July 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2021:1088-1: moderate: Security update for curl
by opensuse-security＠opensuse.org 24 Jul '21

24 Jul '21

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1088-1 Rating: moderate References: #1188217 #1188218 #1188219 #1188220 Cross-References: CVE-2021-22922 CVE-2021-22923 CVE-2021-22924 CVE-2021-22925 CVSS scores: CVE-2021-22922 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVE-2021-22923 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2021-22924 (SUSE): 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVE-2021-22925 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for curl fixes the following issues: - CVE-2021-22925: TELNET stack contents disclosure again. (bsc#1188220) - CVE-2021-22924: Bad connection reuse due to flawed path name checks. (bsc#1188219) - CVE-2021-22923: Insufficiently Protected Credentials. (bsc#1188218) - CVE-2021-22922: Wrong content via metalink not discarded. (bsc#1188217) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1088=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): curl-7.66.0-lp152.3.21.1 curl-debuginfo-7.66.0-lp152.3.21.1 curl-debugsource-7.66.0-lp152.3.21.1 curl-mini-7.66.0-lp152.3.21.1 curl-mini-debuginfo-7.66.0-lp152.3.21.1 curl-mini-debugsource-7.66.0-lp152.3.21.1 libcurl-devel-7.66.0-lp152.3.21.1 libcurl-mini-devel-7.66.0-lp152.3.21.1 libcurl4-7.66.0-lp152.3.21.1 libcurl4-debuginfo-7.66.0-lp152.3.21.1 libcurl4-mini-7.66.0-lp152.3.21.1 libcurl4-mini-debuginfo-7.66.0-lp152.3.21.1 - openSUSE Leap 15.2 (x86_64): libcurl-devel-32bit-7.66.0-lp152.3.21.1 libcurl4-32bit-7.66.0-lp152.3.21.1 libcurl4-32bit-debuginfo-7.66.0-lp152.3.21.1 References: https://www.suse.com/security/cve/CVE-2021-22922.html https://www.suse.com/security/cve/CVE-2021-22923.html https://www.suse.com/security/cve/CVE-2021-22924.html https://www.suse.com/security/cve/CVE-2021-22925.html https://bugzilla.suse.com/1188217 https://bugzilla.suse.com/1188218 https://bugzilla.suse.com/1188219 https://bugzilla.suse.com/1188220

1 0

openSUSE-RU-2021:1083-1: moderate: Recommended update for fossil
by maintenance＠opensuse.org 24 Jul '21

24 Jul '21

openSUSE Recommended Update: Recommended update for fossil ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1083-1 Rating: moderate References: #1187988 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for fossil fixes the following issues: fossil 2.16: * Add the fossil patch command * Improve the fossil ui command to work on check-out directories and remote machines * web UI improvements * Add fossil bisect run command for improved automation of bisects * Improve fossil merge handling of renames * wiki now defaults to markdown * email alerts can now be set to expire to prevent sending mail to abandoned accounts forever fossil 2.15.2: * Fix the client-side TLS so that it verifies that the server hostname matches its certificate (boo#1187988) fossil 2.15.1: * fix access to tables starting "fx_" in ticket report fossil 2.15: * Relax default Content Security policy to allow images to be loaded from any URL * Updates to skins and their configuration options * Built-in skin can now be selected via the skin= request parameter and the /skins page. * /cookies page can now now delete individual cookies * Various extensions to diff displaz and operations * Add the --list option to the tarball, zip, and sqlar commands. * New TH1 commands: "builtin_request_js", "capexpr", "foreach", "lappend", and "string match" * The leaves command now shows the branch point of each leaf. * The fossil add command refuses to add files whose names are reserved by Windows (ex: "aux") unless the --allow-reserved option is included. fossil 2.14 * add fossil chat * enhanced fossil clone * performance optimization * enhanced documents * Pikchr improvements * Schema Update Notice #1: This release drops a trigger from the database schema * Schema Update Notice #2: This release changes how the descriptions of wiki edits are stored in the EVENT table, for improved display on timelines fossil 2.13: * wiki improvements: interwiki links, markup features * support for rendering pikchr markup scriptions * line number modes support interactive selection of range of lines to hyperlink to * Enhance finfo page to track a file across renames This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1083=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): fossil-2.16-bp152.2.12.1 References: https://bugzilla.suse.com/1187988

1 0

openSUSE-RU-2021:1085-1: moderate: Recommended update for go
by maintenance＠opensuse.org 24 Jul '21

24 Jul '21

openSUSE Recommended Update: Recommended update for go ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1085-1 Rating: moderate References: #1182345 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for go fixes the following issues: - Update to current stable go1.16 (bsc#1182345) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1085=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 ppc64le s390x x86_64): go-1.16-bp153.3.3.1 go-doc-1.16-bp153.3.3.1 - openSUSE Backports SLE-15-SP3 (aarch64 x86_64): go-race-1.16-bp153.3.3.1 References: https://bugzilla.suse.com/1182345

1 0

openSUSE-RU-2021:1084-1: Recommended update for mstflint
by maintenance＠opensuse.org 24 Jul '21

24 Jul '21

openSUSE Recommended Update: Recommended update for mstflint ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1084-1 Rating: low References: #1184124 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for mstflint fixes the following issues: - Link as position independent executables. (bsc#1184124) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1084=1 Package List: - openSUSE Leap 15.2 (x86_64): mstflint-4.13.3-lp152.2.3.1 mstflint-debuginfo-4.13.3-lp152.2.3.1 mstflint-debugsource-4.13.3-lp152.2.3.1 References: https://bugzilla.suse.com/1184124

1 0

openSUSE-SU-2021:1082-1: moderate: Security update for systemd
by opensuse-security＠opensuse.org 24 Jul '21

24 Jul '21

openSUSE Security Update: Security update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1082-1 Rating: moderate References: #1184994 #1188063 Cross-References: CVE-2021-33910 CVSS scores: CVE-2021-33910 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for systemd fixes the following issues: - CVE-2021-33910: Fixed a denial of service in systemd via unit_name_path_escape() (bsc#1188063) - Skip udev rules if 'elevator=' is used (bsc#1184994) This update was imported from the SUSE:SLE-15:Update update project. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1082=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libsystemd0-234-lp152.31.31.1 libsystemd0-debuginfo-234-lp152.31.31.1 libsystemd0-mini-234-lp152.31.31.1 libsystemd0-mini-debuginfo-234-lp152.31.31.1 libudev-devel-234-lp152.31.31.1 libudev-mini-devel-234-lp152.31.31.1 libudev-mini1-234-lp152.31.31.1 libudev-mini1-debuginfo-234-lp152.31.31.1 libudev1-234-lp152.31.31.1 libudev1-debuginfo-234-lp152.31.31.1 nss-myhostname-234-lp152.31.31.1 nss-myhostname-debuginfo-234-lp152.31.31.1 nss-mymachines-234-lp152.31.31.1 nss-mymachines-debuginfo-234-lp152.31.31.1 nss-systemd-234-lp152.31.31.1 nss-systemd-debuginfo-234-lp152.31.31.1 systemd-234-lp152.31.31.1 systemd-container-234-lp152.31.31.1 systemd-container-debuginfo-234-lp152.31.31.1 systemd-coredump-234-lp152.31.31.1 systemd-coredump-debuginfo-234-lp152.31.31.1 systemd-debuginfo-234-lp152.31.31.1 systemd-debugsource-234-lp152.31.31.1 systemd-devel-234-lp152.31.31.1 systemd-journal-remote-234-lp152.31.31.1 systemd-journal-remote-debuginfo-234-lp152.31.31.1 systemd-logger-234-lp152.31.31.1 systemd-mini-234-lp152.31.31.1 systemd-mini-container-mini-234-lp152.31.31.1 systemd-mini-container-mini-debuginfo-234-lp152.31.31.1 systemd-mini-coredump-mini-234-lp152.31.31.1 systemd-mini-coredump-mini-debuginfo-234-lp152.31.31.1 systemd-mini-debuginfo-234-lp152.31.31.1 systemd-mini-debugsource-234-lp152.31.31.1 systemd-mini-devel-234-lp152.31.31.1 systemd-mini-sysvinit-234-lp152.31.31.1 systemd-network-234-lp152.31.31.1 systemd-network-debuginfo-234-lp152.31.31.1 systemd-sysvinit-234-lp152.31.31.1 udev-234-lp152.31.31.1 udev-debuginfo-234-lp152.31.31.1 udev-mini-234-lp152.31.31.1 udev-mini-debuginfo-234-lp152.31.31.1 - openSUSE Leap 15.2 (noarch): systemd-bash-completion-234-lp152.31.31.1 systemd-mini-bash-completion-234-lp152.31.31.1 - openSUSE Leap 15.2 (x86_64): libsystemd0-32bit-234-lp152.31.31.1 libsystemd0-32bit-debuginfo-234-lp152.31.31.1 libudev-devel-32bit-234-lp152.31.31.1 libudev1-32bit-234-lp152.31.31.1 libudev1-32bit-debuginfo-234-lp152.31.31.1 nss-myhostname-32bit-234-lp152.31.31.1 nss-myhostname-32bit-debuginfo-234-lp152.31.31.1 nss-mymachines-32bit-234-lp152.31.31.1 nss-mymachines-32bit-debuginfo-234-lp152.31.31.1 systemd-32bit-234-lp152.31.31.1 systemd-32bit-debuginfo-234-lp152.31.31.1 References: https://www.suse.com/security/cve/CVE-2021-33910.html https://bugzilla.suse.com/1184994 https://bugzilla.suse.com/1188063

1 0

openSUSE-SU-2021:1081-1: moderate: Security update for containerd
by opensuse-security＠opensuse.org 23 Jul '21

23 Jul '21

openSUSE Security Update: Security update for containerd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1081-1 Rating: moderate References: #1188282 Cross-References: CVE-2021-32760 CVSS scores: CVE-2021-32760 (SUSE): 3 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for containerd fixes the following issues: - CVE-2021-32760: Fixed a bug which allows untrusted container images to change permissions in the host's filesystem. (bsc#1188282) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1081=1 Package List: - openSUSE Leap 15.2 (x86_64): containerd-1.4.4-lp152.2.9.1 containerd-ctr-1.4.4-lp152.2.9.1 References: https://www.suse.com/security/cve/CVE-2021-32760.html https://bugzilla.suse.com/1188282

1 0

openSUSE-RU-2021:2463-1: moderate: Recommended update for python-pyzmq
by maintenance＠opensuse.org 23 Jul '21

23 Jul '21

openSUSE Recommended Update: Recommended update for python-pyzmq ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:2463-1 Rating: moderate References: #1186945 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-pyzmq fixes the following issues: - Update to version 17.1.2 (bsc#1186945) * Fix possible hang when working with asyncio * Remove some outdated workarounds for old Cython versions * Fix some compilation with custom compilers * Remove unneeded link of libstdc++ on PyPy Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2463=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): python-pyzmq-debuginfo-17.1.2-3.3.1 python-pyzmq-debugsource-17.1.2-3.3.1 python2-pyzmq-17.1.2-3.3.1 python2-pyzmq-debuginfo-17.1.2-3.3.1 python2-pyzmq-devel-17.1.2-3.3.1 python3-pyzmq-17.1.2-3.3.1 python3-pyzmq-debuginfo-17.1.2-3.3.1 python3-pyzmq-devel-17.1.2-3.3.1 References: https://bugzilla.suse.com/1186945

1 0

openSUSE-RU-2021:2464-1: moderate: Recommended update for shim
by maintenance＠opensuse.org 23 Jul '21

23 Jul '21

openSUSE Recommended Update: Recommended update for shim ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:2464-1 Rating: moderate References: #1185232 #1185261 #1185441 #1185464 #1185961 #1187071 #1187260 #1187696 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has 8 recommended fixes can now be installed. Description: This update for shim fixes the following issues: - shim-install: Always assume "removable" for Azure to avoid the endless reset loop (bsc#1185464) - Avoid deleting the mirrored RT variables (bsc#1187696) - Split the keys in vendor-dbx.bin to vendor-dbx-sles and vendor-dbx-opensuse for shim-sles and shim-opensuse to reduce the size of MokListXRT (bsc#1185261) + Also update generate-vendor-dbx.sh in dbx-cert.tar.xz - Handle ignore_db and user_insecure_mode correctly (bsc#1185441, bsc#1187071) - Relax the maximum variable size check for u-boot (bsc#1185621) - Relax the check for import_mok_state() when Secure Boot is off. (bsc#1185261) - Ignore the odd LoadOptions length (bsc#1185232) - shim-install: reset def_shim_efi to "shim.efi" if the given file doesn't exist - Fided the size of rela sections for AArch64 - Disable exporting vendor-dbx to MokListXRT since writing a large RT variable could crash some machines (bsc#1185261) - Avoid potential crash when calling QueryVariableInfo in EFI 1.10 machines (bsc#1187260) - Avoid buffer overflow when copying data to the MOK config table (bsc#1185232) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2464=1 Package List: - openSUSE Leap 15.3 (aarch64 x86_64): shim-15.4-4.7.1 shim-debuginfo-15.4-4.7.1 shim-debugsource-15.4-4.7.1 References: https://bugzilla.suse.com/1185232 https://bugzilla.suse.com/1185261 https://bugzilla.suse.com/1185441 https://bugzilla.suse.com/1185464 https://bugzilla.suse.com/1185961 https://bugzilla.suse.com/1187071 https://bugzilla.suse.com/1187260 https://bugzilla.suse.com/1187696

1 0

openSUSE-RU-2021:1080-1: moderate: Recommended update for cloud-init
by maintenance＠opensuse.org 23 Jul '21

23 Jul '21

openSUSE Recommended Update: Recommended update for cloud-init ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1080-1 Rating: moderate References: #1183939 #1184758 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for cloud-init contains the following: - Change log file creation mode to 640. (bsc#1183939) - Do not write the generated password to the log file. (bsc#1184758) - Allow purging cache when Python when version change detected. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1080=1 Package List: - openSUSE Leap 15.2 (x86_64): cloud-init-20.2-lp152.5.24.1 cloud-init-config-suse-20.2-lp152.5.24.1 cloud-init-doc-20.2-lp152.5.24.1 References: https://bugzilla.suse.com/1183939 https://bugzilla.suse.com/1184758

1 0

openSUSE-SU-2021:1079-1: moderate: Security update for go1.15
by opensuse-security＠opensuse.org 22 Jul '21

22 Jul '21

openSUSE Security Update: Security update for go1.15 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1079-1 Rating: moderate References: #1175132 #1188229 Cross-References: CVE-2021-34558 CVSS scores: CVE-2021-34558 (SUSE): 5.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for go1.15 fixes the following issues: - go1.15.14 (released 2021-07-12) includes a security fix to the crypto/tls package, as well as bug fixes to the linker, and the net package. CVE-2021-34558 Refs bsc#1175132 go1.15 release tracking * bsc#1188229 go#47143 CVE-2021-34558 * go#47144 security: fix CVE-2021-34558 * go#47012 net: LookupMX behaviour broken * go#46994 net: TestCVE202133195 fails if /etc/resolv.conf specifies ndots larger than 3 * go#46768 syscall: TestGroupCleanupUserNamespace test failure on Fedora * go#46684 x/build/cmd/release: linux-armv6l release tests aren't passing * go#46656 runtime: deeply nested struct initialized with non-zero values - Fix extraneous trailing percent character %endif% in spec file. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1079=1 Package List: - openSUSE Leap 15.2 (x86_64): go1.15-1.15.14-lp152.23.1 go1.15-doc-1.15.14-lp152.23.1 go1.15-race-1.15.14-lp152.23.1 References: https://www.suse.com/security/cve/CVE-2021-34558.html https://bugzilla.suse.com/1175132 https://bugzilla.suse.com/1188229

1 0