October 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2021:1344-1: moderate: Security update for mbedtls
by opensuse-security＠opensuse.org 11 Oct '21

11 Oct '21

openSUSE Security Update: Security update for mbedtls ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1344-1 Rating: moderate References: #1189589 Cross-References: CVE-2021-24119 CVSS scores: CVE-2021-24119 (NVD) : 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mbedtls fixes the following issues: * CVE-2021-24119: Fixed side-channel vulnerability in base64 PEM [boo#1189589] Guard against strong local side channel attack against base64 tables by making access aceess to them use constant flow code. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1344=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libmbedcrypto3-2.16.9-lp152.2.6.1 libmbedcrypto3-debuginfo-2.16.9-lp152.2.6.1 libmbedtls12-2.16.9-lp152.2.6.1 libmbedtls12-debuginfo-2.16.9-lp152.2.6.1 libmbedx509-0-2.16.9-lp152.2.6.1 libmbedx509-0-debuginfo-2.16.9-lp152.2.6.1 mbedtls-debugsource-2.16.9-lp152.2.6.1 mbedtls-devel-2.16.9-lp152.2.6.1 - openSUSE Leap 15.2 (x86_64): libmbedcrypto3-32bit-2.16.9-lp152.2.6.1 libmbedcrypto3-32bit-debuginfo-2.16.9-lp152.2.6.1 libmbedtls12-32bit-2.16.9-lp152.2.6.1 libmbedtls12-32bit-debuginfo-2.16.9-lp152.2.6.1 libmbedx509-0-32bit-2.16.9-lp152.2.6.1 libmbedx509-0-32bit-debuginfo-2.16.9-lp152.2.6.1 References: https://www.suse.com/security/cve/CVE-2021-24119.html https://bugzilla.suse.com/1189589

1 0

openSUSE-RU-2021:1348-1: moderate: Recommended update for virt-what
by maintenance＠opensuse.org 11 Oct '21

11 Oct '21

openSUSE Recommended Update: Recommended update for virt-what ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1348-1 Rating: moderate References: #1161850 #1176132 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for virt-what fixes the following issues: - Nutanix Acropolis Hypervisor detection - podman detection - Add "which" to requires This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1348=1 Package List: - openSUSE Leap 15.2 (x86_64): virt-what-1.21-lp152.4.3.1 virt-what-debuginfo-1.21-lp152.4.3.1 virt-what-debugsource-1.21-lp152.4.3.1 References: https://bugzilla.suse.com/1161850 https://bugzilla.suse.com/1176132

1 0

openSUSE-SU-2021:1342-1: important: Security update for go1.16
by opensuse-security＠opensuse.org 11 Oct '21

11 Oct '21

openSUSE Security Update: Security update for go1.16 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1342-1 Rating: important References: #1182345 #1190589 Cross-References: CVE-2021-39293 CVSS scores: CVE-2021-39293 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for go1.16 fixes the following issues: - Update to go 1.16.8 - CVE-2021-39293: Fixed a buffer overflow issue in preallocation check that can cause OOM panic. (bas#) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1342=1 Package List: - openSUSE Leap 15.2 (x86_64): go1.16-1.16.8-lp152.11.1 go1.16-doc-1.16.8-lp152.11.1 go1.16-race-1.16.8-lp152.11.1 References: https://www.suse.com/security/cve/CVE-2021-39293.html https://bugzilla.suse.com/1182345 https://bugzilla.suse.com/1190589

1 0

openSUSE-RU-2021:1346-1: moderate: Recommended update for autoyast2
by maintenance＠opensuse.org 11 Oct '21

11 Oct '21

openSUSE Recommended Update: Recommended update for autoyast2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1346-1 Rating: moderate References: #1176089 #1183352 #1188153 #1190696 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for autoyast2 fixes the following issues: - Update elements on rules schema: Add 'hostname' (bsc#1190696). Remove wrong spelled 'haspcmica' (bsc#1183352). Add installed_product and installed_product_version (boo#1176089). Add dialog section (bsc#1188153). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1346=1 Package List: - openSUSE Leap 15.2 (noarch): autoyast2-4.2.56-lp152.2.18.1 autoyast2-installation-4.2.56-lp152.2.18.1 - openSUSE Leap 15.2 (x86_64): yast2-schema-4.2.15-lp152.2.6.1 References: https://bugzilla.suse.com/1176089 https://bugzilla.suse.com/1183352 https://bugzilla.suse.com/1188153 https://bugzilla.suse.com/1190696

1 0

openSUSE-SU-2021:1343-1: important: Security update for nodejs8
by opensuse-security＠opensuse.org 11 Oct '21

11 Oct '21

openSUSE Security Update: Security update for nodejs8 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1343-1 Rating: important References: #1188917 Cross-References: CVE-2021-22930 CVSS scores: CVE-2021-22930 (SUSE): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: nodejs8 was updated to fix the following security issues: - CVE-2021-22930: http2: fixes use after free on close in stream canceling (bsc#1188917) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1343=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): nodejs8-8.17.0-lp152.3.17.1 nodejs8-debuginfo-8.17.0-lp152.3.17.1 nodejs8-debugsource-8.17.0-lp152.3.17.1 nodejs8-devel-8.17.0-lp152.3.17.1 npm8-8.17.0-lp152.3.17.1 - openSUSE Leap 15.2 (noarch): nodejs8-docs-8.17.0-lp152.3.17.1 References: https://www.suse.com/security/cve/CVE-2021-22930.html https://bugzilla.suse.com/1188917

1 0

openSUSE-RU-2021:1340-1: moderate: Recommended update for skelcd-control-openSUSE
by maintenance＠opensuse.org 11 Oct '21

11 Oct '21

openSUSE Recommended Update: Recommended update for skelcd-control-openSUSE ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1340-1 Rating: moderate References: #1186593 #1188689 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for skelcd-control-openSUSE fixes the following issues: 15.3.5 - During upgrade run also the manual network configuration when it is not configured automatically (boo#1188689). - Add backports-update, backports-debug-update, sle-update and sle-debug-update to control file (bsc#1186593) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-2021-1340=1 Package List: - openSUSE Leap 15.3 (aarch64 i586 ppc64le s390x x86_64): skelcd-control-openSUSE-15.3.6-lp153.2.5.1 skelcd-control-openSUSE-promo-15.3.6-lp153.2.5.1 References: https://bugzilla.suse.com/1186593 https://bugzilla.suse.com/1188689

1 0

openSUSE-RU-2021:3328-1: moderate: Recommended update for patterns-sap
by maintenance＠opensuse.org 11 Oct '21

11 Oct '21

openSUSE Recommended Update: Recommended update for patterns-sap ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3328-1 Rating: moderate References: SLE-20033 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has 0 recommended fixes and contains one feature can now be installed. Description: This update for patterns-sap fixes the following issue: - Remove 'libssh2-1' from SAP-HANA pattern (jsc#SLE-20033) - 'libssh2-1' is not longer needed for newer HANA 2.0 versions - Adjust the 'patterns-sap' version to 15.3 Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3328=1 Package List: - openSUSE Leap 15.3 (ppc64le x86_64): patterns-sap-15.3-9.5.1 patterns-sap-b1-15.3-9.5.1 patterns-sap-hana-15.3-9.5.1 patterns-sap-nw-15.3-9.5.1 References:

1 0

openSUSE-OU-2021:3327-1: Optional update for coreutils
by maintenance＠opensuse.org 11 Oct '21

11 Oct '21

openSUSE Optional Update: Optional update for coreutils ______________________________________________________________________________ Announcement ID: openSUSE-OU-2021:3327-1 Rating: low References: #1189454 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This optional update for coreutils fixes the following issue: - Provide coreutils documentation, 'coreutils-doc', with 'L2' support level. (bsc#1189454) Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3327=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): coreutils-8.32-3.2.1 coreutils-debuginfo-8.32-3.2.1 coreutils-debugsource-8.32-3.2.1 coreutils-single-8.32-3.2.1 coreutils-single-debuginfo-8.32-3.2.1 coreutils-single-debugsource-8.32-3.2.1 coreutils-testsuite-8.32-3.2.1 - openSUSE Leap 15.3 (noarch): coreutils-doc-8.32-3.2.1 coreutils-lang-8.32-3.2.1 References: https://bugzilla.suse.com/1189454

1 0

openSUSE-SU-2021:1339-1: important: Security update for chromium
by opensuse-security＠opensuse.org 11 Oct '21

11 Oct '21

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1339-1 Rating: important References: #1190765 #1191166 #1191204 Cross-References: CVE-2021-37956 CVE-2021-37957 CVE-2021-37958 CVE-2021-37959 CVE-2021-37960 CVE-2021-37961 CVE-2021-37962 CVE-2021-37963 CVE-2021-37964 CVE-2021-37965 CVE-2021-37966 CVE-2021-37967 CVE-2021-37968 CVE-2021-37969 CVE-2021-37970 CVE-2021-37971 CVE-2021-37972 CVE-2021-37973 CVE-2021-37974 CVE-2021-37975 CVE-2021-37976 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes 21 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium 94.0.4606.54 (boo#1190765): * CVE-2021-37956: Use after free in Offline use * CVE-2021-37957: Use after free in WebGPU * CVE-2021-37958: Inappropriate implementation in Navigation * CVE-2021-37959: Use after free in Task Manager * CVE-2021-37960: Inappropriate implementation in Blink graphics * CVE-2021-37961: Use after free in Tab Strip * CVE-2021-37962: Use after free in Performance Manager * CVE-2021-37963: Side-channel information leakage in DevTools * CVE-2021-37964: Inappropriate implementation in ChromeOS Networking * CVE-2021-37965: Inappropriate implementation in Background Fetch API * CVE-2021-37966: Inappropriate implementation in Compositing * CVE-2021-37967: Inappropriate implementation in Background Fetch API * CVE-2021-37968: Inappropriate implementation in Background Fetch API * CVE-2021-37969: Inappropriate implementation in Google Updater * CVE-2021-37970: Use after free in File System API * CVE-2021-37971: Incorrect security UI in Web Browser UI * CVE-2021-37972: Out of bounds read in libjpeg-turbo Chromium 94.0.4606.61 (boo#1191166): * CVE-2021-37973: Use after free in Portals Chromium 94.0.4606.71 (boo#1191204): * CVE-2021-37974 : Use after free in Safe Browsing * CVE-2021-37975 : Use after free in V8 * CVE-2021-37976 : Information leak in core Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1339=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 x86_64): chromedriver-94.0.4606.71-bp153.2.31.1 chromium-94.0.4606.71-bp153.2.31.1 References: https://www.suse.com/security/cve/CVE-2021-37956.html https://www.suse.com/security/cve/CVE-2021-37957.html https://www.suse.com/security/cve/CVE-2021-37958.html https://www.suse.com/security/cve/CVE-2021-37959.html https://www.suse.com/security/cve/CVE-2021-37960.html https://www.suse.com/security/cve/CVE-2021-37961.html https://www.suse.com/security/cve/CVE-2021-37962.html https://www.suse.com/security/cve/CVE-2021-37963.html https://www.suse.com/security/cve/CVE-2021-37964.html https://www.suse.com/security/cve/CVE-2021-37965.html https://www.suse.com/security/cve/CVE-2021-37966.html https://www.suse.com/security/cve/CVE-2021-37967.html https://www.suse.com/security/cve/CVE-2021-37968.html https://www.suse.com/security/cve/CVE-2021-37969.html https://www.suse.com/security/cve/CVE-2021-37970.html https://www.suse.com/security/cve/CVE-2021-37971.html https://www.suse.com/security/cve/CVE-2021-37972.html https://www.suse.com/security/cve/CVE-2021-37973.html https://www.suse.com/security/cve/CVE-2021-37974.html https://www.suse.com/security/cve/CVE-2021-37975.html https://www.suse.com/security/cve/CVE-2021-37976.html https://bugzilla.suse.com/1190765 https://bugzilla.suse.com/1191166 https://bugzilla.suse.com/1191204

1 0

openSUSE-SU-2021:3325-1: moderate: Security update for rabbitmq-server
by opensuse-security＠opensuse.org 09 Oct '21

09 Oct '21

openSUSE Security Update: Security update for rabbitmq-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3325-1 Rating: moderate References: #1185075 #1186203 #1187818 #1187819 Cross-References: CVE-2021-22116 CVE-2021-32718 CVE-2021-32719 CVSS scores: CVE-2021-22116 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-22116 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-32718 (SUSE): 3.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N CVE-2021-32719 (SUSE): 3.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for rabbitmq-server fixes the following issues: - CVE-2021-32718: Fixed improper neutralization of script-related HTML tags in a web page (basic XSS) in management UI (bsc#1187818). - CVE-2021-32719: Fixed improper neutralization of script-related HTML tags in a web page (basic XSS) in federation management plugin (bsc#1187819). - CVE-2021-22116: Fixed improper input validation may lead to DoS (bsc#1186203). - Use /run instead of /var/run in tmpfiles.d configuration (bsc#1185075). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3325=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): erlang-rabbitmq-client-3.8.11-3.3.3 rabbitmq-server-3.8.11-3.3.3 rabbitmq-server-plugins-3.8.11-3.3.3 References: https://www.suse.com/security/cve/CVE-2021-22116.html https://www.suse.com/security/cve/CVE-2021-32718.html https://www.suse.com/security/cve/CVE-2021-32719.html https://bugzilla.suse.com/1185075 https://bugzilla.suse.com/1186203 https://bugzilla.suse.com/1187818 https://bugzilla.suse.com/1187819

1 0