August 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2021:1210-1: moderate: Recommended update for rust
by maintenance＠opensuse.org 30 Aug '21

30 Aug '21

openSUSE Recommended Update: Recommended update for rust ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1210-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for rust fixes the following issues: - Updated rust to be able to build Firefox ESR91 (bsc#1188891) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1210=1 Package List: - openSUSE Leap 15.2 (x86_64): cargo-1.53.0-lp152.3.11.1 cargo-debuginfo-1.53.0-lp152.3.11.1 cmake-gui-3.17.0-lp152.2.1 cmake-gui-debuginfo-3.17.0-lp152.2.1 cmake-man-3.17.0-lp152.2.1 cmake3-3.17.0-lp152.2.1 cmake3-full-3.17.0-lp152.2.1 cmake3-full-debuginfo-3.17.0-lp152.2.1 cmake3-full-debugsource-3.17.0-lp152.2.1 cmake3-mini-3.17.0-lp152.2.1 cmake3-mini-debuginfo-3.17.0-lp152.2.1 cmake3-mini-debugsource-3.17.0-lp152.2.1 cmake3-ui-debugsource-3.17.0-lp152.2.1 rls-1.53.0-lp152.3.11.1 rls-debuginfo-1.53.0-lp152.3.11.1 rust-1.53.0-lp152.3.11.1 rust-analysis-1.53.0-lp152.3.11.1 rust-debuginfo-1.53.0-lp152.3.11.1 rust-doc-1.53.0-lp152.3.11.1 rust-gdb-1.53.0-lp152.3.11.1 - openSUSE Leap 15.2 (noarch): cargo-doc-1.53.0-lp152.3.11.1 rust-src-1.53.0-lp152.3.11.1 References:

1 0

openSUSE-SU-2021:1209-1: important: Security update for opera
by opensuse-security＠opensuse.org 30 Aug '21

30 Aug '21

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1209-1 Rating: important References: Cross-References: CVE-2021-30590 CVE-2021-30591 CVE-2021-30592 CVE-2021-30593 CVE-2021-30594 CVE-2021-30596 CVE-2021-30597 Affected Products: openSUSE Leap 15.3:NonFree openSUSE Leap 15.2:NonFree ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for opera fixes the following issues: opera was updated to version 78.0.4093.147 - CHR-8251 Update chromium on desktop-stable-92-4093 to 92.0.4515.131 - DNA-93036 Opera not starting after closing window. Processes still working. - DNA-94516 Add ��Detach tab�� entry to tab menu - DNA-94584 [Mac] Sidebar setup not closed after press ��Add extensions�� button - DNA-94761 Crash when trying to record ��Chrome developer�� trace - DNA-94790 Crash at opera::VideoConferenceTabDetachController:: OnBrowserAboutToStartClosing(Browser*) - The update to chromium 92.0.4515.131 fixes following issues: CVE-2021-30590, CVE-2021-30591, CVE-2021-30592, CVE-2021-30593, CVE-2021-30594, CVE-2021-30596, CVE-2021-30597 Update to version 78.0.4093.112 - DNA-94466 Implement sorting Pinboards in overview - DNA-94582 Add access to APIs for showing pinboard icon in sidebar - DNA-94603 Suspicious pinboards events - DNA-94625 Disable opr.pinboardPrivate.getThumbnail() for local files - DNA-94640 Promote O78 to stable - DNA-94661 Missing translations for some languages - Complete Opera 78.0 changelog at: https://blogs.opera.com/desktop/changelog-for-78/ Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3:NonFree: zypper in -t patch openSUSE-2021-1209=1 - openSUSE Leap 15.2:NonFree: zypper in -t patch openSUSE-2021-1209=1 Package List: - openSUSE Leap 15.3:NonFree (x86_64): opera-78.0.4093.147-lp153.2.12.1 - openSUSE Leap 15.2:NonFree (x86_64): opera-78.0.4093.147-lp152.2.58.1 References: https://www.suse.com/security/cve/CVE-2021-30590.html https://www.suse.com/security/cve/CVE-2021-30591.html https://www.suse.com/security/cve/CVE-2021-30592.html https://www.suse.com/security/cve/CVE-2021-30593.html https://www.suse.com/security/cve/CVE-2021-30594.html https://www.suse.com/security/cve/CVE-2021-30596.html https://www.suse.com/security/cve/CVE-2021-30597.html

1 0

openSUSE-SU-2021:1208-1: moderate: Security update for cacti, cacti-spine
by opensuse-security＠opensuse.org 29 Aug '21

29 Aug '21

openSUSE Security Update: Security update for cacti, cacti-spine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1208-1 Rating: moderate References: #1188188 Cross-References: CVE-2020-14424 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cacti, cacti-spine fixes the following issues: cacti-spine 1.2.18: * Fix missing time parameter on FROM_UNIXTIME function cacti 1.2.18: * CVE-2020-14424: Lack of escaping on template import can lead to XSS exposure under 'midwinter' theme (boo#1188188) * Real time graphs can expose XSS issue This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1208=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): cacti-spine-1.2.18-bp152.2.10.1 cacti-spine-debuginfo-1.2.18-bp152.2.10.1 cacti-spine-debugsource-1.2.18-bp152.2.10.1 - openSUSE Backports SLE-15-SP2 (noarch): cacti-1.2.18-bp152.2.13.1 References: https://www.suse.com/security/cve/CVE-2020-14424.html https://bugzilla.suse.com/1188188

1 0

openSUSE-SU-2021:1207-1: moderate: Security update for go1.15
by opensuse-security＠opensuse.org 27 Aug '21

27 Aug '21

openSUSE Security Update: Security update for go1.15 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1207-1 Rating: moderate References: #1175132 #1188906 #1189162 Cross-References: CVE-2021-36221 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for go1.15 fixes the following issues: Update to go1.15.15: - go#47473 net/http: panic due to racy read of persistConn after handler panic (CVE-2021-36221 bsc#1189162) - go#47347 cmd/go: "go list -f '{{.Stale}}'" stack overflow with cyclic imports - go#47014 cmd/go: go mod vendor: open C:\Users\LICENSE: Access is denied. - go#46927 cmd/compile: register conflict between external linker and duffzero on arm64 - go#46857 runtime: ppc64x binaries randomly segfault on linux 5.13rc6 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1207=1 Package List: - openSUSE Leap 15.2 (x86_64): go1.15-1.15.15-lp152.26.1 go1.15-doc-1.15.15-lp152.26.1 go1.15-race-1.15.15-lp152.26.1 References: https://www.suse.com/security/cve/CVE-2021-36221.html https://bugzilla.suse.com/1175132 https://bugzilla.suse.com/1188906 https://bugzilla.suse.com/1189162

1 0

openSUSE-SU-2021:2861-1: moderate: Security update for spectre-meltdown-checker
by opensuse-security＠opensuse.org 27 Aug '21

27 Aug '21

openSUSE Security Update: Security update for spectre-meltdown-checker ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2861-1 Rating: moderate References: #1189477 Cross-References: CVE-2017-5753 CVSS scores: CVE-2017-5753 (NVD) : 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2017-5753 (SUSE): 7.1 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for spectre-meltdown-checker fixes the following issues: spectre-meltdown-checker was updated to version 0.44 (bsc#1189477) - feat: add support for SRBDS related vulnerabilities - feat: add zstd kernel decompression (#370) - enh: arm: add experimental support for binary arm images - enh: rsb filling: no longer need the 'strings' tool to check for kernel support in live mode - fix: fwdb: remove Intel extract tempdir on exit - fix: has_vmm: ignore kernel threads when looking for a hypervisor (fixes #278) - fix: fwdb: use the commit date as the intel fwdb version - fix: fwdb: update Intel's repository URL - fix: arm64: CVE-2017-5753: kernels 4.19+ use a different nospec macro - fix: on CPU parse info under FreeBSD - chore: github: add check run on pull requests - chore: fwdb: update to v165.20201021+i20200616 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2861=1 Package List: - openSUSE Leap 15.3 (x86_64): spectre-meltdown-checker-0.44-3.6.1 References: https://www.suse.com/security/cve/CVE-2017-5753.html https://bugzilla.suse.com/1189477

1 0

openSUSE-SU-2021:2858-1: moderate: Security update for qemu
by opensuse-security＠opensuse.org 27 Aug '21

27 Aug '21

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2858-1 Rating: moderate References: #1180432 #1180433 #1180434 #1180435 #1182651 #1186012 #1188299 #1189145 Cross-References: CVE-2020-35503 CVE-2020-35504 CVE-2020-35505 CVE-2020-35506 CVE-2021-20255 CVE-2021-3527 CVE-2021-3682 CVSS scores: CVE-2020-35503 (NVD) : 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2020-35503 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2020-35504 (NVD) : 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2020-35504 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2020-35505 (NVD) : 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2020-35505 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2020-35506 (NVD) : 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2020-35506 (SUSE): 5.6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H CVE-2021-20255 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-20255 (SUSE): 3.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L CVE-2021-3527 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-3527 (SUSE): 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L CVE-2021-3682 (SUSE): 6 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has one errata is now available. Description: This update for qemu fixes the following issues: Security issues fixed: - usbredir: free call on invalid pointer in bufp_alloc (bsc#1189145, CVE-2021-3682) - NULL pointer dereference in ESP (bsc#1180433, CVE-2020-35504) (bsc#1180434, CVE-2020-35505) (bsc#1180435, CVE-2020-35506) - NULL pointer dereference issue in megasas-gen2 host bus adapter (bsc#1180432, CVE-2020-35503) - eepro100: stack overflow via infinite recursion (bsc#1182651, CVE-2021-20255) - usb: unbounded stack allocation in usbredir (bsc#1186012, CVE-2021-3527) Non-security issues fixed: - Use max host physical address if -cpu max is used (bsc#1188299) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2858=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): qemu-5.2.0-103.2 qemu-arm-5.2.0-103.2 qemu-arm-debuginfo-5.2.0-103.2 qemu-audio-alsa-5.2.0-103.2 qemu-audio-alsa-debuginfo-5.2.0-103.2 qemu-audio-pa-5.2.0-103.2 qemu-audio-pa-debuginfo-5.2.0-103.2 qemu-audio-spice-5.2.0-103.2 qemu-audio-spice-debuginfo-5.2.0-103.2 qemu-block-curl-5.2.0-103.2 qemu-block-curl-debuginfo-5.2.0-103.2 qemu-block-dmg-5.2.0-103.2 qemu-block-dmg-debuginfo-5.2.0-103.2 qemu-block-gluster-5.2.0-103.2 qemu-block-gluster-debuginfo-5.2.0-103.2 qemu-block-iscsi-5.2.0-103.2 qemu-block-iscsi-debuginfo-5.2.0-103.2 qemu-block-nfs-5.2.0-103.2 qemu-block-nfs-debuginfo-5.2.0-103.2 qemu-block-rbd-5.2.0-103.2 qemu-block-rbd-debuginfo-5.2.0-103.2 qemu-block-ssh-5.2.0-103.2 qemu-block-ssh-debuginfo-5.2.0-103.2 qemu-chardev-baum-5.2.0-103.2 qemu-chardev-baum-debuginfo-5.2.0-103.2 qemu-chardev-spice-5.2.0-103.2 qemu-chardev-spice-debuginfo-5.2.0-103.2 qemu-debuginfo-5.2.0-103.2 qemu-debugsource-5.2.0-103.2 qemu-extra-5.2.0-103.2 qemu-extra-debuginfo-5.2.0-103.2 qemu-guest-agent-5.2.0-103.2 qemu-guest-agent-debuginfo-5.2.0-103.2 qemu-hw-display-qxl-5.2.0-103.2 qemu-hw-display-qxl-debuginfo-5.2.0-103.2 qemu-hw-display-virtio-gpu-5.2.0-103.2 qemu-hw-display-virtio-gpu-debuginfo-5.2.0-103.2 qemu-hw-display-virtio-gpu-pci-5.2.0-103.2 qemu-hw-display-virtio-gpu-pci-debuginfo-5.2.0-103.2 qemu-hw-display-virtio-vga-5.2.0-103.2 qemu-hw-display-virtio-vga-debuginfo-5.2.0-103.2 qemu-hw-s390x-virtio-gpu-ccw-5.2.0-103.2 qemu-hw-s390x-virtio-gpu-ccw-debuginfo-5.2.0-103.2 qemu-hw-usb-redirect-5.2.0-103.2 qemu-hw-usb-redirect-debuginfo-5.2.0-103.2 qemu-hw-usb-smartcard-5.2.0-103.2 qemu-hw-usb-smartcard-debuginfo-5.2.0-103.2 qemu-ivshmem-tools-5.2.0-103.2 qemu-ivshmem-tools-debuginfo-5.2.0-103.2 qemu-ksm-5.2.0-103.2 qemu-lang-5.2.0-103.2 qemu-ppc-5.2.0-103.2 qemu-ppc-debuginfo-5.2.0-103.2 qemu-s390x-5.2.0-103.2 qemu-s390x-debuginfo-5.2.0-103.2 qemu-tools-5.2.0-103.2 qemu-tools-debuginfo-5.2.0-103.2 qemu-ui-curses-5.2.0-103.2 qemu-ui-curses-debuginfo-5.2.0-103.2 qemu-ui-gtk-5.2.0-103.2 qemu-ui-gtk-debuginfo-5.2.0-103.2 qemu-ui-opengl-5.2.0-103.2 qemu-ui-opengl-debuginfo-5.2.0-103.2 qemu-ui-spice-app-5.2.0-103.2 qemu-ui-spice-app-debuginfo-5.2.0-103.2 qemu-ui-spice-core-5.2.0-103.2 qemu-ui-spice-core-debuginfo-5.2.0-103.2 qemu-vhost-user-gpu-5.2.0-103.2 qemu-vhost-user-gpu-debuginfo-5.2.0-103.2 qemu-x86-5.2.0-103.2 qemu-x86-debuginfo-5.2.0-103.2 - openSUSE Leap 15.3 (s390x x86_64): qemu-kvm-5.2.0-103.2 - openSUSE Leap 15.3 (noarch): qemu-ipxe-1.0.0+-103.2 qemu-microvm-5.2.0-103.2 qemu-seabios-1.14.0_0_g155821a-103.2 qemu-sgabios-8-103.2 qemu-skiboot-5.2.0-103.2 qemu-vgabios-1.14.0_0_g155821a-103.2 References: https://www.suse.com/security/cve/CVE-2020-35503.html https://www.suse.com/security/cve/CVE-2020-35504.html https://www.suse.com/security/cve/CVE-2020-35505.html https://www.suse.com/security/cve/CVE-2020-35506.html https://www.suse.com/security/cve/CVE-2021-20255.html https://www.suse.com/security/cve/CVE-2021-3527.html https://www.suse.com/security/cve/CVE-2021-3682.html https://bugzilla.suse.com/1180432 https://bugzilla.suse.com/1180433 https://bugzilla.suse.com/1180434 https://bugzilla.suse.com/1180435 https://bugzilla.suse.com/1182651 https://bugzilla.suse.com/1186012 https://bugzilla.suse.com/1188299 https://bugzilla.suse.com/1189145

1 0

openSUSE-RU-2021:2855-1: moderate: Recommended update for rust
by maintenance＠opensuse.org 27 Aug '21

27 Aug '21

openSUSE Recommended Update: Recommended update for rust ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:2855-1 Rating: moderate References: SLE-18626 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has 0 recommended fixes and contains one feature can now be installed. Description: This update for rust fixes the following issues: This ships the new parallel rust 1.54 version. Version 1.54.0 (2021-07-29) Language: - You can now use macros for values in built-in attribute macros. While a seemingly minor addition on its own, this enables a lot of powerful functionality when combined correctly. Most notably you can now include external documentation in your crate by writing the following. ```rust #![doc = include_str!("README.md")] ``` You can also use this to include auto-generated modules: ```rust #[path = concat!(env!("OUT_DIR"), "/generated.rs")] mod generated; ``` - You can now cast between unsized slice types (and types which contain unsized slices) in `const fn`. - You can now use multiple generic lifetimes with `impl Trait` where the lifetimes don't explicitly outlive another. In code this means that you can now have `impl Trait<'a, 'b>` where as before you could only have `impl Trait<'a, 'b> where 'b: 'a`. Compiler: - Rustc will now search for custom JSON targets in `/lib/rustlib/<target-triple>/target.json` where `/` is the "sysroot" directory. You can find your sysroot directory by running `rustc --print sysroot`. - Added `wasm` as a `target_family` for WebAssembly platforms. - You can now use `#[target_feature]` on safe functions when targeting WebAssembly platforms. - Improved debugger output for enums on Windows MSVC platforms. - Added tier 3\* support for `bpfel-unknown-none` and `bpfeb-unknown-none`. \* Refer to Rust's platform support page for more information on Rust's tiered platform support. Libraries: - `panic::panic_any` will now `#[track_caller]`. - Added `OutOfMemory` as a variant of `io::ErrorKind`. - `proc_macro::Literal` now implements `FromStr`. - The implementations of vendor intrinsics in core::arch have been significantly refactored. The main user-visible changes are a 50% reduction in the size of libcore.rlib and stricter validation of constant operands passed to intrinsics. The latter is technically a breaking change, but allows Rust to more closely match the C vendor intrinsics API. Stabilized APIs: - BTreeMap::into_keys - BTreeMap::into_values - HashMap::into_keys - HashMap::into_values - arch::wasm32 - VecDeque::binary_search - VecDeque::binary_search_by - VecDeque::binary_search_by_key - VecDeque::partition_point Cargo: - Added the `--prune <spec>` option to `cargo-tree` to remove a package from the dependency graph. - Added the `--depth` option to `cargo-tree` to print only to a certain depth in the tree. - Added the `no-proc-macro` value to `cargo-tree --edges` to hide procedural macro dependencies. - A new environment variable named `CARGO_TARGET_TMPDIR` is available. This variable points to a directory that integration tests and benches can use as a "scratchpad" for testing filesystem operations. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2855=1 Package List: - openSUSE Leap 15.3 (aarch64 i586 ppc64le s390x x86_64): cargo-1.54.0-21.6.2 rust-1.54.0-21.6.2 rust-gdb-1.54.0-21.6.2 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): cargo1.54-1.54.0-7.3.1 cargo1.54-debuginfo-1.54.0-7.3.1 rust1.54-1.54.0-7.3.1 rust1.54-debuginfo-1.54.0-7.3.1 rust1.54-gdb-1.54.0-7.3.1 - openSUSE Leap 15.3 (aarch64 x86_64): rls-1.54.0-21.6.2 rls1.54-1.54.0-7.3.1 rls1.54-debuginfo-1.54.0-7.3.1 rust1.54-analysis-1.54.0-7.3.1 rust1.54-doc-1.54.0-7.3.1 - openSUSE Leap 15.3 (noarch): cargo1.54-doc-1.54.0-7.3.1 rust1.54-src-1.54.0-7.3.1 References:

1 0

openSUSE-SU-2021:1206-1: moderate: Security update for aws-cli, python-boto3, python-botocore, python-service_identity, python-trustme, python-urllib3
by opensuse-security＠opensuse.org 27 Aug '21

27 Aug '21

openSUSE Security Update: Security update for aws-cli, python-boto3, python-botocore, python-service_identity, python-trustme, python-urllib3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1206-1 Rating: moderate References: #1102408 #1138715 #1138746 #1176389 #1177120 #1182421 #1182422 ECO-3352 PM-2485 Cross-References: CVE-2020-26137 CVSS scores: CVE-2020-26137 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2020-26137 (SUSE): 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability, contains two features and has 6 fixes is now available. Description: This patch updates the Python AWS SDK stack in SLE 15: General: # aws-cli - Version updated to upstream release v1.19.9 For a detailed list of all changes, please refer to the changelog file of this package. # python-boto3 - Version updated to upstream release 1.17.9 For a detailed list of all changes, please refer to the changelog file of this package. # python-botocore - Version updated to upstream release 1.20.9 For a detailed list of all changes, please refer to the changelog file of this package. # python-urllib3 - Version updated to upstream release 1.25.10 For a detailed list of all changes, please refer to the changelog file of this package. # python-service_identity - Added this new package to resolve runtime dependencies for other packages. Version: 18.1.0 # python-trustme - Added this new package to resolve runtime dependencies for other packages. Version: 0.6.0 Security fixes: # python-urllib3: - CVE-2020-26137: urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest() (bsc#1177120) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1206=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): python-cffi-debuginfo-1.13.2-lp152.2.3.1 python-cffi-debugsource-1.13.2-lp152.2.3.1 python-cryptography-debuginfo-2.8-lp152.2.12.1 python-cryptography-debugsource-2.8-lp152.2.12.1 python2-cffi-1.13.2-lp152.2.3.1 python2-cffi-debuginfo-1.13.2-lp152.2.3.1 python2-cryptography-2.8-lp152.2.12.1 python2-cryptography-debuginfo-2.8-lp152.2.12.1 python3-cffi-1.13.2-lp152.2.3.1 python3-cffi-debuginfo-1.13.2-lp152.2.3.1 python3-cryptography-2.8-lp152.2.12.1 python3-cryptography-debuginfo-2.8-lp152.2.12.1 - openSUSE Leap 15.2 (noarch): python-pyOpenSSL-doc-17.5.0-lp152.7.3.1 python2-pyOpenSSL-17.5.0-lp152.7.3.1 python3-pyOpenSSL-17.5.0-lp152.7.3.1 References: https://www.suse.com/security/cve/CVE-2020-26137.html https://bugzilla.suse.com/1102408 https://bugzilla.suse.com/1138715 https://bugzilla.suse.com/1138746 https://bugzilla.suse.com/1176389 https://bugzilla.suse.com/1177120 https://bugzilla.suse.com/1182421 https://bugzilla.suse.com/1182422

1 0

openSUSE-SU-2021:1204-1: moderate: Security update for dbus-1
by opensuse-security＠opensuse.org 26 Aug '21

26 Aug '21

openSUSE Security Update: Security update for dbus-1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1204-1 Rating: moderate References: #1172505 Cross-References: CVE-2020-12049 CVSS scores: CVE-2020-12049 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2020-12049 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for dbus-1 fixes the following issues: - CVE-2020-12049: truncated messages lead to resource exhaustion. (bsc#1172505) This update was imported from the SUSE:SLE-15-SP1:Update update project. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1204=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): dbus-1-1.12.2-lp152.6.6.1 dbus-1-debuginfo-1.12.2-lp152.6.6.1 dbus-1-debugsource-1.12.2-lp152.6.6.1 dbus-1-devel-1.12.2-lp152.6.6.1 dbus-1-x11-1.12.2-lp152.6.6.1 dbus-1-x11-debuginfo-1.12.2-lp152.6.6.1 dbus-1-x11-debugsource-1.12.2-lp152.6.6.1 libdbus-1-3-1.12.2-lp152.6.6.1 libdbus-1-3-debuginfo-1.12.2-lp152.6.6.1 - openSUSE Leap 15.2 (x86_64): dbus-1-32bit-debuginfo-1.12.2-lp152.6.6.1 dbus-1-devel-32bit-1.12.2-lp152.6.6.1 libdbus-1-3-32bit-1.12.2-lp152.6.6.1 libdbus-1-3-32bit-debuginfo-1.12.2-lp152.6.6.1 - openSUSE Leap 15.2 (noarch): dbus-1-devel-doc-1.12.2-lp152.6.6.1 References: https://www.suse.com/security/cve/CVE-2020-12049.html https://bugzilla.suse.com/1172505

1 0

openSUSE-RU-2021:1205-1: moderate: Recommended update for resource-agents
by maintenance＠opensuse.org 26 Aug '21

26 Aug '21

openSUSE Recommended Update: Recommended update for resource-agents ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1205-1 Rating: moderate References: #1188975 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for resource-agents fixes the following issues: - Fix for azure-lb resource agents using '/usr/bin/nc' instead of 'usr/bin/socat'. (bsc#1188975) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1205=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): ldirectord-4.4.0+git57.70549516-lp152.2.25.1 resource-agents-4.4.0+git57.70549516-lp152.2.25.1 resource-agents-debuginfo-4.4.0+git57.70549516-lp152.2.25.1 resource-agents-debugsource-4.4.0+git57.70549516-lp152.2.25.1 - openSUSE Leap 15.2 (noarch): monitoring-plugins-metadata-4.4.0+git57.70549516-lp152.2.25.1 References: https://bugzilla.suse.com/1188975

1 0