September 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2021:1283-1: moderate: Recommended update for glmark2
by maintenance＠opensuse.org 17 Sep '21

17 Sep '21

openSUSE Recommended Update: Recommended update for glmark2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1283-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 openSUSE Backports SLE-15-SP3 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for glmark2 fixes the following issues: glmark2 was updated to version 20210830: * GLStateEGL: Support EGL versions < 1.4 * Fix model loading on big endian. * Fix -Wunreachable-code-aggressive. Update to version 20210521: * glad: Update for GL 2.1 + GL_EXT_framebuffer_object * Gracefully handle missing GL features * NativeStateWayland: Improve surface configuration handling Update to version 20210224: * SceneRefract: Fix incorrect generation of mipmap * NativeStateWayland: Don't assume order of globals * GLStateEGL: Avoid creating two EGLDisplay instances * Build,Doc: Update files for 2021.02 release * Build: Remove invalid build flavors for meson * NativeStateWayland: Support quitting with ESC or Q key * NativeStateWayland: Add basic pointer support * CanvasGeneric: avoid undefined behavior constructing a std::string with NULL * libmatrix: declare Shader::Shader(Shader&&) as noexcept * libmatrix: add move constructor to class Shader for v.push_back opt * build: glmark2 does not really require libpng version 16 * SceneBump: Fix precision bug in height rendering * SceneDesktop: Draw to correct FBO in off-screen mode * SceneShadow: Draw to correct FBO in off-screen mode * SceneRefract: Draw to correct FBO in off-screen mode * SceneTerrain: Draw to correct FBO in off-screen mode * CanvasGeneric: End the frame with glFinish when validating * Build: Use the build system wayland-scanner on meson * Build: Fix drm-only and wayland-only builds on meson * loop,function,conditionals: Fix mediump overflow * terrain: Fix precision handling in noise shader * terrain: Fix precision bug in light rendering * Doc: Document that the -b flag can pass common opts * Doc: Update files for meson build system * ci: Add build github workflow * Build: Meson build system support * Build: Use python3 in waf * NativeStateWayland: Fix no response to wayland server ping event. * Check for proper initialization of native_window and MVC matrix * egl: Ensure eglReleaseThread is valid before calling it * drm: Don't prefer RGBA component widths larger than 8 Update to version 20200503: * Build: Fix Python 3 incompatibility * Build,Doc: Update files for 2020.04 release * doc: Update --data-path documentation entry * Build: Improve configure error message when no flavors are selected * Android: Add fastlane metadata for F-Droid release * Android: Add unofficial adaptive icon for the android 8+ release * Android: Add unofficial icon for the android release * Android: Remove old drawables with non standard names * Android: Add different resolution of drawable and use sdk name for it * Fix UTF-8 in copyright headers * Allow version string suffix * Port Wayland to xdg-shell window management * Allow flavours to generate their own source files * Add support for Wayland display-scale events * glad: Update to latest upstream version * glad: Add README Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1283=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1283=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1283=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-1283=1 Package List: - openSUSE Leap 15.2 (x86_64): glmark2-20210830-lp152.4.3.1 glmark2-debuginfo-20210830-lp152.4.3.1 glmark2-debugsource-20210830-lp152.4.3.1 - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): glmark2-20210830-bp153.2.3.1 glmark2-debuginfo-20210830-bp153.2.3.1 glmark2-debugsource-20210830-bp153.2.3.1 - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): glmark2-20210830-bp152.4.3.1 glmark2-debuginfo-20210830-bp152.4.3.1 glmark2-debugsource-20210830-bp152.4.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): glmark2-20210830-bp151.4.3.1 References:

1 0

openSUSE-RU-2021:3138-1: moderate: Recommended update for mdadm
by maintenance＠opensuse.org 17 Sep '21

17 Sep '21

openSUSE Recommended Update: Recommended update for mdadm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3138-1 Rating: moderate References: #1180661 #1182642 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for mdadm fixes the following issues: - Remove Spare drives line from details for external metadata. (bsc#1180661, bsc#1182642) - Arrays with external metadata do not have spare disks directly assigned to volumes; spare disks belong to containers and are moved to arrays when the array is degraded/reshaping. Thus, the display of zero spare disks in volume details is incorrect and can be confusing. - Don't associate spares with other arrays during RAID Examine. (bsc#1180661, bsc#1182642) - Spares in imsm belong to containers, not volumes, and must go into a separate container when assembling the RAID. Remove association spares with other arrays and make Examine print separate containers for spares. Auto assemble without config file already works like this. So make creating a config file and assembling from it consistent with auto assemble. With this change, 'mdadm -Es' will add this line to output if spares are found: 'ARRAY metadata=imsm UUID=00000000:00000000:00000000:00000000' Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3138=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): mdadm-4.1-24.6.1 mdadm-debuginfo-4.1-24.6.1 mdadm-debugsource-4.1-24.6.1 References: https://bugzilla.suse.com/1180661 https://bugzilla.suse.com/1182642

1 0

openSUSE-RU-2021:3127-1: moderate: Recommended update for gimp
by maintenance＠opensuse.org 17 Sep '21

17 Sep '21

openSUSE Recommended Update: Recommended update for gimp ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3127-1 Rating: moderate References: #1178726 #1180362 #1180770 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for gimp fixes the following issues: - Recurse directories when looking for python plugins (bsc#1180362) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3127=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): gimp-plugins-python-2.10.12-3.6.2 gimp-plugins-python-debuginfo-2.10.12-3.6.2 References: https://bugzilla.suse.com/1178726 https://bugzilla.suse.com/1180362 https://bugzilla.suse.com/1180770

1 0

openSUSE-RU-2021:1281-1: moderate: Recommended update for plasma5-integration
by maintenance＠opensuse.org 17 Sep '21

17 Sep '21

openSUSE Recommended Update: Recommended update for plasma5-integration ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1281-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for plasma5-integration fixes the following issues: Update to 5.18.7 * For more details please see: * https://kde.org/announcements/plasma/5/5.18.7 * https://kde.org/announcements/plasma-5.18.6 * Use KDE shortcuts for "move to trash" action coming from QStandardKey (kde#426573) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1281=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): plasma5-integration-plugin-5.18.7-bp153.2.5.1 - openSUSE Backports SLE-15-SP3 (noarch): plasma5-integration-plugin-lang-5.18.7-bp153.2.5.1 References:

1 0

openSUSE-RU-2021:1280-1: moderate: Recommended update for yast2-users
by maintenance＠opensuse.org 16 Sep '21

16 Sep '21

openSUSE Recommended Update: Recommended update for yast2-users ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1280-1 Rating: moderate References: #1188361 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-users fixes the following issues: - Do not rewrite authorized_keys unless it is needed (bsc#1188361). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1280=1 Package List: - openSUSE Leap 15.2 (x86_64): yast2-users-4.2.13-lp152.2.6.1 yast2-users-debuginfo-4.2.13-lp152.2.6.1 yast2-users-debugsource-4.2.13-lp152.2.6.1 References: https://bugzilla.suse.com/1188361

1 0

openSUSE-SU-2021:3123-1: moderate: Security update for libcroco
by opensuse-security＠opensuse.org 16 Sep '21

16 Sep '21

openSUSE Security Update: Security update for libcroco ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3123-1 Rating: moderate References: #1171685 Cross-References: CVE-2020-12825 CVSS scores: CVE-2020-12825 (NVD) : 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H CVE-2020-12825 (SUSE): 2.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libcroco fixes the following issues: - CVE-2020-12825: Fixed recursion issue in block and any productions (bsc#1171685). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3123=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libcroco-0.6.13-3.3.1 libcroco-0_6-3-0.6.13-3.3.1 libcroco-0_6-3-debuginfo-0.6.13-3.3.1 libcroco-debuginfo-0.6.13-3.3.1 libcroco-debugsource-0.6.13-3.3.1 libcroco-devel-0.6.13-3.3.1 - openSUSE Leap 15.3 (x86_64): libcroco-0_6-3-32bit-0.6.13-3.3.1 libcroco-0_6-3-32bit-debuginfo-0.6.13-3.3.1 References: https://www.suse.com/security/cve/CVE-2020-12825.html https://bugzilla.suse.com/1171685

1 0

openSUSE-SU-2021:1279-1: moderate: Security update for haserl
by opensuse-security＠opensuse.org 16 Sep '21

16 Sep '21

openSUSE Security Update: Security update for haserl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1279-1 Rating: moderate References: #1187671 Cross-References: CVE-2021-29133 Affected Products: openSUSE Leap 15.2 openSUSE Backports SLE-15-SP3 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for haserl fixes the following issues: Update to version 0.9.36: * Fixed: Its possible to issue a PUT request without a CONTENT-TYPE. Assume an octet-stream in that case. This is CVE-2021-29133 and boo#1187671 * Change the Prefix for variables to be the REQUEST_METHOD (PUT/DELETE/GET/POST) THIS IS A BREAKING CHANGE * Mitigations vs running haserl to get access to files not available to the user. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1279=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1279=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1279=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-1279=1 Package List: - openSUSE Leap 15.2 (x86_64): haserl-0.9.36-lp152.4.3.1 haserl-debuginfo-0.9.36-lp152.4.3.1 haserl-debugsource-0.9.36-lp152.4.3.1 - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): haserl-0.9.36-bp153.2.3.1 haserl-debuginfo-0.9.36-bp153.2.3.1 haserl-debugsource-0.9.36-bp153.2.3.1 - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): haserl-0.9.36-bp152.4.3.1 haserl-debuginfo-0.9.36-bp152.4.3.1 haserl-debugsource-0.9.36-bp152.4.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): haserl-0.9.36-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2021-29133.html https://bugzilla.suse.com/1187671

1 0

openSUSE-RU-2021:1278-1: moderate: Recommended update for pidgin
by maintenance＠opensuse.org 16 Sep '21

16 Sep '21

openSUSE Recommended Update: Recommended update for pidgin ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1278-1 Rating: moderate References: SLE-17111 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes and contains one feature can now be installed. Description: This update for pidgin fixes the following issue: - Add support for the 'no_proxy' environment variable. (jsc#SLE-17111) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1278=1 Package List: - openSUSE Leap 15.2 (x86_64): finch-2.13.0-lp152.7.3.1 finch-debuginfo-2.13.0-lp152.7.3.1 finch-devel-2.13.0-lp152.7.3.1 libpurple-2.13.0-lp152.7.3.1 libpurple-debuginfo-2.13.0-lp152.7.3.1 libpurple-devel-2.13.0-lp152.7.3.1 libpurple-plugin-sametime-2.13.0-lp152.7.3.1 libpurple-plugin-sametime-debuginfo-2.13.0-lp152.7.3.1 libpurple-tcl-2.13.0-lp152.7.3.1 libpurple-tcl-debuginfo-2.13.0-lp152.7.3.1 pidgin-2.13.0-lp152.7.3.1 pidgin-debuginfo-2.13.0-lp152.7.3.1 pidgin-debugsource-2.13.0-lp152.7.3.1 pidgin-devel-2.13.0-lp152.7.3.1 - openSUSE Leap 15.2 (noarch): libpurple-branding-upstream-2.13.0-lp152.7.3.1 libpurple-lang-2.13.0-lp152.7.3.1 References:

1 0

openSUSE-RU-2021:3115-1: moderate: Recommended update for mozilla-nspr, mozilla-nss
by maintenance＠opensuse.org 16 Sep '21

16 Sep '21

openSUSE Recommended Update: Recommended update for mozilla-nspr, mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3115-1 Rating: moderate References: #1029961 #1174697 #1176206 #1176934 #1179382 #1188891 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has 6 recommended fixes can now be installed. Description: This update for mozilla-nspr fixes the following issues: mozilla-nspr was updated to version 4.32: * implement new socket option PR_SockOpt_DontFrag * support larger DNS records by increasing the default buffer size for DNS queries * Lock access to PRCallOnceType members in PR_CallOnce* for thread safety bmo#1686138 * PR_GetSystemInfo supports a new flag PR_SI_RELEASE_BUILD to get information about the operating system build version. Mozilla NSS was updated to version 3.68: * bmo#1713562 - Fix test leak. * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32. * bmo#1693206 - Implement PKCS8 export of ECDSA keys. * bmo#1712883 - DTLS 1.3 draft-43. * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension. * bmo#1713562 - Validate ECH public names. * bmo#1717610 - Add function to get seconds from epoch from pkix::Time. update to NSS 3.67 * bmo#1683710 - Add a means to disable ALPN. * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66). * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja. * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c. * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte. update to NSS 3.66 * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS. * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority. * bmo#1708307 - Remove Trustis FPS Root CA from NSS. * bmo#1707097 - Add Certum Trusted Root CA to NSS. * bmo#1707097 - Add Certum EC-384 CA to NSS. * bmo#1703942 - Add ANF Secure Server Root CA to NSS. * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS. * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database. * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler. * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h. * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators. * bmo#1709291 - Add VerifyCodeSigningCertificateChain. update to NSS 3.65 * bmo#1709654 - Update for NetBSD configuration. * bmo#1709750 - Disable HPKE test when fuzzing. * bmo#1566124 - Optimize AES-GCM for ppc64le. * bmo#1699021 - Add AES-256-GCM to HPKE. * bmo#1698419 - ECH -10 updates. * bmo#1692930 - Update HPKE to final version. * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default. * bmo#1703936 - New coverity/cpp scanner errors. * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards. * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms. * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens. update to NSS 3.64 * bmo#1705286 - Properly detect mips64. * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and disable_crypto_vsx. * bmo#1698320 - replace __builtin_cpu_supports("vsx") with ppc_crypto_support() for clang. * bmo#1613235 - Add POWER ChaCha20 stream cipher vector acceleration. Fixed in 3.63 * bmo#1697380 - Make a clang-format run on top of helpful contributions. * bmo#1683520 - ECCKiila P384, change syntax of nested structs initialization to prevent build isses with GCC 4.8. * bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual scalar multiplication. * bmo#1683520 - ECCKiila P521, change syntax of nested structs initialization to prevent build isses with GCC 4.8. * bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual scalar multiplication. * bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683. * bmo#1694214 - tstclnt can't enable middlebox compat mode. * bmo#1694392 - NSS does not work with PKCS #11 modules not supporting profiles. * bmo#1685880 - Minor fix to prevent unused variable on early return. * bmo#1685880 - Fix for the gcc compiler version 7 to support setenv with nss build. * bmo#1693217 - Increase nssckbi.h version number for March 2021 batch of root CA changes, CA list version 2.48. * bmo#1692094 - Set email distrust after to 21-03-01 for Camerfirma's 'Chambers of Commerce' and 'Global Chambersign' roots. * bmo#1618407 - Symantec root certs - Set CKA_NSS_EMAIL_DISTRUST_AFTER. * bmo#1693173 - Add GlobalSign R45, E45, R46, and E46 root certs to NSS. * bmo#1683738 - Add AC RAIZ FNMT-RCM SERVIDORES SEGUROS root cert to NSS. * bmo#1686854 - Remove GeoTrust PCA-G2 and VeriSign Universal root certs from NSS. * bmo#1687822 - Turn off Websites trust bit for the ��Staat der Nederlanden Root CA - G3�� root cert in NSS. * bmo#1692094 - Turn off Websites Trust Bit for 'Chambers of Commerce Root - 2008' and 'Global Chambersign Root - 2008��. * bmo#1694291 - Tracing fixes for ECH. update to NSS 3.62 * bmo#1688374 - Fix parallel build NSS-3.61 with make * bmo#1682044 - pkix_Build_GatherCerts() + pkix_CacheCert_Add() can corrupt "cachedCertTable" * bmo#1690583 - Fix CH padding extension size calculation * bmo#1690421 - Adjust 3.62 ABI report formatting for new libabigail * bmo#1690421 - Install packaged libabigail in docker-builds image * bmo#1689228 - Minor ECH -09 fixes for interop testing, fuzzing * bmo#1674819 - Fixup a51fae403328, enum type may be signed * bmo#1681585 - Add ECH support to selfserv * bmo#1681585 - Update ECH to Draft-09 * bmo#1678398 - Add Export/Import functions for HPKE context * bmo#1678398 - Update HPKE to draft-07 update to NSS 3.61 * bmo#1682071 - Fix issue with IKE Quick mode deriving incorrect key values under certain conditions. * bmo#1684300 - Fix default PBE iteration count when NSS is compiled with NSS_DISABLE_DBM. * bmo#1651411 - Improve constant-timeness in RSA operations. * bmo#1677207 - Upgrade Google Test version to latest release. * bmo#1654332 - Add aarch64-make target to nss-try. Update to NSS 3.60.1: Notable changes in NSS 3.60: * TLS 1.3 Encrypted Client Hello (draft-ietf-tls-esni-08) support has been added, replacing the previous ESNI (draft-ietf-tls-esni-01) implementation. See bmo#1654332 for more information. * December 2020 batch of Root CA changes, builtins library updated to version 2.46. See bmo#1678189, bmo#1678166, and bmo#1670769 for more information. Update to NSS 3.59.1: * bmo#1679290 - Fix potential deadlock with certain third-party PKCS11 modules Update to NSS 3.59: Notable changes: * Exported two existing functions from libnss: CERT_AddCertToListHeadWithData and CERT_AddCertToListTailWithData Bugfixes * bmo#1607449 - Lock cert->nssCertificate to prevent a potential data race * bmo#1672823 - Add Wycheproof test cases for HMAC, HKDF, and DSA * bmo#1663661 - Guard against NULL token in nssSlot_IsTokenPresent * bmo#1670835 - Support enabling and disabling signatures via Crypto Policy * bmo#1672291 - Resolve libpkix OCSP failures on SHA1 self-signed root certs when SHA1 signatures are disabled. * bmo#1644209 - Fix broken SelectedCipherSuiteReplacer filter to solve some test intermittents * bmo#1672703 - Tolerate the first CCS in TLS 1.3 to fix a regression in our CVE-2020-25648 fix that broke purple-discord (boo#1179382) * bmo#1666891 - Support key wrap/unwrap with RSA-OAEP * bmo#1667989 - Fix gyp linking on Solaris * bmo#1668123 - Export CERT_AddCertToListHeadWithData and CERT_AddCertToListTailWithData from libnss * bmo#1634584 - Set CKA_NSS_SERVER_DISTRUST_AFTER for Trustis FPS Root CA * bmo#1663091 - Remove unnecessary assertions in the streaming ASN.1 decoder that affected decoding certain PKCS8 private keys when using NSS debug builds * bmo#670839 - Use ARM crypto extension for AES, SHA1 and SHA2 on MacOS. update to NSS 3.58 Bugs fixed: * bmo#1641480 (CVE-2020-25648) Tighten CCS handling for middlebox compatibility mode. * bmo#1631890 - Add support for Hybrid Public Key Encryption (draft-irtf-cfrg-hpke) support for TLS Encrypted Client Hello (draft-ietf-tls-esni). * bmo#1657255 - Add CI tests that disable SHA1/SHA2 ARM crypto extensions. * bmo#1668328 - Handle spaces in the Python path name when using gyp on Windows. * bmo#1667153 - Add PK11_ImportDataKey for data object import. * bmo#1665715 - Pass the embedded SCT list extension (if present) to TrustDomain::CheckRevocation instead of the notBefore value. update to NSS 3.57 * The following CA certificates were Added: bmo#1663049 - CN=Trustwave Global Certification Authority SHA-256 Fingerprint: 97552015F5DDFC3C8788C006944555408894450084F100867086BC1A2BB58DC8 bmo#1663049 - CN=Trustwave Global ECC P256 Certification Authority SHA-256 Fingerprint: 945BBC825EA554F489D1FD51A73DDF2EA624AC7019A05205225C22A78CCFA8B4 bmo#1663049 - CN=Trustwave Global ECC P384 Certification Authority SHA-256 Fingerprint: 55903859C8C0C3EBB8759ECE4E2557225FF5758BBD38EBD48276601E1BD58097 * The following CA certificates were Removed: bmo#1651211 - CN=EE Certification Centre Root CA SHA-256 Fingerprint: 3E84BA4342908516E77573C0992F0979CA084E4685681FF195CCBA8A229B8A76 bmo#1656077 - O=Government Root Certification Authority; C=TW SHA-256 Fingerprint: 7600295EEFE85B9E1FD624DB76062AAAAE59818A54D2774CD4C0B2C01131E1B3 * Trust settings for the following CA certificates were Modified: bmo#1653092 - CN=OISTE WISeKey Global Root GA CA Websites (server authentication) trust bit removed. * https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.57_rele ase_notes update to NSS 3.56 Notable changes * bmo#1650702 - Support SHA-1 HW acceleration on ARMv8 * bmo#1656981 - Use MPI comba and mulq optimizations on x86-64 MacOS. * bmo#1654142 - Add CPU feature detection for Intel SHA extension. * bmo#1648822 - Add stricter validation of DH keys in FIPS mode. * bmo#1656986 - Properly detect arm64 during GYP build architecture detection. * bmo#1652729 - Add build flag to disable RC2 and relocate to lib/freebl/deprecated. * bmo#1656429 - Correct RTT estimate used in 0-RTT anti-replay. * bmo#1588941 - Send empty certificate message when scheme selection fails. * bmo#1652032 - Fix failure to build in Windows arm64 makefile cross-compilation. * bmo#1625791 - Fix deadlock issue in nssSlot_IsTokenPresent. * bmo#1653975 - Fix 3.53 regression by setting "all" as the default makefile target. * bmo#1659792 - Fix broken libpkix tests with unexpired PayPal cert. * bmo#1659814 - Fix interop.sh failures with newer tls-interop commit and dependencies. * bmo#1656519 - NSPR dependency updated to 4.28 update to NSS 3.55 Notable changes * P384 and P521 elliptic curve implementations are replaced with verifiable implementations from Fiat-Crypto [0] and ECCKiila [1]. * PK11_FindCertInSlot is added. With this function, a given slot can be queried with a DER-Encoded certificate, providing performance and usability improvements over other mechanisms. (bmo#1649633) * DTLS 1.3 implementation is updated to draft-38. (bmo#1647752) Relevant Bugfixes * bmo#1631583 (CVE-2020-6829, CVE-2020-12400) - Replace P384 and P521 with new, verifiable implementations from Fiat-Crypto and ECCKiila. * bmo#1649487 - Move overzealous assertion in VFY_EndWithSignature. * bmo#1631573 (CVE-2020-12401) - Remove unnecessary scalar padding. * bmo#1636771 (CVE-2020-12403) - Explicitly disable multi-part ChaCha20 (which was not functioning correctly) and more strictly enforce tag length. * bmo#1649648 - Don't memcpy zero bytes (sanitizer fix). * bmo#1649316 - Don't memcpy zero bytes (sanitizer fix). * bmo#1649322 - Don't memcpy zero bytes (sanitizer fix). * bmo#1653202 - Fix initialization bug in blapitest when compiled with NSS_DISABLE_DEPRECATED_SEED. * bmo#1646594 - Fix AVX2 detection in makefile builds. * bmo#1649633 - Add PK11_FindCertInSlot to search a given slot for a DER-encoded certificate. * bmo#1651520 - Fix slotLock race in NSC_GetTokenInfo. * bmo#1647752 - Update DTLS 1.3 implementation to draft-38. * bmo#1649190 - Run cipher, sdr, and ocsp tests under standard test cycle in CI. * bmo#1649226 - Add Wycheproof ECDSA tests. * bmo#1637222 - Consistently enforce IV requirements for DES and 3DES. * bmo#1067214 - Enforce minimum PKCS#1 v1.5 padding length in RSA_CheckSignRecover. * bmo#1646324 - Advertise PKCS#1 schemes for certificates in the signature_algorithms extension. update to NSS 3.54 Notable changes * Support for TLS 1.3 external pre-shared keys (bmo#1603042). * Use ARM Cryptography Extension for SHA256, when available (bmo#1528113) * The following CA certificates were Added: bmo#1645186 - certSIGN Root CA G2. bmo#1645174 - e-Szigno Root CA 2017. bmo#1641716 - Microsoft ECC Root Certificate Authority 2017. bmo#1641716 - Microsoft RSA Root Certificate Authority 2017. * The following CA certificates were Removed: bmo#1645199 - AddTrust Class 1 CA Root. bmo#1645199 - AddTrust External CA Root. bmo#1641718 - LuxTrust Global Root 2. bmo#1639987 - Staat der Nederlanden Root CA - G2. bmo#1618402 - Symantec Class 2 Public Primary Certification Authority - G4. bmo#1618402 - Symantec Class 1 Public Primary Certification Authority - G4. bmo#1618402 - VeriSign Class 3 Public Primary Certification Authority - G3. * A number of certificates had their Email trust bit disabled. See bmo#1618402 for a complete list. Bugs fixed * bmo#1528113 - Use ARM Cryptography Extension for SHA256. * bmo#1603042 - Add TLS 1.3 external PSK support. * bmo#1642802 - Add uint128 support for HACL* curve25519 on Windows. * bmo#1645186 - Add "certSIGN Root CA G2" root certificate. * bmo#1645174 - Add Microsec's "e-Szigno Root CA 2017" root certificate. * bmo#1641716 - Add Microsoft's non-EV root certificates. * bmo1621151 - Disable email trust bit for "O=Government Root Certification Authority; C=TW" root. * bmo#1645199 - Remove AddTrust root certificates. * bmo#1641718 - Remove "LuxTrust Global Root 2" root certificate. * bmo#1639987 - Remove "Staat der Nederlanden Root CA - G2" root certificate. * bmo#1618402 - Remove Symantec root certificates and disable email trust bit. * bmo#1640516 - NSS 3.54 should depend on NSPR 4.26. * bmo#1642146 - Fix undefined reference to `PORT_ZAlloc_stub' in seed.c. * bmo#1642153 - Fix infinite recursion building NSS. * bmo#1642638 - Fix fuzzing assertion crash. * bmo#1642871 - Enable SSL_SendSessionTicket after resumption. * bmo#1643123 - Support SSL_ExportEarlyKeyingMaterial with External PSKs. * bmo#1643557 - Fix numerous compile warnings in NSS. * bmo#1644774 - SSL gtests to use ClearServerCache when resetting self-encrypt keys. * bmo#1645479 - Don't use SECITEM_MakeItem in secutil.c. * bmo#1646520 - Stricter enforcement of ASN.1 INTEGER encoding. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3115=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libfreebl3-3.68-3.56.1 libfreebl3-debuginfo-3.68-3.56.1 libfreebl3-hmac-3.68-3.56.1 libsoftokn3-3.68-3.56.1 libsoftokn3-debuginfo-3.68-3.56.1 libsoftokn3-hmac-3.68-3.56.1 mozilla-nspr-4.32-3.20.1 mozilla-nspr-debuginfo-4.32-3.20.1 mozilla-nspr-debugsource-4.32-3.20.1 mozilla-nspr-devel-4.32-3.20.1 mozilla-nss-3.68-3.56.1 mozilla-nss-certs-3.68-3.56.1 mozilla-nss-certs-debuginfo-3.68-3.56.1 mozilla-nss-debuginfo-3.68-3.56.1 mozilla-nss-debugsource-3.68-3.56.1 mozilla-nss-devel-3.68-3.56.1 mozilla-nss-sysinit-3.68-3.56.1 mozilla-nss-sysinit-debuginfo-3.68-3.56.1 mozilla-nss-tools-3.68-3.56.1 mozilla-nss-tools-debuginfo-3.68-3.56.1 - openSUSE Leap 15.3 (x86_64): libfreebl3-32bit-3.68-3.56.1 libfreebl3-32bit-debuginfo-3.68-3.56.1 libfreebl3-hmac-32bit-3.68-3.56.1 libsoftokn3-32bit-3.68-3.56.1 libsoftokn3-32bit-debuginfo-3.68-3.56.1 libsoftokn3-hmac-32bit-3.68-3.56.1 mozilla-nspr-32bit-4.32-3.20.1 mozilla-nspr-32bit-debuginfo-4.32-3.20.1 mozilla-nss-32bit-3.68-3.56.1 mozilla-nss-32bit-debuginfo-3.68-3.56.1 mozilla-nss-certs-32bit-3.68-3.56.1 mozilla-nss-certs-32bit-debuginfo-3.68-3.56.1 mozilla-nss-sysinit-32bit-3.68-3.56.1 mozilla-nss-sysinit-32bit-debuginfo-3.68-3.56.1 References: https://bugzilla.suse.com/1029961 https://bugzilla.suse.com/1174697 https://bugzilla.suse.com/1176206 https://bugzilla.suse.com/1176934 https://bugzilla.suse.com/1179382 https://bugzilla.suse.com/1188891

1 0

openSUSE-SU-2021:1274-1: important: Security update for fail2ban
by opensuse-security＠opensuse.org 16 Sep '21

16 Sep '21

openSUSE Security Update: Security update for fail2ban ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1274-1 Rating: important References: #1145181 #1146856 #1180738 #1188610 Cross-References: CVE-2021-32749 CVSS scores: CVE-2021-32749 (NVD) : 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 openSUSE Backports SLE-15-SP3 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update for fail2ban fixes the following issues: - CVE-2021-32749: prevent a command injection via mail command (boo#1188610) - Integrate change to resolve boo#1146856 and boo#1180738 Update to 0.11.2 - increased stability, filter and action updates New Features and Enhancements * fail2ban-regex: - speedup formatted output (bypass unneeded stats creation) - extended with prefregex statistic - more informative output for `datepattern` (e. g. set from filter) - pattern : description * parsing of action in jail-configs considers space between action-names as separator also (previously only new-line was allowed), for example `action = a b` would specify 2 actions `a` and `b` * new filter and jail for GitLab recognizing failed application logins (gh#fail2ban/fail2ban#2689) * new filter and jail for Grafana recognizing failed application logins (gh#fail2ban/fail2ban#2855) * new filter and jail for SoftEtherVPN recognizing failed application logins (gh#fail2ban/fail2ban#2723) * `filter.d/guacamole.conf` extended with `logging` parameter to follow webapp-logging if it's configured (gh#fail2ban/fail2ban#2631) * `filter.d/bitwarden.conf` enhanced to support syslog (gh#fail2ban/fail2ban#2778) * introduced new prefix `{UNB}` for `datepattern` to disable word boundaries in regex; * datetemplate: improved anchor detection for capturing groups `(^...)`; * datepattern: improved handling with wrong recognized timestamps (timezones, no datepattern, etc) as well as some warnings signaling user about invalid pattern or zone (gh#fail2ban/fail2ban#2814): - filter gets mode in-operation, which gets activated if filter starts processing of new messages; in this mode a timestamp read from log-line that appeared recently (not an old line), deviating too much from now (up too 24h), will be considered as now (assuming a timezone issue), so could avoid unexpected bypass of failure (previously exceeding `findtime`); - better interaction with non-matching optional datepattern or invalid timestamps; - implements special datepattern `{NONE}` - allow to find failures totally without date-time in log messages, whereas filter will use now as timestamp (gh#fail2ban/fail2ban#2802) * performance optimization of `datepattern` (better search algorithm in datedetector, especially for single template); * fail2ban-client: extended to unban IP range(s) by subnet (CIDR/mask) or hostname (DNS), gh#fail2ban/fail2ban#2791; * extended capturing of alternate tags in filter, allowing combine of multiple groups to single tuple token with new tag prefix `<F-TUPLE_`, that would combine value of `<F-V>` with all value of `<F-TUPLE_V?_n?>` tags (gh#fail2ban/fail2ban#2755) - Fixes * [stability] prevent race condition - no ban if filter (backend) is continuously busy if too many messages will be found in log, e. g. initial scan of large log-file or journal (gh#fail2ban/fail2ban#2660) * pyinotify-backend sporadically avoided initial scanning of log-file by start * python 3.9 compatibility (and Travis CI support) * restoring a large number (500+ depending on files ulimit) of current bans when using PyPy fixed * manual ban is written to database, so can be restored by restart (gh#fail2ban/fail2ban#2647) * `jail.conf`: don't specify `action` directly in jails (use `action_` or `banaction` instead) * no mails-action added per default anymore (e. g. to allow that `action = %(action_mw)s` should be specified per jail or in default section in jail.local), closes gh#fail2ban/fail2ban#2357 * ensure we've unique action name per jail (also if parameter `actname` is not set but name deviates from standard name, gh#fail2ban/fail2ban#2686) * don't use `%(banaction)s` interpolation because it can be complex value (containing `[...]` and/or quotes), so would bother the action interpolation * fixed type conversion in config readers (take place after all interpolations get ready), that allows to specify typed parameters variable (as substitutions) as well as to supply it in other sections or as init parameters. * `action.d/*-ipset*.conf`: several ipset actions fixed (no timeout per default anymore), so no discrepancy between ipset and fail2ban (removal from ipset will be managed by fail2ban only, gh#fail2ban/fail2ban#2703) * `action.d/cloudflare.conf`: fixed `actionunban` (considering new-line chars and optionally real json-parsing with `jq`, gh#fail2ban/fail2ban#2140, gh#fail2ban/fail2ban#2656) * `action.d/nftables.conf` (type=multiport only): fixed port range selector, replacing `:` with `-` (gh#fail2ban/fail2ban#2763) * `action.d/firewallcmd-*.conf` (multiport only): fixed port range selector, replacing `:` with `-` (gh#fail2ban/fail2ban#2821) * `action.d/bsd-ipfw.conf`: fixed selection of rule-no by large list or initial `lowest_rule_num` (gh#fail2ban/fail2ban#2836) * `filter.d/common.conf`: avoid substitute of default values in related `lt_*` section, `__prefix_line` should be interpolated in definition section (inside the filter-config, gh#fail2ban/fail2ban#2650) * `filter.d/dovecot.conf`: - add managesieve and submission support (gh#fail2ban/fail2ban#2795); - accept messages with more verbose logging (gh#fail2ban/fail2ban#2573); * `filter.d/courier-smtp.conf`: prefregex extended to consider port in log-message (gh#fail2ban/fail2ban#2697) * `filter.d/traefik-auth.conf`: filter extended with parameter mode (`normal`, `ddos`, `aggressive`) to handle the match of username differently (gh#fail2ban/fail2ban#2693): - `normal`: matches 401 with supplied username only - `ddos`: matches 401 without supplied username only - `aggressive`: matches 401 and any variant (with and without username) * `filter.d/sshd.conf`: normalizing of user pattern in all RE's, allowing empty user (gh#fail2ban/fail2ban#2749) Update to 0.11.1: * Increment ban time (+ observer) functionality introduced. * Database functionality extended with bad ips. * New tags (usable in actions): - `<bancount>` - ban count of this offender if known as bad (started by 1 for unknown) - `<bantime>` - current ban-time of the ticket (prolongation can be retarded up to 10 sec.) * Introduced new action command `actionprolong` to prolong ban-time (e. g. set new timeout if expected); * algorithm of restore current bans after restart changed: update the restored ban-time (and therefore end of ban) of the ticket with ban-time of jail (as maximum), for all tickets with ban-time greater (or persistent) * added new setup-option `--without-tests` to skip building and installing of tests files (gh-2287). * added new command `fail2ban-client get <JAIL> banip ?sep-char|--with-time?` to get the banned ip addresses (gh-1916). * purge database will be executed now (within observer). restoring currently banned ip after service restart fixed (now < timeofban + bantime), ignore old log failures (already banned) * upgrade database: update new created table `bips` with entries from table `bans` (allows restore current bans after upgrade from version <= 0.10) - removal of SuSEfirewall2-fail2ban for factory versions since SuSEfirewall2 will be removed from Factory (see sr#713247): * removed references to SuSEfirewall2 service * use references to SuSEfirewall2 only for older distributions * Removed installation recommendation of the fail2ban-SuSEfirewall2 package for all distributions as it is deprecated. - changed fail2ban unit file location (boo#1145181, gh#fail2ban/fail2ban#2474) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1274=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1274=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1274=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-1274=1 Package List: - openSUSE Leap 15.2 (noarch): fail2ban-0.11.2-lp152.3.3.1 monitoring-plugins-fail2ban-0.11.2-lp152.3.3.1 - openSUSE Backports SLE-15-SP3 (noarch): fail2ban-0.11.2-bp153.2.3.1 monitoring-plugins-fail2ban-0.11.2-bp153.2.3.1 - openSUSE Backports SLE-15-SP2 (noarch): fail2ban-0.11.2-bp152.4.3.1 monitoring-plugins-fail2ban-0.11.2-bp152.4.3.1 - openSUSE Backports SLE-15-SP1 (noarch): fail2ban-0.11.2-bp151.3.3.1 monitoring-plugins-fail2ban-0.11.2-bp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2021-32749.html https://bugzilla.suse.com/1145181 https://bugzilla.suse.com/1146856 https://bugzilla.suse.com/1180738 https://bugzilla.suse.com/1188610

1 0