February 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2021:0312-1: moderate: Security update for mumble
by opensuse-security＠opensuse.org 19 Feb '21

19 Feb '21

openSUSE Security Update: Security update for mumble ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0312-1 Rating: moderate References: #1180068 #1182123 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for mumble fixes the following issues: mumble was updated to 1.3.4: * Fix use of outdated (non-existent) notification icon names * Fix Security vulnerability caused by allowing non http/https URL schemes in public server list (boo#1182123) * Server: Fix Exit status for actions like --version or --supw * Fix packet loss & audio artifacts caused by OCB2 XEX* mitigation - update apparmor profiles to get warning free again on 15.2 - use abstractions for ssl files - allow inet dgram sockets as mumble can also work via udp - allow netlink socket (probably for dbus) - properly allow lsb_release again - add support for optional local include - start murmurd directly as user mumble-server it gets rid of the dac_override/setgid/setuid/chown permissions Update to upstream version 1.3.3 Client: * Fixed: Chatbox invisble (zero height) (#4388) * Fixed: Handling of invalid packet sizes (#4394) * Fixed: Race-condition leading to loss of shortcuts (#4430) * Fixed: Link in About dialog is now clickable again (#4454) * Fixed: Sizing issues in ACL-Editor (#4455) * Improved: PulseAudio now always samples at 48 kHz (#4449) Server: * Fixed: Crash due to problems when using PostgreSQL (#4370) * Fixed: Handling of invalid package sizes (#4392) This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-312=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): mumble-1.3.4-bp152.2.6.1 mumble-server-1.3.4-bp152.2.6.1 - openSUSE Backports SLE-15-SP2 (aarch64_ilp32): mumble-64bit-1.3.4-bp152.2.6.1 References: https://bugzilla.suse.com/1180068 https://bugzilla.suse.com/1182123

1 0

openSUSE-RU-2021:0311-1: moderate: Recommended update for adminer
by maintenance＠opensuse.org 19 Feb '21

19 Feb '21

openSUSE Recommended Update: Recommended update for adminer ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0311-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for adminer fixes the following issues: adminer was updated to version 4.7.9: * Reorder changes * Editor: Avoid trailing dot in export filename * Skip impossible condition ($link always contains ?username=) * Fix displayed foreign key columns from other DB (bug #766) * Do not display empty database in the list twice * Display CSRF logout error after connecting * Fix displaying type mapping for Elasticsearch >= 6.0 * MongoDB: Prefer modern extension * Fix MongoDB connect 'Database does not support password.' tips * Update bug numbers * Postgres - fix missing partitioned tables in navigation * Linkify URLs in SQL results * Title for select data link * Quote values with leading and trailing zeroes in CSV export (bug #777) * MySQL: Don't quote default value of text fields (bug #779) * fixed Unsupported operand types when $port is socket * Respect SQL command URL parameters * Fix XSS in browsers which don't encode URL parameters (bug #775) * SQLite: Set busy_timeout to 500 * PostgreSQL 11: Create PRIMARY KEY for auto increment columns * PostgreSQL: Support smallserial * Add comment * PostgreSQL PDO: Support PgBouncer, unsupport PostgreSQL < 9.1 (bug #771) * fix wrong hungarian translation * Editor: Cast to string when searching (bug #325) * Don't syntax highlight during IME composition (bug #747) * PostgreSQL: Use bigserial for bigint auto increment (bug #765, regression from 3.0.0) * MSSQL: Don't trucate displayed comments to 30 chars (use varchar maximum of 8000 upon casting) * Update Korean translation (thanks to B. Cansmile Cha) * add alternative design dracula theme * show correct collation for PostgresSQL * PostgreSQL: Fix current schema in view definition * Add external designs as submodules * Fixes to lucas-sandery theme * Do not export names in quotes with sql_mode='ANSI_QUOTES' (bug #749) * Fix PgSQL generated always as identity fix * Update Russian translation. * Update Ukrainian translation. * PostgreSQL: Export all FKs after all CREATE TABLE * MySQL, MariaDB: Fix doc links * Do not display SQL function for checkbox * Fix style (bug #743) * PostgreSQL: Fix dollar-quoted syntax highlighting (bug #738) * Elasticsearch, ClickHouse: Do not print response if HTTP code is not 200 * Add basic Makefile. * Travis: add php 7.4 && 8.0 * Re-enable PHP warnings Update to version 4.7.8: * Release 4.7.8 * MySQL: Use renamed variable * Avoid PDO exceptions in PHP 8 * Fix method call after #406 * Improve check for numeric ports (bug #769) * Add missing method * Fix compatibility with PHP 8 * Avoid each() not available in PHP 8 * Fix style * Escape : also in remove_from_param This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-311=1 Package List: - openSUSE Backports SLE-15-SP2 (noarch): adminer-4.7.9-bp152.2.3.1 adminer-designs-4.7.9-bp152.2.3.1 adminer-editor-4.7.9-bp152.2.3.1 adminer-mysql-4.7.9-bp152.2.3.1 adminer-pgsql-4.7.9-bp152.2.3.1 adminer-sqlite-4.7.9-bp152.2.3.1 References:

1 0

openSUSE-RU-2021:0309-1: Recommended update for libmodulemd
by maintenance＠opensuse.org 19 Feb '21

19 Feb '21

openSUSE Recommended Update: Recommended update for libmodulemd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0309-1 Rating: low References: #1181004 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libmodulemd fixes the following issues: - Fixed a building issue for 32-bit architectures This update was imported from the SUSE:SLE-15-SP2:Update update project. This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-309=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): libmodulemd-devel-2.10.0-bp152.5.3.1 libmodulemd2-2.10.0-bp152.5.3.1 modulemd-validator-2.10.0-bp152.5.3.1 python3-libmodulemd-2.10.0-bp152.5.3.1 typelib-1_0-Modulemd-2_0-2.10.0-bp152.5.3.1 References: https://bugzilla.suse.com/1181004

1 0

openSUSE-RU-2021:0308-1: moderate: Recommended update for loki, system-user-loki
by maintenance＠opensuse.org 19 Feb '21

19 Feb '21

openSUSE Recommended Update: Recommended update for loki, system-user-loki ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0308-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for loki, system-user-loki fixes the following issues: loki version v2.0.0 is shipped by this update. Update to version 1.5.0: * Prep 1.5.0 release (#2098) * updates loki config examples (#2097) * Adds backtick for the quoted string token lexer. (#2095) * Fixes unit in stats request log. (#2093) * allow no encoding/compression on chunks (#2088) * Accept suffixes to pod name in instance labels (#2080) * removes yolostring (#2078) * fluentd plugin: support placeholders in tenant field (#2074) * Fixes a panic in dry-run when using external labels. (#2075) * Allows to pass inlined pipeline stages to the docker driver. (#2076) * Loki: Allow configuring query_store_max_look_back_period when running a filesystem store and boltdb-shipper (#2073) * expand the match_all to also optionally allow counting bytes per stream (#2066) * some metrics for measuring performance and failures in boltdb shipper (#2034) * output a debug log if the requested path in the scrape config doesn't match any files (#2069) * Targets not required in promtail config (#2026) * Update loki to cortex master (#2030) * Reverse entry iterator pool (#2064) * Improve protobuf serialization (#2031) * Recover from panic in http and grpc handlers. (#2059) * Docker driver: Allow to provision external pipeline files to plugin (#2054) * Fix a bug in range vector skipping data. (#2058) * Docs: update Loki Helm Chart document to support Helm 3 (#2038) * Fix promtail client default values (#2049) * Fix spelling of per second (#2055) * Update api.md (#2056) * Chore: Correct typo "per seconds" (#2050) * Fix bug in logql parsing that leads to crash. (#2046) * fixes the cpu usage graphs (#2044) * Add extraOutputs variable to support multiple outputs for fluent-bit (#2040) * Swapped to container restarts over terminated reasons (#2043) * Remove generated comment at top of .drone/drone.yaml (#2042) * Dashboard: Loki Operational improvements (#2041) * Support Post request in the frontend queryrange handler. (#2023) * fluent-plugin-loki: Restructuring and CI (#2006) * Revert "Update go from 1.13 to 1.14. (#2013)" (#2028) * Update go from 1.13 to 1.14. (#2013) * Adds :delegated flags to speed up build experience on MacOS. (#2009) * logcli: Query needs to be stored into url.RawQuery, and not url.Path (#2027) * more linter fixes (#2024) * I <3 you Linter (#2022) * Docs: Added labels content (#1999) * Loki: refactor validation and improve error messages (#2021) * Spelling (#2014) * Change image tag from 1.4.1 to 1.4.0 in Helm chart (#2015) * Update lz4 library to latest to ensure deterministic output. (#2010) * make `loki_ingester_memory_streams` Gauge per tenant. (#2019) * Loki: Improve logging and add metrics to streams dropped by stream limit (#2012) * Fix a bad rebase between #1970 and #1965. (#2011) * Adds config to disable HTTP and GRPC server in Promtail. (#2004) * Allow to aggregate binary operations. (#1970) * table client for boltdb shipper to enforce retention (#2001) * Improve URL building in the logcli to strip trailing /. (#2000) * Ensure trace propagation in our logs. (#1977) * Loki: Adds an `interval` paramater to query_range queries allowing a sampling of events to be returned based on the provided interval (#1965) * make boltdb shipper singleton and some other minor refactoring (#1995) * Update cortex to latest. (#1982) * Add a missing method to facade which is called by the metrics storage client in cortex (#1987) * added extraCommandlineArgs in values file (#1981) * Log error message for invalid checksum (#1713) * Log slow query from the frontend by default in ksonnet. (#1980) * incorporate some better defaults into table-manager configs (#1976) * Update cortex vendoring to latest master (#1975) * [Loki]: Cleanup dockerfile (#1949) * Convert Loki modules to services (#1804) * fix available stores for chunk and index in documentation for period config (#1974) * Improve the local config to work locally and inside docker. (#1963) * helm chart: add missing line feed (#1967) * Docs: Update docker.md (#1966) * chunk bounds metric now records 8h range in 1h increments (#1964) * flush boltdb to object store (#1837) * chunk lifespan histogram (#1958) * Workaround for broken etcd gomod import (#1961) * Go mod: explicit golang.org/x/net replace (#1953) * Move build from source instructions to root readme. (#1951) * update cortex to latest master (#1956) * Loki Update the cut block size counter when creating a memchunk from byte slice (#1946) * Fixes case handling in regex simplification. (#1950) * Log docker driver config map. (#1903) * version pin the docker image in docker-compose (#1945) * Reverting helm changes which were included in Cortex 1.0 vendor upgrade because it resulted in us pushing an unstable helm. * delete tag script filters by prefix instead of substring (#1942) * Support stdin target via flag instead of automatic detection. (#1935) * adds config validation, similar to cortex (#1939) * bumps helm to keepalive-master after cortex vendoring (#1937) * Update Cortex to latest master (#1869) * Add no-file and keep-file log option for docker driver. (#1906) * logcli: org-id/tls-skip-verify set via env var (#1922) * Clarified that the api push path needs to be specified. (#1925) * And the loki mixin * Put loki-mixin and promtail-mixin dashboards in a folder. * feat: tms readiness check bypass implementation * this Dockerfile is a remnant from a long time ago, not needed. (#1918) * only fetches one chunk per series in /series (#1914) * Add cap_net_bind_service linux capabilities to Loki. (#1916) * Fix fluent-bit metrics (#1915) * s/dashboards/grafanaDashboards. * fluentd loki plugin README: add note about labels (#1909) * push images for `k` branches * updating typo for end time parameter (#1905) * updating helm and ksonnet to 1.4.1 updating Fluent Bit to correct image * JSON encoding: avoid base64 encoding of []byte inside other slices (#1890) * [helm loki/promtail] make UpdateStrategy configurable (#1898) * Addition of a `/suspend` endpoint to Loki Canary (#1891) * Removes file size check for pipe, not provided by linux. (#1893) * Fixes possible panic in json pipeline stage. (#1894) * Fix flaky promtail test (#1865) * docs: cleaning up the comments for the cache_config, default_validity option (#1888) * Adding a config change in release 1.4 upgrade doc Updating readme with links to new docs * Sign helm package with GPG. (#1864) * Add precision about the range notation for LogQL. (#1881) * updating helm and ksonnet for 1.4.0 release * clear out some changelog entries to fix a merge conflict from the release branch * docs: update promtail docs for backoff (#1879) * Support series API in logcli (#1861) * support `match[]` encoding (#1875) * Keep plugin install command example in one line (#1870) * Add extraMount, extraVolumeMount to promtail helm chart for systemd-journal (#1871) * documents frontend worker (#1873) * clarify logcli commands and output (#1712) * Logcli remote storage. (#1814) * Sharding optimizations I: AST mapping (#1846) * docs: tweak the doc section of the readme a little (#1856) * Support configurable maximum of the limits parameter (#1798) * bump gem version (#1853) * throw exceptions on HTTPTooManyRequests and HTTPServerError so FluentD will retry (#1845) * logcli client: use OrgID in LiveTail (#1850) * remove a few places we recommend the schema version and consolidate in the configuration doc * Pin helm version in circle-ci helm testing workflow. (#1849) * Proposal: Promtail Push API (#1627) * promtail retry 429 rate limit errors, clarifying risks in the docs of configuring multiple client sections in promtail, also increased the backoff and retry settings in promtail. * Docs: Update configuration docs for redis (#1843) * Log error message when source does not exist in extracted values (#1815) * Helm/loki-stack: refresh default grafana.image.tag to 6.7.0 (#1825) * Move default port for Loki to 3100 everywhere. (#1838) * Change local storage directory to /loki/ and fix permissions (#1833) (#1834) * Use 8080 for Loki http port binding in tanka. (#1823) * Adds a counter for total flushed chunks per reason. (#1819) * Prevent prometheus to scrap both services (#1817) * loki can not be started with loki-local-config.yaml (#1816) * Optimize empty filter queries. (#1810) * Improve fluentbit logfmt. (#1791) * Test stats memchunk (#1809) * Error handling: Show data stream at "debug" level, not "warn" (#1811) * loki: update Cortex to master (#1799) * Non-root user docker image for Loki. (#1706) Update to version 1.4.1: * updating changelog and version numbers in docs for 1.4.1 release * JSON encoding: avoid base64 encoding of []byte inside other slices (#1890) * Removes file size check for pipe, not provided by linux. (#1893) * fixing release date * Updating some of the references to v1.3.0 Adding an entry in the changelog to reference image name changes * docs: update promtail docs for backoff (#1879) * bump gem version (#1853) * throw exceptions on HTTPTooManyRequests and HTTPServerError so FluentD will retry (#1845) * promtail retry 429 rate limit errors, clarifying risks in the docs of configuring multiple client sections in promtail, also increased the backoff and retry settings in promtail. * Adding upgrade doc and updating changelog for release Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-308=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): loki-2.0.0+git.1603727260.6978ee5d-bp151.2.1 - openSUSE Backports SLE-15-SP1 (noarch): system-user-loki-1.0.0-bp151.2.1 References:

1 0

openSUSE-SU-2021:0310-1: moderate: Security update for buildah, libcontainers-common, podman
by opensuse-security＠opensuse.org 19 Feb '21

19 Feb '21

openSUSE Security Update: Security update for buildah, libcontainers-common, podman ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0310-1 Rating: moderate References: #1144065 #1165184 Cross-References: CVE-2019-10214 CVE-2020-10696 CVSS scores: CVE-2019-10214 (NVD) : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2019-10214 (SUSE): 9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H CVE-2020-10696 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-10696 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for buildah, libcontainers-common, podman fixes the following issues: Changes in libcontainers-common: - Update common to 0.33.0 - Update image to 5.9.0 - Update podman to 2.2.1 - Update storage to 1.24.5 - Switch to seccomp profile provided by common instead of podman - Update containers.conf to match latest version Changes in buildah: Update to version 1.19.2: * Update vendor of containers/storage and containers/common * Buildah inspect should be able to inspect manifests * Make buildah push support pushing manifests lists and digests * Fix handling of TMPDIR environment variable * Add support for --manifest flags * Upper directory should match mode of destination directory * Only grab the OS, Arch if the user actually specified them * Use --arch and --os and --variant options to select architecture and os * Cirrus: Track libseccomp and golang version * copier.PutOptions: add an "IgnoreDevices" flag * fix: `rmi --prune` when parent image is in store. * build(deps): bump github.com/containers/storage from 1.24.3 to 1.24.4 * build(deps): bump github.com/containers/common from 0.31.1 to 0.31.2 * Allow users to specify stdin into containers * Drop log message on failure to mount on /sys file systems to info * Spelling * SELinux no longer requires a tag. * build(deps): bump github.com/opencontainers/selinux from 1.6.0 to 1.8.0 * build(deps): bump github.com/containers/common from 0.31.0 to 0.31.1 * Update nix pin with `make nixpkgs` * Switch references of /var/run -> /run * Allow FROM to be overriden with from option * copier: don't assume we can chroot() on Unixy systems * copier: add PutOptions.NoOverwriteDirNonDir, Get/PutOptions.Rename * copier: handle replacing directories with not-directories * copier: Put: skip entries with zero-length names * build(deps): bump github.com/containers/storage from 1.24.2 to 1.24.3 * Add U volume flag to chown source volumes * Turn off PRIOR_UBUNTU Test until vm is updated * pkg, cli: rootless uses correct isolation * build(deps): bump github.com/onsi/gomega from 1.10.3 to 1.10.4 * update installation doc to reflect current status * Move away from using docker.io * enable short-name aliasing * build(deps): bump github.com/containers/storage from 1.24.1 to 1.24.2 * build(deps): bump github.com/containers/common from 0.30.0 to 0.31.0 * Throw errors when using bogus --network flags * pkg/supplemented test: replace our null blobinfocache * build(deps): bump github.com/containers/common from 0.29.0 to 0.30.0 * inserts forgotten quotation mark * Not prefer use local image create/add manifest * Add container information to .containerenv * Add --ignorefile flag to use alternate .dockerignore flags * Add a source debug build * Fix crash on invalid filter commands * build(deps): bump github.com/containers/common from 0.27.0 to 0.29.0 * Switch to using containers/common pkg's * fix: non-portable shebang #2812 * Remove copy/paste errors that leaked `Podman` into man pages. * Add suggests cpp to spec file * Apply suggestions from code review * update docs for debian testing and unstable * imagebuildah: disable pseudo-terminals for RUN * Compute diffID for mapped-layer at creating image source * intermediateImageExists: ignore images whose history we can't read * Bump to v1.19.0-dev * build(deps): bump github.com/containers/common from 0.26.3 to 0.27.0 * Fix testing error caused by simultanious merge * Vendor in containers/storage v1.24.0 * short-names aliasing * Add --policy flag to buildah pull * Stop overwrapping and stuttering * copier.Get(): ignore ENOTSUP/ENOSYS when listing xattrs * Run: don't forcibly disable UTS namespaces in rootless mode * test: ensure non-directory in a Dockerfile path is handled correctly * Add a few tests for `pull` command * Fix buildah config --cmd to handle array * build(deps): bump github.com/containers/storage from 1.23.8 to 1.23.9 * Fix NPE when Dockerfile path contains non-directory entries * Update buildah bud man page from podman build man page * Move declaration of decryption-keys to common cli * Run: correctly call copier.Mkdir * util: digging UID/GID out of os.FileInfo should work on Unix * imagebuildah.getImageTypeAndHistoryAndDiffIDs: cache results * Verify userns-uid-map and userns-gid-map input * Use CPP, CC and flags in dep check scripts * Avoid overriding LDFLAGS in Makefile * ADD: handle --chown on URLs * Update nix pin with `make nixpkgs` * (*Builder).Run: MkdirAll: handle EEXIST error * copier: try to force loading of nsswitch modules before chroot() * fix MkdirAll usage * build(deps): bump github.com/containers/common from 0.26.2 to 0.26.3 * build(deps): bump github.com/containers/storage from 1.23.7 to 1.23.8 * Use osusergo build tag for static build * imagebuildah: cache should take image format into account * Bump to v1.18.0-dev Update to version 1.17.1: * copier.Get(): ignore ENOTSUP/ENOSYS when listing xattrs * copier: try to force loading of nsswitch modules before chroot() * ADD: handle --chown on URLs * imagebuildah: cache should take image format into account * Update CI configuration for the release-1.17 branch added cni to requires as its needed for buildah to run Update to v1.17.0 (boo#1165184) * Handle cases where other tools mount/unmount containers * overlay.MountReadOnly: support RO overlay mounts * overlay: use fusermount for rootless umounts * overlay: fix umount * Switch default log level of Buildah to Warn. Users need to see these messages * Drop error messages about OCI/Docker format to Warning level * build(deps): bump github.com/containers/common from 0.26.0 to 0.26.2 * tests/testreport: adjust for API break in storage v1.23.6 * build(deps): bump github.com/containers/storage from 1.23.5 to 1.23.7 * build(deps): bump github.com/fsouza/go-dockerclient from 1.6.5 to 1.6.6 * copier: put: ignore Typeflag="g" * Use curl to get repo file (fix #2714) * build(deps): bump github.com/containers/common from 0.25.0 to 0.26.0 * build(deps): bump github.com/spf13/cobra from 1.0.0 to 1.1.1 * Remove docs that refer to bors, since we're not using it * Buildah bud should not use stdin by default * bump containerd, docker, and golang.org/x/sys * Makefile: cross: remove windows.386 target * copier.copierHandlerPut: don't check length when there are errors * Stop excessive wrapping * CI: require that conformance tests pass * bump(github.com/openshift/imagebuilder) to v1.1.8 * Skip tlsVerify insecure BUILD_REGISTRY_SOURCES * Fix build path wrong containers/podman#7993 * refactor pullpolicy to avoid deps * build(deps): bump github.com/containers/common from 0.24.0 to 0.25.0 * CI: run gating tasks with a lot more memory * ADD and COPY: descend into excluded directories, sometimes * copier: add more context to a couple of error messages * copier: check an error earlier * copier: log stderr output as debug on success * Update nix pin with make nixpkgs * Set directory ownership when copied with ID mapping * build(deps): bump github.com/sirupsen/logrus from 1.6.0 to 1.7.0 * build(deps): bump github.com/containers/common from 0.23.0 to 0.24.0 * Cirrus: Remove bors artifacts * Sort build flag definitions alphabetically * ADD: only expand archives at the right time * Remove configuration for bors * Shell Completion for podman build flags * Bump c/common to v0.24.0 * New CI check: xref --help vs man pages * CI: re-enable several linters * Move --userns-uid-map/--userns-gid-map description into buildah man page * add: preserve ownerships and permissions on ADDed archives * Makefile: tweak the cross-compile target * Bump containers/common to v0.23.0 * chroot: create bind mount targets 0755 instead of 0700 * Change call to Split() to safer SplitN() * chroot: fix handling of errno seccomp rules * build(deps): bump github.com/containers/image/v5 from 5.5.2 to 5.6.0 * Add In Progress section to contributing * integration tests: make sure tests run in ${topdir}/tests * Run(): ignore containers.conf's environment configuration * Warn when setting healthcheck in OCI format * Cirrus: Skip git-validate on branches * tools: update git-validation to the latest commit * tools: update golangci-lint to v1.18.0 * Add a few tests of push command * Add(): fix handling of relative paths with no ContextDir * build(deps): bump github.com/containers/common from 0.21.0 to 0.22.0 * Lint: Use same linters as podman * Validate: reference HEAD * Fix buildah mount to display container names not ids * Update nix pin with make nixpkgs * Add missing --format option in buildah from man page * Fix up code based on codespell * build(deps): bump github.com/openshift/imagebuilder from 1.1.6 to 1.1.7 * build(deps): bump github.com/containers/storage from 1.23.4 to 1.23.5 * Improve buildah completions * Cirrus: Fix validate commit epoch * Fix bash completion of manifest flags * Uniform some man pages * Update Buildah Tutorial to address BZ1867426 * Update bash completion of manifest add sub command * copier.Get(): hard link targets shouldn't be relative paths * build(deps): bump github.com/onsi/gomega from 1.10.1 to 1.10.2 * Pass timestamp down to history lines * Timestamp gets updated everytime you inspect an image * bud.bats: use absolute paths in newly-added tests * contrib/cirrus/lib.sh: don't use CN for the hostname * tests: Add some tests * Update manifest add man page * Extend flags of manifest add * build(deps): bump github.com/containers/storage from 1.23.3 to 1.23.4 * build(deps): bump github.com/onsi/ginkgo from 1.14.0 to 1.14.1 * Bump to v1.17.0-dev * CI: expand cross-compile checks - SLE: Remove unneeded patch: CVE-2019-10214.patch Update to v1.16.2 * fix build on 32bit arches * containerImageRef.NewImageSource(): don't always force timestamps * Add fuse module warning to image readme * Heed our retry delay option values when retrying commit/pull/push * Switch to containers/common for seccomp * Use --timestamp rather then --omit-timestamp * docs: remove outdated notice * docs: remove outdated notice * build-using-dockerfile: add a hidden --log-rusage flag * build(deps): bump github.com/containers/image/v5 from 5.5.1 to 5.5.2 * Discard ReportWriter if user sets options.Quiet * build(deps): bump github.com/containers/common from 0.19.0 to 0.20.3 * Fix ownership of content copied using COPY --from * newTarDigester: zero out timestamps in tar headers * Update nix pin with `make nixpkgs` * bud.bats: correct .dockerignore integration tests * Use pipes for copying * run: include stdout in error message * run: use the correct error for errors.Wrapf * copier: un-export internal types * copier: add Mkdir() * in_podman: don't get tripped up by $CIRRUS_CHANGE_TITLE * docs/buildah-commit.md: tweak some wording, add a --rm example * imagebuildah: don��t blank out destination names when COPYing * Replace retry functions with common/pkg/retry * StageExecutor.historyMatches: compare timestamps using .Equal * Update vendor of containers/common * Fix errors found in coverity scan * Change namespace handling flags to better match podman commands * conformance testing: ignore buildah.BuilderIdentityAnnotation labels * Vendor in containers/storage v1.23.0 * Add buildah.IsContainer interface * Avoid feeding run_buildah to pipe * fix(buildahimage): add xz dependency in buildah image * Bump github.com/containers/common from 0.15.2 to 0.18.0 * Howto for rootless image building from OpenShift * Add --omit-timestamp flag to buildah bud * Update nix pin with `make nixpkgs` * Shutdown storage on failures * Handle COPY --from when an argument is used * Bump github.com/seccomp/containers-golang from 0.5.0 to 0.6.0 * Cirrus: Use newly built VM images * Bump github.com/opencontainers/runc from 1.0.0-rc91 to 1.0.0-rc92 * Enhance the .dockerignore man pages * conformance: add a test for COPY from subdirectory * fix bug manifest inspct * Add documentation for .dockerignore * Add BuilderIdentityAnnotation to identify buildah version * DOC: Add quay.io/containers/buildah image to README.md * Update buildahimages readme * fix spelling mistake in "info" command result display * Don't bind /etc/host and /etc/resolv.conf if network is not present * blobcache: avoid an unnecessary NewImage() * Build static binary with `buildGoModule` * copier: split StripSetidBits into StripSetuidBit/StripSetgidBit/StripStickyBit * tarFilterer: handle multiple archives * Fix a race we hit during conformance tests * Rework conformance testing * Update 02-registries-repositories.md * test-unit: invoke cmd/buildah tests with --flags * parse: fix a type mismatch in a test * Fix compilation of tests/testreport/testreport * build.sh: log the version of Go that we're using * test-unit: increase the test timeout to 40/45 minutes * Add the "copier" package * Fix & add notes regarding problematic language in codebase * Add dependency on github.com/stretchr/testify/require * CompositeDigester: add the ability to filter tar streams * BATS tests: make more robust * vendor golang.org/x/text@v0.3.3 * Switch golang 1.12 to golang 1.13 * imagebuildah: wait for stages that might not have even started yet * chroot, run: not fail on bind mounts from /sys * chroot: do not use setgroups if it is blocked * Set engine env from containers.conf * imagebuildah: return the right stage's image as the "final" image * Fix a help string * Deduplicate environment variables * switch containers/libpod to containers/podman * Bump github.com/containers/ocicrypt from 1.0.2 to 1.0.3 * Bump github.com/opencontainers/selinux from 1.5.2 to 1.6.0 * Mask out /sys/dev to prevent information leak * linux: skip errors from the runtime kill * Mask over the /sys/fs/selinux in mask branch * Add VFS additional image store to container * tests: add auth tests * Allow "readonly" as alias to "ro" in mount options * Ignore OS X specific consistency mount option * Bump github.com/onsi/ginkgo from 1.13.0 to 1.14.0 * Bump github.com/containers/common from 0.14.0 to 0.15.2 * Rootless Buildah should default to IsolationOCIRootless * imagebuildah: fix inheriting multi-stage builds * Make imagebuildah.BuildOptions.Architecture/OS optional * Make imagebuildah.BuildOptions.Jobs optional * Resolve a possible race in imagebuildah.Executor.startStage() * Switch scripts to use containers.conf * Bump openshift/imagebuilder to v1.1.6 * Bump go.etcd.io/bbolt from 1.3.4 to 1.3.5 * buildah, bud: support --jobs=N for parallel execution * executor: refactor build code inside new function * Add bud regression tests * Cirrus: Fix missing htpasswd in registry img * docs: clarify the 'triples' format * CHANGELOG.md: Fix markdown formatting * Add nix derivation for static builds Update to v1.15.1 * Mask over the /sys/fs/selinux in mask branch * chroot: do not use setgroups if it is blocked * chroot, run: not fail on bind mounts from /sys * Allow "readonly" as alias to "ro" in mount options * Add VFS additional image store to container * vendor golang.org/x/text@v0.3.3 * Make imagebuildah.BuildOptions.Architecture/OS optional Update to v1.15.0 * Add CVE-2020-10696 to CHANGELOG.md and changelog.txt * fix lighttpd example * remove dependency on openshift struct * Warn on unset build arguments * vendor: update seccomp/containers-golang to v0.4.1 * Updated docs * clean up comments * update exit code for tests * Implement commit for encryption * implementation of encrypt/decrypt push/pull/bud/from * fix resolve docker image name as transport * Add preliminary profiling support to the CLI * Evaluate symlinks in build context directory * fix error info about get signatures for containerImageSource * Add Security Policy * Cirrus: Fixes from review feedback * imagebuildah: stages shouldn't count as their base images * Update containers/common v0.10.0 * Add registry to buildahimage Dockerfiles * Cirrus: Use pre-installed VM packages + F32 * Cirrus: Re-enable all distro versions * Cirrus: Update to F31 + Use cache images * golangci-lint: Disable gosimple * Lower number of golangci-lint threads * Fix permissions on containers.conf * Don't force tests to use runc * Return exit code from failed containers * cgroup_manager should be under [engine] * Use c/common/pkg/auth in login/logout * Cirrus: Temporarily disable Ubuntu 19 testing * Add containers.conf to stablebyhand build * Update gitignore to exclude test Dockerfiles * Remove warning for systemd inside of container - Add patch for CVE-2019-10214. boo#1144065 + CVE-2019-10214.patch Changes in podman: Update to v2.2.1 * Changes - Due to a conflict with a previously-removed field, we were forced to modify the way image volumes (mounting images into containers using --mount type=image) were handled in the database. As a result, containers created in Podman 2.2.0 with image volume will not have them in v2.2.1, and these containers will need to be re-created. * Bugfixes - Fixed a bug where rootless Podman would, on systems without the XDG_RUNTIME_DIR environment variable defined, use an incorrect path for the PID file of the Podman pause process, causing Podman to fail to start (#8539). - Fixed a bug where containers created using Podman v1.7 and earlier were unusable in Podman due to JSON decode errors (#8613). - Fixed a bug where Podman could retrieve invalid cgroup paths, instead of erroring, for containers that were not running. - Fixed a bug where the podman system reset command would print a warning about a duplicate shutdown handler being registered. - Fixed a bug where rootless Podman would attempt to mount sysfs in circumstances where it was not allowed; some OCI runtimes (notably crun) would fall back to alternatives and not fail, but others (notably runc) would fail to run containers. - Fixed a bug where the podman run and podman create commands would fail to create containers from untagged images (#8558). - Fixed a bug where remote Podman would prompt for a password even when the server did not support password authentication (#8498). - Fixed a bug where the podman exec command did not move the Conmon process for the exec session into the correct cgroup. - Fixed a bug where shell completion for the ancestor option to podman ps --filter did not work correctly. - Fixed a bug where detached containers would not properly clean themselves up (or remove themselves if --rm was set) if the Podman command that created them was invoked with --log-level=debug. * API - Fixed a bug where the Compat Create endpoint for Containers did not properly handle the Binds and Mounts parameters in HostConfig. - Fixed a bug where the Compat Create endpoint for Containers ignored the Name query parameter. - Fixed a bug where the Compat Create endpoint for Containers did not properly handle the "default" value for NetworkMode (this value is used extensively by docker-compose) (#8544). - Fixed a bug where the Compat Build endpoint for Images would sometimes incorrectly use the target query parameter as the image's tag. * Misc - Podman v2.2.0 vendored a non-released, custom version of the github.com/spf13/cobra package; this has been reverted to the latest upstream release to aid in packaging. - Updated the containers/image library to v5.9.0 Update to v2.2.0 * Features - Experimental support for shortname aliasing has been added. This is not enabled by default, but can be turned on by setting the environment variable CONTAINERS_SHORT_NAME_ALIASING to on. Documentation is available here and here. - Initial support has been added for the podman network connect and podman network disconnect commands, which allow existing containers to modify what networks they are connected to. At present, these commands can only be used on running containers that did not specify --network=none when they were created. - The podman run command now supports the --network-alias option to set network aliases (additional names the container can be accessed at from other containers via DNS if the dnsname CNI plugin is in use). Aliases can also be added and removed using the new podman network connect and podman network disconnect commands. Please note that this requires a new release (v1.1.0) of the dnsname plugin, and will only work on newly-created CNI networks. - The podman generate kube command now features support for exporting container's memory and CPU limits (#7855). - The podman play kube command now features support for setting CPU and Memory limits for containers (#7742). - The podman play kube command now supports persistent volumes claims using Podman named volumes. - The podman play kube command now supports Kubernetes configmaps via the --configmap option (#7567). - The podman play kube command now supports a --log-driver option to set the log driver for created containers. - The podman play kube command now supports a --start option, enabled by default, to start the pod after creating it. This allows for podman play kube to be more easily used in systemd unitfiles. - The podman network create command now supports the --ipv6 option to enable dual-stack IPv6 networking for created networks (#7302). - The podman inspect command can now inspect pods, networks, and volumes, in addition to containers and images (#6757). - The --mount option for podman run and podman create now supports a new type, image, to mount the contents of an image into the container at a given location. - The Bash and ZSH completions have been completely reworked and have received significant enhancements! Additionally, support for Fish completions and completions for the podman-remote executable have been added. - The --log-opt option for podman create and podman run now supports the max-size option to set the maximum size for a container's logs (#7434). - The --network option to the podman pod create command now allows pods to be configured to use slirp4netns networking, even when run as root (#6097). - The podman pod stop, podman pod pause, podman pod unpause, and podman pod kill commands now work on multiple containers in parallel and should be significantly faster. - The podman search command now supports a --list-tags option to list all available tags for a single image in a single repository. - The podman search command can now output JSON using the --format=json option. - The podman diff and podman mount commands now work with all containers in the storage library, including those not created by Podman. This allows them to be used with Buildah and CRI-O containers. - The podman container exists command now features a --external option to check if a container exists not just in Podman, but also in the storage library. This will allow Podman to identify Buildah and CRI-O containers. - The --tls-verify and --authfile options have been enabled for use with remote Podman. - The /etc/hosts file now includes the container's name and hostname (both pointing to localhost) when the container is run with --net=none (#8095). - The podman events command now supports filtering events based on the labels of the container they occurred on using the --filter label=key=value option. - The podman volume ls command now supports filtering volumes based on their labels using the --filter label=key=value option. - The --volume and --mount options to podman run and podman create now support two new mount propagation options, unbindable and runbindable. - The name and id filters for podman pod ps now match based on a regular expression, instead of requiring an exact match. - The podman pod ps command now supports a new filter status, that matches pods in a certain state. * Changes - The podman network rm --force command will now also remove pods that are using the network (#7791). - The podman volume rm, podman network rm, and podman pod rm commands now return exit code 1 if the object specified for removal does not exist, and exit code 2 if the object is in use and the --force option was not given. - If /dev/fuse is passed into Podman containers as a device, Podman will open it before starting the container to ensure that the kernel module is loaded on the host and the device is usable in the container. - Global Podman options that were not supported with remote operation have been removed from podman-remote (e.g. --cgroup-manager, --storage-driver). - Many errors have been changed to remove repetition and be more clear as to what has gone wrong. - The --storage option to podman rm is now enabled by default, with slightly changed semantics. If the given container does not exist in Podman but does exist in the storage library, it will be removed even without the --storage option. If the container exists in Podman it will be removed normally. The --storage option for podman rm is now deprecated and will be removed in a future release. - The --storage option to podman ps has been renamed to --external. An alias has been added so the old form of the option will continue to work. - Podman now delays the SIGTERM and SIGINT signals during container creation to ensure that Podman is not stopped midway through creating a container resulting in potential resource leakage (#7941). - The podman save command now strips signatures from images it is exporting, as the formats we export to do not support signatures (#7659). - A new Degraded state has been added to pods. Pods that have some, but not all, of their containers running are now considered to be Degraded instead of Running. - Podman will now print a warning when conflicting network options related to port forwarding (e.g. --publish and --net=host) are specified when creating a container. - The --restart on-failure and --rm options for containers no longer conflict. When both are specified, the container will be restarted if it exits with a non-zero error code, and removed if it exits cleanly (#7906). - Remote Podman will no longer use settings from the client's containers.conf; defaults will instead be provided by the server's containers.conf (#7657). - The podman network rm command now has a new alias, podman network remove (#8402). * Bugfixes - Fixed a bug where podman load on the remote client did not error when attempting to load a directory, which is not yet supported for remote use. - Fixed a bug where rootless Podman could hang when the newuidmap binary was not installed (#7776). - Fixed a bug where the --pull option to podman run, podman create, and podman build did not match Docker's behavior. - Fixed a bug where sysctl settings from the containers.conf configuration file were applied, even if the container did not join the namespace associated with a sysctl. - Fixed a bug where Podman would not return the text of errors encounted when trying to run a healthcheck for a container. - Fixed a bug where Podman was accidentally setting the containers environment variable in addition to the expected container environment variable. - Fixed a bug where rootless Podman using CNI networking did not properly clean up DNS entries for removed containers (#7789). - Fixed a bug where the podman untag --all command was not supported with remote Podman. - Fixed a bug where the podman system service command could time out even if active attach connections were present (#7826). - Fixed a bug where the podman system service command would sometimes never time out despite no active connections being present. - Fixed a bug where Podman's handling of capabilities, specifically inheritable, did not match Docker's. - Fixed a bug where podman run would fail if the image specified was a manifest list and had already been pulled (#7798). - Fixed a bug where Podman did not take search registries into account when looking up images locally (#6381). - Fixed a bug where the podman manifest inspect command would fail for images that had already been pulled (#7726). - Fixed a bug where rootless Podman would not add supplemental GIDs to containers when when a user, but not a group, was set via the --user option to podman create and podman run and sufficient GIDs were available to add the groups (#7782). - Fixed a bug where remote Podman commands did not properly handle cases where the user gave a name that could also be a short ID for a pod or container (#7837). - Fixed a bug where podman image prune could leave images ready to be pruned after podman image prune was run (#7872). - Fixed a bug where the podman logs command with the journald log driver would not read all available logs (#7476). - Fixed a bug where the --rm and --restart options to podman create and podman run did not conflict when a restart policy that is not on-failure was chosen (#7878). - Fixed a bug where the --format "table {{ .Field }}" option to numerous Podman commands ceased to function on Podman v2.0 and up. - Fixed a bug where pods did not properly share an SELinux label between their containers, resulting in containers being unable to see the processes of other containers when the pod shared a PID namespace (#7886). - Fixed a bug where the --namespace option to podman ps did not work with the remote client (#7903). - Fixed a bug where rootless Podman incorrectly calculated the number of UIDs available in the container if multiple different ranges of UIDs were specified. - Fixed a bug where the /etc/hosts file would not be correctly populated for containers in a user namespace (#7490). - Fixed a bug where the podman network create and podman network remove commands could race when run in parallel, with unpredictable results (#7807). - Fixed a bug where the -p option to podman run, podman create, and podman pod create would, when given only a single number (e.g. -p 80), assign the same port for both host and container, instead of generating a random host port (#7947). - Fixed a bug where Podman containers did not properly store the cgroup manager they were created with, causing them to stop functioning after the cgroup manager was changed in containers.conf or with the --cgroup-manager option (#7830). - Fixed a bug where the podman inspect command did not include information on the CNI networks a container was connected to if it was not running. - Fixed a bug where the podman attach command would not print a newline after detaching from the container (#7751). - Fixed a bug where the HOME environment variable was not set properly in containers when the --userns=keep-id option was set (#8004). - Fixed a bug where the podman container restore command could panic when the container in question was in a pod (#8026). - Fixed a bug where the output of the podman image trust show --raw command was not properly formatted. - Fixed a bug where the podman runlabel command could panic if a label to run was not given (#8038). - Fixed a bug where the podman run and podman start --attach commands would exit with an error when the user detached manually using the detach keys on remote Podman (#7979). - Fixed a bug where rootless CNI networking did not use the dnsname CNI plugin if it was not available on the host, despite it always being available in the container used for rootless networking (#8040). - Fixed a bug where Podman did not properly handle cases where an OCI runtime is specified by its full path, and could revert to using another OCI runtime with the same binary path that existed in the system $PATH on subsequent invocations. - Fixed a bug where the --net=host option to podman create and podman run would cause the /etc/hosts file to be incorrectly populated (#8054). - Fixed a bug where the podman inspect command did not include container network information when the container shared its network namespace (IE, joined a pod or another container's network namespace via --net=container:...) (#8073). - Fixed a bug where the podman ps command did not include information on all ports a container was publishing. - Fixed a bug where the podman build command incorrectly forwarded STDIN into build containers from RUN instructions. - Fixed a bug where the podman wait command's --interval option did not work when units were not specified for the duration (#8088). - Fixed a bug where the --detach-keys and --detach options could be passed to podman create despite having no effect (and not making sense in that context). - Fixed a bug where Podman could not start containers if running on a system without a /etc/resolv.conf file (which occurs on some WSL2 images) (#8089). - Fixed a bug where the --extract option to podman cp was nonfunctional. - Fixed a bug where the --cidfile option to podman run would, when the container was not run with --detach, only create the file after the container exited (#8091). - Fixed a bug where the podman images and podman images -a commands could panic and not list any images when certain improperly-formatted images were present in storage (#8148). - Fixed a bug where the podman events command could, when the journald events backend was in use, become nonfunctional when a badly-formatted event or a log message that container certain string was present in the journal (#8125). - Fixed a bug where remote Podman would, when using SSH transport, not authenticate to the server using hostkeys when connecting on a port other than 22 (#8139). - Fixed a bug where the podman attach command would not exit when containers stopped (#8154). - Fixed a bug where Podman did not properly clean paths before verifying them, resulting in Podman refusing to start if the root or temporary directories were specified with extra trailing / characters (#8160). - Fixed a bug where remote Podman did not support hashed hostnames in the known_hosts file on the host for establishing connections (#8159). - Fixed a bug where the podman image exists command would return non-zero (false) when multiple potential matches for the given name existed. - Fixed a bug where the podman manifest inspect command on images that are not manifest lists would error instead of inspecting the image (#8023). - Fixed a bug where the podman system service command would fail if the directory the Unix socket was to be created inside did not exist (#8184). - Fixed a bug where pods that shared the IPC namespace (which is done by default) did not share a /dev/shm filesystem between all containers in the pod (#8181). - Fixed a bug where filters passed to podman volume list were not inclusive (#6765). - Fixed a bug where the podman volume create command would fail when the volume's data directory already existed (as might occur when a volume was not completely removed) (#8253). - Fixed a bug where the podman run and podman create commands would deadlock when trying to create a container that mounted the same named volume at multiple locations (e.g. podman run -v testvol:/test1 -v testvol:/test2) (#8221). - Fixed a bug where the parsing of the --net option to podman build was incorrect (#8322). - Fixed a bug where the podman build command would print the ID of the built image twice when using remote Podman (#8332). - Fixed a bug where the podman stats command did not show memory limits for containers (#8265). - Fixed a bug where the podman pod inspect command printed the static MAC address of the pod in a non-human-readable format (#8386). - Fixed a bug where the --tls-verify option of the podman play kube command had its logic inverted (false would enforce the use of TLS, true would disable it). - Fixed a bug where the podman network rm command would error when trying to remove macvlan networks and rootless CNI networks (#8491). - Fixed a bug where Podman was not setting sane defaults for missing XDG_ environment variables. - Fixed a bug where remote Podman would check if volume paths to be mounted in the container existed on the host, not the server (#8473). - Fixed a bug where the podman manifest create and podman manifest add commands on local images would drop any images in the manifest not pulled by the host. - Fixed a bug where networks made by podman network create did not include the tuning plugin, and as such did not support setting custom MAC addresses (#8385). - Fixed a bug where container healthchecks did not use $PATH when searching for the Podman executable to run the healthcheck. - Fixed a bug where the --ip-range option to podman network create did not properly handle non-classful subnets when calculating the last usable IP for DHCP assignment (#8448). - Fixed a bug where the podman container ps alias for podman ps was missing (#8445). * API - The Compat Create endpoint for Container has received a major refactor to share more code with the Libpod Create endpoint, and should be significantly more stable. - A Compat endpoint for exporting multiple images at once, GET /images/get, has been added (#7950). - The Compat Network Connect and Network Disconnect endpoints have been added. - Endpoints that deal with image registries now support a X-Registry-Config header to specify registry authentication configuration. - The Compat Create endpoint for images now properly supports specifying images by digest. - The Libpod Build endpoint for images now supports an httpproxy query parameter which, if set to true, will forward the server's HTTP proxy settings into the build container for RUN instructions. - The Libpod Untag endpoint for images will now remove all tags for the given image if no repository and tag are specified for removal. - Fixed a bug where the Ping endpoint misspelled a header name (Libpod-Buildha-Version instead of Libpod-Buildah-Version). - Fixed a bug where the Ping endpoint sent an extra newline at the end of its response where Docker did not. - Fixed a bug where the Compat Logs endpoint for containers did not send a newline character after each log line. - Fixed a bug where the Compat Logs endpoint for containers would mangle line endings to change newline characters to add a preceding carriage return (#7942). - Fixed a bug where the Compat Inspect endpoint for Containers did not properly list the container's stop signal (#7917). - Fixed a bug where the Compat Inspect endpoint for Containers formatted the container's create time incorrectly (#7860). - Fixed a bug where the Compat Inspect endpoint for Containers did not include the container's Path, Args, and Restart Count. - Fixed a bug where the Compat Inspect endpoint for Containers prefixed added and dropped capabilities with CAP_ (Docker does not do so). - Fixed a bug where the Compat Info endpoint for the Engine did not include configured registries. - Fixed a bug where the server could panic if a client closed a connection midway through an image pull (#7896). - Fixed a bug where the Compat Create endpoint for volumes returned an error when a volume with the same name already existed, instead of succeeding with a 201 code (#7740). - Fixed a bug where a client disconnecting from the Libpod or Compat events endpoints could result in the server using 100% CPU (#7946). - Fixed a bug where the "no such image" error message sent by the Compat Inspect endpoint for Images returned a 404 status code with an error that was improperly formatted for Docker compatibility. - Fixed a bug where the Compat Create endpoint for networks did not properly set a default for the driver parameter if it was not provided by the client. - Fixed a bug where the Compat Inspect endpoint for images did not populate the RootFS field of the response. - Fixed a bug where the Compat Inspect endpoint for images would omit the ParentId field if the image had no parent, and the Created field if the image did not have a creation time. - Fixed a bug where the Compat Remove endpoint for Networks did not support the Force query parameter. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-310=1 Package List: - openSUSE Leap 15.2 (noarch): libcontainers-common-20210112-lp152.2.6.1 podman-cni-config-2.2.1-lp152.4.9.1 - openSUSE Leap 15.2 (x86_64): buildah-1.19.2-lp152.2.3.1 podman-2.2.1-lp152.4.9.1 References: https://www.suse.com/security/cve/CVE-2019-10214.html https://www.suse.com/security/cve/CVE-2020-10696.html https://bugzilla.suse.com/1144065 https://bugzilla.suse.com/1165184

1 0

openSUSE-RU-2021:0307-1: important: Recommended update for ucode-intel
by maintenance＠opensuse.org 19 Feb '21

19 Feb '21

openSUSE Recommended Update: Recommended update for ucode-intel ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0307-1 Rating: important References: #1178971 #1182347 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for ucode-intel fixes the following issues: Updated Intel CPU Microcode to 20210216 official release. (bsc#1182347 bsc#1179224) - | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products - |:---------------|:---------|:------------|:---------|:---------|:--------- - | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon Scalable - | SKX-D | M1 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon D-21xx - | CLX-SP | B0 | 06-55-06/bf | 04003003 | 04003006 | Xeon Scalable Gen2 - | CLX-SP | B1 | 06-55-07/bf | 05003003 | 05003006 | Xeon Scalable Gen2 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-307=1 Package List: - openSUSE Leap 15.2 (x86_64): ucode-intel-20210216-lp152.2.14.1 References: https://bugzilla.suse.com/1178971 https://bugzilla.suse.com/1182347

1 0

openSUSE-RU-2021:0306-1: moderate: Recommended update for loki, system-user-loki
by maintenance＠opensuse.org 18 Feb '21

18 Feb '21

openSUSE Recommended Update: Recommended update for loki, system-user-loki ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0306-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for loki, system-user-loki fixes the following issues: loki 2.0.0 was added to PackageHub 15-sp1. - Update to upstream version v2.0.0 Update to version 1.5.0: * Prep 1.5.0 release (#2098) * updates loki config examples (#2097) * Adds backtick for the quoted string token lexer. (#2095) * Fixes unit in stats request log. (#2093) * allow no encoding/compression on chunks (#2088) * Accept suffixes to pod name in instance labels (#2080) * removes yolostring (#2078) * fluentd plugin: support placeholders in tenant field (#2074) * Fixes a panic in dry-run when using external labels. (#2075) * Allows to pass inlined pipeline stages to the docker driver. (#2076) * Loki: Allow configuring query_store_max_look_back_period when running a filesystem store and boltdb-shipper (#2073) * expand the match_all to also optionally allow counting bytes per stream (#2066) * some metrics for measuring performance and failures in boltdb shipper (#2034) * output a debug log if the requested path in the scrape config doesn't match any files (#2069) * Targets not required in promtail config (#2026) * Update loki to cortex master (#2030) * Reverse entry iterator pool (#2064) * Improve protobuf serialization (#2031) * Recover from panic in http and grpc handlers. (#2059) * Docker driver: Allow to provision external pipeline files to plugin (#2054) * Fix a bug in range vector skipping data. (#2058) * Docs: update Loki Helm Chart document to support Helm 3 (#2038) * Fix promtail client default values (#2049) * Fix spelling of per second (#2055) * Update api.md (#2056) * Chore: Correct typo "per seconds" (#2050) * Fix bug in logql parsing that leads to crash. (#2046) * fixes the cpu usage graphs (#2044) * Add extraOutputs variable to support multiple outputs for fluent-bit (#2040) * Swapped to container restarts over terminated reasons (#2043) * Remove generated comment at top of .drone/drone.yaml (#2042) * Dashboard: Loki Operational improvements (#2041) * Support Post request in the frontend queryrange handler. (#2023) * fluent-plugin-loki: Restructuring and CI (#2006) * Revert "Update go from 1.13 to 1.14. (#2013)" (#2028) * Update go from 1.13 to 1.14. (#2013) * Adds :delegated flags to speed up build experience on MacOS. (#2009) * logcli: Query needs to be stored into url.RawQuery, and not url.Path (#2027) * more linter fixes (#2024) * I <3 you Linter (#2022) * Docs: Added labels content (#1999) * Loki: refactor validation and improve error messages (#2021) * Spelling (#2014) * Change image tag from 1.4.1 to 1.4.0 in Helm chart (#2015) * Update lz4 library to latest to ensure deterministic output. (#2010) * make `loki_ingester_memory_streams` Gauge per tenant. (#2019) * Loki: Improve logging and add metrics to streams dropped by stream limit (#2012) * Fix a bad rebase between #1970 and #1965. (#2011) * Adds config to disable HTTP and GRPC server in Promtail. (#2004) * Allow to aggregate binary operations. (#1970) * table client for boltdb shipper to enforce retention (#2001) * Improve URL building in the logcli to strip trailing /. (#2000) * Ensure trace propagation in our logs. (#1977) * Loki: Adds an `interval` paramater to query_range queries allowing a sampling of events to be returned based on the provided interval (#1965) * make boltdb shipper singleton and some other minor refactoring (#1995) * Update cortex to latest. (#1982) * Add a missing method to facade which is called by the metrics storage client in cortex (#1987) * added extraCommandlineArgs in values file (#1981) * Log error message for invalid checksum (#1713) * Log slow query from the frontend by default in ksonnet. (#1980) * incorporate some better defaults into table-manager configs (#1976) * Update cortex vendoring to latest master (#1975) * [Loki]: Cleanup dockerfile (#1949) * Convert Loki modules to services (#1804) * fix available stores for chunk and index in documentation for period config (#1974) * Improve the local config to work locally and inside docker. (#1963) * helm chart: add missing line feed (#1967) * Docs: Update docker.md (#1966) * chunk bounds metric now records 8h range in 1h increments (#1964) * flush boltdb to object store (#1837) * chunk lifespan histogram (#1958) * Workaround for broken etcd gomod import (#1961) * Go mod: explicit golang.org/x/net replace (#1953) * Move build from source instructions to root readme. (#1951) * update cortex to latest master (#1956) * Loki Update the cut block size counter when creating a memchunk from byte slice (#1946) * Fixes case handling in regex simplification. (#1950) * Log docker driver config map. (#1903) * version pin the docker image in docker-compose (#1945) * Reverting helm changes which were included in Cortex 1.0 vendor upgrade because it resulted in us pushing an unstable helm. * delete tag script filters by prefix instead of substring (#1942) * Support stdin target via flag instead of automatic detection. (#1935) * adds config validation, similar to cortex (#1939) * bumps helm to keepalive-master after cortex vendoring (#1937) * Update Cortex to latest master (#1869) * Add no-file and keep-file log option for docker driver. (#1906) * logcli: org-id/tls-skip-verify set via env var (#1922) * Clarified that the api push path needs to be specified. (#1925) * And the loki mixin * Put loki-mixin and promtail-mixin dashboards in a folder. * feat: tms readiness check bypass implementation * this Dockerfile is a remnant from a long time ago, not needed. (#1918) * only fetches one chunk per series in /series (#1914) * Add cap_net_bind_service linux capabilities to Loki. (#1916) * Fix fluent-bit metrics (#1915) * s/dashboards/grafanaDashboards. * fluentd loki plugin README: add note about labels (#1909) * push images for `k` branches * updating typo for end time parameter (#1905) * updating helm and ksonnet to 1.4.1 updating Fluent Bit to correct image * JSON encoding: avoid base64 encoding of []byte inside other slices (#1890) * [helm loki/promtail] make UpdateStrategy configurable (#1898) * Addition of a `/suspend` endpoint to Loki Canary (#1891) * Removes file size check for pipe, not provided by linux. (#1893) * Fixes possible panic in json pipeline stage. (#1894) * Fix flaky promtail test (#1865) * docs: cleaning up the comments for the cache_config, default_validity option (#1888) * Adding a config change in release 1.4 upgrade doc Updating readme with links to new docs * Sign helm package with GPG. (#1864) * Add precision about the range notation for LogQL. (#1881) * updating helm and ksonnet for 1.4.0 release * clear out some changelog entries to fix a merge conflict from the release branch * docs: update promtail docs for backoff (#1879) * Support series API in logcli (#1861) * support `match[]` encoding (#1875) * Keep plugin install command example in one line (#1870) * Add extraMount, extraVolumeMount to promtail helm chart for systemd-journal (#1871) * documents frontend worker (#1873) * clarify logcli commands and output (#1712) * Logcli remote storage. (#1814) * Sharding optimizations I: AST mapping (#1846) * docs: tweak the doc section of the readme a little (#1856) * Support configurable maximum of the limits parameter (#1798) * bump gem version (#1853) * throw exceptions on HTTPTooManyRequests and HTTPServerError so FluentD will retry (#1845) * logcli client: use OrgID in LiveTail (#1850) * remove a few places we recommend the schema version and consolidate in the configuration doc * Pin helm version in circle-ci helm testing workflow. (#1849) * Proposal: Promtail Push API (#1627) * promtail retry 429 rate limit errors, clarifying risks in the docs of configuring multiple client sections in promtail, also increased the backoff and retry settings in promtail. * Docs: Update configuration docs for redis (#1843) * Log error message when source does not exist in extracted values (#1815) * Helm/loki-stack: refresh default grafana.image.tag to 6.7.0 (#1825) * Move default port for Loki to 3100 everywhere. (#1838) * Change local storage directory to /loki/ and fix permissions (#1833) (#1834) * Use 8080 for Loki http port binding in tanka. (#1823) * Adds a counter for total flushed chunks per reason. (#1819) * Prevent prometheus to scrap both services (#1817) * loki can not be started with loki-local-config.yaml (#1816) * Optimize empty filter queries. (#1810) * Improve fluentbit logfmt. (#1791) * Test stats memchunk (#1809) * Error handling: Show data stream at "debug" level, not "warn" (#1811) * loki: update Cortex to master (#1799) * Non-root user docker image for Loki. (#1706) - Update to version 1.4.1: * updating changelog and version numbers in docs for 1.4.1 release * JSON encoding: avoid base64 encoding of []byte inside other slices (#1890) * Removes file size check for pipe, not provided by linux. (#1893) * fixing release date * Updating some of the references to v1.3.0 Adding an entry in the changelog to reference image name changes * docs: update promtail docs for backoff (#1879) * bump gem version (#1853) * throw exceptions on HTTPTooManyRequests and HTTPServerError so FluentD will retry (#1845) * promtail retry 429 rate limit errors, clarifying risks in the docs of configuring multiple client sections in promtail, also increased the backoff and retry settings in promtail. * Adding upgrade doc and updating changelog for release Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-306=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): loki-2.0.0+git.1603727260.6978ee5d-bp152.2.1 - openSUSE Backports SLE-15-SP2 (noarch): system-user-loki-1.0.0-bp152.2.1 References:

1 0

openSUSE-SU-2021:0304-1: important: Security update for screen
by opensuse-security＠opensuse.org 18 Feb '21

18 Feb '21

openSUSE Security Update: Security update for screen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0304-1 Rating: important References: #1182092 Cross-References: CVE-2021-26937 CVSS scores: CVE-2021-26937 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for screen fixes the following issues: - CVE-2021-26937: Fixed double width combining char handling that could lead to a denial of service or code execution (bsc#1182092). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-304=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): screen-4.6.2-lp152.6.3.1 screen-debuginfo-4.6.2-lp152.6.3.1 screen-debugsource-4.6.2-lp152.6.3.1 References: https://www.suse.com/security/cve/CVE-2021-26937.html https://bugzilla.suse.com/1182092

1 0

openSUSE-SU-2021:0305-1: important: Security update for php7
by opensuse-security＠opensuse.org 18 Feb '21

18 Feb '21

openSUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0305-1 Rating: important References: #1182049 Cross-References: CVE-2021-21702 CVSS scores: CVE-2021-21702 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for php7 fixes the following issues: - CVE-2021-21702 [bsc#1182049]: NULL pointer dereference in SoapClient This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-305=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): apache2-mod_php7-7.4.6-lp152.2.15.1 apache2-mod_php7-debuginfo-7.4.6-lp152.2.15.1 php7-7.4.6-lp152.2.15.1 php7-bcmath-7.4.6-lp152.2.15.1 php7-bcmath-debuginfo-7.4.6-lp152.2.15.1 php7-bz2-7.4.6-lp152.2.15.1 php7-bz2-debuginfo-7.4.6-lp152.2.15.1 php7-calendar-7.4.6-lp152.2.15.1 php7-calendar-debuginfo-7.4.6-lp152.2.15.1 php7-ctype-7.4.6-lp152.2.15.1 php7-ctype-debuginfo-7.4.6-lp152.2.15.1 php7-curl-7.4.6-lp152.2.15.1 php7-curl-debuginfo-7.4.6-lp152.2.15.1 php7-dba-7.4.6-lp152.2.15.1 php7-dba-debuginfo-7.4.6-lp152.2.15.1 php7-debuginfo-7.4.6-lp152.2.15.1 php7-debugsource-7.4.6-lp152.2.15.1 php7-devel-7.4.6-lp152.2.15.1 php7-dom-7.4.6-lp152.2.15.1 php7-dom-debuginfo-7.4.6-lp152.2.15.1 php7-embed-7.4.6-lp152.2.15.1 php7-embed-debuginfo-7.4.6-lp152.2.15.1 php7-enchant-7.4.6-lp152.2.15.1 php7-enchant-debuginfo-7.4.6-lp152.2.15.1 php7-exif-7.4.6-lp152.2.15.1 php7-exif-debuginfo-7.4.6-lp152.2.15.1 php7-fastcgi-7.4.6-lp152.2.15.1 php7-fastcgi-debuginfo-7.4.6-lp152.2.15.1 php7-fileinfo-7.4.6-lp152.2.15.1 php7-fileinfo-debuginfo-7.4.6-lp152.2.15.1 php7-firebird-7.4.6-lp152.2.15.1 php7-firebird-debuginfo-7.4.6-lp152.2.15.1 php7-fpm-7.4.6-lp152.2.15.1 php7-fpm-debuginfo-7.4.6-lp152.2.15.1 php7-ftp-7.4.6-lp152.2.15.1 php7-ftp-debuginfo-7.4.6-lp152.2.15.1 php7-gd-7.4.6-lp152.2.15.1 php7-gd-debuginfo-7.4.6-lp152.2.15.1 php7-gettext-7.4.6-lp152.2.15.1 php7-gettext-debuginfo-7.4.6-lp152.2.15.1 php7-gmp-7.4.6-lp152.2.15.1 php7-gmp-debuginfo-7.4.6-lp152.2.15.1 php7-iconv-7.4.6-lp152.2.15.1 php7-iconv-debuginfo-7.4.6-lp152.2.15.1 php7-intl-7.4.6-lp152.2.15.1 php7-intl-debuginfo-7.4.6-lp152.2.15.1 php7-json-7.4.6-lp152.2.15.1 php7-json-debuginfo-7.4.6-lp152.2.15.1 php7-ldap-7.4.6-lp152.2.15.1 php7-ldap-debuginfo-7.4.6-lp152.2.15.1 php7-mbstring-7.4.6-lp152.2.15.1 php7-mbstring-debuginfo-7.4.6-lp152.2.15.1 php7-mysql-7.4.6-lp152.2.15.1 php7-mysql-debuginfo-7.4.6-lp152.2.15.1 php7-odbc-7.4.6-lp152.2.15.1 php7-odbc-debuginfo-7.4.6-lp152.2.15.1 php7-opcache-7.4.6-lp152.2.15.1 php7-opcache-debuginfo-7.4.6-lp152.2.15.1 php7-openssl-7.4.6-lp152.2.15.1 php7-openssl-debuginfo-7.4.6-lp152.2.15.1 php7-pcntl-7.4.6-lp152.2.15.1 php7-pcntl-debuginfo-7.4.6-lp152.2.15.1 php7-pdo-7.4.6-lp152.2.15.1 php7-pdo-debuginfo-7.4.6-lp152.2.15.1 php7-pgsql-7.4.6-lp152.2.15.1 php7-pgsql-debuginfo-7.4.6-lp152.2.15.1 php7-phar-7.4.6-lp152.2.15.1 php7-phar-debuginfo-7.4.6-lp152.2.15.1 php7-posix-7.4.6-lp152.2.15.1 php7-posix-debuginfo-7.4.6-lp152.2.15.1 php7-readline-7.4.6-lp152.2.15.1 php7-readline-debuginfo-7.4.6-lp152.2.15.1 php7-shmop-7.4.6-lp152.2.15.1 php7-shmop-debuginfo-7.4.6-lp152.2.15.1 php7-snmp-7.4.6-lp152.2.15.1 php7-snmp-debuginfo-7.4.6-lp152.2.15.1 php7-soap-7.4.6-lp152.2.15.1 php7-soap-debuginfo-7.4.6-lp152.2.15.1 php7-sockets-7.4.6-lp152.2.15.1 php7-sockets-debuginfo-7.4.6-lp152.2.15.1 php7-sodium-7.4.6-lp152.2.15.1 php7-sodium-debuginfo-7.4.6-lp152.2.15.1 php7-sqlite-7.4.6-lp152.2.15.1 php7-sqlite-debuginfo-7.4.6-lp152.2.15.1 php7-sysvmsg-7.4.6-lp152.2.15.1 php7-sysvmsg-debuginfo-7.4.6-lp152.2.15.1 php7-sysvsem-7.4.6-lp152.2.15.1 php7-sysvsem-debuginfo-7.4.6-lp152.2.15.1 php7-sysvshm-7.4.6-lp152.2.15.1 php7-sysvshm-debuginfo-7.4.6-lp152.2.15.1 php7-test-7.4.6-lp152.2.15.1 php7-tidy-7.4.6-lp152.2.15.1 php7-tidy-debuginfo-7.4.6-lp152.2.15.1 php7-tokenizer-7.4.6-lp152.2.15.1 php7-tokenizer-debuginfo-7.4.6-lp152.2.15.1 php7-xmlreader-7.4.6-lp152.2.15.1 php7-xmlreader-debuginfo-7.4.6-lp152.2.15.1 php7-xmlrpc-7.4.6-lp152.2.15.1 php7-xmlrpc-debuginfo-7.4.6-lp152.2.15.1 php7-xmlwriter-7.4.6-lp152.2.15.1 php7-xmlwriter-debuginfo-7.4.6-lp152.2.15.1 php7-xsl-7.4.6-lp152.2.15.1 php7-xsl-debuginfo-7.4.6-lp152.2.15.1 php7-zip-7.4.6-lp152.2.15.1 php7-zip-debuginfo-7.4.6-lp152.2.15.1 php7-zlib-7.4.6-lp152.2.15.1 php7-zlib-debuginfo-7.4.6-lp152.2.15.1 References: https://www.suse.com/security/cve/CVE-2021-21702.html https://bugzilla.suse.com/1182049

1 0

openSUSE-SU-2021:0303-1: important: Security update for jasper
by opensuse-security＠opensuse.org 18 Feb '21

18 Feb '21

openSUSE Security Update: Security update for jasper ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0303-1 Rating: important References: #1179748 #1181483 Cross-References: CVE-2020-27828 CVE-2021-3272 CVSS scores: CVE-2020-27828 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-27828 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-3272 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-3272 (SUSE): 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for jasper fixes the following issues: - bsc#1179748 CVE-2020-27828: Fix heap overflow by checking maxrlvls - bsc#1181483 CVE-2021-3272: Fix buffer over-read in jp2_decode This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-303=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): jasper-2.0.14-lp152.7.6.1 jasper-debuginfo-2.0.14-lp152.7.6.1 jasper-debugsource-2.0.14-lp152.7.6.1 libjasper-devel-2.0.14-lp152.7.6.1 libjasper4-2.0.14-lp152.7.6.1 libjasper4-debuginfo-2.0.14-lp152.7.6.1 - openSUSE Leap 15.2 (x86_64): libjasper4-32bit-2.0.14-lp152.7.6.1 libjasper4-32bit-debuginfo-2.0.14-lp152.7.6.1 References: https://www.suse.com/security/cve/CVE-2020-27828.html https://www.suse.com/security/cve/CVE-2021-3272.html https://bugzilla.suse.com/1179748 https://bugzilla.suse.com/1181483

1 0

openSUSE-SU-2021:0302-1: important: Security update for python-bottle
by opensuse-security＠opensuse.org 16 Feb '21

16 Feb '21

openSUSE Security Update: Security update for python-bottle ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0302-1 Rating: important References: #1182181 Cross-References: CVE-2020-28473 CVSS scores: CVE-2020-28473 (NVD) : 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2020-28473 (SUSE): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-bottle fixes the following issues: - CVE-2020-28473: Fixed Web Cache Poisoning vulnerability using parameter cloaking (bsc#1182181). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-302=1 Package List: - openSUSE Leap 15.2 (noarch): python-bottle-doc-0.12.13-lp152.4.3.1 python2-bottle-0.12.13-lp152.4.3.1 python3-bottle-0.12.13-lp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2020-28473.html https://bugzilla.suse.com/1182181

1 0

openSUSE-RU-2021:0301-1: moderate: Recommended update for adminer
by maintenance＠opensuse.org 16 Feb '21

16 Feb '21

openSUSE Recommended Update: Recommended update for adminer ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0301-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for adminer fixes the following issues: adminer was updated to version 4.7.9: * Reorder changes * Editor: Avoid trailing dot in export filename * Skip impossible condition ($link always contains ?username=) * Fix displayed foreign key columns from other DB (bug #766) * Do not display empty database in the list twice * Display CSRF logout error after connecting * Fix displaying type mapping for Elasticsearch >= 6.0 * MongoDB: Prefer modern extension * Fix MongoDB connect 'Database does not support password.' tips * Update bug numbers * Postgres - fix missing partitioned tables in navigation * Linkify URLs in SQL results * Title for select data link * Quote values with leading and trailing zeroes in CSV export (bug #777) * MySQL: Don't quote default value of text fields (bug #779) * fixed Unsupported operand types when $port is socket * Respect SQL command URL parameters * Fix XSS in browsers which don't encode URL parameters (bug #775) * SQLite: Set busy_timeout to 500 * PostgreSQL 11: Create PRIMARY KEY for auto increment columns * PostgreSQL: Support smallserial * Add comment * PostgreSQL PDO: Support PgBouncer, unsupport PostgreSQL < 9.1 (bug #771) * fix wrong hungarian translation * Editor: Cast to string when searching (bug #325) * Don't syntax highlight during IME composition (bug #747) * PostgreSQL: Use bigserial for bigint auto increment (bug #765, regression from 3.0.0) * MSSQL: Don't trucate displayed comments to 30 chars (use varchar maximum of 8000 upon casting) * Update Korean translation (thanks to B. Cansmile Cha) * add alternative design dracula theme * show correct collation for PostgresSQL * PostgreSQL: Fix current schema in view definition * Add external designs as submodules * Fixes to lucas-sandery theme * Do not export names in quotes with sql_mode='ANSI_QUOTES' (bug #749) * Fix PgSQL generated always as identity fix * Update Russian translation. * Update Ukrainian translation. * PostgreSQL: Export all FKs after all CREATE TABLE * MySQL, MariaDB: Fix doc links * Do not display SQL function for checkbox * Fix style (bug #743) * PostgreSQL: Fix dollar-quoted syntax highlighting (bug #738) * Elasticsearch, ClickHouse: Do not print response if HTTP code is not 200 * Add basic Makefile. * Travis: add php 7.4 && 8.0 * Re-enable PHP warnings Update to version 4.7.8: * Release 4.7.8 * MySQL: Use renamed variable * Avoid PDO exceptions in PHP 8 * Fix method call after #406 * Improve check for numeric ports (bug #769) * Add missing method * Fix compatibility with PHP 8 * Avoid each() not available in PHP 8 * Fix style * Escape : also in remove_from_param Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-301=1 Package List: - openSUSE Leap 15.2 (noarch): adminer-4.7.9-lp152.2.3.1 adminer-designs-4.7.9-lp152.2.3.1 adminer-editor-4.7.9-lp152.2.3.1 adminer-mysql-4.7.9-lp152.2.3.1 adminer-pgsql-4.7.9-lp152.2.3.1 adminer-sqlite-4.7.9-lp152.2.3.1 References:

1 0

openSUSE-SU-2021:0300-1: moderate: Security update for mumble
by opensuse-security＠opensuse.org 16 Feb '21

16 Feb '21

openSUSE Security Update: Security update for mumble ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0300-1 Rating: moderate References: #1180068 #1182123 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for mumble fixes the following issues: mumble was updated to 1.3.4: * Fix use of outdated (non-existent) notification icon names * Fix Security vulnerability caused by allowing non http/https URL schemes in public server list (boo#1182123) * Server: Fix Exit status for actions like --version or --supw * Fix packet loss & audio artifacts caused by OCB2 XEX* mitigation - update apparmor profiles to get warning free again on 15.2 - use abstractions for ssl files - allow inet dgram sockets as mumble can also work via udp - allow netlink socket (probably for dbus) - properly allow lsb_release again - add support for optional local include - start murmurd directly as user mumble-server it gets rid of the dac_override/setgid/setuid/chown permissions Update to upstream version 1.3.3 Client: * Fixed: Chatbox invisble (zero height) (#4388) * Fixed: Handling of invalid packet sizes (#4394) * Fixed: Race-condition leading to loss of shortcuts (#4430) * Fixed: Link in About dialog is now clickable again (#4454) * Fixed: Sizing issues in ACL-Editor (#4455) * Improved: PulseAudio now always samples at 48 kHz (#4449) Server: * Fixed: Crash due to problems when using PostgreSQL (#4370) * Fixed: Handling of invalid package sizes (#4392) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-300=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): mumble-1.3.4-lp152.2.6.1 mumble-debuginfo-1.3.4-lp152.2.6.1 mumble-debugsource-1.3.4-lp152.2.6.1 mumble-server-1.3.4-lp152.2.6.1 mumble-server-debuginfo-1.3.4-lp152.2.6.1 - openSUSE Leap 15.2 (x86_64): mumble-32bit-1.3.4-lp152.2.6.1 mumble-32bit-debuginfo-1.3.4-lp152.2.6.1 References: https://bugzilla.suse.com/1180068 https://bugzilla.suse.com/1182123

1 0

openSUSE-RU-2021:0299-1: moderate: Recommended update for virt-manager
by maintenance＠opensuse.org 16 Feb '21

16 Feb '21

openSUSE Recommended Update: Recommended update for virt-manager ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0299-1 Rating: moderate References: #1027942 #1169708 #1172356 #1174176 #1176080 #1177620 #1179236 #1180062 #1180069 #1180897 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 10 recommended fixes can now be installed. Description: This update for virt-manager fixes the following issues: - Fix for an issue when virtual host does not boot after installing from 'ISO' image. (bsc#1180897) - Fix for 'virsh edit' error when 'XML' document failed to validate against schema. (bsc#1180069) - Fix for 'virt-install' using 'isoinfo' by including 'mkisofs' in the spec file. (bsc#1180062) - Fix for validating install location. (bsc#1179236) - Fix for an issue when deployed 'WIN2K19' guest system could not find a network adapter driver. (bsc#1177620) - Fix for an issue when selecting one 'UEFI' firmware in install wizard resets 'UI' to 'BIOS'. (bsc#1176080) - Upstream bug fix (bsc#1027942) - Fix for an issue when 'IDE' supports only 2 disks for bus 'NONE'. (bsc#1174176) - Fix for an issue when hot-plug network adapter via 'virt-manager' asks to attach on next reboot while it should be live attached. (bsc#1172356) - Fix for a bug in yast2 'virt-install' causing internal error. (bsc#1169708) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-299=1 Package List: - openSUSE Leap 15.2 (noarch): virt-install-2.2.1-lp152.9.3.1 virt-manager-2.2.1-lp152.9.3.1 virt-manager-common-2.2.1-lp152.9.3.1 References: https://bugzilla.suse.com/1027942 https://bugzilla.suse.com/1169708 https://bugzilla.suse.com/1172356 https://bugzilla.suse.com/1174176 https://bugzilla.suse.com/1176080 https://bugzilla.suse.com/1177620 https://bugzilla.suse.com/1179236 https://bugzilla.suse.com/1180062 https://bugzilla.suse.com/1180069 https://bugzilla.suse.com/1180897

1 0

openSUSE-RU-2021:0298-1: moderate: Recommended update for yast2-rear
by maintenance＠opensuse.org 16 Feb '21

16 Feb '21

openSUSE Recommended Update: Recommended update for yast2-rear ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0298-1 Rating: moderate References: #1180983 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-rear fixes the following issues: - Fixed a syntax error which has been shown while booting an image (bsc#1180983) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-298=1 Package List: - openSUSE Leap 15.2 (noarch): yast2-rear-4.2.2-lp152.2.3.1 References: https://bugzilla.suse.com/1180983

1 0

openSUSE-RU-2021:0297-1: Recommended update for libmodulemd
by maintenance＠opensuse.org 16 Feb '21

16 Feb '21

openSUSE Recommended Update: Recommended update for libmodulemd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0297-1 Rating: low References: #1181004 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libmodulemd fixes the following issues: - Fixed a building issue for 32-bit architectures This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-297=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libmodulemd-debuginfo-2.10.0-lp152.8.3.1 libmodulemd-debugsource-2.10.0-lp152.8.3.1 libmodulemd-devel-2.10.0-lp152.8.3.1 libmodulemd2-2.10.0-lp152.8.3.1 libmodulemd2-debuginfo-2.10.0-lp152.8.3.1 modulemd-validator-2.10.0-lp152.8.3.1 modulemd-validator-debuginfo-2.10.0-lp152.8.3.1 python3-libmodulemd-2.10.0-lp152.8.3.1 typelib-1_0-Modulemd-2_0-2.10.0-lp152.8.3.1 References: https://bugzilla.suse.com/1181004

1 0

openSUSE-SU-2021:0296-1: important: Security update for opera
by opensuse-security＠opensuse.org 15 Feb '21

15 Feb '21

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0296-1 Rating: important References: #1181827 Cross-References: CVE-2021-21148 Affected Products: openSUSE Leap 15.2:NonFree ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for opera fixes the following issues: - Update to version 74.0.3911.107 - CHR-8311 Update chromium on desktop-stable-88-3911 to 88.0.4324.150 - DNA-90329 Implement client_capabilities negotiation for Flow / Sync - DNA-90560 [Search Tabs] Open Tabs On Top - DNA-90620 Add opauto tests for tab snoozing - DNA-90628 Update opauto tests after design changes - DNA-90818 Only 3 recently closed tabs are shown in a search mode - DNA-90911 Enable search-tabs-open-tabs-on-top on developer - DNA-90990 Crash at opera::AddressBarView::NotifyBoundsChanged() - DNA-90991 Opera doesn��t show version and ��Relaunch�� button despite update is ready - DNA-91097 Crash at extensions::BrowserSidebarPrivateGetPremium ExtensionsInfoFunction::Run() - DNA-91163 [Win] ��URL navigation filters�� subpage doesn��t react on actions - DNA-91196 [Flow] Device capabilities is not properly saved in Local State - DNA-91276 Sidebar setup wont open - The update to chromium 88.0.4324.150 fixes following issues: - CVE-2021-21148 (1181827) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2:NonFree: zypper in -t patch openSUSE-2021-296=1 Package List: - openSUSE Leap 15.2:NonFree (x86_64): opera-74.0.3911.107-lp152.2.34.1 References: https://www.suse.com/security/cve/CVE-2021-21148.html https://bugzilla.suse.com/1181827

1 0

openSUSE-SU-2021:0295-1: important: Security update for librepo
by opensuse-security＠opensuse.org 15 Feb '21

15 Feb '21

openSUSE Security Update: Security update for librepo ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0295-1 Rating: important References: #1175475 Cross-References: CVE-2020-14352 CVSS scores: CVE-2020-14352 (NVD) : 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVE-2020-14352 (SUSE): 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for librepo fixes the following issues: - Upgrade to 1.12.1 + Validate path read from repomd.xml (bsc#1175475, CVE-2020-14352) - Changes from 1.12.0 + Prefer mirrorlist/metalink over baseurl (rh#1775184) + Decode package URL when using for local filename (rh#1817130) + Fix memory leak in lr_download_metadata() and lr_yum_download_remote() + Download sources work when at least one of specified is working (rh#1775184) This update was imported from the SUSE:SLE-15-SP2:Update update project. This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-295=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): librepo-devel-1.12.1-bp152.2.6.1 librepo0-1.12.1-bp152.2.6.1 python3-librepo-1.12.1-bp152.2.6.1 References: https://www.suse.com/security/cve/CVE-2020-14352.html https://bugzilla.suse.com/1175475

1 0

openSUSE-RU-2021:0294-1: moderate: Recommended update for gimp
by maintenance＠opensuse.org 15 Feb '21

15 Feb '21

openSUSE Recommended Update: Recommended update for gimp ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0294-1 Rating: moderate References: #1178726 #1180770 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for gimp fixes the following issues: - Fixed a crash when importing ps files (bsc#1180770, bsc#1178726) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-294=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): gimp-2.10.12-lp152.2.3.1 gimp-debuginfo-2.10.12-lp152.2.3.1 gimp-debugsource-2.10.12-lp152.2.3.1 gimp-devel-2.10.12-lp152.2.3.1 gimp-devel-debuginfo-2.10.12-lp152.2.3.1 gimp-plugin-aa-2.10.12-lp152.2.3.1 gimp-plugin-aa-debuginfo-2.10.12-lp152.2.3.1 gimp-plugins-python-2.10.12-lp152.2.3.1 gimp-plugins-python-debuginfo-2.10.12-lp152.2.3.1 libgimp-2_0-0-2.10.12-lp152.2.3.1 libgimp-2_0-0-debuginfo-2.10.12-lp152.2.3.1 libgimpui-2_0-0-2.10.12-lp152.2.3.1 libgimpui-2_0-0-debuginfo-2.10.12-lp152.2.3.1 - openSUSE Leap 15.2 (noarch): gimp-lang-2.10.12-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): libgimp-2_0-0-32bit-2.10.12-lp152.2.3.1 libgimp-2_0-0-32bit-debuginfo-2.10.12-lp152.2.3.1 libgimpui-2_0-0-32bit-2.10.12-lp152.2.3.1 libgimpui-2_0-0-32bit-debuginfo-2.10.12-lp152.2.3.1 References: https://bugzilla.suse.com/1178726 https://bugzilla.suse.com/1180770

1 0

openSUSE-RU-2021:0293-1: moderate: Recommended update for sendmail
by maintenance＠opensuse.org 15 Feb '21

15 Feb '21

openSUSE Recommended Update: Recommended update for sendmail ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0293-1 Rating: moderate References: #1171164 #1174572 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for sendmail fixes the following issues: - Move SMTPD_LISTEN_REMOTE hack into valid code of update script - Change location of update script in fillup/sysconfig files - Add better support for IPv6 Update to sendmail 8.16.1 2020/07/05 (boo#1174572) - SECURITY: If sendmail tried to reuse an SMTP session which had already been closed by the server, then the connection cache could have invalid information about the session. One possible consequence was that STARTTLS was not used even if offered. This problem has been fixed by clearing out all relevant status information when a closed session is encountered. - Initial support for DANE (see RFC 7672 et.al.) is available if the compile time option DANE is set. Only TLSA RR 3-1-x is currently implemented. - New options SSLEngine and SSLEnginePath to support OpenSSL engines. Note: this feature has so far only been tested with the "chil" engine; please report problems with other engines if you encounter any. - New option CRLPath to specify a directory which contains hashes pointing to certificate revocations files. Based on patch from Al Smith. - New rulesets tls_srv_features and tls_clt_features which can return a (semicolon separated) list of TLS related options, e.g., CipherList, CertFile, KeyFile, see doc/op/op.me for details. - To automatically handle TLS interoperability problems for outgoing mail, sendmail can now immediately try a connection again without STARTTLS after a TLS handshake failure. This can be configured globally via the option TLSFallbacktoClear or per session via the 'C' flag of tls_clt_features. This also adds the new value "CLEAR" for the macro {verify}: STARTTLS has been disabled internally for a clear text delivery attempt. - Apply Timeout.starttls also to the server waiting for the TLS handshake to begin. Based on patch from Simon Hradecky. - New compile time option TLS_EC to enable the use of elliptic curve cryptography in STARTTLS (previously available as _FFR_TLS_EC). - Handle MIME boundaries specified in headers which contain CRLF. - Fix detection of loopback net (it was broken when compiled with NETINET6) and only set the macros {if_addr_out} and {if_family_out} if the interface of the outgoing connection does not belong to the loopback net. - Fix logic to enable a milter to delete a recipient in DeliveryMode=interactive even if it might be subject to alias expansion. - Log name of a milter making changes (this was missing for some functions). - Log the actual reply of a server when an SMTP delivery problem occurs in a "reply=" field if possible. - Log user= for failed AUTH attempts if possible. Based on patch from Packet Hack, Jim Hranicky, Kevin A. McGrail, and Joe Quinn. - Add CDB as map type. Note: CDB is a "Constant DataBase", i.e., no changes can be made after it is created, hence it does not work with vacation(1) nor editmap(8) (except for query mode). - Fix some memory leaks (mostly in error cases) and properly handle copied varargs in sm_io_vfprintf(). The issues were found using Coverity Scan and reported (including patches) by Ond��ej Lyson��k of Red Hat. - Do not override ServerSSLOptions and ClientSSLOptions when they are specified on the command line. Based on patch from Hiroki Sato. - Add RFC7505 Null MX support for domains that declare they do not accept mail. - New compile time option LDAP_NETWORK_TIMEOUT which is set automatically when LDAPMAP is used and LDAP_OPT_NETWORK_TIMEOUT is available to enable the new -c option for LDAP maps to specify the network timeout. - CONFIG: New FEATURE(`tls_session_features') to enable standard rules for tls_srv_features and tls_clt_features; for details see cf/README. - CONFIG: New options confSSL_ENGINE and confSSL_ENGINE_PATH for SSLEngine and SSLEnginePath, respectively. - CONFIG: New options confDANE to enable DANE support. - CONFIG: New option confTLS_FALLBACK_TO_CLEAR for TLSFallbacktoClear. - CONFIG: New extension CITag: for TLS restrictions, see cf/README for details. - CONFIG: FEATURE(`blacklist_recipients') renamed to FEATURE(`blocklist_recipients'). - CONTRIB: cidrexpand updated to support IPv6 CIDR ranges and to canonicalize IPv6 addresses; if cidrexpand is used with IPv6 addresses then UseCompressedIPv6Addresses must be disabled. - DOC: The dns map can return multiple values in a single result if the -z option is used. - DOC: Note to set MustQuoteChars=. due to DKIM signatures. - LIBMILTER: Fix typo in a macro. Patch from Ignacio Goyret of Alcatel-Lucent. - LIBMILTER: Fix reference in xxfi_negotiate documentation. Patch from Sven Neuhaus. - LIBMILTER: Fix function name in smfi_addrcpt_par documentation. Patch from G.W. Haywood. - LIBMILTER: Fix a potential memory leak in smfi_setsymlist(). Patch from Martin Svec. - MAKEMAP: New map type "implicit" refers to the first available type, i.e., it depends on the compile time options NEWDB, DBM, and CDB. This can be used in conjunction with the "implicit" map type in sendmail.cf. Note: makemap, libsmdb, and sendmail must be compiled with the same options (and library versions of course). - Portability: - Add support for Darwin 14-18 (Mac OS X 10.x). - New option HAS_GETHOSTBYNAME2: set if your system supports gethostbyname2(2). - Set SM_CONF_SEM=2 for FreeBSD 12 and later due to changes in sys/sem.h - On Linux set MAXHOSTNAMELEN (the maximum length of a FQHN) to 256 if it is less than that value. - Added Files: - cf/feature/blocklist_recipients.m4 - cf/feature/tls_failures.m4 - devtools/OS/Darwin.14.x - devtools/OS/Darwin.15.x - devtools/OS/Darwin.16.x - libsmdb/smcdb.c - sendmail/ratectrl.h - Use DANE and TLS_EC Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-293=1 Package List: - openSUSE Leap 15.2 (x86_64): libmilter1_0-8.16.1-lp152.10.3.1 libmilter1_0-debuginfo-8.16.1-lp152.10.3.1 rmail-8.16.1-lp152.10.3.1 rmail-debuginfo-8.16.1-lp152.10.3.1 sendmail-8.16.1-lp152.10.3.1 sendmail-debuginfo-8.16.1-lp152.10.3.1 sendmail-debugsource-8.16.1-lp152.10.3.1 sendmail-devel-8.16.1-lp152.10.3.1 - openSUSE Leap 15.2 (noarch): libmilter-doc-8.16.1-lp152.10.3.1 sendmail-starttls-8.16.1-lp152.10.3.1 References: https://bugzilla.suse.com/1171164 https://bugzilla.suse.com/1174572

1 0

openSUSE-RU-2021:0292-1: moderate: Recommended update for docker
by maintenance＠opensuse.org 14 Feb '21

14 Feb '21

openSUSE Recommended Update: Recommended update for docker ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0292-1 Rating: moderate References: #1182168 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for docker fixes startup of docker when firewalld is enabled (bsc#1182168). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-292=1 Package List: - openSUSE Leap 15.2 (noarch): docker-bash-completion-19.03.15_ce-lp152.2.6.1 docker-fish-completion-19.03.15_ce-lp152.2.6.1 docker-zsh-completion-19.03.15_ce-lp152.2.6.1 - openSUSE Leap 15.2 (x86_64): docker-19.03.15_ce-lp152.2.6.1 docker-debuginfo-19.03.15_ce-lp152.2.6.1 docker-test-19.03.15_ce-lp152.2.6.1 docker-test-debuginfo-19.03.15_ce-lp152.2.6.1 References: https://bugzilla.suse.com/1182168

1 0

openSUSE-RU-2021:0290-1: moderate: Recommended update for open-iscsi
by maintenance＠opensuse.org 13 Feb '21

13 Feb '21

openSUSE Recommended Update: Recommended update for open-iscsi ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0290-1 Rating: moderate References: #1181313 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for open-iscsi fixes the following issues: - Fixes a segfault when exiting from iscsiadm (bsc#1181313) - Fix for several memory leaks in iscsiadm - Fix for a crash when function iscsi_rec_update_param() is invoked This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-290=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): iscsiuio-0.7.8.6-lp152.18.9.1 iscsiuio-debuginfo-0.7.8.6-lp152.18.9.1 libopeniscsiusr0_2_0-2.1.3-lp152.18.9.1 libopeniscsiusr0_2_0-debuginfo-2.1.3-lp152.18.9.1 open-iscsi-2.1.3-lp152.18.9.1 open-iscsi-debuginfo-2.1.3-lp152.18.9.1 open-iscsi-debugsource-2.1.3-lp152.18.9.1 open-iscsi-devel-2.1.3-lp152.18.9.1 References: https://bugzilla.suse.com/1181313

1 0

openSUSE-RU-2021:0288-1: Recommended update for hwdata
by maintenance＠opensuse.org 13 Feb '21

13 Feb '21

openSUSE Recommended Update: Recommended update for hwdata ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0288-1 Rating: low References: #1180422 #1180482 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for hwdata fixes the following issues: - Added merge-pciids.pl to fully duplicate behavior of pciutils-ids (bsc#1180422, bsc#1180482) - Updated pci, usb and vendor ids. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-288=1 Package List: - openSUSE Leap 15.2 (noarch): hwdata-0.343-lp152.2.3.1 References: https://bugzilla.suse.com/1180422 https://bugzilla.suse.com/1180482

1 0

openSUSE-RU-2021:0287-1: moderate: Recommended update for PackageKit
by maintenance＠opensuse.org 13 Feb '21

13 Feb '21

openSUSE Recommended Update: Recommended update for PackageKit ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0287-1 Rating: moderate References: #1180150 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for PackageKit fixes the following issues: - Reset update mode after getting updates. (bsc#1180150) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-287=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): PackageKit-1.1.13-lp152.3.19.1 PackageKit-backend-dnf-1.1.13-lp152.3.19.1 PackageKit-backend-dnf-debuginfo-1.1.13-lp152.3.19.1 PackageKit-backend-zypp-1.1.13-lp152.3.19.1 PackageKit-backend-zypp-debuginfo-1.1.13-lp152.3.19.1 PackageKit-debuginfo-1.1.13-lp152.3.19.1 PackageKit-debugsource-1.1.13-lp152.3.19.1 PackageKit-devel-1.1.13-lp152.3.19.1 PackageKit-devel-debuginfo-1.1.13-lp152.3.19.1 PackageKit-gstreamer-plugin-1.1.13-lp152.3.19.1 PackageKit-gstreamer-plugin-debuginfo-1.1.13-lp152.3.19.1 PackageKit-gtk3-module-1.1.13-lp152.3.19.1 PackageKit-gtk3-module-debuginfo-1.1.13-lp152.3.19.1 libpackagekit-glib2-18-1.1.13-lp152.3.19.1 libpackagekit-glib2-18-debuginfo-1.1.13-lp152.3.19.1 libpackagekit-glib2-devel-1.1.13-lp152.3.19.1 typelib-1_0-PackageKitGlib-1_0-1.1.13-lp152.3.19.1 - openSUSE Leap 15.2 (noarch): PackageKit-branding-upstream-1.1.13-lp152.3.19.1 PackageKit-lang-1.1.13-lp152.3.19.1 - openSUSE Leap 15.2 (x86_64): libpackagekit-glib2-18-32bit-1.1.13-lp152.3.19.1 libpackagekit-glib2-18-32bit-debuginfo-1.1.13-lp152.3.19.1 libpackagekit-glib2-devel-32bit-1.1.13-lp152.3.19.1 References: https://bugzilla.suse.com/1180150

1 0

openSUSE-RU-2021:0286-1: moderate: Recommended update for osc
by maintenance＠opensuse.org 13 Feb '21

13 Feb '21

openSUSE Recommended Update: Recommended update for osc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0286-1 Rating: moderate References: #235071 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for osc fixes the following issues: - support --lastsucceeded/--last-succeeded in "osc buildlog", "osc remotebuildlog" + friends (perform the corresponding operation on the build log of the last successful build) - several fixes in request related code paths (no double html_escape of a request's description etc.) - fix potential TypeErrors+UnicodeEncodeErrors in the util.cpio and util.ar modules - support local flatpak builds (requires a recent build version) - "osc init <prj>" works for a non-existent (server-side) project <prj> - .old dir support for source services so that some services have access to the results of a previous service run - maintainer search: lookup via package name by default and binary as fallback - fix crash on console resize when downloading files during build - add proper repourls to osc reporuls - new command osc releaserequest: This command is used to transfer sources and binaries without rebuilding them. - It requires defined release targets set to trigger="manual". - some improvements on output of help and error messages - Fix path and permissions for fish completion file to /usr/share/fish/vendor_completions.d This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-286=1 Package List: - openSUSE Leap 15.2 (noarch): osc-0.172.0-lp152.2.6.1 References: https://bugzilla.suse.com/235071

1 0

openSUSE-RU-2021:0285-1: moderate: Recommended update for cloud-init
by maintenance＠opensuse.org 13 Feb '21

13 Feb '21

openSUSE Recommended Update: Recommended update for cloud-init ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0285-1 Rating: moderate References: #1180176 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for cloud-init fixes the following issues: - Update cloud-init-write-routes.patch (bsc#1180176) + Follow up to previous changes. Fix order of operations error to make gateway comparison between subnet configuration and route configuration valuable rather than self-comparing. - Add cloud-init-sle12-compat.patch (jsc#PM-2335) - Python 3.4 compatibility in setup.py - Disable some test for mock version compatibility This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-285=1 Package List: - openSUSE Leap 15.2 (x86_64): cloud-init-20.2-lp152.5.15.1 cloud-init-config-suse-20.2-lp152.5.15.1 cloud-init-doc-20.2-lp152.5.15.1 References: https://bugzilla.suse.com/1180176

1 0

openSUSE-RU-2021:0289-1: moderate: Recommended update for lftp
by maintenance＠opensuse.org 13 Feb '21

13 Feb '21

openSUSE Recommended Update: Recommended update for lftp ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0289-1 Rating: moderate References: #1179669 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for lftp fixes the following issue: - Fixed an issue with the SSH prompt recognition (bsc#1179669) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-289=1 Package List: - openSUSE Leap 15.2 (x86_64): lftp-4.8.4-lp152.5.3.1 lftp-debuginfo-4.8.4-lp152.5.3.1 lftp-debugsource-4.8.4-lp152.5.3.1 References: https://bugzilla.suse.com/1179669

1 0

openSUSE-OU-2021:0291-1: Recommended update for tk
by maintenance＠opensuse.org 13 Feb '21

13 Feb '21

openSUSE Optional Update: Recommended update for tk ______________________________________________________________________________ Announcement ID: openSUSE-OU-2021:0291-1 Rating: low References: #1179615 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update for tk fixes the following issues: - Fix for package building on newer service packs (bsc#1179615) This fix is optional to install. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-291=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): tk-8.6.7-lp152.4.3.1 tk-debuginfo-8.6.7-lp152.4.3.1 tk-debugsource-8.6.7-lp152.4.3.1 tk-devel-8.6.7-lp152.4.3.1 - openSUSE Leap 15.2 (x86_64): tk-32bit-8.6.7-lp152.4.3.1 tk-32bit-debuginfo-8.6.7-lp152.4.3.1 References: https://bugzilla.suse.com/1179615

1 0

openSUSE-SU-2021:0284-1: important: Security update for wpa_supplicant
by opensuse-security＠opensuse.org 13 Feb '21

13 Feb '21

openSUSE Security Update: Security update for wpa_supplicant ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0284-1 Rating: important References: #1181777 Cross-References: CVE-2021-0326 CVSS scores: CVE-2021-0326 (SUSE): 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for wpa_supplicant fixes the following issues: - CVE-2021-0326: P2P group information processing vulnerability (bsc#1181777). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-284=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): wpa_supplicant-2.9-lp152.8.6.1 wpa_supplicant-debuginfo-2.9-lp152.8.6.1 wpa_supplicant-debugsource-2.9-lp152.8.6.1 wpa_supplicant-gui-2.9-lp152.8.6.1 wpa_supplicant-gui-debuginfo-2.9-lp152.8.6.1 References: https://www.suse.com/security/cve/CVE-2021-0326.html https://bugzilla.suse.com/1181777

1 0

openSUSE-SU-2021:0283-1: important: Security update for openvswitch
by opensuse-security＠opensuse.org 13 Feb '21

13 Feb '21

openSUSE Security Update: Security update for openvswitch ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0283-1 Rating: important References: #1181742 Cross-References: CVE-2020-35498 CVSS scores: CVE-2020-35498 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openvswitch fixes the following issues: - CVE-2020-35498: Fixed a denial of service related to the handling of Ethernet padding (bsc#1181742). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-283=1 Package List: - openSUSE Leap 15.2 (x86_64): libopenvswitch-2_13-0-2.13.2-lp152.3.12.1 libopenvswitch-2_13-0-debuginfo-2.13.2-lp152.3.12.1 libovn-20_03-0-20.03.1-lp152.3.12.1 libovn-20_03-0-debuginfo-20.03.1-lp152.3.12.1 openvswitch-2.13.2-lp152.3.12.1 openvswitch-debuginfo-2.13.2-lp152.3.12.1 openvswitch-debugsource-2.13.2-lp152.3.12.1 openvswitch-devel-2.13.2-lp152.3.12.1 openvswitch-ipsec-2.13.2-lp152.3.12.1 openvswitch-pki-2.13.2-lp152.3.12.1 openvswitch-test-2.13.2-lp152.3.12.1 openvswitch-test-debuginfo-2.13.2-lp152.3.12.1 openvswitch-vtep-2.13.2-lp152.3.12.1 openvswitch-vtep-debuginfo-2.13.2-lp152.3.12.1 ovn-20.03.1-lp152.3.12.1 ovn-central-20.03.1-lp152.3.12.1 ovn-central-debuginfo-20.03.1-lp152.3.12.1 ovn-debuginfo-20.03.1-lp152.3.12.1 ovn-devel-20.03.1-lp152.3.12.1 ovn-docker-20.03.1-lp152.3.12.1 ovn-host-20.03.1-lp152.3.12.1 ovn-host-debuginfo-20.03.1-lp152.3.12.1 ovn-vtep-20.03.1-lp152.3.12.1 ovn-vtep-debuginfo-20.03.1-lp152.3.12.1 python3-ovs-2.13.2-lp152.3.12.1 - openSUSE Leap 15.2 (noarch): openvswitch-doc-2.13.2-lp152.3.12.1 ovn-doc-20.03.1-lp152.3.12.1 References: https://www.suse.com/security/cve/CVE-2020-35498.html https://bugzilla.suse.com/1181742

1 0

openSUSE-RU-2021:0282-1: moderate: Recommended update for release-notes-openSUSE
by maintenance＠opensuse.org 13 Feb '21

13 Feb '21

openSUSE Recommended Update: Recommended update for release-notes-openSUSE ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0282-1 Rating: moderate References: #1085628 #1091103 #1092953 #1093098 #1093398 #1094834 #1095111 #1100005 #1116922 #1125819 #1126496 #1129362 #1129587 #1161841 #1182141 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 15 recommended fixes can now be installed. Description: This update for release-notes-openSUSE fixes the following issues: release-notes-openSUSE was updated to 15.1.20210211 (tracked in boo#1182141) - openSUSE Leap 15.1 is now unmaintained - Updated translations (Catalan, Chinese (China), Chinese (Taiwan), Czech, Danish, Dutch, English (United Kingdom), Estonian, Finnish, French, Galician, German, Greek, Hindi, Indonesian, Italian, Japanese, Kabyle, Persian, Polish, Portuguese (Brazil), Russian, Slovak, Spanish, Swedish, Turkish) - Fixed doc site URLs (boo#1161841) - Added note about ypbind (boo#1129587) - Added a link to the System Upgrade wiki page - Simplify wording (boo#1126496) - Added note we are removing yast2-fonts (boo#1125819) - Added note about erlang-rebar (boo#1129362) - Added note for AMANDA users/groups (boo#1116922) - Added mention of git-annex removal (boo#1100005) - Fixed modeset advice (boo#1094834, comment 29) - Removed DRM-KMP note, it is outdated (boo#1094834, comment 29) - Added note about Wicked DHCP client-ids (boo#1095111, copy of jsc#323576) - Added note about Nvidia hybrid graphics (boo#1094834) - Added note about Qt scaling (boo#1091103) - Updated SDDM on High-DPI note (boo#1091103) - Added note about Transactional Server role (boo#1092953) - Added note about installations on small disks (boo#1093098) - Updated instructions to change display manager (boo#1093398) - Added note about Btrfs subvolumes (boo#1085628) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2021-282=1 Package List: - openSUSE Leap 15.1 (noarch): release-notes-openSUSE-15.1.20210211-lp151.2.3.1 References: https://bugzilla.suse.com/1085628 https://bugzilla.suse.com/1091103 https://bugzilla.suse.com/1092953 https://bugzilla.suse.com/1093098 https://bugzilla.suse.com/1093398 https://bugzilla.suse.com/1094834 https://bugzilla.suse.com/1095111 https://bugzilla.suse.com/1100005 https://bugzilla.suse.com/1116922 https://bugzilla.suse.com/1125819 https://bugzilla.suse.com/1126496 https://bugzilla.suse.com/1129362 https://bugzilla.suse.com/1129587 https://bugzilla.suse.com/1161841 https://bugzilla.suse.com/1182141

1 0

openSUSE-RU-2021:0281-1: moderate: Recommended update for SUSE Manager Client Tools
by maintenance＠opensuse.org 12 Feb '21

12 Feb '21

openSUSE Recommended Update: Recommended update for SUSE Manager Client Tools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0281-1 Rating: moderate References: #1176823 #1177884 #1179555 #1179566 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update fixes the following issues: golang-github-prometheus-alertmanager: - Exclude s390 architecture - Update packaging * Remove systemd and shadow hard requirements * use the system user provided by the system-user-prometheus subpackge * add 'prometheus-alertmanager' package alias golang-github-prometheus-prometheus: - Update to upstream version 2.22.1 - Update packaging * Remove systemd and shadow hard requirements * use systemd-sysusers to configure the user in a dedicated 'system-user-prometheus' subpackage * add 'prometheus' package alias grafana: - Update packaging * avoid systemd and shadow hard requirements * Require the user from a new dedicated 'system-user-grafana' sibling package * avoid pinning to a specific Go version in the spec file - Update to version 7.3.1: * Breaking changes - CloudWatch: The AWS CloudWatch data source's authentication scheme has changed. See the upgrade notes for details and how this may affect you. - Units: The date time units `YYYY-MM-DD HH:mm:ss` and `MM/DD/YYYY h:mm:ss a` have been renamed to `Datetime ISO` and `Datetime US` respectively. * Features / Enhancements - AzureMonitor: Support decimal (as float64) type in analytics/logs. - Add monitoring mixing for Grafana. - CloudWatch: Missing Namespace AWS/EC2CapacityReservations. - CloudWatch: Add support for AWS DirectConnect virtual interface metrics and add missing dimensions. - CloudWatch: Adding support for Amazon ElastiCache Redis metrics. - CloudWatch: Adding support for additional Amazon CloudFront metrics. - CloudWatch: Re-implement authentication. - Elasticsearch: Support multiple pipeline aggregations for a query. - Prometheus: Add time range parameters to labels API. - Loki: Visually distinguish error logs for LogQL2. - Api: Add /healthz endpoint for health checks. - API: Enrich add user to org endpoints with user ID in the response. - API: Enrich responses and improve error handling for alerting API endpoints. - Elasticsearch: Add support for date_nanos type. - Elasticsearch: Allow fields starting with underscore. - Elasticsearch: Increase maximum geohash aggregation precision to 12. - Postgres: Support request cancellation properly (Uses new backendSrv.fetch Observable request API). - Provisioning: Remove provisioned dashboards without parental reader. - API: Return ID of the deleted resource for dashboard, datasource and folder DELETE endpoints. - API: Support paging in the admin orgs list API. - API: return resource ID for auth key creation, folder permissions update and user invite complete endpoints. - BackendSrv: Uses credentials, deprecates withCredentials & defaults to same-origin. - CloudWatch: Update list of AmazonMQ metrics and dimensions. - Cloudwatch: Add Support for external ID in assume role. - Cloudwatch: Add af-south-1 region. - DateFormats: Default ISO & US formats never omit date part even if date is today (breaking change). - Explore: Transform prometheus query to elasticsearch query. - InfluxDB/Flux: Increase series limit for Flux datasource. - InfluxDB: exclude result and table column from Flux table results. - InfluxDB: return a table rather than an error when timeseries is missing time. - Loki: Add scopedVars support in legend formatting for repeated variables. - Loki: Re-introduce running of instant queries. - Loki: Support request cancellation properly (Uses new backendSrv.fetch Observable request API). - MixedDatasource: Shows retrieved data even if a data source fails. - Postgres: Support Unix socket for host. - Prometheus: Add scopedVars support in legend formatting for repeated variables. - Prometheus: Support request cancellation properly (Uses new backendSrv.fetch Observable request API). - Prometheus: add $__rate_interval variable. - Table: Adds column filtering. - grafana-cli: Add ability to read password from stdin to reset admin password. - Variables: enables cancel for slow query variables queries. - AzureMonitor: fix panic introduced in 7.1.4 when unit was unspecified and alias was used. - TextPanel: Fix content overflowing panel boundaries. - Fix golang version = 1.14 to avoid dependency conflicts on some OBS projects - Update to version 7.0.0 * Remove phantomJS patch from Makefile mgr-osad: - Change the log file permissions as expected by logrotate (bsc#1177884) spacecmd: - Fix spacecmd with no parameters produces traceback on SLE 11 SP4 (bsc#1176823) - Added '-r REVISION' option to the 'configchannel_updateinitsls' command (bsc#1179566) - Fix: internal: workaround for future tee of logs translation uyuni-common-libs: - Section in Debian packages in now treated as optional (bsc#1179555) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-281=1 Package List: - openSUSE Leap 15.2 (x86_64): golang-github-prometheus-alertmanager-0.21.0-lp152.3.3.1 golang-github-prometheus-prometheus-2.22.1-lp152.3.4.1 grafana-7.3.1-lp152.2.10.1 - openSUSE Leap 15.2 (noarch): system-user-grafana-1.0.0-lp152.2.1 system-user-prometheus-1.0.0-lp152.2.1 References: https://bugzilla.suse.com/1176823 https://bugzilla.suse.com/1177884 https://bugzilla.suse.com/1179555 https://bugzilla.suse.com/1179566

1 0

openSUSE-SU-2021:0280-1: important: Security update for subversion
by opensuse-security＠opensuse.org 12 Feb '21

12 Feb '21

openSUSE Security Update: Security update for subversion ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0280-1 Rating: important References: #1181687 Cross-References: CVE-2020-17525 CVSS scores: CVE-2020-17525 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for subversion fixes the following issues: - CVE-2020-17525: A null-pointer-dereference has been found in mod_authz_svn that results in a remote unauthenticated Denial-of-Service in some server configurations (bsc#1181687). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-280=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libsvn_auth_gnome_keyring-1-0-1.10.6-lp152.2.9.1 libsvn_auth_gnome_keyring-1-0-debuginfo-1.10.6-lp152.2.9.1 libsvn_auth_kwallet-1-0-1.10.6-lp152.2.9.1 libsvn_auth_kwallet-1-0-debuginfo-1.10.6-lp152.2.9.1 subversion-1.10.6-lp152.2.9.1 subversion-debuginfo-1.10.6-lp152.2.9.1 subversion-debugsource-1.10.6-lp152.2.9.1 subversion-devel-1.10.6-lp152.2.9.1 subversion-perl-1.10.6-lp152.2.9.1 subversion-perl-debuginfo-1.10.6-lp152.2.9.1 subversion-python-1.10.6-lp152.2.9.1 subversion-python-ctypes-1.10.6-lp152.2.9.1 subversion-python-debuginfo-1.10.6-lp152.2.9.1 subversion-ruby-1.10.6-lp152.2.9.1 subversion-ruby-debuginfo-1.10.6-lp152.2.9.1 subversion-server-1.10.6-lp152.2.9.1 subversion-server-debuginfo-1.10.6-lp152.2.9.1 subversion-tools-1.10.6-lp152.2.9.1 subversion-tools-debuginfo-1.10.6-lp152.2.9.1 - openSUSE Leap 15.2 (noarch): subversion-bash-completion-1.10.6-lp152.2.9.1 References: https://www.suse.com/security/cve/CVE-2020-17525.html https://bugzilla.suse.com/1181687

1 0

openSUSE-SU-2021:0279-1: moderate: Security update for privoxy
by opensuse-security＠opensuse.org 12 Feb '21

12 Feb '21

openSUSE Security Update: Security update for privoxy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0279-1 Rating: moderate References: #1181650 Cross-References: CVE-2021-20216 CVE-2021-20217 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for privoxy fixes the following issues: - Update to version 3.0.31: - Security/Reliability (boo#1181650) - Prevent an assertion from getting triggered by a crafted CGI request. Commit 5bba5b89193fa. OVE-20210130-0001. CVE-2021-20217 Reported by: Joshua Rogers (Opera) - Fixed a memory leak when decompression fails "unexpectedly". Commit f431d61740cc0. OVE-20210128-0001. CVE-2021-20216 - Bug fixes: - Fixed detection of insufficient data for decompression. Previously Privoxy could try to decompress a partly uninitialized buffer. This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-279=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): privoxy-3.0.31-bp152.4.6.1 - openSUSE Backports SLE-15-SP2 (noarch): privoxy-doc-3.0.31-bp152.4.6.1 References: https://www.suse.com/security/cve/CVE-2021-20216.html https://www.suse.com/security/cve/CVE-2021-20217.html https://bugzilla.suse.com/1181650

1 0

openSUSE-SU-2021:0278-1: important: Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork
by opensuse-security＠opensuse.org 12 Feb '21

12 Feb '21

openSUSE Security Update: Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0278-1 Rating: important References: #1174075 #1176708 #1178801 #1178969 #1180243 #1180401 #1181730 #1181732 Cross-References: CVE-2020-15257 CVE-2021-21284 CVE-2021-21285 CVSS scores: CVE-2020-15257 (NVD) : 5.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N CVE-2020-15257 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-21284 (NVD) : 6.8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N CVE-2021-21284 (SUSE): 2.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:N CVE-2021-21285 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-21285 (SUSE): 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves three vulnerabilities and has 5 fixes is now available. Description: This update for containerd, docker, docker-runc, golang-github-docker-libnetwork fixes the following issues: Security issues fixed: - CVE-2020-15257: Fixed a privilege escalation in containerd (bsc#1178969). - CVE-2021-21284: potential privilege escalation when the root user in the remapped namespace has access to the host filesystem (bsc#1181732) - CVE-2021-21285: pulling a malformed Docker image manifest crashes the dockerd daemon (bsc#1181730) Non-security issues fixed: - Update Docker to 19.03.15-ce. See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285). - Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE. It appears that SLES doesn't like the patch. (bsc#1180401) - Update to containerd v1.3.9, which is needed for Docker v19.03.14-ce and fixes CVE-2020-15257. bsc#1180243 - Update to containerd v1.3.7, which is required for Docker 19.03.13-ce. bsc#1176708 - Update to Docker 19.03.14-ce. See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243 https://github.com/docker/docker-ce/releases/tag/v19.03.14 - Enable fish-completion - Add a patch which makes Docker compatible with firewalld with nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548 (bsc#1178801, SLE-16460) - Update to Docker 19.03.13-ce. See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708 - Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075) - Emergency fix: %requires_eq does not work with provide symbols, only effective package names. Convert back to regular Requires. - Update to Docker 19.03.12-ce. See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md. - Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of spurrious errors due to Go returning -EINTR from I/O syscalls much more often (due to Go 1.14's pre-emptive goroutine support). - Add BuildRequires for all -git dependencies so that we catch missing dependencies much more quickly. - Update to libnetwork 55e924b8a842, which is required for Docker 19.03.14-ce. bsc#1180243 - Add patch which makes libnetwork compatible with firewalld with nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548 (bsc#1178801, SLE-16460) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-278=1 Package List: - openSUSE Leap 15.2 (x86_64): containerd-1.3.9-lp152.2.3.1 containerd-ctr-1.3.9-lp152.2.3.1 docker-19.03.15_ce-lp152.2.3.1 docker-debuginfo-19.03.15_ce-lp152.2.3.1 docker-libnetwork-0.7.0.1+gitr2908_55e924b8a842-lp152.2.3.1 docker-libnetwork-debuginfo-0.7.0.1+gitr2908_55e924b8a842-lp152.2.3.1 docker-runc-1.0.0rc10+gitr3981_dc9208a3303f-lp152.2.3.1 docker-runc-debuginfo-1.0.0rc10+gitr3981_dc9208a3303f-lp152.2.3.1 docker-test-19.03.15_ce-lp152.2.3.1 docker-test-debuginfo-19.03.15_ce-lp152.2.3.1 fish-2.7.1-lp152.5.3.1 fish-debuginfo-2.7.1-lp152.5.3.1 fish-debugsource-2.7.1-lp152.5.3.1 fish-devel-2.7.1-lp152.5.3.1 golang-github-docker-libnetwork-0.7.0.1+gitr2908_55e924b8a842-lp152.2.3.1 - openSUSE Leap 15.2 (noarch): docker-bash-completion-19.03.15_ce-lp152.2.3.1 docker-fish-completion-19.03.15_ce-lp152.2.3.1 docker-zsh-completion-19.03.15_ce-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-15257.html https://www.suse.com/security/cve/CVE-2021-21284.html https://www.suse.com/security/cve/CVE-2021-21285.html https://bugzilla.suse.com/1174075 https://bugzilla.suse.com/1176708 https://bugzilla.suse.com/1178801 https://bugzilla.suse.com/1178969 https://bugzilla.suse.com/1180243 https://bugzilla.suse.com/1180401 https://bugzilla.suse.com/1181730 https://bugzilla.suse.com/1181732

1 0

openSUSE-SU-2021:0277-1: important: Security update for librepo
by opensuse-security＠opensuse.org 12 Feb '21

12 Feb '21

openSUSE Security Update: Security update for librepo ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0277-1 Rating: important References: #1175475 Cross-References: CVE-2020-14352 CVSS scores: CVE-2020-14352 (NVD) : 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVE-2020-14352 (SUSE): 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for librepo fixes the following issues: - Upgrade to 1.12.1 + Validate path read from repomd.xml (bsc#1175475, CVE-2020-14352) - Changes from 1.12.0 + Prefer mirrorlist/metalink over baseurl (rh#1775184) + Decode package URL when using for local filename (rh#1817130) + Fix memory leak in lr_download_metadata() and lr_yum_download_remote() + Download sources work when at least one of specified is working (rh#1775184) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-277=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): librepo-debuginfo-1.12.1-lp152.2.6.1 librepo-debugsource-1.12.1-lp152.2.6.1 librepo-devel-1.12.1-lp152.2.6.1 librepo0-1.12.1-lp152.2.6.1 librepo0-debuginfo-1.12.1-lp152.2.6.1 python3-librepo-1.12.1-lp152.2.6.1 python3-librepo-debuginfo-1.12.1-lp152.2.6.1 References: https://www.suse.com/security/cve/CVE-2020-14352.html https://bugzilla.suse.com/1175475

1 0

openSUSE-RU-2021:0273-1: moderate: Recommended update for ServiceReport
by maintenance＠opensuse.org 11 Feb '21

11 Feb '21

openSUSE Recommended Update: Recommended update for ServiceReport ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0273-1 Rating: moderate References: #1181729 SLE-13288 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has one recommended fix and contains one feature can now be installed. Description: This update for ServiceReport fixes the following issues: Update to version 2.2.2+git10.1caca0630e36 (boo#1181729 ltc#191203 jsc#SLE-13288): * Update SLES crashkernel recommendation values * update HTX service name Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-273=1 Package List: - openSUSE Backports SLE-15-SP2 (noarch): ServiceReport-2.2.2+git10.1caca0630e36-bp152.2.1 References: https://bugzilla.suse.com/1181729

1 0

openSUSE-SU-2021:0276-1: important: Security update for chromium
by opensuse-security＠opensuse.org 11 Feb '21

11 Feb '21

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0276-1 Rating: important References: #1181827 Cross-References: CVE-2021-21148 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for chromium fixes the following issues: Update to 88.0.4324.150 boo#1181827 - CVE-2021-21148: Heap buffer overflow in V8 This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-276=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 x86_64): chromedriver-88.0.4324.150-bp152.2.59.1 chromium-88.0.4324.150-bp152.2.59.1 References: https://www.suse.com/security/cve/CVE-2021-21148.html https://bugzilla.suse.com/1181827

1 0

openSUSE-SU-2021:0274-1: moderate: Security update for nextcloud
by opensuse-security＠opensuse.org 11 Feb '21

11 Feb '21

openSUSE Security Update: Security update for nextcloud ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0274-1 Rating: moderate References: #1181445 #1181803 #1181804 Cross-References: CVE-2020-8293 CVE-2020-8294 CVE-2020-8295 CVSS scores: CVE-2020-8293 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2020-8294 (NVD) : 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for nextcloud fixes the following issues: - nextcloud was upgraded to version 20.0.7 - CVE-2020-8294: Fixed a missing link validation (boo#1181803) - CVE-2020-8295: Fixed a denial of service attack (boo#1181804) - CVE-2020-8293: Fixed an input validation issue (boo#1181445) This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-274=1 Package List: - openSUSE Backports SLE-15-SP2 (noarch): nextcloud-20.0.7-bp152.2.6.1 nextcloud-apache-20.0.7-bp152.2.6.1 References: https://www.suse.com/security/cve/CVE-2020-8293.html https://www.suse.com/security/cve/CVE-2020-8294.html https://www.suse.com/security/cve/CVE-2020-8295.html https://bugzilla.suse.com/1181445 https://bugzilla.suse.com/1181803 https://bugzilla.suse.com/1181804

1 0

openSUSE-OU-2021:0275-1: Optional update for pam
by maintenance＠opensuse.org 11 Feb '21

11 Feb '21

openSUSE Optional Update: Optional update for pam ______________________________________________________________________________ Announcement ID: openSUSE-OU-2021:0275-1 Rating: low References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 optional fixes can now be installed. Description: This update for pam fixes the following issues: - Added rpm macros for this package, so that other packages can make use of it This patch is optional to be installed - it doesn't fix any bugs. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-275=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): pam-1.3.0-lp152.11.9.1 pam-debuginfo-1.3.0-lp152.11.9.1 pam-debugsource-1.3.0-lp152.11.9.1 pam-devel-1.3.0-lp152.11.9.1 pam-extra-1.3.0-lp152.11.9.1 pam-extra-debuginfo-1.3.0-lp152.11.9.1 - openSUSE Leap 15.2 (x86_64): pam-32bit-1.3.0-lp152.11.9.1 pam-32bit-debuginfo-1.3.0-lp152.11.9.1 pam-devel-32bit-1.3.0-lp152.11.9.1 pam-extra-32bit-1.3.0-lp152.11.9.1 pam-extra-32bit-debuginfo-1.3.0-lp152.11.9.1 - openSUSE Leap 15.2 (noarch): pam-doc-1.3.0-lp152.11.9.1 References:

1 0

openSUSE-SU-2021:0272-1: moderate: Security update for rclone
by opensuse-security＠opensuse.org 10 Feb '21

10 Feb '21

openSUSE Security Update: Security update for rclone ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0272-1 Rating: moderate References: #1179005 Cross-References: CVE-2020-28924 CVSS scores: CVE-2020-28924 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rclone fixes the following issues: rclone was updated to version 1.53.3: * Bug Fixes - Fix incorrect use of math/rand instead of crypto/rand CVE-2020-28924 boo#1179005 (Nick Craig-Wood) - Check https://github.com/rclone/passwordcheck for a tool check for weak passwords generated by rclone * VFS - Fix vfs/refresh calls with fs= parameter (Nick Craig-Wood) * Sharefile - Fix backend due to API swapping integers for strings (Nick Craig-Wood) Update to 1.53.2: * Bug Fixes - accounting + Fix incorrect speed and transferTime in core/stats (Nick Craig-Wood) + Stabilize display order of transfers on Windows (Nick Craig-Wood) - operations + Fix use of --suffix without --backup-dir (Nick Craig-Wood) + Fix spurious "--checksum is in use but the source and destination have no hashes in common" (Nick Craig-Wood) - build + Work around GitHub actions brew problem (Nick Craig-Wood) + Stop using set-env and set-path in the GitHub actions (Nick Craig-Wood) * Mount - mount2: Fix the swapped UID / GID values (Russell Cattelan) * VFS - Detect and recover from a file being removed externally from the cache (Nick Craig-Wood) - Fix a deadlock vulnerability in downloaders.Close (Leo Luan) - Fix a race condition in retryFailedResets (Leo Luan) - Fix missed concurrency control between some item operations and reset (Leo Luan) - Add exponential backoff during ENOSPC retries (Leo Luan) - Add a missed update of used cache space (Leo Luan) - Fix --no-modtime to not attempt to set modtimes (as documented) (Nick Craig-Wood) * Local - Fix sizes and syncing with --links option on Windows (Nick Craig-Wood) * Chunker - Disable ListR to fix missing files on GDrive (workaround) (Ivan Andreev) - Fix upload over crypt (Ivan Andreev) * Fichier - Increase maximum file size from 100GB to 300GB (gyutw) * Jottacloud - Remove clientSecret from config when upgrading to token based authentication (buengese) - Avoid double url escaping of device/mountpoint (albertony) - Remove DirMove workaround as it's not required anymore - also (buengese) * Mailru - Fix uploads after recent changes on server (Ivan Andreev) - Fix range requests after june changes on server (Ivan Andreev) - Fix invalid timestamp on corrupted files (fixes) (Ivan Andreev) * Onedrive - Fix disk usage for sharepoint (Nick Craig-Wood) * S3 - Add missing regions for AWS (Anagh Kumar Baranwal) * Seafile - Fix accessing libraries > 2GB on 32 bit systems (Muffin King) * SFTP - Always convert the checksum to lower case (buengese) * Union - Create root directories if none exist (Nick Craig-Wood) Update to version 1.53.1: * Bug Fixes - accounting: Remove new line from end of --stats-one-line display * VFS - Fix spurious error "vfs cache: failed to _ensure cache EOF" - Log an ERROR if we fail to set the file to be sparse * Local - Log an ERROR if we fail to set the file to be sparse * Drive - Re-adds special oauth help text * Opendrive - Do not retry 400 errors Update to version 1.53.0 * New Features - The VFS layer was heavily reworked for this release - see below for more details - Interactive mode -i/--interactive for destructive operations (fishbullet) - Add --bwlimit-file flag to limit speeds of individual file transfers (Nick Craig-Wood) - Transfers are sorted by start time in the stats and progress output (Max Sum) - Make sure backends expand ~ and environment vars in file names they use (Nick Craig-Wood) - Add --refresh-times flag to set modtimes on hashless backends (Nick Craig-Wood) - rclone check + Add reporting of filenames for same/missing/changed (Nick Craig-Wood) + Make check command obey --dry-run/-i/--interactive (Nick Craig-Wood) + Make check do --checkers files concurrently (Nick Craig-Wood) + Retry downloads if they fail when using the --download flag (Nick Craig-Wood) + Make it show stats by default (Nick Craig-Wood) - rclone config + Set RCLONE_CONFIG_DIR for use in config files and subprocesses (Nick Craig-Wood) + Reject remote names starting with a dash. (jtagcat) - rclone cryptcheck: Add reporting of filenames for same/missing/changed (Nick Craig-Wood) - rclone dedupe: Make it obey the --size-only flag for duplicate detection (Nick Craig-Wood) - rclone link: Add --expire and --unlink flags (Roman Kredentser) - rclone mkdir: Warn when using mkdir on remotes which can't have empty directories (Nick Craig-Wood) - rclone rc: Allow JSON parameters to simplify command line usage (Nick Craig-Wood) - rclone serve ftp + Don't compile on < go1.13 after dependency update (Nick Craig-Wood) + Add error message if auth proxy fails (Nick Craig-Wood) + Use refactored goftp.io/server library for binary shrink (Nick Craig-Wood) - rclone serve restic: Expose interfaces so that rclone can be used as a library from within restic (Jack) - rclone sync: Add --track-renames-strategy leaf (Nick Craig-Wood) - rclone touch: Add ability to set nanosecond resolution times (Nick Craig-Wood) - rclone tree: Remove -i shorthand for --noindent as it conflicts with -i/--interactive (Nick Craig-Wood) * Bug Fixes * Mount - rc interface + Add call for unmount all (Chaitanya Bankanhal) + Make mount/mount remote control take vfsOpt option (Nick Craig-Wood) + Add mountOpt to mount/mount (Nick Craig-Wood) + Add VFS and Mount options to mount/listmounts (Nick Craig-Wood) - Catch panics in cgofuse initialization and turn into error messages (Nick Craig-Wood) - Always supply stat information in Readdir (Nick Craig-Wood) - Add support for reading unknown length files using direct IO (Windows) (Nick Craig-Wood) - Fix On Windows don't add -o uid/gid=-1 if user supplies -o uid/gid. (Nick Craig-Wood) - Fix volume name broken in recent refactor (Nick Craig-Wood) * VFS - Implement partial reads for --vfs-cache-mode full (Nick Craig-Wood) - Add --vfs-writeback option to delay writes back to cloud storage (Nick Craig-Wood) - Add --vfs-read-ahead parameter for use with --vfs-cache-mode full (Nick Craig-Wood) - Restart pending uploads on restart of the cache (Nick Craig-Wood) - Support synchronous cache space recovery upon ENOSPC (Leo Luan) - Allow ReadAt and WriteAt to run concurrently with themselves (Nick Craig-Wood) - Change modtime of file before upload to current (Rob Calistri) - Recommend --vfs-cache-modes writes on backends which can't stream (Nick Craig-Wood) - Add an optional fs parameter to vfs rc methods (Nick Craig-Wood) - Fix errors when using > 260 char files in the cache in Windows (Nick Craig-Wood) - Fix renaming of items while they are being uploaded (Nick Craig-Wood) - Fix very high load caused by slow directory listings (Nick Craig-Wood) - Fix renamed files not being uploaded with --vfs-cache-mode minimal (Nick Craig-Wood) - Fix directory locking caused by slow directory listings (Nick Craig-Wood) - Fix saving from chrome without --vfs-cache-mode writes (Nick Craig-Wood) * Crypt Add --crypt-server-side-across-configs flag (Nick Craig-Wood) Make any created backends be cached to fix rc problems (Nick Craig-Wood) * Azure Blob Don't compile on < go1.13 after dependency update (Nick Craig-Wood) * B2 Implement server side copy for files > 5GB (Nick Craig-Wood) Cancel in progress multipart uploads and copies on rclone exit (Nick Craig-Wood) Note that b2's encoding now allows \ but rclone's hasn't changed (Nick Craig-Wood) Fix transfers when using download_url (Nick Craig-Wood) * Box - Implement rclone cleanup (buengese) - Cancel in progress multipart uploads and copies on rclone exit (Nick Craig-Wood) - Allow authentication with access token (David) * Chunker - Make any created backends be cached to fix rc problems (Nick Craig-Wood) * Drive - Add rclone backend drives to list shared drives (teamdrives) (Nick Craig-Wood) - Implement rclone backend untrash (Nick Craig-Wood) - Work around drive bug which didn't set modtime of copied docs (Nick Craig-Wood) - Added --drive-starred-only to only show starred files (Jay McEntire) - Deprecate --drive-alternate-export as it is no longer needed (themylogin) - Fix duplication of Google docs on server side copy (Nick Craig-Wood) - Fix "panic: send on closed channel" when recycling dir entries (Nick Craig-Wood) * Dropbox - Add copyright detector info in limitations section in the docs (Alex Guerrero) - Fix rclone link by removing expires parameter (Nick Craig-Wood) * Fichier - Detect Flood detected: IP Locked error and sleep for 30s (Nick Craig-Wood) * FTP - Add explicit TLS support (Heiko Bornholdt) - Add support for --dump bodies and --dump auth for debugging (Nick Craig-Wood) - Fix interoperation with pure-ftpd (Nick Craig-Wood) * Google Cloud Storage - Add support for anonymous access (Kai L��ke) * Jottacloud - Bring back legacy authentification for use with whitelabel versions (buengese) - Switch to new api root - also implement a very ugly workaround for the DirMove failures (buengese) * Onedrive - Rework cancel of multipart uploads on rclone exit (Nick Craig-Wood) - Implement rclone cleanup (Nick Craig-Wood) - Add --onedrive-no-versions flag to remove old versions (Nick Craig-Wood) * Pcloud - Implement rclone link for public link creation (buengese) * Qingstor - Cancel in progress multipart uploads on rclone exit (Nick Craig-Wood) * S3 - Preserve metadata when doing multipart copy (Nick Craig-Wood) - Cancel in progress multipart uploads and copies on rclone exit (Nick Craig-Wood) - Add rclone link for public link sharing (Roman Kredentser) - Add rclone backend restore command to restore objects from GLACIER (Nick Craig-Wood) - Add rclone cleanup and rclone backend cleanup to clean unfinished multipart uploads (Nick Craig-Wood) - Add rclone backend list-multipart-uploads to list unfinished multipart uploads (Nick Craig-Wood) - Add --s3-max-upload-parts support (Kamil Trzci��ski) - Add --s3-no-check-bucket for minimising rclone transactions and perms (Nick Craig-Wood) - Add --s3-profile and --s3-shared-credentials-file options (Nick Craig-Wood) - Use regional s3 us-east-1 endpoint (David) - Add Scaleway provider (Vincent Feltz) - Update IBM COS endpoints (Egor Margineanu) - Reduce the default --s3-copy-cutoff to < 5GB for Backblaze S3 compatibility (Nick Craig-Wood) - Fix detection of bucket existing (Nick Craig-Wood) * SFTP - Use the absolute path instead of the relative path for listing for improved compatibility (Nick Craig-Wood) - Add --sftp-subsystem and --sftp-server-command options (aus) * Swift - Fix dangling large objects breaking the listing (Nick Craig-Wood) - Fix purge not deleting directory markers (Nick Craig-Wood) - Fix update multipart object removing all of its own parts (Nick Craig-Wood) - Fix missing hash from object returned from upload (Nick Craig-Wood) * Tardigrade - Upgrade to uplink v1.2.0 (Kaloyan Raev) * Union - Fix writing with the all policy (Nick Craig-Wood) * WebDAV - Fix directory creation with 4shared (Nick Craig-Wood) - Update to version 1.52.3 * Bug Fixes - docs + Disable smart typography (eg en-dash) in MANUAL.* and man page (Nick Craig-Wood) + Update install.md to reflect minimum Go version (Evan Harris) + Update install from source instructions (Nick Craig-Wood) + make_manual: Support SOURCE_DATE_EPOCH (Morten Linderud) - log: Fix --use-json-log going to stderr not --log-file on Windows (Nick Craig-Wood) - serve dlna: Fix file list on Samsung Series 6+ TVs (Matteo Pietro Dazzi) - sync: Fix deadlock with --track-renames-strategy modtime (Nick Craig-Wood) * Cache - Fix moveto/copyto remote:file remote:file2 (Nick Craig-Wood) * Drive - Stop using root_folder_id as a cache (Nick Craig-Wood) - Make dangling shortcuts appear in listings (Nick Craig-Wood) - Drop "Disabling ListR" messages down to debug (Nick Craig-Wood) - Workaround and policy for Google Drive API (Dmitry Ustalov) * FTP - Add note to docs about home vs root directory selection (Nick Craig-Wood) * Onedrive - Fix reverting to Copy when Move would have worked (Nick Craig-Wood) - Avoid comma rendered in URL in onedrive.md (Kevin) * Pcloud - Fix oauth on European region "eapi.pcloud.com" (Nick Craig-Wood) * S3 - Fix bucket Region auto detection when Region unset in config (Nick Craig-Wood) - Update to version 1.52.2 * Bug Fixes - build + Fix docker release build action (Nick Craig-Wood) + Fix custom timezone in Docker image (NoLooseEnds) - check: Fix misleading message which printed errors instead of differences (Nick Craig-Wood) - errors: Add WSAECONNREFUSED and more to the list of retriable Windows errors (Nick Craig-Wood) - rcd: Fix incorrect prometheus metrics (Gary Kim) - serve restic: Fix flags so they use environment variables (Nick Craig-Wood) - serve webdav: Fix flags so they use environment variables (Nick Craig-Wood) - sync: Fix --track-renames-strategy modtime (Nick Craig-Wood) * Drive - Fix not being able to delete a directory with a trashed shortcut (Nick Craig-Wood) - Fix creating a directory inside a shortcut (Nick Craig-Wood) - Fix --drive-impersonate with cached root_folder_id (Nick Craig-Wood) * SFTP - Fix SSH key PEM loading (Zac Rubin) * Swift - Speed up deletes by not retrying segment container deletes (Nick Craig-Wood) * Tardigrade - Upgrade to uplink v1.1.1 (Caleb Case) * WebDAV - Fix free/used display for rclone about/df for certain backends (Nick Craig-Wood) - Update to version 1.52.1 * VFS - Fix OS vs Unix path confusion - fixes ChangeNotify on Windows (Nick Craig-Wood) * Drive - Fix missing items when listing using --fast-list / ListR (Nick Craig-Wood) * Putio - Fix panic on Object.Open (Cenk Alti) * S3 - Fix upload of single files into buckets without create permission (Nick Craig-Wood) - Fix --header-upload (Nick Craig-Wood) * Tardigrade - Fix listing bug by upgrading to v1.0.7 - Set UserAgent to rclone (Caleb Case) - Update to version 1.52.0 * New backends - Tardigrade backend for use with storj.io (Caleb Case) - Union re-write to have multiple writable remotes (Max Sum) - Seafile for Seafile server (Fred @creativeprojects) * New commands - backend: command for backend specific commands (see backends) (Nick Craig-Wood) - cachestats: Deprecate in favour of rclone backend stats cache: (Nick Craig-Wood) - dbhashsum: Deprecate in favour of rclone hashsum DropboxHash (Nick Craig-Wood) * New Features - Add --header-download and --header-upload flags for setting HTTP headers when uploading/downloading (Tim Gallant) - Add --header flag to add HTTP headers to every HTTP transaction (Nick Craig-Wood) - Add --check-first to do all checking before starting transfers (Nick Craig-Wood) - Add --track-renames-strategy for configurable matching criteria for --track-renames (Bernd Schoolmann) - Add --cutoff-mode hard,soft,catious (Shing Kit Chan & Franklyn Tackitt) - Filter flags (eg --files-from -) can read from stdin (fishbullet) - Add --error-on-no-transfer option (Jon Fautley) - Implement --order-by xxx,mixed for copying some small and some big files (Nick Craig-Wood) - Allow --max-backlog to be negative meaning as large as possible (Nick Craig-Wood) - Added --no-unicode-normalization flag to allow Unicode filenames to remain unique (Ben Zenker) - Allow --min-age/--max-age to take a date as well as a duration (Nick Craig-Wood) - Add rename statistics for file and directory renames (Nick Craig-Wood) - Add statistics output to JSON log (reddi) - Make stats be printed on non-zero exit code (Nick Craig-Wood) - When running --password-command allow use of stdin (S��bastien Gross) - Stop empty strings being a valid remote path (Nick Craig-Wood) - accounting: support WriterTo for less memory copying (Nick Craig-Wood) - build + Update to use go1.14 for the build (Nick Craig-Wood) + Add -trimpath to release build for reproduceable builds (Nick Craig-Wood) + Remove GOOS and GOARCH from Dockerfile (Brandon Philips) - config + Fsync the config file after writing to save more reliably (Nick Craig-Wood) + Add --obscure and --no-obscure flags to config create/update (Nick Craig-Wood) + Make config show take remote: as well as remote (Nick Craig-Wood) - copyurl: Add --no-clobber flag (Denis) - delete: Added --rmdirs flag to delete directories as well (Kush) - filter: Added --files-from-raw flag (Ankur Gupta) - genautocomplete: Add support for fish shell (Matan Rosenberg) - log: Add support for syslog LOCAL facilities (Patryk Jakuszew) - lsjson: Add --hash-type parameter and use it in lsf to speed up hashing (Nick Craig-Wood) - rc + Add -o/--opt and -a/--arg for more structured input (Nick Craig-Wood) + Implement backend/command for running backend specific commands remotely (Nick Craig-Wood) + Add mount/mount command for starting rclone mount via the API (Chaitanya) - rcd: Add Prometheus metrics support (Gary Kim) - serve http + Added a --template flag for user defined markup (calistri) + Add Last-Modified headers to files and directories (Nick Craig-Wood) - serve sftp: Add support for multiple host keys by repeating --key flag (Maxime Suret) - touch: Add --localtime flag to make --timestamp localtime not UTC (Nick Craig-Wood) * Bug Fixes - accounting + Restore "Max number of stats groups reached" log line (Micha�� Matczuk) + Correct exitcode on Transfer Limit Exceeded flag. (Anuar Serdaliyev) + Reset bytes read during copy retry (Ankur Gupta) + Fix race clearing stats (Nick Craig-Wood) - copy: Only create empty directories when they don't exist on the remote (Ishuah Kariuki) - dedupe: Stop dedupe deleting files with identical IDs (Nick Craig-Wood) - oauth + Use custom http client so that --no-check-certificate is honored by oauth token fetch (Mark Spieth) + Replace deprecated oauth2.NoContext (Lars Lehtonen) - operations + Fix setting the timestamp on Windows for multithread copy (Nick Craig-Wood) + Make rcat obey --ignore-checksum (Nick Craig-Wood) + Make --max-transfer more accurate (Nick Craig-Wood) - rc + Fix dropped error (Lars Lehtonen) + Fix misplaced http server config (Xiaoxing Ye) + Disable duplicate log (ElonH) - serve dlna + Cds: don't specify childCount at all when unknown (Dan Walters) + Cds: use modification time as date in dlna metadata (Dan Walters) - serve restic: Fix tests after restic project removed vendoring (Nick Craig-Wood) - sync + Fix incorrect "nothing to transfer" message using --delete-before (Nick Craig-Wood) + Only create empty directories when they don't exist on the remote (Ishuah Kariuki) * Mount - Add --async-read flag to disable asynchronous reads (Nick Craig-Wood) - Ignore --allow-root flag with a warning as it has been removed upstream (Nick Craig-Wood) - Warn if --allow-non-empty used on Windows and clarify docs (Nick Craig-Wood) - Constrain to go1.13 or above otherwise bazil.org/fuse fails to compile (Nick Craig-Wood) - Fix fail because of too long volume name (evileye) - Report 1PB free for unknown disk sizes (Nick Craig-Wood) - Map more rclone errors into file systems errors (Nick Craig-Wood) - Fix disappearing cwd problem (Nick Craig-Wood) - Use ReaddirPlus on Windows to improve directory listing performance (Nick Craig-Wood) - Send a hint as to whether the filesystem is case insensitive or not (Nick Craig-Wood) - Add rc command mount/types (Nick Craig-Wood) - Change maximum leaf name length to 1024 bytes (Nick Craig-Wood) * VFS - Add --vfs-read-wait and --vfs-write-wait flags to control time waiting for a sequential read/write (Nick Craig-Wood) - Change default --vfs-read-wait to 20ms (it was 5ms and not configurable) (Nick Craig-Wood) - Make df output more consistent on a rclone mount. (Yves G) - Report 1PB free for unknown disk sizes (Nick Craig-Wood) - Fix race condition caused by unlocked reading of Dir.path (Nick Craig-Wood) - Make File lock and Dir lock not overlap to avoid deadlock (Nick Craig-Wood) - Implement lock ordering between File and Dir to eliminate deadlocks (Nick Craig-Wood) - Factor the vfs cache into its own package (Nick Craig-Wood) - Pin the Fs in use in the Fs cache (Nick Craig-Wood) - Add SetSys() methods to Node to allow caching stuff on a node (Nick Craig-Wood) - Ignore file not found errors from Hash in Read.Release (Nick Craig-Wood) - Fix hang in read wait code (Nick Craig-Wood) * Local - Speed up multi thread downloads by using sparse files on Windows (Nick Craig-Wood) - Implement --local-no-sparse flag for disabling sparse files (Nick Craig-Wood) - Implement rclone backend noop for testing purposes (Nick Craig-Wood) - Fix "file not found" errors on post transfer Hash calculation (Nick Craig-Wood) * Cache - Implement rclone backend stats command (Nick Craig-Wood) - Fix Server Side Copy with Temp Upload (Brandon McNama) - Remove Unused Functions (Lars Lehtonen) - Disable race tests until bbolt is fixed (Nick Craig-Wood) - Move methods used for testing into test file (greatroar) - Add Pin and Unpin and canonicalised lookup (Nick Craig-Wood) - Use proper import path go.etcd.io/bbolt (Robert-Andr�� Mauchin) * Crypt - Calculate hashes for uploads from local disk (Nick Craig-Wood) + This allows crypted Jottacloud uploads without using local disk + This means crypted s3/b2 uploads will now have hashes - Added rclone backend decode/encode commands to replicate functionality of cryptdecode (Anagh Kumar Baranwal) - Get rid of the unused Cipher interface as it obfuscated the code (Nick Craig-Wood) * Azure Blob - Implement streaming of unknown sized files so rcat is now supported (Nick Craig-Wood) - Implement memory pooling to control memory use (Nick Craig-Wood) - Add --azureblob-disable-checksum flag (Nick Craig-Wood) - Retry InvalidBlobOrBlock error as it may indicate block concurrency problems (Nick Craig-Wood) - Remove unused Object.parseTimeString() (Lars Lehtonen) - Fix permission error on SAS URL limited to container (Nick Craig-Wood) * B2 - Add support for --header-upload and --header-download (Tim Gallant) - Ignore directory markers at the root also (Nick Craig-Wood) - Force the case of the SHA1 to lowercase (Nick Craig-Wood) - Remove unused largeUpload.clearUploadURL() (Lars Lehtonen) * Box - Add support for --header-upload and --header-download (Tim Gallant) - Implement About to read size used (Nick Craig-Wood) - Add token renew function for jwt auth (David Bramwell) - Added support for interchangeable root folder for Box backend (Sunil Patra) - Remove unnecessary iat from jws claims (David) * Drive - Follow shortcuts by default, skip with --drive-skip-shortcuts (Nick Craig-Wood) - Implement rclone backend shortcut command for creating shortcuts (Nick Craig-Wood) - Added rclone backend command to change service_account_file and chunk_size (Anagh Kumar Baranwal) - Fix missing files when using --fast-list and --drive-shared-with-me (Nick Craig-Wood) - Fix duplicate items when using --drive-shared-with-me (Nick Craig-Wood) - Extend --drive-stop-on-upload-limit to respond to teamDriveFileLimitExceeded. (harry) - Don't delete files with multiple parents to avoid data loss (Nick Craig-Wood) - Server side copy docs use default description if empty (Nick Craig-Wood) * Dropbox - Make error insufficient space to be fatal (harry) - Add info about required redirect url (Elan Ruusam��e) * Fichier - Add support for --header-upload and --header-download (Tim Gallant) - Implement custom pacer to deal with the new rate limiting (buengese) * FTP - Fix lockup when using concurrency limit on failed connections (Nick Craig-Wood) - Fix lockup on failed upload when using concurrency limit (Nick Craig-Wood) - Fix lockup on Close failures when using concurrency limit (Nick Craig-Wood) - Work around pureftp sending spurious 150 messages (Nick Craig-Wood) * Google Cloud Storage - Add support for --header-upload and --header-download (Nick Craig-Wood) - Add ARCHIVE storage class to help (Adam Stroud) - Ignore directory markers at the root (Nick Craig-Wood) * Googlephotos - Make the start year configurable (Daven) - Add support for --header-upload and --header-download (Tim Gallant) - Create feature/favorites directory (Brandon Philips) - Fix "concurrent map write" error (Nick Craig-Wood) - Don't put an image in error message (Nick Craig-Wood) * HTTP - Improved directory listing with new template from Caddy project (calisro) * Jottacloud - Implement --jottacloud-trashed-only (buengese) - Add support for --header-upload and --header-download (Tim Gallant) - Use RawURLEncoding when decoding base64 encoded login token (buengese) - Implement cleanup (buengese) - Update docs regarding cleanup, removed remains from old auth, and added warning about special mountpoints. (albertony) * Mailru - Describe 2FA requirements (valery1707) * Onedrive - Implement --onedrive-server-side-across-configs (Nick Craig-Wood) - Add support for --header-upload and --header-download (Tim Gallant) - Fix occasional 416 errors on multipart uploads (Nick Craig-Wood) - Added maximum chunk size limit warning in the docs (Harry) - Fix missing drive on config (Nick Craig-Wood) - Make error quotaLimitReached to be fatal (harry) * Opendrive - Add support for --header-upload and --header-download (Tim Gallant) * Pcloud - Added support for interchangeable root folder for pCloud backend (Sunil Patra) - Add support for --header-upload and --header-download (Tim Gallant) - Fix initial config "Auth state doesn't match" message (Nick Craig-Wood) * Premiumizeme - Add support for --header-upload and --header-download (Tim Gallant) - Prune unused functions (Lars Lehtonen) * Putio - Add support for --header-upload and --header-download (Nick Craig-Wood) - Make downloading files use the rclone http Client (Nick Craig-Wood) - Fix parsing of remotes with leading and trailing / (Nick Craig-Wood) * Qingstor - Make rclone cleanup remove pending multipart uploads older than 24h (Nick Craig-Wood) - Try harder to cancel failed multipart uploads (Nick Craig-Wood) - Prune multiUploader.list() (Lars Lehtonen) - Lint fix (Lars Lehtonen) * S3 - Add support for --header-upload and --header-download (Tim Gallant) - Use memory pool for buffer allocations (Maciej Zimnoch) - Add SSE-C support for AWS, Ceph, and MinIO (Jack Anderson) - Fail fast multipart upload (Micha�� Matczuk) - Report errors on bucket creation (mkdir) correctly (Nick Craig-Wood) - Specify that Minio supports URL encoding in listings (Nick Craig-Wood) - Added 500 as retryErrorCode (Micha�� Matczuk) - Use --low-level-retries as the number of SDK retries (Aleksandar Jankovi��) - Fix multipart abort context (Aleksandar Jankovic) - Replace deprecated session.New() with session.NewSession() (Lars Lehtonen) - Use the provided size parameter when allocating a new memory pool (Joachim Brandon LeBlanc) - Use rclone's low level retries instead of AWS SDK to fix listing retries (Nick Craig-Wood) - Ignore directory markers at the root also (Nick Craig-Wood) - Use single memory pool (Micha�� Matczuk) - Do not resize buf on put to memBuf (Micha�� Matczuk) - Improve docs for --s3-disable-checksum (Nick Craig-Wood) - Don't leak memory or tokens in edge cases for multipart upload (Nick Craig-Wood) * Seafile - Implement 2FA (Fred) * SFTP - Added --sftp-pem-key to support inline key files (calisro) - Fix post transfer copies failing with 0 size when using set_modtime=false (Nick Craig-Wood) * Sharefile - Add support for --header-upload and --header-download (Tim Gallant) * Sugarsync - Add support for --header-upload and --header-download (Tim Gallant) * Swift - Add support for --header-upload and --header-download (Nick Craig-Wood) - Fix cosmetic issue in error message (Martin Michlmayr) * Union - Implement multiple writable remotes (Max Sum) - Fix server-side copy (Max Sum) - Implement ListR (Max Sum) - Enable ListR when upstreams contain local (Max Sum) * WebDAV - Add support for --header-upload and --header-download (Tim Gallant) - Fix X-OC-Mtime header for Transip compatibility (Nick Craig-Wood) - Report full and consistent usage with about (Yves G) * Yandex - Add support for --header-upload and --header-download (Tim Gallant) This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-272=1 Package List: - openSUSE Backports SLE-15-SP2 (ppc64le s390x x86_64): rclone-1.53.3-bp152.2.4.11 - openSUSE Backports SLE-15-SP2 (noarch): rclone-bash-completion-1.53.3-bp152.2.4.11 rclone-zsh-completion-1.53.3-bp152.2.4.11 References: https://www.suse.com/security/cve/CVE-2020-28924.html https://bugzilla.suse.com/1179005

1 0

openSUSE-SU-2021:0270-1: important: Security update for python
by opensuse-security＠opensuse.org 10 Feb '21

10 Feb '21

openSUSE Security Update: Security update for python ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0270-1 Rating: important References: #1176262 #1180686 #1181126 Cross-References: CVE-2019-20916 CVE-2021-3177 CVSS scores: CVE-2019-20916 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2019-20916 (SUSE): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N CVE-2021-3177 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-3177 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for python fixes the following issues: - buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution (bsc#1181126, CVE-2021-3177). - Provide the newest setuptools wheel (bsc#1176262, CVE-2019-20916) in their correct form (bsc#1180686). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-270=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libpython2_7-1_0-2.7.17-lp152.3.12.1 libpython2_7-1_0-debuginfo-2.7.17-lp152.3.12.1 python-2.7.17-lp152.3.12.1 python-base-2.7.17-lp152.3.12.1 python-base-debuginfo-2.7.17-lp152.3.12.1 python-base-debugsource-2.7.17-lp152.3.12.1 python-curses-2.7.17-lp152.3.12.1 python-curses-debuginfo-2.7.17-lp152.3.12.1 python-debuginfo-2.7.17-lp152.3.12.1 python-debugsource-2.7.17-lp152.3.12.1 python-demo-2.7.17-lp152.3.12.1 python-devel-2.7.17-lp152.3.12.1 python-gdbm-2.7.17-lp152.3.12.1 python-gdbm-debuginfo-2.7.17-lp152.3.12.1 python-idle-2.7.17-lp152.3.12.1 python-tk-2.7.17-lp152.3.12.1 python-tk-debuginfo-2.7.17-lp152.3.12.1 python-xml-2.7.17-lp152.3.12.1 python-xml-debuginfo-2.7.17-lp152.3.12.1 - openSUSE Leap 15.2 (noarch): python-doc-2.7.17-lp152.3.12.1 python-doc-pdf-2.7.17-lp152.3.12.1 - openSUSE Leap 15.2 (x86_64): libpython2_7-1_0-32bit-2.7.17-lp152.3.12.1 libpython2_7-1_0-32bit-debuginfo-2.7.17-lp152.3.12.1 python-32bit-2.7.17-lp152.3.12.1 python-32bit-debuginfo-2.7.17-lp152.3.12.1 python-base-32bit-2.7.17-lp152.3.12.1 python-base-32bit-debuginfo-2.7.17-lp152.3.12.1 References: https://www.suse.com/security/cve/CVE-2019-20916.html https://www.suse.com/security/cve/CVE-2021-3177.html https://bugzilla.suse.com/1176262 https://bugzilla.suse.com/1180686 https://bugzilla.suse.com/1181126

1 0

openSUSE-SU-2021:0269-1: important: Security update for java-11-openjdk
by opensuse-security＠opensuse.org 10 Feb '21

10 Feb '21

openSUSE Security Update: Security update for java-11-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0269-1 Rating: important References: #1181239 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for java-11-openjdk fixes the following issues: java-11-openjdk was upgraded to include January 2021 CPU (bsc#1181239) - Enable Sheandoah GC for x86_64 (jsc#ECO-3171) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-269=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): java-11-openjdk-11.0.10.0-lp152.2.9.1 java-11-openjdk-accessibility-11.0.10.0-lp152.2.9.1 java-11-openjdk-accessibility-debuginfo-11.0.10.0-lp152.2.9.1 java-11-openjdk-debuginfo-11.0.10.0-lp152.2.9.1 java-11-openjdk-debugsource-11.0.10.0-lp152.2.9.1 java-11-openjdk-demo-11.0.10.0-lp152.2.9.1 java-11-openjdk-devel-11.0.10.0-lp152.2.9.1 java-11-openjdk-headless-11.0.10.0-lp152.2.9.1 java-11-openjdk-jmods-11.0.10.0-lp152.2.9.1 java-11-openjdk-src-11.0.10.0-lp152.2.9.1 - openSUSE Leap 15.2 (noarch): java-11-openjdk-javadoc-11.0.10.0-lp152.2.9.1 References: https://bugzilla.suse.com/1181239

1 0

openSUSE-SU-2021:0271-1: important: Security update for firejail
by opensuse-security＠opensuse.org 10 Feb '21

10 Feb '21

openSUSE Security Update: Security update for firejail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0271-1 Rating: important References: #1181990 Cross-References: CVE-2020-17367 CVE-2020-17368 CVE-2021-26910 CVSS scores: CVE-2020-17367 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2020-17368 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for firejail fixes the following issues: firejail 0.9.64.4 is shipped to openSUSE Leap 15.2 - CVE-2021-26910: Fixed root privilege escalation due to race condition (boo#1181990) Update to 0.9.64.4: * disabled overlayfs, pending multiple fixes * fixed launch firefox for open url in telegram-desktop.profile Update to 0.9.64.2: * allow --tmpfs inside $HOME for unprivileged users * --disable-usertmpfs compile time option * allow AF_BLUETOOTH via --protocol=bluetooth * setup guide for new users: contrib/firejail-welcome.sh * implement netns in profiles * added nolocal6.net IPv6 network filter * new profiles: spectacle, chromium-browser-privacy, gtk-straw-viewer, gtk-youtube-viewer, gtk2-youtube-viewer, gtk3-youtube-viewer, straw-viewer, lutris, dolphin-emu, authenticator-rs, servo, npm, marker, yarn, lsar, unar, agetpkg, mdr, shotwell, qnapi, new profiles: guvcview, pkglog, kdiff3, CoyIM. Update to version 0.9.64: * replaced --nowrap option with --wrap in firemon * The blocking action of seccomp filters has been changed from killing the process to returning EPERM to the caller. To get the previous behaviour, use --seccomp-error-action=kill or syscall:kill syntax when constructing filters, or override in /etc/firejail/firejail.config file. * Fine-grained D-Bus sandboxing with xdg-dbus-proxy. xdg-dbus-proxy must be installed, if not D-Bus access will be allowed. With this version nodbus is deprecated, in favor of dbus-user none and dbus-system none and will be removed in a future version. * DHCP client support * firecfg only fix dektop-files if started with sudo * SELinux labeling support * custom 32-bit seccomp filter support * restrict ${RUNUSER} in several profiles * blacklist shells such as bash in several profiles * whitelist globbing * mkdir and mkfile support for /run/user directory * support ignore for include * --include on the command line * splitting up media players whitelists in whitelist-players.inc * new condition: HAS_NOSOUND * new profiles: gfeeds, firefox-x11, tvbrowser, rtv, clipgrab, muraster * new profiles: gnome-passwordsafe, bibtex, gummi, latex, mupdf-x11-curl * new profiles: pdflatex, tex, wpp, wpspdf, wps, et, multimc, mupdf-x11 * new profiles: gnome-hexgl, com.github.johnfactotum.Foliate, mupdf-gl, mutool * new profiles: desktopeditors, impressive, planmaker18, planmaker18free * new profiles: presentations18, presentations18free, textmaker18, teams * new profiles: textmaker18free, xournal, gnome-screenshot, ripperX * new profiles: sound-juicer, com.github.dahenson.agenda, gnome-pomodoro * new profiles: gnome-todo, x2goclient, iagno, kmplayer, penguin-command * new profiles: frogatto, gnome-mines, gnome-nibbles, lightsoff, warmux * new profiles: ts3client_runscript.sh, ferdi, abiword, four-in-a-row * new profiles: gnome-mahjongg, gnome-robots, gnome-sudoku, gnome-taquin * new profiles: gnome-tetravex, blobwars, gravity-beams-and-evaporating-stars * new profiles: hyperrogue, jumpnbump-menu, jumpnbump, magicor, mindless * new profiles: mirrormagic, mrrescue, scorched3d-wrapper, scorchwentbonkers * new profiles: seahorse-adventures, wordwarvi, xbill, gnome-klotski * new profiles: swell-foop, fdns, five-or-more, steam-runtime * new profiles: nicotine, plv, mocp, apostrophe, quadrapassel, dino-im * new profiles: hitori, bijiben, gnote, gnubik, ZeGrapher, xonotic-sdl-wrapper * new profiles: gapplication, openarena_ded, element-desktop, cawbird * new profiles: freetube, strawberry, jitsi-meet-desktop * new profiles: homebank, mattermost-desktop, newsflash, com.gitlab.newsflash * new profiles: sushi, xfce4-screenshooter, org.gnome.NautilusPreviewer, lyx * new profiles: minitube, nuclear, mtpaint, minecraft-launcher, gnome-calendar * new profiles: vmware, git-cola, otter-browser, kazam, menulibre, musictube * new profiles: onboard, fractal, mirage, quaternion, spectral, man, psi * new profiles: smuxi-frontend-gnome, balsa, kube, trojita, youtube * new profiles: youtubemusic-nativefier, cola, dbus-send, notify-send * new profiles: qrencode, ytmdesktop, twitch * new profiles: xournalpp, chromium-freeworld, equalx - Make the AppArmor profile compatible with AppArmor 3.0 (add missing include <tunables/global>) Update to 0.9.62.4 * fix AppArmor broken in the previous release * miscellaneous fixes Update to 0.9.62.2 * fix CVE-2020-17367 * fix CVE-2020-17368 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-271=1 Package List: - openSUSE Leap 15.2 (x86_64): firejail-0.9.64.4-lp152.3.6.1 firejail-debuginfo-0.9.64.4-lp152.3.6.1 firejail-debugsource-0.9.64.4-lp152.3.6.1 References: https://www.suse.com/security/cve/CVE-2020-17367.html https://www.suse.com/security/cve/CVE-2020-17368.html https://www.suse.com/security/cve/CVE-2021-26910.html https://bugzilla.suse.com/1181990

1 0

openSUSE-SU-2021:0268-1: important: Security update for chromium
by opensuse-security＠opensuse.org 10 Feb '21

10 Feb '21

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0268-1 Rating: important References: #1181772 Cross-References: CVE-2021-21142 CVE-2021-21143 CVE-2021-21144 CVE-2021-21145 CVE-2021-21146 CVE-2021-21147 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for chromium fixes the following issues: - Update to 88.0.4324.146 boo#1181772 - CVE-2021-21142: Use after free in Payments - CVE-2021-21143: Heap buffer overflow in Extensions - CVE-2021-21144: Heap buffer overflow in Tab Groups. - CVE-2021-21145: Use after free in Fonts - CVE-2021-21146: Use after free in Navigation. - CVE-2021-21147: Inappropriate implementation in Skia This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-268=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 x86_64): chromedriver-88.0.4324.146-bp152.2.56.5 chromium-88.0.4324.146-bp152.2.56.5 References: https://www.suse.com/security/cve/CVE-2021-21142.html https://www.suse.com/security/cve/CVE-2021-21143.html https://www.suse.com/security/cve/CVE-2021-21144.html https://www.suse.com/security/cve/CVE-2021-21145.html https://www.suse.com/security/cve/CVE-2021-21146.html https://www.suse.com/security/cve/CVE-2021-21147.html https://bugzilla.suse.com/1181772

1 0

openSUSE-SU-2021:0267-1: important: Security update for chromium
by opensuse-security＠opensuse.org 09 Feb '21

09 Feb '21

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0267-1 Rating: important References: #1181827 Cross-References: CVE-2021-21148 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for chromium fixes the following issues: Update to 88.0.4324.150 boo#1181827 - CVE-2021-21148: Heap buffer overflow in V8 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-267=1 Package List: - openSUSE Leap 15.2 (x86_64): chromedriver-88.0.4324.150-lp152.2.72.1 chromedriver-debuginfo-88.0.4324.150-lp152.2.72.1 chromium-88.0.4324.150-lp152.2.72.1 chromium-debuginfo-88.0.4324.150-lp152.2.72.1 References: https://www.suse.com/security/cve/CVE-2021-21148.html https://bugzilla.suse.com/1181827

1 0

openSUSE-RU-2021:0266-1: moderate: Recommended update for openafs
by maintenance＠opensuse.org 09 Feb '21

09 Feb '21

openSUSE Recommended Update: Recommended update for openafs ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0266-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for openafs fixes the following issues: update to official 1.8.7 * fix critical bug described in https://lists.openafs.org/pipermail/openafs-info/2021-January/043026.html - add firewalld-configuration files Update to official 1.8.6. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-266=1 Package List: - openSUSE Leap 15.2 (x86_64): openafs-1.8.7-lp152.2.7.1 openafs-authlibs-1.8.7-lp152.2.7.1 openafs-authlibs-debuginfo-1.8.7-lp152.2.7.1 openafs-authlibs-devel-1.8.7-lp152.2.7.1 openafs-client-1.8.7-lp152.2.7.1 openafs-client-debuginfo-1.8.7-lp152.2.7.1 openafs-debuginfo-1.8.7-lp152.2.7.1 openafs-debugsource-1.8.7-lp152.2.7.1 openafs-devel-1.8.7-lp152.2.7.1 openafs-devel-debuginfo-1.8.7-lp152.2.7.1 openafs-fuse_client-1.8.7-lp152.2.7.1 openafs-fuse_client-debuginfo-1.8.7-lp152.2.7.1 openafs-kernel-source-1.8.7-lp152.2.7.1 openafs-kmp-default-1.8.7_k5.3.18_lp152.63-lp152.2.7.1 openafs-kmp-default-debuginfo-1.8.7_k5.3.18_lp152.63-lp152.2.7.1 openafs-kmp-preempt-1.8.7_k5.3.18_lp152.63-lp152.2.7.1 openafs-kmp-preempt-debuginfo-1.8.7_k5.3.18_lp152.63-lp152.2.7.1 openafs-server-1.8.7-lp152.2.7.1 openafs-server-debuginfo-1.8.7-lp152.2.7.1 References:

1 0

openSUSE-RU-2021:0264-1: moderate: Recommended update for lxd
by maintenance＠opensuse.org 08 Feb '21

08 Feb '21

openSUSE Recommended Update: Recommended update for lxd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0264-1 Rating: moderate References: #1181825 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for lxd fixes the following issues: Update to LXD 4.11. (boo#1181825) The full upstream changelog is available from: https://discuss.linuxcontainers.org/t/lxd-4-11-has-been-released/10135 + Bulk instance state change API + GVRP support for dynamic vlan configuration + Server-side instance storage pool migration + Volume usage API + VM: SR-IOV GPU Support + VM: PCI Device Type + VM: ISO images now exposed as cdrom Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-264=1 Package List: - openSUSE Leap 15.2 (x86_64): lxd-4.11-lp152.2.24.1 - openSUSE Leap 15.2 (noarch): lxd-bash-completion-4.11-lp152.2.24.1 References: https://bugzilla.suse.com/1181825

1 0

openSUSE-RU-2021:0263-1: moderate: Recommended update for salt
by maintenance＠opensuse.org 08 Feb '21

08 Feb '21

openSUSE Recommended Update: Recommended update for salt ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0263-1 Rating: moderate References: #1083110 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for salt fixes the following issues: - Revert wrong zypper patch to support `vendorchanges` flags on `pkg.install` - Adjusted `python2-cherrypy` naming in `salt-api`. - Force `zyppnotify` to prefer `Packages.db` than `Packages` if it exists - Allow vendor change option with zypper - Add `pkg.services_need_restart` - Bigvm backports - virt consoles, CPU tuning and topology, and memory tuning. - Fix for `file.check_perms` to work with numeric `uid/gid` - change `Requires(pre)` to `Requires` for `salt-minion` package (bsc#1083110) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-263=1 Package List: - openSUSE Leap 15.2 (x86_64): python2-salt-3000-lp152.3.24.1 python3-salt-3000-lp152.3.24.1 salt-3000-lp152.3.24.1 salt-api-3000-lp152.3.24.1 salt-cloud-3000-lp152.3.24.1 salt-doc-3000-lp152.3.24.1 salt-master-3000-lp152.3.24.1 salt-minion-3000-lp152.3.24.1 salt-proxy-3000-lp152.3.24.1 salt-ssh-3000-lp152.3.24.1 salt-standalone-formulas-configuration-3000-lp152.3.24.1 salt-syndic-3000-lp152.3.24.1 - openSUSE Leap 15.2 (noarch): salt-bash-completion-3000-lp152.3.24.1 salt-fish-completion-3000-lp152.3.24.1 salt-zsh-completion-3000-lp152.3.24.1 References: https://bugzilla.suse.com/1083110

1 0

openSUSE-SU-2021:0265-1: moderate: Security update for privoxy
by opensuse-security＠opensuse.org 08 Feb '21

08 Feb '21

openSUSE Security Update: Security update for privoxy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0265-1 Rating: moderate References: #1181650 Cross-References: CVE-2021-20216 CVE-2021-20217 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for privoxy fixes the following issues: - Update to version 3.0.31: - Security/Reliability (boo#1181650) - Prevent an assertion from getting triggered by a crafted CGI request. Commit 5bba5b89193fa. OVE-20210130-0001. CVE-2021-20217 Reported by: Joshua Rogers (Opera) - Fixed a memory leak when decompression fails "unexpectedly". Commit f431d61740cc0. OVE-20210128-0001. CVE-2021-20216 - Bug fixes: - Fixed detection of insufficient data for decompression. Previously Privoxy could try to decompress a partly uninitialized buffer. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-265=1 Package List: - openSUSE Leap 15.2 (x86_64): privoxy-3.0.31-lp152.3.6.1 privoxy-debuginfo-3.0.31-lp152.3.6.1 privoxy-debugsource-3.0.31-lp152.3.6.1 - openSUSE Leap 15.2 (noarch): privoxy-doc-3.0.31-lp152.3.6.1 References: https://www.suse.com/security/cve/CVE-2021-20216.html https://www.suse.com/security/cve/CVE-2021-20217.html https://bugzilla.suse.com/1181650

1 0