October 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2021:1371-1: moderate: Security update for libqt5-qtsvg
by opensuse-security＠opensuse.org 18 Oct '21

18 Oct '21

openSUSE Security Update: Security update for libqt5-qtsvg ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1371-1 Rating: moderate References: #1184783 Cross-References: CVE-2021-3481 CVSS scores: CVE-2021-3481 (SUSE): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libqt5-qtsvg fixes the following issues: - CVE-2021-3481: Fixed an out of bounds read in function QRadialFetchSimd from crafted svg file. (bsc#1184783) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1371=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libQt5Svg5-5.12.7-lp152.2.3.1 libQt5Svg5-debuginfo-5.12.7-lp152.2.3.1 libqt5-qtsvg-debugsource-5.12.7-lp152.2.3.1 libqt5-qtsvg-devel-5.12.7-lp152.2.3.1 libqt5-qtsvg-examples-5.12.7-lp152.2.3.1 libqt5-qtsvg-examples-debuginfo-5.12.7-lp152.2.3.1 - openSUSE Leap 15.2 (noarch): libqt5-qtsvg-private-headers-devel-5.12.7-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): libQt5Svg5-32bit-5.12.7-lp152.2.3.1 libQt5Svg5-32bit-debuginfo-5.12.7-lp152.2.3.1 libqt5-qtsvg-devel-32bit-5.12.7-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-3481.html https://bugzilla.suse.com/1184783

1 0

openSUSE-RU-2021:1379-1: moderate: Recommended update for yast2-network
by maintenance＠opensuse.org 18 Oct '21

18 Oct '21

openSUSE Recommended Update: Recommended update for yast2-network ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1379-1 Rating: moderate References: #1190645 #1190739 #1190915 #1190933 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for yast2-network fixes the following issues: - Do not crash when the interfaces table contains a not configured one (bsc#119064, bsc#1190915). - Fix the shown description using the interface friendly name when it is empty (bsc#1190933). - Consider aliases sections as case insensitive (bsc#1190739). - Display user defined device name in the devices overview (bsc#1190645). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1379=1 Package List: - openSUSE Leap 15.2 (noarch): yast2-network-4.2.105-lp152.2.45.1 References: https://bugzilla.suse.com/1190645 https://bugzilla.suse.com/1190739 https://bugzilla.suse.com/1190915 https://bugzilla.suse.com/1190933

1 0

openSUSE-RU-2021:1381-1: moderate: Recommended update for xkeyboard-config
by maintenance＠opensuse.org 18 Oct '21

18 Oct '21

openSUSE Recommended Update: Recommended update for xkeyboard-config ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1381-1 Rating: moderate References: #1191242 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for xkeyboard-config fixes the following issue: - Wrong keyboard mapping causing input delays with ABNT2 keyboards. (bsc#1191242) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1381=1 Package List: - openSUSE Leap 15.2 (noarch): xkeyboard-config-2.23.1-lp152.5.6.1 xkeyboard-config-lang-2.23.1-lp152.5.6.1 References: https://bugzilla.suse.com/1191242

1 0

openSUSE-RU-2021:1380-1: Recommended update for resource-agents
by maintenance＠opensuse.org 18 Oct '21

18 Oct '21

openSUSE Recommended Update: Recommended update for resource-agents ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1380-1 Rating: low References: #1180668 #1186830 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for resource-agents fixes the following issues: - Live migration fails in some scenarios. (bsc#1180668) - Failover issue due to a Google API being unreachable. (bsc#1186830) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1380=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): ldirectord-4.4.0+git57.70549516-lp152.2.31.1 resource-agents-4.4.0+git57.70549516-lp152.2.31.1 resource-agents-debuginfo-4.4.0+git57.70549516-lp152.2.31.1 resource-agents-debugsource-4.4.0+git57.70549516-lp152.2.31.1 - openSUSE Leap 15.2 (noarch): monitoring-plugins-metadata-4.4.0+git57.70549516-lp152.2.31.1 References: https://bugzilla.suse.com/1180668 https://bugzilla.suse.com/1186830

1 0

openSUSE-RU-2021:1378-1: moderate: Recommended update for lvm2
by maintenance＠opensuse.org 18 Oct '21

18 Oct '21

openSUSE Recommended Update: Recommended update for lvm2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1378-1 Rating: moderate References: #1191019 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for lvm2 fixes the following issues: - Do not crash vgextend when extending VG with missing PV. (bsc#1191019) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1378=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): device-mapper-1.02.163-lp152.7.30.1 device-mapper-debuginfo-1.02.163-lp152.7.30.1 device-mapper-devel-1.02.163-lp152.7.30.1 libdevmapper-event1_03-1.02.163-lp152.7.30.1 libdevmapper-event1_03-debuginfo-1.02.163-lp152.7.30.1 libdevmapper1_03-1.02.163-lp152.7.30.1 libdevmapper1_03-debuginfo-1.02.163-lp152.7.30.1 liblvm2cmd2_03-2.03.05-lp152.7.30.1 liblvm2cmd2_03-debuginfo-2.03.05-lp152.7.30.1 lvm2-2.03.05-lp152.7.30.1 lvm2-debuginfo-2.03.05-lp152.7.30.1 lvm2-debugsource-2.03.05-lp152.7.30.1 lvm2-devel-2.03.05-lp152.7.30.1 lvm2-device-mapper-debugsource-2.03.05-lp152.7.30.1 lvm2-lockd-2.03.05-lp152.7.30.1 lvm2-lockd-debuginfo-2.03.05-lp152.7.30.1 lvm2-lvmlockd-debugsource-2.03.05-lp152.7.30.1 lvm2-testsuite-2.03.05-lp152.7.30.1 lvm2-testsuite-debuginfo-2.03.05-lp152.7.30.1 - openSUSE Leap 15.2 (x86_64): device-mapper-devel-32bit-1.02.163-lp152.7.30.1 libdevmapper-event1_03-32bit-1.02.163-lp152.7.30.1 libdevmapper-event1_03-32bit-debuginfo-1.02.163-lp152.7.30.1 libdevmapper1_03-32bit-1.02.163-lp152.7.30.1 libdevmapper1_03-32bit-debuginfo-1.02.163-lp152.7.30.1 References: https://bugzilla.suse.com/1191019

1 0

openSUSE-SU-2021:1383-1: moderate: Security update for ssh-audit
by opensuse-security＠opensuse.org 18 Oct '21

18 Oct '21

openSUSE Security Update: Security update for ssh-audit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1383-1 Rating: moderate References: Cross-References: CVE-2018-15473 CVSS scores: CVE-2018-15473 (NVD) : 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2018-15473 (SUSE): 5.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ssh-audit fixes the following issues: ssh-audit was updated to version 2.5.0 * Fixed crash when running host key tests. * Handles server connection failures more gracefully. * Now prints JSON with indents when -jj is used (useful for debugging). * Added MD5 fingerprints to verbose output. * Added -d/--debug option for getting debugging output. * Updated JSON output to include MD5 fingerprints. Note that this results in a breaking change in the 'fingerprints' dictionary format. * Updated OpenSSH 8.1 (and earlier) policies to include rsa-sha2-512 and rsa-sha2-256. * Added OpenSSH v8.6 & v8.7 policies. * Added 3 new key exchanges: + gss-gex-sha1-eipGX3TCiQSrx573bT1o1Q== + gss-group1-sha1-eipGX3TCiQSrx573bT1o1Q== + gss-group14-sha1-eipGX3TCiQSrx573bT1o1Q== * Added 3 new MACs: + hmac-ripemd160-96 + AEAD_AES_128_GCM + AEAD_AES_256_GCM Update to version 2.4.0 * Added multi-threaded scanning support. * Added version check for OpenSSH user enumeration (CVE-2018-15473). * Added deprecation note to host key types based on SHA-1. * Added extra warnings for SSHv1. * Added built-in hardened OpenSSH v8.5 policy. * Upgraded warnings to failures for host key types based on SHA-1 * Fixed crash when receiving unexpected response during host key test. * Fixed hang against older Cisco devices during host key test & gex test. * Fixed improper termination while scanning multiple targets when one target returns an error. * Dropped support for Python 3.5 (which reached EOL in Sept.2020) * Added 1 new key exchange: sntrup761x25519-sha512(a)openssh.com. Update to version 2.3.1 * Now parses public key sizes for rsa-sha2-256-cert-v01(a)openssh.com and rsa-sha2-512-cert-v01(a)openssh.com host key types. * Flag ssh-rsa-cert-v01(a)openssh.com as a failure due to SHA-1 hash. * Fixed bug in recommendation output which suppressed some algorithms inappropriately. * Built-in policies now include CA key requirements (if certificates are in use). * Lookup function (--lookup) now performs case-insensitive lookups of similar algorithms. * Migrated pre-made policies from external files to internal database. * Split single 3,500 line script into many files (by class). * Added setup.py support * Added 1 new cipher: des-cbc(a)ssh.com. Update to version 2.3.0 The highlight of this release is support for policy scanning (this allows an admin to test a server against a hardened/standard configuration). * Added new policy auditing functionality to test adherence to a hardening guide/standard configuration (see -L/--list-policies, -M/--make-policy and -P/--policy). * Created new man page (see ssh-audit.1 file). * 1024-bit moduli upgraded from warnings to failures. * Many Python 2 code clean-ups, testing framework improvements, pylint & flake8 fixes, and mypy type comments. * Added feature to look up algorithms in internal database (see --lookup) * Suppress recommendation of token host key types. * Added check for use-after-free vulnerability in PuTTY v0.73. * Added 11 new host key types: ssh-rsa1, ssh-dss-sha256(a)ssh.com, ssh-gost2001, ssh-gost2012-256, ssh-gost2012-512, spki-sign-rsa, ssh-ed448, x509v3-ecdsa-sha2-nistp256, x509v3-ecdsa-sha2-nistp384, x509v3-ecdsa-sha2-nistp521, x509v3-rsa2048-sha256. * Added 8 new key exchanges: diffie-hellman-group1-sha256, kexAlgoCurve25519SHA256, Curve25519SHA256, gss-group14-sha256-, gss-group15-sha512-, gss-group16-sha512-, gss-nistp256-sha256-, gss-curve25519-sha256-. * Added 5 new ciphers: blowfish, AEAD_AES_128_GCM, AEAD_AES_256_GCM, crypticore128(a)ssh.com, seed-cbc(a)ssh.com. * Added 3 new MACs: chacha20-poly1305(a)openssh.com, hmac-sha3-224, crypticore-mac(a)ssh.com. - Update ssh-audit.keyring Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1383=1 Package List: - openSUSE Leap 15.2 (noarch): ssh-audit-2.5.0-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-15473.html

1 0

openSUSE-RU-2021:1376-1: moderate: Recommended update for emacs
by maintenance＠opensuse.org 18 Oct '21

18 Oct '21

openSUSE Recommended Update: Recommended update for emacs ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1376-1 Rating: moderate References: #1178942 #1180353 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for emacs fixes the following issues: - Fixed an issue when emacs hangs in isearch. (bsc#1178942) - Fix for a possible segmentation fault in case of stack overflow of etags. (bsc#1180353) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1376=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): emacs-25.3-lp152.5.6.1 emacs-debuginfo-25.3-lp152.5.6.1 emacs-debugsource-25.3-lp152.5.6.1 emacs-nox-25.3-lp152.5.6.1 emacs-nox-debuginfo-25.3-lp152.5.6.1 emacs-x11-25.3-lp152.5.6.1 emacs-x11-debuginfo-25.3-lp152.5.6.1 etags-25.3-lp152.5.6.1 etags-debuginfo-25.3-lp152.5.6.1 - openSUSE Leap 15.2 (noarch): emacs-el-25.3-lp152.5.6.1 emacs-info-25.3-lp152.5.6.1 References: https://bugzilla.suse.com/1178942 https://bugzilla.suse.com/1180353

1 0

openSUSE-RU-2021:1372-1: moderate: Recommended update for pacemaker
by maintenance＠opensuse.org 18 Oct '21

18 Oct '21

openSUSE Recommended Update: Recommended update for pacemaker ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1372-1 Rating: moderate References: #1177212 #1180618 #1181744 #1187414 #1188653 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for pacemaker fixes the following issues: - controller: ensure newly joining node learns the node names of non-DCs. (bsc#1180618) - libcrmcommon: Correctly handle case-sensitive ids of xml objects when changing a value. (bsc#1187414) - libpe_status: handle pending migrations correctly. (bsc#1177212) - scheduler: add test for probe of unmanaged resource on pending node (bsc#1188653): scheduler: update existing tests for probe scheduling change. scheduler: don't schedule probes of unmanaged resources on pending nodes. - controld-fencing: add notice-log for successful fencer-connect (bsc#1181744): st_client: make safe to remove notifications from notifications. controld-fencing: remove-notifications upon connection-destroy. fenced: Remove relayed stonith operation. fence-history: resync fence-history after fenced crash. fence-history: add notification upon history-synced. fence-history: fail leftover pending-actions after fenced-restart. This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1372=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libpacemaker-devel-2.0.4+20200616.2deceaa3a-lp152.2.12.1 libpacemaker3-2.0.4+20200616.2deceaa3a-lp152.2.12.1 libpacemaker3-debuginfo-2.0.4+20200616.2deceaa3a-lp152.2.12.1 pacemaker-2.0.4+20200616.2deceaa3a-lp152.2.12.1 pacemaker-cli-2.0.4+20200616.2deceaa3a-lp152.2.12.1 pacemaker-cli-debuginfo-2.0.4+20200616.2deceaa3a-lp152.2.12.1 pacemaker-debuginfo-2.0.4+20200616.2deceaa3a-lp152.2.12.1 pacemaker-debugsource-2.0.4+20200616.2deceaa3a-lp152.2.12.1 pacemaker-remote-2.0.4+20200616.2deceaa3a-lp152.2.12.1 pacemaker-remote-debuginfo-2.0.4+20200616.2deceaa3a-lp152.2.12.1 - openSUSE Leap 15.2 (noarch): pacemaker-cts-2.0.4+20200616.2deceaa3a-lp152.2.12.1 References: https://bugzilla.suse.com/1177212 https://bugzilla.suse.com/1180618 https://bugzilla.suse.com/1181744 https://bugzilla.suse.com/1187414 https://bugzilla.suse.com/1188653

1 0

openSUSE-RU-2021:1375-1: moderate: Recommended update for syslinux
by maintenance＠opensuse.org 18 Oct '21

18 Oct '21

openSUSE Recommended Update: Recommended update for syslinux ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1375-1 Rating: moderate References: #1184124 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for syslinux fixes the following issues: - Link all binaries as Position Independent Executables. (bsc#1184124) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1375=1 Package List: - openSUSE Leap 15.2 (aarch64 ppc64le s390x): syslinux-debuginfo-x86_64-4.04-lp152.7.3.1 syslinux-x86_64-4.04-lp152.7.3.1 - openSUSE Leap 15.2 (i586 x86_64): syslinux-4.04-lp152.7.3.1 syslinux-debuginfo-4.04-lp152.7.3.1 syslinux-debugsource-4.04-lp152.7.3.1 References: https://bugzilla.suse.com/1184124

1 0

openSUSE-SU-2021:1374-1: moderate: Security update for glibc
by opensuse-security＠opensuse.org 18 Oct '21

18 Oct '21

openSUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1374-1 Rating: moderate References: #1186489 #1187911 Cross-References: CVE-2021-33574 CVE-2021-35942 CVSS scores: CVE-2021-33574 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-33574 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-35942 (SUSE): 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for glibc fixes the following issues: - CVE-2021-35942: wordexp: handle overflow in positional parameter number (bsc#1187911) - CVE-2021-33574: Use __pthread_attr_copy in mq_notify (bsc#1186489) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1374=1 Package List: - openSUSE Leap 15.2 (i586 i686 x86_64): glibc-2.26-lp152.26.9.1 glibc-debuginfo-2.26-lp152.26.9.1 glibc-debugsource-2.26-lp152.26.9.1 glibc-devel-2.26-lp152.26.9.1 glibc-devel-debuginfo-2.26-lp152.26.9.1 glibc-devel-static-2.26-lp152.26.9.1 glibc-locale-2.26-lp152.26.9.1 glibc-locale-base-2.26-lp152.26.9.1 glibc-locale-base-debuginfo-2.26-lp152.26.9.1 glibc-profile-2.26-lp152.26.9.1 - openSUSE Leap 15.2 (i586 x86_64): glibc-extra-2.26-lp152.26.9.1 glibc-extra-debuginfo-2.26-lp152.26.9.1 glibc-utils-2.26-lp152.26.9.1 glibc-utils-debuginfo-2.26-lp152.26.9.1 glibc-utils-src-debugsource-2.26-lp152.26.9.1 nscd-2.26-lp152.26.9.1 nscd-debuginfo-2.26-lp152.26.9.1 - openSUSE Leap 15.2 (noarch): glibc-html-2.26-lp152.26.9.1 glibc-i18ndata-2.26-lp152.26.9.1 glibc-info-2.26-lp152.26.9.1 - openSUSE Leap 15.2 (x86_64): glibc-32bit-2.26-lp152.26.9.1 glibc-32bit-debuginfo-2.26-lp152.26.9.1 glibc-devel-32bit-2.26-lp152.26.9.1 glibc-devel-32bit-debuginfo-2.26-lp152.26.9.1 glibc-devel-static-32bit-2.26-lp152.26.9.1 glibc-locale-base-32bit-2.26-lp152.26.9.1 glibc-locale-base-32bit-debuginfo-2.26-lp152.26.9.1 glibc-profile-32bit-2.26-lp152.26.9.1 glibc-utils-32bit-2.26-lp152.26.9.1 glibc-utils-32bit-debuginfo-2.26-lp152.26.9.1 References: https://www.suse.com/security/cve/CVE-2021-33574.html https://www.suse.com/security/cve/CVE-2021-35942.html https://bugzilla.suse.com/1186489 https://bugzilla.suse.com/1187911

1 0