July 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2020:1020-1: important: Security update for chromium
by opensuse-security＠opensuse.org 20 Jul '20

20 Jul '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1020-1 Rating: important References: #1174189 Cross-References: CVE-2020-6510 CVE-2020-6511 CVE-2020-6512 CVE-2020-6513 CVE-2020-6514 CVE-2020-6515 CVE-2020-6516 CVE-2020-6517 CVE-2020-6518 CVE-2020-6519 CVE-2020-6520 CVE-2020-6521 CVE-2020-6522 CVE-2020-6523 CVE-2020-6524 CVE-2020-6525 CVE-2020-6526 CVE-2020-6527 CVE-2020-6528 CVE-2020-6529 CVE-2020-6530 CVE-2020-6531 CVE-2020-6533 CVE-2020-6534 CVE-2020-6535 CVE-2020-6536 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 26 vulnerabilities is now available. Description: This update for chromium fixes the following issues: - Update to 84.0.4147.89 boo#1174189: * Critical CVE-2020-6510: Heap buffer overflow in background fetch. * High CVE-2020-6511: Side-channel information leakage in content security policy. * High CVE-2020-6512: Type Confusion in V8. * High CVE-2020-6513: Heap buffer overflow in PDFium. * High CVE-2020-6514: Inappropriate implementation in WebRTC. * High CVE-2020-6515: Use after free in tab strip. * High CVE-2020-6516: Policy bypass in CORS. * High CVE-2020-6517: Heap buffer overflow in history. * Medium CVE-2020-6518: Use after free in developer tools. * Medium CVE-2020-6519: Policy bypass in CSP. * Medium CVE-2020-6520: Heap buffer overflow in Skia. * Medium CVE-2020-6521: Side-channel information leakage in autofill. * Medium CVE-2020-6522: Inappropriate implementation in external protocol handlers. * Medium CVE-2020-6523: Out of bounds write in Skia. * Medium CVE-2020-6524: Heap buffer overflow in WebAudio. * Medium CVE-2020-6525: Heap buffer overflow in Skia. * Low CVE-2020-6526: Inappropriate implementation in iframe sandbox. * Low CVE-2020-6527: Insufficient policy enforcement in CSP. * Low CVE-2020-6528: Incorrect security UI in basic auth. * Low CVE-2020-6529: Inappropriate implementation in WebRTC. * Low CVE-2020-6530: Out of bounds memory access in developer tools. * Low CVE-2020-6531: Side-channel information leakage in scroll to text. * Low CVE-2020-6533: Type Confusion in V8. * Low CVE-2020-6534: Heap buffer overflow in WebRTC. * Low CVE-2020-6535: Insufficient data validation in WebUI. * Low CVE-2020-6536: Incorrect security UI in PWAs. - Use bundled xcb-proto as we need to generate py2 bindings - Try to fix non-wayland build for Leap builds Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1020=1 Package List: - openSUSE Leap 15.2 (x86_64): chromedriver-84.0.4147.89-lp152.2.6.2 chromedriver-debuginfo-84.0.4147.89-lp152.2.6.2 chromium-84.0.4147.89-lp152.2.6.2 chromium-debuginfo-84.0.4147.89-lp152.2.6.2 chromium-debugsource-84.0.4147.89-lp152.2.6.2 References: https://www.suse.com/security/cve/CVE-2020-6510.html https://www.suse.com/security/cve/CVE-2020-6511.html https://www.suse.com/security/cve/CVE-2020-6512.html https://www.suse.com/security/cve/CVE-2020-6513.html https://www.suse.com/security/cve/CVE-2020-6514.html https://www.suse.com/security/cve/CVE-2020-6515.html https://www.suse.com/security/cve/CVE-2020-6516.html https://www.suse.com/security/cve/CVE-2020-6517.html https://www.suse.com/security/cve/CVE-2020-6518.html https://www.suse.com/security/cve/CVE-2020-6519.html https://www.suse.com/security/cve/CVE-2020-6520.html https://www.suse.com/security/cve/CVE-2020-6521.html https://www.suse.com/security/cve/CVE-2020-6522.html https://www.suse.com/security/cve/CVE-2020-6523.html https://www.suse.com/security/cve/CVE-2020-6524.html https://www.suse.com/security/cve/CVE-2020-6525.html https://www.suse.com/security/cve/CVE-2020-6526.html https://www.suse.com/security/cve/CVE-2020-6527.html https://www.suse.com/security/cve/CVE-2020-6528.html https://www.suse.com/security/cve/CVE-2020-6529.html https://www.suse.com/security/cve/CVE-2020-6530.html https://www.suse.com/security/cve/CVE-2020-6531.html https://www.suse.com/security/cve/CVE-2020-6533.html https://www.suse.com/security/cve/CVE-2020-6534.html https://www.suse.com/security/cve/CVE-2020-6535.html https://www.suse.com/security/cve/CVE-2020-6536.html https://bugzilla.suse.com/1174189

1 0

openSUSE-RU-2020:1019-1: moderate: Recommended update for libsolv, libzypp, zypper
by maintenance＠opensuse.org 20 Jul '20

20 Jul '20

openSUSE Recommended Update: Recommended update for libsolv, libzypp, zypper ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1019-1 Rating: moderate References: #1169947 #1170801 #1172925 #1173106 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for libsolv, libzypp, zypper fixes the following issues: libsolv was updated to: - Enable zstd compression support for sle15 zypper was updated to version 1.14.37: - Print switch abbrev warning to stderr (bsc#1172925) - Fix typo in man page (bsc#1169947) libzypp was updated to 17.24.0 - Fix core dump with corrupted history file (bsc#1170801) - Enable zchunk metadata download if libsolv supports it. - Better handling of the purge-kernels algorithm. (bsc#1173106) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1019=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libsolv-debuginfo-0.7.14-lp152.2.3.1 libsolv-debugsource-0.7.14-lp152.2.3.1 libsolv-demo-0.7.14-lp152.2.3.1 libsolv-demo-debuginfo-0.7.14-lp152.2.3.1 libsolv-devel-0.7.14-lp152.2.3.1 libsolv-devel-debuginfo-0.7.14-lp152.2.3.1 libsolv-tools-0.7.14-lp152.2.3.1 libsolv-tools-debuginfo-0.7.14-lp152.2.3.1 libzypp-17.24.0-lp152.2.3.2 libzypp-debuginfo-17.24.0-lp152.2.3.2 libzypp-debugsource-17.24.0-lp152.2.3.2 libzypp-devel-17.24.0-lp152.2.3.2 libzypp-devel-doc-17.24.0-lp152.2.3.2 perl-solv-0.7.14-lp152.2.3.1 perl-solv-debuginfo-0.7.14-lp152.2.3.1 python-solv-0.7.14-lp152.2.3.1 python-solv-debuginfo-0.7.14-lp152.2.3.1 python3-solv-0.7.14-lp152.2.3.1 python3-solv-debuginfo-0.7.14-lp152.2.3.1 ruby-solv-0.7.14-lp152.2.3.1 ruby-solv-debuginfo-0.7.14-lp152.2.3.1 zypper-1.14.37-lp152.2.3.1 zypper-debuginfo-1.14.37-lp152.2.3.1 zypper-debugsource-1.14.37-lp152.2.3.1 - openSUSE Leap 15.2 (noarch): zypper-aptitude-1.14.37-lp152.2.3.1 zypper-log-1.14.37-lp152.2.3.1 zypper-needs-restarting-1.14.37-lp152.2.3.1 References: https://bugzilla.suse.com/1169947 https://bugzilla.suse.com/1170801 https://bugzilla.suse.com/1172925 https://bugzilla.suse.com/1173106

1 0

openSUSE-RU-2020:1018-1: Recommended update for python-numpy
by maintenance＠opensuse.org 20 Jul '20

20 Jul '20

openSUSE Recommended Update: Recommended update for python-numpy ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1018-1 Rating: low References: #1166678 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-numpy fixes the following issues: - Fixes a file conflict with /usr/bin/f2py (bsc#1166678) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1018=1 Package List: - openSUSE Leap 15.2 (x86_64): python-numpy-debugsource-1.17.3-lp152.2.4.1 python-numpy_1_17_3-gnu-hpc-debugsource-1.17.3-lp152.2.4.1 python3-numpy-1.17.3-lp152.2.4.1 python3-numpy-debuginfo-1.17.3-lp152.2.4.1 python3-numpy-devel-1.17.3-lp152.2.4.1 python3-numpy-gnu-hpc-1.17.3-lp152.2.4.1 python3-numpy-gnu-hpc-devel-1.17.3-lp152.2.4.1 python3-numpy_1_17_3-gnu-hpc-1.17.3-lp152.2.4.1 python3-numpy_1_17_3-gnu-hpc-debuginfo-1.17.3-lp152.2.4.1 python3-numpy_1_17_3-gnu-hpc-devel-1.17.3-lp152.2.4.1 References: https://bugzilla.suse.com/1166678

1 0

openSUSE-SU-2020:1016-1: moderate: Security update for mumble
by opensuse-security＠opensuse.org 20 Jul '20

20 Jul '20

openSUSE Security Update: Security update for mumble ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1016-1 Rating: moderate References: #1174041 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for mumble fixes the following issues: mumble was updated 1.3.2: * client: Fixed overlay not starting Update to upstream version 1.3.1 - Security * Fixed: Potential exploit in the OCB2 encryption (#4227) boo#1174041 - ICE * Fixed: Added missing UserKDFIterations field to UserInfo => Prevents getRegistration() from failing with enumerator out of range error (#3835) - GRPC * Fixed: Segmentation fault during murmur shutdown (#3938) - Client * Fixed: Crash when using multiple monitors (#3756) * Fixed: Don't send empty message from clipboard via shortcut, if clipboard is empty (#3864) * Fixed: Talking indicator being able to freeze to indicate talking when self-muted (#4006) * Fixed: High CPU usage for update-check if update server not available (#4019) * Fixed: DBus getCurrentUrl returning empty string when not in root-channel (#4029) * Fixed: Small parts of whispering leaking out (#4051) * Fixed: Last audio frame of normal talking is sent to last whisper target (#4050) * Fixed: LAN-icon not found in ConnectDialog (#4058) * Improved: Set maximal vertical size for User Volume Adjustment dialog (#3801) * Improved: Don't send empty data to PulseAudio (#3316) * Improved: Use the SRV resolved port for UDP connections (#3820) * Improved: Manual Plugin UI (#3919) * Improved: Don't start Jack server by default (#3990) * Improved: Overlay doesn't hook into all other processes by default (#4041) * Improved: Wait longer before disconnecting from a server due to unanswered Ping-messages (#4123) - Server * Fixed: Possibility to circumvent max user-count in channel (#3880) * Fixed: Rate-limit implementation susceptible to time-underflow (#4004) * Fixed: OpenSSL error 140E0197 with Qt >= 5.12.2 (#4032) * Fixed: VersionCheck for SQL for when to use the WAL feature (#4163) * Fixed: Wrong database encoding that could lead to server-crash (#4220) * Fixed: DB crash due to primary key violation (now performs "UPSERT" to avoid this) (#4105) * Improved: The fields in the Version ProtoBuf message are now size-restricted (#4101) - use the "profile profilename /path/to/binary" syntax to make "ps aufxZ" more readable Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1016=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1016=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): mumble-1.3.2-lp152.2.3.1 mumble-debuginfo-1.3.2-lp152.2.3.1 mumble-debugsource-1.3.2-lp152.2.3.1 mumble-server-1.3.2-lp152.2.3.1 mumble-server-debuginfo-1.3.2-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): mumble-32bit-1.3.2-lp152.2.3.1 mumble-32bit-debuginfo-1.3.2-lp152.2.3.1 - openSUSE Leap 15.1 (i586 x86_64): mumble-1.3.2-lp151.4.12.1 mumble-debuginfo-1.3.2-lp151.4.12.1 mumble-debugsource-1.3.2-lp151.4.12.1 mumble-server-1.3.2-lp151.4.12.1 mumble-server-debuginfo-1.3.2-lp151.4.12.1 - openSUSE Leap 15.1 (x86_64): mumble-32bit-1.3.2-lp151.4.12.1 mumble-32bit-debuginfo-1.3.2-lp151.4.12.1 References: https://bugzilla.suse.com/1174041

1 0

openSUSE-SU-2020:1017-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 20 Jul '20

20 Jul '20

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1017-1 Rating: important References: #1166238 #1173576 #1173613 Cross-References: CVE-2020-12402 CVE-2020-12415 CVE-2020-12416 CVE-2020-12417 CVE-2020-12418 CVE-2020-12419 CVE-2020-12420 CVE-2020-12421 CVE-2020-12422 CVE-2020-12423 CVE-2020-12424 CVE-2020-12425 CVE-2020-12426 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: This update for MozillaFirefox to version 78.0.1 ESR fixes the following issues: Security issues fixed: - CVE-2020-12415: AppCache manifest poisoning due to url encoded character processing (bsc#1173576). - CVE-2020-12416: Use-after-free in WebRTC VideoBroadcaster (bsc#1173576). - CVE-2020-12417: Memory corruption due to missing sign-extension for ValueTags on ARM64 (bsc#1173576). - CVE-2020-12418: Information disclosure due to manipulated URL object (bsc#1173576). - CVE-2020-12419: Use-after-free in nsGlobalWindowInner (bsc#1173576). - CVE-2020-12420: Use-After-Free when trying to connect to a STUN server (bsc#1173576). - CVE-2020-12402: RSA Key Generation vulnerable to side-channel attack (bsc#1173576). - CVE-2020-12421: Add-On updates did not respect the same certificate trust rules as software updates (bsc#1173576). - CVE-2020-12422: Integer overflow in nsJPEGEncoder::emptyOutputBuffer (bsc#1173576). - CVE-2020-12423: DLL Hijacking due to searching %PATH% for a library (bsc#1173576). - CVE-2020-12424: WebRTC permission prompt could have been bypassed by a compromised content process (bsc#1173576). - CVE-2020-12425: Out of bound read in Date.parse() (bsc#1173576). - CVE-2020-12426: Memory safety bugs fixed in Firefox 78 (bsc#1173576). - FIPS: MozillaFirefox: allow /proc/sys/crypto/fips_enabled (bsc#1167231). Non-security issues fixed: - Fixed interaction with freetype6 (bsc#1173613). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1017=1 Package List: - openSUSE Leap 15.1 (x86_64): MozillaFirefox-78.0.1-lp151.2.53.1 MozillaFirefox-branding-upstream-78.0.1-lp151.2.53.1 MozillaFirefox-buildsymbols-78.0.1-lp151.2.53.1 MozillaFirefox-debuginfo-78.0.1-lp151.2.53.1 MozillaFirefox-debugsource-78.0.1-lp151.2.53.1 MozillaFirefox-devel-78.0.1-lp151.2.53.1 MozillaFirefox-translations-common-78.0.1-lp151.2.53.1 MozillaFirefox-translations-other-78.0.1-lp151.2.53.1 References: https://www.suse.com/security/cve/CVE-2020-12402.html https://www.suse.com/security/cve/CVE-2020-12415.html https://www.suse.com/security/cve/CVE-2020-12416.html https://www.suse.com/security/cve/CVE-2020-12417.html https://www.suse.com/security/cve/CVE-2020-12418.html https://www.suse.com/security/cve/CVE-2020-12419.html https://www.suse.com/security/cve/CVE-2020-12420.html https://www.suse.com/security/cve/CVE-2020-12421.html https://www.suse.com/security/cve/CVE-2020-12422.html https://www.suse.com/security/cve/CVE-2020-12423.html https://www.suse.com/security/cve/CVE-2020-12424.html https://www.suse.com/security/cve/CVE-2020-12425.html https://www.suse.com/security/cve/CVE-2020-12426.html https://bugzilla.suse.com/1166238 https://bugzilla.suse.com/1173576 https://bugzilla.suse.com/1173613

1 0

openSUSE-SU-2020:1015-1: moderate: Security update for openexr
by opensuse-security＠opensuse.org 19 Jul '20

19 Jul '20

openSUSE Security Update: Security update for openexr ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1015-1 Rating: moderate References: #1173466 #1173467 #1173469 Cross-References: CVE-2020-15304 CVE-2020-15305 CVE-2020-15306 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for openexr fixes the following issues: - CVE-2020-15304: Fixed a NULL pointer dereference in TiledInputFile:TiledInputFile() (bsc#1173466). - CVE-2020-15305: Fixed a use-after-free in DeepScanLineInputFile:DeepScanLineInputFile() (bsc#1173467). - CVE-2020-15306: Fixed a heap buffer overflow in getChunkOffsetTableSize() (bsc#1173469). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1015=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libIlmImf-2_2-23-2.2.1-lp152.7.5.1 libIlmImf-2_2-23-debuginfo-2.2.1-lp152.7.5.1 libIlmImfUtil-2_2-23-2.2.1-lp152.7.5.1 libIlmImfUtil-2_2-23-debuginfo-2.2.1-lp152.7.5.1 openexr-2.2.1-lp152.7.5.1 openexr-debuginfo-2.2.1-lp152.7.5.1 openexr-debugsource-2.2.1-lp152.7.5.1 openexr-devel-2.2.1-lp152.7.5.1 openexr-doc-2.2.1-lp152.7.5.1 - openSUSE Leap 15.2 (x86_64): libIlmImf-2_2-23-32bit-2.2.1-lp152.7.5.1 libIlmImf-2_2-23-32bit-debuginfo-2.2.1-lp152.7.5.1 libIlmImfUtil-2_2-23-32bit-2.2.1-lp152.7.5.1 libIlmImfUtil-2_2-23-32bit-debuginfo-2.2.1-lp152.7.5.1 References: https://www.suse.com/security/cve/CVE-2020-15304.html https://www.suse.com/security/cve/CVE-2020-15305.html https://www.suse.com/security/cve/CVE-2020-15306.html https://bugzilla.suse.com/1173466 https://bugzilla.suse.com/1173467 https://bugzilla.suse.com/1173469

1 0

openSUSE-SU-2020:1014-1: important: Security update for google-compute-engine
by opensuse-security＠opensuse.org 19 Jul '20

19 Jul '20

openSUSE Security Update: Security update for google-compute-engine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1014-1 Rating: important References: #1169978 #1173258 Cross-References: CVE-2020-8903 CVE-2020-8907 CVE-2020-8933 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for google-compute-engine fixes the following issues: - Don't enable and start google-network-daemon.service when it's already installed (bsc#1169978) + Do not add the created user to the adm (CVE-2020-8903), docker (CVE-2020-8907), or lxd (CVE-2020-8933) groups if they exist (bsc#1173258) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1014=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): google-compute-engine-debugsource-20190801-lp152.5.4.1 google-compute-engine-oslogin-20190801-lp152.5.4.1 google-compute-engine-oslogin-debuginfo-20190801-lp152.5.4.1 - openSUSE Leap 15.2 (x86_64): google-compute-engine-oslogin-32bit-20190801-lp152.5.4.1 google-compute-engine-oslogin-32bit-debuginfo-20190801-lp152.5.4.1 - openSUSE Leap 15.2 (noarch): google-compute-engine-init-20190801-lp152.5.4.1 References: https://www.suse.com/security/cve/CVE-2020-8903.html https://www.suse.com/security/cve/CVE-2020-8907.html https://www.suse.com/security/cve/CVE-2020-8933.html https://bugzilla.suse.com/1169978 https://bugzilla.suse.com/1173258

1 0

openSUSE-OU-2020:1013-1: moderate: Optional update for python-Cerberus
by maintenance＠opensuse.org 19 Jul '20

19 Jul '20

openSUSE Optional Update: Optional update for python-Cerberus ______________________________________________________________________________ Announcement ID: openSUSE-OU-2020:1013-1 Rating: moderate References: #1121858 #1173465 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has two optional fixes can now be installed. Description: This update for python-Cerberus fixes the following issues: - Update to version 1.3.2 * includes various features and improvements - please refer to the changelog for a detailed technical list of changes This update was imported from the SUSE:SLE-15-SP1:Update update project. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1013=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): python2-Cerberus-1.3.2-bp151.2.1 References: https://bugzilla.suse.com/1121858 https://bugzilla.suse.com/1173465

1 0

openSUSE-RU-2020:1012-1: moderate: Recommended update for pan
by maintenance＠opensuse.org 19 Jul '20

19 Jul '20

openSUSE Recommended Update: Recommended update for pan ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1012-1 Rating: moderate References: #1166404 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for pan fixes the following issues: - Fix message sending when using gmime 3.0 (boo#1166404, Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1012=1 Package List: - openSUSE Leap 15.2 (noarch): pan-lang-0.146-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): pan-0.146-lp152.2.3.1 pan-debuginfo-0.146-lp152.2.3.1 pan-debugsource-0.146-lp152.2.3.1 References: https://bugzilla.suse.com/1166404

1 0

openSUSE-SU-2020:1011-1: important: Security update for singularity
by opensuse-security＠opensuse.org 19 Jul '20

19 Jul '20

openSUSE Security Update: Security update for singularity ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1011-1 Rating: important References: #1174148 #1174150 #1174152 Cross-References: CVE-2020-13845 CVE-2020-13846 CVE-2020-13847 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for singularity fixes the following issues: - New version 3.6.0. This version introduces a new signature format for SIF images, and changes to the signing / verification code to address the following security problems: - CVE-2020-13845, boo#1174150 In Singularity 3.x versions below 3.6.0, issues allow the ECL to be bypassed by a malicious user. - CVE-2020-13846, boo#1174148 In Singularity 3.5 the --all / -a option to singularity verify returns success even when some objects in a SIF container are not signed, or cannot be verified. - CVE-2020-13847, boo#1174152 In Singularity 3.x versions below 3.6.0, Singularity's sign and verify commands do not sign metadata found in the global header or data object descriptors of a SIF file, allowing an attacker to cause unexpected behavior. A signed container may verify successfully, even when it has been modified in ways that could be exploited to cause malicious behavior. - New features / functionalities - A new '--legacy-insecure' flag to verify allows verification of SIF signatures in the old, insecure format. - A new '-l / --logs' flag for instance list that shows the paths to instance STDERR / STDOUT log files. - The --json output of instance list now include paths to STDERR / STDOUT log files. - Singularity now supports the execution of minimal Docker/OCI containers that do not contain /bin/sh, e.g. docker://hello-world. - A new cache structure is used that is concurrency safe on a filesystem that supports atomic rename. If you downgrade to Singularity 3.5 or older after using 3.6 you will need to run singularity cache clean. - A plugin system rework adds new hook points that will allow the development of plugins that modify behavior of the runtime. An image driver concept is introduced for plugins to support new ways of handling image and overlay mounts. Plugins built for <=3.5 are not compatible with 3.6. - The --bind flag can now bind directories from a SIF or ext3 image into a container. - The --fusemount feature to mount filesystems to a container via FUSE drivers is now a supported feature (previously an experimental hidden flag). - This permits users to mount e.g. sshfs and cvmfs filesystems to the container at runtime. - A new -c/--config flag allows an alternative singularity.conf to be specified by the root user, or all users in an unprivileged installation. - A new --env flag allows container environment variables to be set via the Singularity command line. - A new --env-file flag allows container environment variables to be set from a specified file. - A new --days flag for cache clean allows removal of items older than a specified number of days. Replaces the --name flag which is not generally useful as the cache entries are stored by hash, not a friendly name. - Changed defaults / behaviours - New signature format (see security fixes above). - Fixed spacing of singularity instance list to be dynamically changing based off of input lengths instead of fixed number of spaces to account for long instance names. - Environment variables prefixed with SINGULARITYENV_ always take precedence over variables without SINGULARITYENV_ prefix. - The %post build section inherits environment variables from the base image. - %files from ... will now follow symlinks for sources that are directly specified, or directly resolved from a glob pattern. It will not follow symlinks found through directory traversal. This mirrors Docker multi-stage COPY behaviour. - Restored the CWD mount behaviour of v2, implying that CWD path is not recreated inside container and any symlinks in the CWD path are not resolved anymore to determine the destination path inside container. - The %test build section is executed the same manner as singularity test image. --fusemount with the container: default directive will foreground the FUSE process. Use container-daemon: for previous behavior. - Deprecate -a / --all option to sign/verify as new signature behavior makes this the default. - For more information about upstream changes, please check: https://github.com/hpcng/singularity/blob/master/CHANGELOG.md - Removed --name flag for cache clean; replaced with --days. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1011=1 Package List: - openSUSE Leap 15.2 (x86_64): singularity-3.6.0-lp152.2.3.1 singularity-debuginfo-3.6.0-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-13845.html https://www.suse.com/security/cve/CVE-2020-13846.html https://www.suse.com/security/cve/CVE-2020-13847.html https://bugzilla.suse.com/1174148 https://bugzilla.suse.com/1174150 https://bugzilla.suse.com/1174152

1 0