June 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2021:0907-1: important: Security update for cryptctl
by opensuse-security＠opensuse.org 24 Jun '21

24 Jun '21

openSUSE Security Update: Security update for cryptctl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0907-1 Rating: important References: #1186226 Cross-References: CVE-2019-18906 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cryptctl fixes the following issues: Update to version 2.4: - CVE-2019-18906: Client side password hashing was equivalent to clear text password storage (bsc#1186226) - First step to use plain text password instead of hashed password. - Move repository into the SUSE github organization - in RPC server, if client comes from localhost, remember its ipv4 localhost address instead of ipv6 address - tell a record to clear expired pending commands upon saving a command result; introduce pending commands RPC test case - avoid hard coding 127.0.0.1 in host ID of alive message test; let system administrator mount and unmount disks by issuing these two commands on key server. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-907=1 Package List: - openSUSE Leap 15.2 (x86_64): cryptctl-2.4-lp152.5.3.1 cryptctl-debuginfo-2.4-lp152.5.3.1 References: https://www.suse.com/security/cve/CVE-2019-18906.html https://bugzilla.suse.com/1186226

1 0

openSUSE-SU-2021:0906-1: important: Security update for libnettle
by opensuse-security＠opensuse.org 24 Jun '21

24 Jun '21

openSUSE Security Update: Security update for libnettle ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0906-1 Rating: important References: #1187060 Cross-References: CVE-2021-3580 CVSS scores: CVE-2021-3580 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libnettle fixes the following issues: - CVE-2021-3580: Fixed a remote denial of service in the RSA decryption via manipulated ciphertext (bsc#1187060). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-906=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libhogweed4-3.4.1-lp152.4.6.1 libhogweed4-debuginfo-3.4.1-lp152.4.6.1 libnettle-debugsource-3.4.1-lp152.4.6.1 libnettle-devel-3.4.1-lp152.4.6.1 libnettle6-3.4.1-lp152.4.6.1 libnettle6-debuginfo-3.4.1-lp152.4.6.1 nettle-3.4.1-lp152.4.6.1 nettle-debuginfo-3.4.1-lp152.4.6.1 - openSUSE Leap 15.2 (x86_64): libhogweed4-32bit-3.4.1-lp152.4.6.1 libhogweed4-32bit-debuginfo-3.4.1-lp152.4.6.1 libnettle-devel-32bit-3.4.1-lp152.4.6.1 libnettle6-32bit-3.4.1-lp152.4.6.1 libnettle6-32bit-debuginfo-3.4.1-lp152.4.6.1 References: https://www.suse.com/security/cve/CVE-2021-3580.html https://bugzilla.suse.com/1187060

1 0

openSUSE-SU-2021:0911-1: important: Security update for xstream
by opensuse-security＠opensuse.org 24 Jun '21

24 Jun '21

openSUSE Security Update: Security update for xstream ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0911-1 Rating: important References: #1186651 Cross-References: CVE-2021-29505 CVSS scores: CVE-2021-29505 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-29505 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for xstream fixes the following issues: Upgrade to 1.4.17 - CVE-2021-29505: Fixed potential code execution when unmarshalling with XStream instances using an uninitialized security framework (bsc#1186651) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-911=1 Package List: - openSUSE Leap 15.2 (noarch): xstream-1.4.17-lp152.2.9.1 xstream-benchmark-1.4.17-lp152.2.9.1 xstream-javadoc-1.4.17-lp152.2.9.1 xstream-parent-1.4.17-lp152.2.9.1 References: https://www.suse.com/security/cve/CVE-2021-29505.html https://bugzilla.suse.com/1186651

1 0

openSUSE-SU-2021:0908-1: important: Security update for apache2
by opensuse-security＠opensuse.org 24 Jun '21

24 Jun '21

openSUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0908-1 Rating: important References: #1186922 #1186923 #1186924 #1187017 #1187040 #1187174 Cross-References: CVE-2020-13950 CVE-2020-35452 CVE-2021-26690 CVE-2021-26691 CVE-2021-30641 CVE-2021-31618 CVSS scores: CVE-2020-13950 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-13950 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2020-35452 (NVD) : 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVE-2020-35452 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-26690 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-26690 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-26691 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-30641 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2021-30641 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2021-31618 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for apache2 fixes the following issues: - fixed CVE-2021-30641 [bsc#1187174]: MergeSlashes regression - fixed CVE-2021-31618 [bsc#1186924]: NULL pointer dereference on specially crafted HTTP/2 request - fixed CVE-2020-13950 [bsc#1187040]: mod_proxy NULL pointer dereference - fixed CVE-2020-35452 [bsc#1186922]: Single zero byte stack overflow in mod_auth_digest - fixed CVE-2021-26690 [bsc#1186923]: mod_session NULL pointer dereference in parser - fixed CVE-2021-26691 [bsc#1187017]: Heap overflow in mod_session Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-908=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): apache2-2.4.43-lp152.2.15.1 apache2-debuginfo-2.4.43-lp152.2.15.1 apache2-debugsource-2.4.43-lp152.2.15.1 apache2-devel-2.4.43-lp152.2.15.1 apache2-event-2.4.43-lp152.2.15.1 apache2-event-debuginfo-2.4.43-lp152.2.15.1 apache2-example-pages-2.4.43-lp152.2.15.1 apache2-prefork-2.4.43-lp152.2.15.1 apache2-prefork-debuginfo-2.4.43-lp152.2.15.1 apache2-utils-2.4.43-lp152.2.15.1 apache2-utils-debuginfo-2.4.43-lp152.2.15.1 apache2-worker-2.4.43-lp152.2.15.1 apache2-worker-debuginfo-2.4.43-lp152.2.15.1 - openSUSE Leap 15.2 (noarch): apache2-doc-2.4.43-lp152.2.15.1 References: https://www.suse.com/security/cve/CVE-2020-13950.html https://www.suse.com/security/cve/CVE-2020-35452.html https://www.suse.com/security/cve/CVE-2021-26690.html https://www.suse.com/security/cve/CVE-2021-26691.html https://www.suse.com/security/cve/CVE-2021-30641.html https://www.suse.com/security/cve/CVE-2021-31618.html https://bugzilla.suse.com/1186922 https://bugzilla.suse.com/1186923 https://bugzilla.suse.com/1186924 https://bugzilla.suse.com/1187017 https://bugzilla.suse.com/1187040 https://bugzilla.suse.com/1187174

1 0

openSUSE-RU-2021:0912-1: moderate: Recommended update for postgresql
by maintenance＠opensuse.org 24 Jun '21

24 Jun '21

openSUSE Recommended Update: Recommended update for postgresql ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0912-1 Rating: moderate References: #1183118 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for postgresql fixes the following issues: - Re-enable build of the 'llvmjit' subpackage on SLE. (bsc#1183118) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-912=1 Package List: - openSUSE Leap 15.2 (noarch): postgresql-13-lp152.3.9.1 postgresql-contrib-13-lp152.3.9.1 postgresql-devel-13-lp152.3.9.1 postgresql-docs-13-lp152.3.9.1 postgresql-llvmjit-13-lp152.3.9.1 postgresql-plperl-13-lp152.3.9.1 postgresql-plpython-13-lp152.3.9.1 postgresql-pltcl-13-lp152.3.9.1 postgresql-server-13-lp152.3.9.1 postgresql-server-devel-13-lp152.3.9.1 postgresql-test-13-lp152.3.9.1 References: https://bugzilla.suse.com/1183118

1 0

openSUSE-RU-2021:0902-1: moderate: Recommended update for chromium
by maintenance＠opensuse.org 23 Jun '21

23 Jun '21

openSUSE Recommended Update: Recommended update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0902-1 Rating: moderate References: #1186948 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for chromium fixes the following issues: - fix crash upon exit (boo#1186948) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-902=1 Package List: - openSUSE Leap 15.2 (x86_64): chromedriver-91.0.4472.114-lp152.2.110.1 chromedriver-debuginfo-91.0.4472.114-lp152.2.110.1 chromium-91.0.4472.114-lp152.2.110.1 chromium-debuginfo-91.0.4472.114-lp152.2.110.1 References: https://bugzilla.suse.com/1186948

1 0

openSUSE-SU-2021:0901-1: important: Security update for python-rsa
by opensuse-security＠opensuse.org 23 Jun '21

23 Jun '21

openSUSE Security Update: Security update for python-rsa ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0901-1 Rating: important References: #1172389 Cross-References: CVE-2020-13757 CVSS scores: CVE-2020-13757 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2020-13757 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-rsa fixes the following issues: - CVE-2020-13757: Proper handling of leading '\0' bytes during decryption of ciphertext (bsc#1172389) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-901=1 Package List: - openSUSE Leap 15.2 (noarch): python2-rsa-3.4.2-lp152.4.3.1 python3-rsa-3.4.2-lp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2020-13757.html https://bugzilla.suse.com/1172389

1 0

openSUSE-RU-2021:0903-1: moderate: Recommended update for autoyast2
by maintenance＠opensuse.org 23 Jun '21

23 Jun '21

openSUSE Recommended Update: Recommended update for autoyast2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0903-1 Rating: moderate References: #1176965 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for autoyast2 fixes the following issues: - AutoYaST does no longer try to register the system if it is explicitly disabled in its profile (bsc#1176965) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-903=1 Package List: - openSUSE Leap 15.2 (noarch): autoyast2-4.2.51-lp152.2.12.1 autoyast2-installation-4.2.51-lp152.2.12.1 References: https://bugzilla.suse.com/1176965

1 0

openSUSE-SU-2021:0904-1: moderate: Security update for go1.15
by opensuse-security＠opensuse.org 23 Jun '21

23 Jun '21

openSUSE Security Update: Security update for go1.15 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0904-1 Rating: moderate References: #1175132 #1185790 Cross-References: CVE-2021-31525 CVSS scores: CVE-2021-31525 (NVD) : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-31525 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for go1.15 fixes the following issues: - Updated go to upstream version 1.15.12 (released 2021-05-06) (bsc#1175132). - CVE-2021-31525: Fixed stack overflow via net/http ReadRequest (bsc#1185790). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-904=1 Package List: - openSUSE Leap 15.2 (x86_64): go1.15-1.15.12-lp152.17.1 go1.15-doc-1.15.12-lp152.17.1 go1.15-race-1.15.12-lp152.17.1 References: https://www.suse.com/security/cve/CVE-2021-31525.html https://bugzilla.suse.com/1175132 https://bugzilla.suse.com/1185790

1 0

openSUSE-SU-2021:0900-1: important: Security update for xterm
by opensuse-security＠opensuse.org 23 Jun '21

23 Jun '21

openSUSE Security Update: Security update for xterm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0900-1 Rating: important References: #1182091 Cross-References: CVE-2021-27135 CVSS scores: CVE-2021-27135 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-27135 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for xterm fixes the following issues: - CVE-2021-27135: Fixed buffer-overflow when clicking on selected utf8 text. (bsc#1182091) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-900=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): xterm-330-lp152.6.3.1 xterm-bin-330-lp152.6.3.1 xterm-bin-debuginfo-330-lp152.6.3.1 xterm-debugsource-330-lp152.6.3.1 References: https://www.suse.com/security/cve/CVE-2021-27135.html https://bugzilla.suse.com/1182091

1 0