using mkdir and reacting to EEXIST in a loop. - Move to DocBook 5.x. Asciidoctor 2.x no longer supports the legacy DocBook 4.5 format. - update git-web AppArmor profile for bash and tar usrMerge (bsc#1132350) git 2.21.0 * Historically, the "-m" (mainline) option can only be used for "git cherry-pick" and "git revert" when working with a merge commit. This version of Git no longer warns or errors out when working with a single-parent commit, as long as the argument to the "-m" option is 1 (i.e. it has only one parent, and the request is to pick or revert relative to that first parent). Scripts that relied on the behaviour may get broken with this change. * Small fixes and features for fast-export and fast-import. * The "http.version" configuration variable can be used with recent enough versions of cURL library to force the version of HTTP used to talk when fetching and pushing. * "git push $there $src:$dst" rejects when $dst is not a fully qualified refname and it is not clear what the end user meant. * Update "git multimail" from the upstream. * A new date format "--date=human" that morphs its output depending on how far the time is from the current time has been introduced. "--date=auto:human" can be used to use this new format (or any existing format) when the output is going to the pager or to the terminal, and otherwise the default format. - Fix worktree creation race (bsc#1114225). - add shadow build dependency to the -daemon subpackage. git 2.20.1: * portability fixes * "git help -a" did not work well when an overly long alias was defined * no longer squelched an error message when the run_command API failed to run a missing command git 2.20.0 * "git help -a" now gives verbose output (same as "git help -av"). Those who want the old output may say "git help --no-verbose -a".. * "git send-email" learned to grab address-looking string on any trailer whose name ends with "-by". * "git format-patch" learned new "--interdiff" and "--range-diff" options to explain the difference between this version and the previous attempt in the cover letter (or after the three-dashes as a comment). * Developer builds now use -Wunused-function compilation option. * Fix a bug in which the same path could be registered under multiple worktree entries if the path was missing (for instance, was removed manually). Also, as a convenience, expand the number of cases in which --force is applicable. * The overly large Documentation/config.txt file have been split into million little pieces. This potentially allows each individual piece to be included into the manual page of the command it affects more easily. * Malformed or crafted data in packstream can make our code attempt to read or write past the allocated buffer and abort, instead of reporting an error, which has been fixed. * Fix for a long-standing bug that leaves the index file corrupt when it shrinks during a partial commit. * "git merge" and "git pull" that merges into an unborn branch used to completely ignore "--verify-signatures", which has been corrected. * ...and much more features and fixes git 2.19.2: * various bug fixes for multiple subcommands and operations git 2.19.1: * CVE-2018-17456: Specially crafted .gitmodules files may have allowed arbitrary code execution when the repository is cloned with --recurse-submodules (bsc#1110949) git 2.19.0: * "git diff" compares the index and the working tree. For paths added with intent-to-add bit, the command shows the full contents of them as added, but the paths themselves were not marked as new files. They are now shown as new by default. * "git apply" learned the "--intent-to-add" option so that an otherwise working-tree-only application of a patch will add new paths to the index marked with the "intent-to-add" bit. * "git grep" learned the "--column" option that gives not just the line number but the column number of the hit. * The "-l" option in "git branch -l" is an unfortunate short-hand for "--create-reflog", but many users, both old and new, somehow expect it to be something else, perhaps "--list". This step warns when "-l" is used as a short-hand for "--create-reflog" and warns about the future repurposing of the it when it is used. * The userdiff pattern for .php has been updated. * The content-transfer-encoding of the message "git send-email" sends out by default was 8bit, which can cause trouble when there is an overlong line to bust RFC 5322/2822 limit. A new option 'auto' to automatically switch to quoted-printable when there is such a line in the payload has been introduced and is made the default. * "git checkout" and "git worktree add" learned to honor checkout.defaultRemote when auto-vivifying a local branch out of a remote tracking branch in a repository with multiple remotes that have tracking branches that share the same names. (merge 8d7b558bae ab/checkout-default-remote later to maint). * "git grep" learned the "--only-matching" option. * "git rebase --rebase-merges" mode now handles octopus merges as well. * Add a server-side knob to skip commits in exponential/fibbonacci stride in an attempt to cover wider swath of history with a smaller number of iterations, potentially accepting a larger packfile transfer, instead of going back one commit a time during common ancestor discovery during the "git fetch" transaction. (merge 42cc7485a2 jt/fetch-negotiator-skipping later to maint). * A new configuration variable core.usereplacerefs has been added, primarily to help server installations that want to ignore the replace mechanism altogether. * Teach "git tag -s" etc. a few configuration variables (gpg.format that can be set to "openpgp" or "x509", and gpg.<format>.program that is used to specify what program to use to deal with the format) to allow x.509 certs with CMS via "gpgsm" to be used instead of openpgp via "gnupg". * Many more strings are prepared for l10n. * "git p4 submit" learns to ask its own pre-submit hook if it should continue with submitting. * The test performed at the receiving end of "git push" to prevent bad objects from entering repository can be customized via receive.fsck.* configuration variables; we now have gained a counterpart to do the same on the "git fetch" side, with fetch.fsck.* configuration variables. * "git pull --rebase=interactive" learned "i" as a short-hand for "interactive". * "git instaweb" has been adjusted to run better with newer Apache on RedHat based distros. * "git range-diff" is a reimplementation of "git tbdiff" that lets us compare individual patches in two iterations of a topic. * The sideband code learned to optionally paint selected keywords at the beginning of incoming lines on the receiving end. * "git branch --list" learned to take the default sort order from the 'branch.sort' configuration variable, just like "git tag --list" pays attention to 'tag.sort'. * "git worktree" command learned "--quiet" option to make it less verbose. git 2.18.0: * improvements to rename detection logic * When built with more recent cURL, GIT_SSL_VERSION can now specify "tlsv1.3" as its value. * "git mergetools" learned talking to guiffy. * various other workflow improvements and fixes * performance improvements and other developer visible fixes git 2.17.1 * Submodule "names" come from the untrusted .gitmodules file, but we blindly append them to $GIT_DIR/modules to create our on-disk repo paths. This means you can do bad things by putting "../" into the name. We now enforce some rules for submodule names which will cause Git to ignore these malicious names (CVE-2018-11235, bsc#1095219) * It was possible to trick the code that sanity-checks paths on NTFS into reading random piece of memory (CVE-2018-11233, bsc#1095218) * Support on the server side to reject pushes to repositories that attempt to create such problematic .gitmodules file etc. as tracked contents, to help hosting sites protect their customers by preventing malicious contents from spreading. git 2.17.0: * "diff" family of commands learned "--find-object=<object-id>" option to limit the findings to changes that involve the named object. * "git format-patch" learned to give 72-cols to diffstat, which is consistent with other line length limits the subcommand uses for its output meant for e-mails. * The log from "git daemon" can be redirected with a new option; one relevant use case is to send the log to standard error (instead of syslog) when running it from inetd. * "git rebase" learned to take "--allow-empty-message" option. * "git am" has learned the "--quit" option, in addition to the existing "--abort" option; having the pair mirrors a few other commands like "rebase" and "cherry-pick". * "git worktree add" learned to run the post-checkout hook, just like "git clone" runs it upon the initial checkout. * "git tag" learned an explicit "--edit" option that allows the message given via "-m" and "-F" to be further edited. * "git fetch --prune-tags" may be used as a handy short-hand for getting rid of stale tags that are locally held. * The new "--show-current-patch" option gives an end-user facing way to get the diff being applied when "git rebase" (and "git am") stops with a conflict. * "git add -p" used to offer "/" (look for a matching hunk) as a choice, even there was only one hunk, which has been corrected. Also the single-key help is now given only for keys that are enabled (e.g. help for '/' won't be shown when there is only one hunk). * Since Git 1.7.9, "git merge" defaulted to --no-ff (i.e. even when the side branch being merged is a descendant of the current commit, create a merge commit instead of fast-forwarding) when merging a tag object. This was appropriate default for integrators who pull signed tags from their downstream contributors, but caused an unnecessary merges when used by downstream contributors who habitually "catch up" their topic branches with tagged releases from the upstream. Update "git merge" to default to --no-ff only when merging a tag object that does *not* sit at its usual place in refs/tags/ hierarchy, and allow fast-forwarding otherwise, to mitigate the problem. * "git status" can spend a lot of cycles to compute the relation between the current branch and its upstream, which can now be disabled with "--no-ahead-behind" option. * "git diff" and friends learned funcname patterns for Go language source files. * "git send-email" learned "--reply-to=<address>" option. * Funcname pattern used for C# now recognizes "async" keyword. * In a way similar to how "git tag" learned to honor the pager setting only in the list mode, "git config" learned to ignore the pager setting when it is used for setting values (i.e. when the purpose of the operation is not to "show"). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-598=1 Package List: - openSUSE Leap 15.1 (x86_64): git-2.26.1-lp151.4.9.1 git-arch-2.26.1-lp151.4.9.1 git-core-2.26.1-lp151.4.9.1 git-core-debuginfo-2.26.1-lp151.4.9.1 git-credential-gnome-keyring-2.26.1-lp151.4.9.1 git-credential-gnome-keyring-debuginfo-2.26.1-lp151.4.9.1 git-credential-libsecret-2.26.1-lp151.4.9.1 git-credential-libsecret-debuginfo-2.26.1-lp151.4.9.1 git-cvs-2.26.1-lp151.4.9.1 git-daemon-2.26.1-lp151.4.9.1 git-daemon-debuginfo-2.26.1-lp151.4.9.1 git-debuginfo-2.26.1-lp151.4.9.1 git-debugsource-2.26.1-lp151.4.9.1 git-email-2.26.1-lp151.4.9.1 git-gui-2.26.1-lp151.4.9.1 git-p4-2.26.1-lp151.4.9.1 git-svn-2.26.1-lp151.4.9.1 git-svn-debuginfo-2.26.1-lp151.4.9.1 git-web-2.26.1-lp151.4.9.1 gitk-2.26.1-lp151.4.9.1 - openSUSE Leap 15.1 (noarch): git-doc-2.26.1-lp151.4.9.1 References: https://www.suse.com/security/cve/CVE-2017-15298.html https://www.suse.com/security/cve/CVE-2018-11233.html https://www.suse.com/security/cve/CVE-2018-11235.html https://www.suse.com/security/cve/CVE-2018-17456.html https://www.suse.com/security/cve/CVE-2019-1348.html https://www.suse.com/security/cve/CVE-2019-1349.html https://www.suse.com/security/cve/CVE-2019-1350.html https://www.suse.com/security/cve/CVE-2019-1351.html https://www.suse.com/security/cve/CVE-2019-1352.html https://www.suse.com/security/cve/CVE-2019-1353.html https://www.suse.com/security/cve/CVE-2019-1354.html https://www.suse.com/security/cve/CVE-2019-1387.html https://www.suse.com/security/cve/CVE-2019-19604.html https://www.suse.com/security/cve/CVE-2020-11008.html https://www.suse.com/security/cve/CVE-2020-5260.html https://bugzilla.suse.com/1063412 https://bugzilla.suse.com/1095218 https://bugzilla.suse.com/1095219 https://bugzilla.suse.com/1110949 https://bugzilla.suse.com/1112230 https://bugzilla.suse.com/1114225 https://bugzilla.suse.com/1132350 https://bugzilla.suse.com/1149792 https://bugzilla.suse.com/1156651 https://bugzilla.suse.com/1158785 https://bugzilla.suse.com/1158787 https://bugzilla.suse.com/1158788 https://bugzilla.suse.com/1158789 https://bugzilla.suse.com/1158790 https://bugzilla.suse.com/1158791 https://bugzilla.suse.com/1158792 https://bugzilla.suse.com/1158793 https://bugzilla.suse.com/1158795 https://bugzilla.suse.com/1167890 https://bugzilla.suse.com/1168930 https://bugzilla.suse.com/1169605 https://bugzilla.suse.com/1169786 https://bugzilla.suse.com/1169936

1 0

openSUSE-RU-2020:0594-1: moderate: Recommended update for ypbind
by maintenance＠opensuse.org 01 May '20

01 May '20

openSUSE Recommended Update: Recommended update for ypbind ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0594-1 Rating: moderate References: #1163252 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ypbind fixes the following issues: - Fix for setting domain name by waiting that network becomes online, so it can be properly configured in sysconfig. (bsc#1163252) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-594=1 Package List: - openSUSE Leap 15.1 (x86_64): ypbind-2.6-lp151.2.3.1 ypbind-debuginfo-2.6-lp151.2.3.1 ypbind-debugsource-2.6-lp151.2.3.1 References: https://bugzilla.suse.com/1163252

1 0

openSUSE-RU-2020:0577-1: moderate: Recommended update for nginx
by maintenance＠opensuse.org 01 May '20

01 May '20

openSUSE Recommended Update: Recommended update for nginx ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0577-1 Rating: moderate References: #1150711 #1155690 #1156202 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for nginx fixes the following issues: nginx was updated to 1.16.1 (jsc#ECO-1401) - Added TLS 1.3 support (jsc#SLE-9295, bsc#1150711) - Replaced obsolete GeoIP module with MaxMinDB-based GeoIP2 (jsc#SLE-11184, bsc#1156202) - Started nginx after network is online (bsc#1155690) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-577=1 Package List: - openSUSE Leap 15.1 (noarch): nginx-source-1.16.1-lp151.4.9.1 vim-plugin-nginx-1.16.1-lp151.4.9.1 - openSUSE Leap 15.1 (x86_64): nginx-1.16.1-lp151.4.9.1 nginx-debuginfo-1.16.1-lp151.4.9.1 nginx-debugsource-1.16.1-lp151.4.9.1 References: https://bugzilla.suse.com/1150711 https://bugzilla.suse.com/1155690 https://bugzilla.suse.com/1156202

1 0

openSUSE-RU-2020:0591-1: moderate: Recommended update for tomcat
by maintenance＠opensuse.org 01 May '20

01 May '20

openSUSE Recommended Update: Recommended update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0591-1 Rating: moderate References: #1161083 #1167438 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for tomcat fixes the following issue: Update from Tomcat 9.0.31 to Tomcat 9.0.33. - Regression in HTTP header parsing. (bsc#1167438) The update improves the validation of the HTTP header parsing causing requests to be incorrectly treated as invalid if a CRLF sequence was split between TCP packets. Has been also improved the validation of request lines, including for HTTP/0.9 requests. - Fix NoSuchMethodError in the HTTP APR connector when using openjdk 1.8. (bsc#1161083) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-591=1 Package List: - openSUSE Leap 15.1 (noarch): tomcat-9.0.33-lp151.3.15.1 tomcat-admin-webapps-9.0.33-lp151.3.15.1 tomcat-docs-webapp-9.0.33-lp151.3.15.1 tomcat-el-3_0-api-9.0.33-lp151.3.15.1 tomcat-embed-9.0.33-lp151.3.15.1 tomcat-javadoc-9.0.33-lp151.3.15.1 tomcat-jsp-2_3-api-9.0.33-lp151.3.15.1 tomcat-jsvc-9.0.33-lp151.3.15.1 tomcat-lib-9.0.33-lp151.3.15.1 tomcat-servlet-4_0-api-9.0.33-lp151.3.15.1 tomcat-webapps-9.0.33-lp151.3.15.1 References: https://bugzilla.suse.com/1161083 https://bugzilla.suse.com/1167438

1 0

openSUSE-RU-2020:0593-1: important: Recommended update for yast2-registration
by maintenance＠opensuse.org 01 May '20

01 May '20

openSUSE Recommended Update: Recommended update for yast2-registration ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0593-1 Rating: important References: #1167945 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-registration fixes the following issues: - Fix for offline upgrade that fails the process at the registration due to a missing function. (bsc#1167945) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-593=1 Package List: - openSUSE Leap 15.1 (noarch): yast2-registration-4.1.25-lp151.2.9.1 References: https://bugzilla.suse.com/1167945

1 0

openSUSE-RU-2020:0580-1: moderate: Recommended update for perl-CGI
by maintenance＠opensuse.org 01 May '20

01 May '20

openSUSE Recommended Update: Recommended update for perl-CGI ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0580-1 Rating: moderate References: #1162868 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for perl-CGI fixes the following issues: Update from version 4.38 to 4.46 (bsc#1162868) * Add support for SameSite=None cookies and update the documentation * Replace only use of "base" with "parent" given that CGI already depends on "parent" * Support unquoted multipart/form-data name values * Update the package license from "Artistic-1.0 or GPL-1.0+" to "Artistic-2.0" * Support perls < 5.10.1 and specify CONFIGURE_REQUIRES in Makefile.PL for being more dynamic This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-580=1 Package List: - openSUSE Leap 15.1 (noarch): perl-CGI-4.46-lp151.3.3.1 References: https://bugzilla.suse.com/1162868

1 0

openSUSE-SU-2020:0597-1: important: Security update for apache2
by opensuse-security＠opensuse.org 01 May '20

01 May '20

openSUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0597-1 Rating: important References: #1168404 #1168407 #1169066 Cross-References: CVE-2020-1927 CVE-2020-1934 CVE-2020-1938 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for apache2 fixes the following issues: - CVE-2020-1934: mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server (bsc#1168404). - CVE-2020-1927: mod_rewrite configurations vulnerable to open redirect (bsc#1168407). - CVE-2020-1938: mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy AJP13 authentication (bsc#1169066). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-597=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): apache2-2.4.33-lp151.8.12.1 apache2-debuginfo-2.4.33-lp151.8.12.1 apache2-debugsource-2.4.33-lp151.8.12.1 apache2-devel-2.4.33-lp151.8.12.1 apache2-event-2.4.33-lp151.8.12.1 apache2-event-debuginfo-2.4.33-lp151.8.12.1 apache2-example-pages-2.4.33-lp151.8.12.1 apache2-prefork-2.4.33-lp151.8.12.1 apache2-prefork-debuginfo-2.4.33-lp151.8.12.1 apache2-utils-2.4.33-lp151.8.12.1 apache2-utils-debuginfo-2.4.33-lp151.8.12.1 apache2-worker-2.4.33-lp151.8.12.1 apache2-worker-debuginfo-2.4.33-lp151.8.12.1 - openSUSE Leap 15.1 (noarch): apache2-doc-2.4.33-lp151.8.12.1 References: https://www.suse.com/security/cve/CVE-2020-1927.html https://www.suse.com/security/cve/CVE-2020-1934.html https://www.suse.com/security/cve/CVE-2020-1938.html https://bugzilla.suse.com/1168404 https://bugzilla.suse.com/1168407 https://bugzilla.suse.com/1169066

1 0

openSUSE-RU-2020:0578-1: moderate: Recommended update for open-iscsi
by maintenance＠opensuse.org 01 May '20

01 May '20

openSUSE Recommended Update: Recommended update for open-iscsi ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0578-1 Rating: moderate References: #1159768 #1164607 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for open-iscsi fixes the following issues: - Avoid logout of iscsi boot session. (bsc#1159768) - Fix iscsi.service so it handles restarts better. (bsc#1164607) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-578=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): iscsiuio-0.7.8.2-lp151.13.9.1 iscsiuio-debuginfo-0.7.8.2-lp151.13.9.1 libopeniscsiusr0_2_0-2.0.876-lp151.13.9.1 libopeniscsiusr0_2_0-debuginfo-2.0.876-lp151.13.9.1 open-iscsi-2.0.876-lp151.13.9.1 open-iscsi-debuginfo-2.0.876-lp151.13.9.1 open-iscsi-debugsource-2.0.876-lp151.13.9.1 open-iscsi-devel-2.0.876-lp151.13.9.1 References: https://bugzilla.suse.com/1159768 https://bugzilla.suse.com/1164607

1 0

openSUSE-RU-2020:0587-1: moderate: Recommended update for seccheck
by maintenance＠opensuse.org 01 May '20

01 May '20

openSUSE Recommended Update: Recommended update for seccheck ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0587-1 Rating: moderate References: #1132919 #985802 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for seccheck fixes the following issues: - adapt WantedBy so the timers are actually started at boot time when enabled (#1132919) - correct indentation of SECCHK_FROM (#985802) for the weekly and monthly mails so that the mail header lines are recognised by the receiving mail client This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-587=1 Package List: - openSUSE Leap 15.1 (noarch): seccheck-3.0-lp151.5.3.1 References: https://bugzilla.suse.com/1132919 https://bugzilla.suse.com/985802

1 0