August 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2021:1191-1: moderate: Recommended update for vagrant
by maintenance＠opensuse.org 25 Aug '21

25 Aug '21

openSUSE Recommended Update: Recommended update for vagrant ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1191-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update provides vagrant to Leap 15.3 and PackageHub 15-SP3. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1191=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-bcrypt_pbkdf-1.1-1.1.0-bp153.17.1 ruby2.5-rubygem-bcrypt_pbkdf-1.1-debuginfo-1.1.0-bp153.17.1 ruby2.5-rubygem-bcrypt_pbkdf-doc-1.1-1.1.0-bp153.17.1 ruby2.5-rubygem-bcrypt_pbkdf-testsuite-1.1-1.1.0-bp153.17.1 ruby2.5-rubygem-childprocess-4.1-4.1.0-bp153.2.1 ruby2.5-rubygem-childprocess-doc-4.1-4.1.0-bp153.2.1 ruby2.5-rubygem-childprocess-testsuite-4.1-4.1.0-bp153.2.1 ruby2.5-rubygem-erubi-1.10-1.10.0-bp153.2.1 ruby2.5-rubygem-erubi-doc-1.10-1.10.0-bp153.2.1 ruby2.5-rubygem-i18n-1.8-1.8.10-bp153.2.1 ruby2.5-rubygem-i18n-doc-1.8-1.8.10-bp153.2.1 ruby2.5-rubygem-listen-3.6-3.6.0-bp153.2.1 ruby2.5-rubygem-mime-types-3.3-3.3.1-bp153.2.1 ruby2.5-rubygem-mime-types-doc-3.3-3.3.1-bp153.2.1 ruby2.5-rubygem-mime-types-testsuite-3.3-3.3.1-bp153.2.1 ruby2.5-rubygem-net-scp-3.0-3.0.0-bp153.2.1 ruby2.5-rubygem-net-scp-doc-3.0-3.0.0-bp153.2.1 ruby2.5-rubygem-net-sftp-3.0-3.0.0-bp153.2.1 ruby2.5-rubygem-net-sftp-doc-3.0-3.0.0-bp153.2.1 ruby2.5-rubygem-net-ssh-6.1-6.1.0-bp153.2.1 ruby2.5-rubygem-net-ssh-doc-6.1-6.1.0-bp153.2.1 ruby2.5-rubygem-rake-13.0-13.0.6-bp153.2.1 ruby2.5-rubygem-rake-doc-13.0-13.0.6-bp153.2.1 ruby2.5-rubygem-rb-fsevent-0.11-0.11.0-bp153.2.1 ruby2.5-rubygem-rb-fsevent-doc-0.11-0.11.0-bp153.2.1 ruby2.5-rubygem-rexml-3.2-3.2.5-bp153.2.1 ruby2.5-rubygem-rexml-doc-3.2-3.2.5-bp153.2.1 ruby2.5-rubygem-rspec-3.10-3.10.0-bp153.2.1 ruby2.5-rubygem-rspec-core-3.10-3.10.1-bp153.2.1 ruby2.5-rubygem-rspec-core-doc-3.10-3.10.1-bp153.2.1 ruby2.5-rubygem-rspec-doc-3.10-3.10.0-bp153.2.1 ruby2.5-rubygem-rspec-expectations-3.10-3.10.1-bp153.2.1 ruby2.5-rubygem-rspec-expectations-doc-3.10-3.10.1-bp153.2.1 ruby2.5-rubygem-rspec-mocks-3.10-3.10.2-bp153.2.1 ruby2.5-rubygem-rspec-mocks-doc-3.10-3.10.2-bp153.2.1 ruby2.5-rubygem-rspec-support-3.10-3.10.2-bp153.2.1 ruby2.5-rubygem-rspec-support-doc-3.10-3.10.2-bp153.2.1 ruby2.5-rubygem-vagrant_cloud-3.0-3.0.5-bp153.2.1 ruby2.5-rubygem-vagrant_cloud-doc-3.0-3.0.5-bp153.2.1 ruby2.5-rubygem-webrick-1.7-1.7.0-bp153.2.1 ruby2.5-rubygem-webrick-doc-1.7-1.7.0-bp153.2.1 ruby2.5-rubygem-winrm-2.3-2.3.6-bp153.2.1 ruby2.5-rubygem-winrm-doc-2.3-2.3.6-bp153.2.1 ruby2.5-rubygem-winrm-elevated-1.2-1.2.3-bp153.2.1 ruby2.5-rubygem-winrm-elevated-doc-1.2-1.2.3-bp153.2.1 ruby2.5-rubygem-winrm-fs-1.3-1.3.5-bp153.2.1 ruby2.5-rubygem-winrm-fs-doc-1.3-1.3.5-bp153.2.1 rubygem-bcrypt_pbkdf-1.1-debugsource-1.1.0-bp153.17.1 vagrant-2.2.18-bp153.2.1 vagrant-libvirt-0.5.3-bp153.2.1 vagrant-libvirt-doc-0.5.3-bp153.2.1 - openSUSE Backports SLE-15-SP3 (noarch): vagrant-bash-completion-2.2.18-bp153.2.1 vagrant-doc-2.2.18-bp153.2.1 vagrant-emacs-2.2.18-bp153.2.1 vagrant-vim-2.2.18-bp153.2.1 References:

1 0

openSUSE-RU-2021:1196-1: moderate: Recommended update for lxd
by maintenance＠opensuse.org 25 Aug '21

25 Aug '21

openSUSE Recommended Update: Recommended update for lxd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1196-1 Rating: moderate References: #1189645 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for lxd fixes the following issues: Update to LXD 4.17. (boo#1189645) The full upstream changelog is available from: https://discuss.linuxcontainers.org/t/lxd-4-17-has-been-released/11812 + lxd import replaced by new lxd recover + Cluster member evacuation * Reworked lxc info output + Requestor address in lifecycle event + USB GPU support in the resources API + Monitoring of all projects in lxc monitor + Alternative format options in lxc monitor Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1196=1 Package List: - openSUSE Leap 15.2 (x86_64): lxd-4.17-lp152.2.44.1 - openSUSE Leap 15.2 (noarch): lxd-bash-completion-4.17-lp152.2.44.1 References: https://bugzilla.suse.com/1189645

1 0

openSUSE-RU-2021:1193-1: moderate: Recommended update for rubygem-paint
by maintenance＠opensuse.org 25 Aug '21

25 Aug '21

openSUSE Recommended Update: Recommended update for rubygem-paint ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1193-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for rubygem-paint fixes the following issues: updated to version 2.2.1 * Explicitly set mac's Terminal.app to 256 colors only, fixes #28 * Support NO_COLOR environment variable, implements #26 (see no-color.org) * Blacklist True Color support for urxvt, fixes #25 * Set True Color as default mode on more terminals, patch by @smoochbot * Add `gray` alias for `white` color, patch by @AlexWayfer * Remove `gunzip` deprecation warning Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1193=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-paint-2.2.1-bp153.2.3.1 ruby2.5-rubygem-paint-doc-2.2.1-bp153.2.3.1 References:

1 0

openSUSE-RU-2021:1194-1: moderate: Recommended update for mate-menu
by maintenance＠opensuse.org 25 Aug '21

25 Aug '21

openSUSE Recommended Update: Recommended update for mate-menu ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1194-1 Rating: moderate References: #1189452 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for mate-menu fixes the following issues: - Fix crash on adding mate advanced menu to MATE panel (boo#1189452) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1194=1 Package List: - openSUSE Backports SLE-15-SP3 (noarch): mate-menu-20.04.1-bp153.2.3.1 mate-menu-lang-20.04.1-bp153.2.3.1 References: https://bugzilla.suse.com/1189452

1 0

openSUSE-SU-2021:1192-1: moderate: Security update for tor
by opensuse-security＠opensuse.org 25 Aug '21

25 Aug '21

openSUSE Security Update: Security update for tor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1192-1 Rating: moderate References: #1189489 Cross-References: CVE-2021-38385 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tor fixes the following issues: tor 0.4.6.7: * Fix a DoS via a remotely triggerable assertion failure (boo#1189489, TROVE-2021-007, CVE-2021-38385) tor 0.4.6.6: * Enable the deterministic RNG for unit tests that covers the address set bloomfilter-based API's tor 0.4.6.5 * Add controller support for creating v3 onion services with client auth * When voting on a relay with a Sybil-like appearance, add the Sybil flag when clearing out the other flags. This lets a relay operator know why their relay hasn't been included in the consensus * Relays now report how overloaded they are * Add a new DoS subsystem to control the rate of client connections for relays * Relays now publish statistics about v3 onions services * Improve circuit timeout algorithm for client performance Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1192=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 ppc64le s390x x86_64): tor-0.4.6.7-bp153.2.6.1 References: https://www.suse.com/security/cve/CVE-2021-38385.html https://bugzilla.suse.com/1189489

1 0

openSUSE-SU-2021:1190-1: moderate: Security update for cacti, cacti-spine
by opensuse-security＠opensuse.org 25 Aug '21

25 Aug '21

openSUSE Security Update: Security update for cacti, cacti-spine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1190-1 Rating: moderate References: #1188188 Cross-References: CVE-2020-14424 Affected Products: openSUSE Leap 15.2 openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cacti, cacti-spine fixes the following issues: cacti-spine 1.2.18: * Fix missing time parameter on FROM_UNIXTIME function cacti 1.2.18: * CVE-2020-14424: Lack of escaping on template import can lead to XSS exposure under 'midwinter' theme (boo#1188188) * Real time graphs can expose XSS issue Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1190=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1190=1 Package List: - openSUSE Leap 15.2 (noarch): cacti-1.2.18-lp152.2.15.1 - openSUSE Leap 15.2 (x86_64): cacti-spine-1.2.18-lp152.2.12.1 cacti-spine-debuginfo-1.2.18-lp152.2.12.1 cacti-spine-debugsource-1.2.18-lp152.2.12.1 - openSUSE Backports SLE-15-SP3 (aarch64 ppc64le s390x x86_64): cacti-spine-1.2.18-bp153.2.3.1 - openSUSE Backports SLE-15-SP3 (noarch): cacti-1.2.18-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-14424.html https://bugzilla.suse.com/1188188

1 0

openSUSE-RU-2021:2839-1: moderate: Recommended update for yast2
by maintenance＠opensuse.org 25 Aug '21

25 Aug '21

openSUSE Recommended Update: Recommended update for yast2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:2839-1 Rating: moderate References: #1187581 #1187676 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for yast2 fixes the following issues: - Do not escape "$" in URL paths. (bsc#1187581) - Don't crash with UI exception in 'Progress.rb' if a popup is in the way. (bsc#1187676) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2839=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): yast2-4.3.65-3.11.1 yast2-logs-4.3.65-3.11.1 References: https://bugzilla.suse.com/1187581 https://bugzilla.suse.com/1187676

1 0

openSUSE-SU-2021:2835-1: moderate: Security update for mariadb
by opensuse-security＠opensuse.org 25 Aug '21

25 Aug '21

openSUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2835-1 Rating: moderate References: #1189320 Cross-References: CVE-2021-2372 CVE-2021-2389 CVSS scores: CVE-2021-2372 (NVD) : 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2021-2372 (SUSE): 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2021-2389 (NVD) : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-2389 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for mariadb fixes the following issues: Update to version 10.2.40 [bsc#1189320]: - fixes for the following security vulnerabilities: CVE-2021-2372 and CVE-2021-2389 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2835=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libmysqld-devel-10.2.40-3.43.1 libmysqld19-10.2.40-3.43.1 libmysqld19-debuginfo-10.2.40-3.43.1 References: https://www.suse.com/security/cve/CVE-2021-2372.html https://www.suse.com/security/cve/CVE-2021-2389.html https://bugzilla.suse.com/1189320

1 0

openSUSE-SU-2021:2838-1: moderate: Security update for jetty-minimal
by opensuse-security＠opensuse.org 25 Aug '21

25 Aug '21

openSUSE Security Update: Security update for jetty-minimal ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2838-1 Rating: moderate References: #1188438 Cross-References: CVE-2021-34429 CVSS scores: CVE-2021-34429 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2021-34429 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for jetty-minimal fixes the following issues: - Update to version 9.4.43.v20210629 - CVE-2021-34429: URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. (bsc#1188438) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2838=1 Package List: - openSUSE Leap 15.3 (noarch): jetty-annotations-9.4.43-3.12.2 jetty-client-9.4.43-3.12.2 jetty-continuation-9.4.43-3.12.2 jetty-http-9.4.43-3.12.2 jetty-io-9.4.43-3.12.2 jetty-jaas-9.4.43-3.12.2 jetty-javax-websocket-client-impl-9.4.43-3.12.2 jetty-javax-websocket-server-impl-9.4.43-3.12.2 jetty-jmx-9.4.43-3.12.2 jetty-jndi-9.4.43-3.12.2 jetty-jsp-9.4.43-3.12.2 jetty-minimal-javadoc-9.4.43-3.12.2 jetty-openid-9.4.43-3.12.2 jetty-plus-9.4.43-3.12.2 jetty-proxy-9.4.43-3.12.2 jetty-security-9.4.43-3.12.2 jetty-server-9.4.43-3.12.2 jetty-servlet-9.4.43-3.12.2 jetty-util-9.4.43-3.12.2 jetty-util-ajax-9.4.43-3.12.2 jetty-webapp-9.4.43-3.12.2 jetty-websocket-api-9.4.43-3.12.2 jetty-websocket-client-9.4.43-3.12.2 jetty-websocket-common-9.4.43-3.12.2 jetty-websocket-javadoc-9.4.43-3.12.2 jetty-websocket-server-9.4.43-3.12.2 jetty-websocket-servlet-9.4.43-3.12.2 jetty-xml-9.4.43-3.12.2 References: https://www.suse.com/security/cve/CVE-2021-34429.html https://bugzilla.suse.com/1188438

1 0

openSUSE-SU-2021:2837-1: moderate: Security update for mariadb
by opensuse-security＠opensuse.org 25 Aug '21

25 Aug '21

openSUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2837-1 Rating: moderate References: #1180014 #1189320 Cross-References: CVE-2021-2372 CVE-2021-2389 CVSS scores: CVE-2021-2372 (NVD) : 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2021-2372 (SUSE): 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2021-2389 (NVD) : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-2389 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for mariadb fixes the following issues: Update to version 10.2.40 (bsc#1189320): - fixes for the following security vulnerabilities: CVE-2021-2372 and CVE-2021-2389 In additon the follwing was changed: - Increase NOFILE limit on service configuration (bsc#1180014) The default 'NOFILE' setting on mariadb service configuration is to low and may cause instability on higher loads. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2837=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): mariadb-galera-10.4.21-3.14.1 References: https://www.suse.com/security/cve/CVE-2021-2372.html https://www.suse.com/security/cve/CVE-2021-2389.html https://bugzilla.suse.com/1180014 https://bugzilla.suse.com/1189320

1 0