September 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2021:1300-1: important: Security update for chromium
by opensuse-security＠opensuse.org 22 Sep '21

22 Sep '21

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1300-1 Rating: important References: #1190096 #1190476 Cross-References: CVE-2021-30606 CVE-2021-30607 CVE-2021-30608 CVE-2021-30609 CVE-2021-30610 CVE-2021-30611 CVE-2021-30612 CVE-2021-30613 CVE-2021-30614 CVE-2021-30615 CVE-2021-30616 CVE-2021-30617 CVE-2021-30618 CVE-2021-30619 CVE-2021-30620 CVE-2021-30621 CVE-2021-30622 CVE-2021-30623 CVE-2021-30624 CVE-2021-30625 CVE-2021-30626 CVE-2021-30627 CVE-2021-30628 CVE-2021-30629 CVE-2021-30630 CVE-2021-30631 CVE-2021-30632 CVE-2021-30633 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes 28 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium 93.0.4577.63 (boo#1190096): * CVE-2021-30606: Use after free in Blink * CVE-2021-30607: Use after free in Permissions * CVE-2021-30608: Use after free in Web Share * CVE-2021-30609: Use after free in Sign-In * CVE-2021-30610: Use after free in Extensions API * CVE-2021-30611: Use after free in WebRTC * CVE-2021-30612: Use after free in WebRTC * CVE-2021-30613: Use after free in Base internals * CVE-2021-30614: Heap buffer overflow in TabStrip * CVE-2021-30615: Cross-origin data leak in Navigation * CVE-2021-30616: Use after free in Media * CVE-2021-30617: Policy bypass in Blink * CVE-2021-30618: Inappropriate implementation in DevTools * CVE-2021-30619: UI Spoofing in Autofill * CVE-2021-30620: Insufficient policy enforcement in Blink * CVE-2021-30621: UI Spoofing in Autofill * CVE-2021-30622: Use after free in WebApp Installs * CVE-2021-30623: Use after free in Bookmarks * CVE-2021-30624: Use after free in Autofill Chromium 93.0.4577.82 (boo#1190476): * CVE-2021-30625: Use after free in Selection API * CVE-2021-30626: Out of bounds memory access in ANGLE * CVE-2021-30627: Type Confusion in Blink layout * CVE-2021-30628: Stack buffer overflow in ANGLE * CVE-2021-30629: Use after free in Permissions * CVE-2021-30630: Inappropriate implementation in Blink * CVE-2021-30631: Type Confusion in Blink layout * CVE-2021-30632: Out of bounds write in V8 * CVE-2021-30633: Use after free in Indexed DB API Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1300=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 x86_64): chromedriver-93.0.4577.82-bp153.2.28.1 chromium-93.0.4577.82-bp153.2.28.1 References: https://www.suse.com/security/cve/CVE-2021-30606.html https://www.suse.com/security/cve/CVE-2021-30607.html https://www.suse.com/security/cve/CVE-2021-30608.html https://www.suse.com/security/cve/CVE-2021-30609.html https://www.suse.com/security/cve/CVE-2021-30610.html https://www.suse.com/security/cve/CVE-2021-30611.html https://www.suse.com/security/cve/CVE-2021-30612.html https://www.suse.com/security/cve/CVE-2021-30613.html https://www.suse.com/security/cve/CVE-2021-30614.html https://www.suse.com/security/cve/CVE-2021-30615.html https://www.suse.com/security/cve/CVE-2021-30616.html https://www.suse.com/security/cve/CVE-2021-30617.html https://www.suse.com/security/cve/CVE-2021-30618.html https://www.suse.com/security/cve/CVE-2021-30619.html https://www.suse.com/security/cve/CVE-2021-30620.html https://www.suse.com/security/cve/CVE-2021-30621.html https://www.suse.com/security/cve/CVE-2021-30622.html https://www.suse.com/security/cve/CVE-2021-30623.html https://www.suse.com/security/cve/CVE-2021-30624.html https://www.suse.com/security/cve/CVE-2021-30625.html https://www.suse.com/security/cve/CVE-2021-30626.html https://www.suse.com/security/cve/CVE-2021-30627.html https://www.suse.com/security/cve/CVE-2021-30628.html https://www.suse.com/security/cve/CVE-2021-30629.html https://www.suse.com/security/cve/CVE-2021-30630.html https://www.suse.com/security/cve/CVE-2021-30631.html https://www.suse.com/security/cve/CVE-2021-30632.html https://www.suse.com/security/cve/CVE-2021-30633.html https://bugzilla.suse.com/1190096 https://bugzilla.suse.com/1190476

1 0

openSUSE-RU-2021:1302-1: moderate: Recommended update for gedit-plugins
by maintenance＠opensuse.org 22 Sep '21

22 Sep '21

openSUSE Recommended Update: Recommended update for gedit-plugins ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1302-1 Rating: moderate References: #1174749 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gedit-plugins fixes the following issues: - VTE changed its API which makes change directory of terminal failed, this patch updates arguments to match VTE's API (boo#1174749, glgo#GNOME/gedit-plugins#1). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1302=1 Package List: - openSUSE Leap 15.2 (x86_64): gedit-plugin-bookmarks-3.28.1-lp152.4.3.1 gedit-plugin-bookmarks-debuginfo-3.28.1-lp152.4.3.1 gedit-plugin-bracketcompletion-3.28.1-lp152.4.3.1 gedit-plugin-charmap-3.28.1-lp152.4.3.1 gedit-plugin-codecomment-3.28.1-lp152.4.3.1 gedit-plugin-colorpicker-3.28.1-lp152.4.3.1 gedit-plugin-colorschemer-3.28.1-lp152.4.3.1 gedit-plugin-commander-3.28.1-lp152.4.3.1 gedit-plugin-dashboard-3.28.1-lp152.4.3.1 gedit-plugin-drawspaces-3.28.1-lp152.4.3.1 gedit-plugin-drawspaces-debuginfo-3.28.1-lp152.4.3.1 gedit-plugin-findinfiles-3.28.1-lp152.4.3.1 gedit-plugin-findinfiles-debuginfo-3.28.1-lp152.4.3.1 gedit-plugin-git-3.28.1-lp152.4.3.1 gedit-plugin-joinlines-3.28.1-lp152.4.3.1 gedit-plugin-multiedit-3.28.1-lp152.4.3.1 gedit-plugin-smartspaces-3.28.1-lp152.4.3.1 gedit-plugin-synctex-3.28.1-lp152.4.3.1 gedit-plugin-terminal-3.28.1-lp152.4.3.1 gedit-plugin-textsize-3.28.1-lp152.4.3.1 gedit-plugin-translate-3.28.1-lp152.4.3.1 gedit-plugin-wordcompletion-3.28.1-lp152.4.3.1 gedit-plugin-wordcompletion-debuginfo-3.28.1-lp152.4.3.1 gedit-plugin-zeitgeist-3.28.1-lp152.4.3.1 gedit-plugin-zeitgeist-debuginfo-3.28.1-lp152.4.3.1 gedit-plugins-3.28.1-lp152.4.3.1 gedit-plugins-data-3.28.1-lp152.4.3.1 gedit-plugins-debuginfo-3.28.1-lp152.4.3.1 gedit-plugins-debugsource-3.28.1-lp152.4.3.1 - openSUSE Leap 15.2 (noarch): gedit-plugins-lang-3.28.1-lp152.4.3.1 References: https://bugzilla.suse.com/1174749

1 0

openSUSE-SU-2021:1301-1: moderate: Security update for xen
by opensuse-security＠opensuse.org 22 Sep '21

22 Sep '21

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1301-1 Rating: moderate References: #1027519 #1189632 Cross-References: CVE-2021-28701 CVSS scores: CVE-2021-28701 (SUSE): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for xen fixes the following issues: - CVE-2021-28701: Fixed race condition in XENMAPSPACE_grant_table handling (XSA-384) (bsc#1189632). - Upstream bug fixes (bsc#1027519) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1301=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): xen-debugsource-4.13.3_04-lp152.2.30.1 xen-devel-4.13.3_04-lp152.2.30.1 xen-libs-4.13.3_04-lp152.2.30.1 xen-libs-debuginfo-4.13.3_04-lp152.2.30.1 xen-tools-domU-4.13.3_04-lp152.2.30.1 xen-tools-domU-debuginfo-4.13.3_04-lp152.2.30.1 - openSUSE Leap 15.2 (noarch): xen-tools-xendomains-wait-disk-4.13.3_04-lp152.2.30.1 - openSUSE Leap 15.2 (x86_64): xen-4.13.3_04-lp152.2.30.1 xen-doc-html-4.13.3_04-lp152.2.30.1 xen-libs-32bit-4.13.3_04-lp152.2.30.1 xen-libs-32bit-debuginfo-4.13.3_04-lp152.2.30.1 xen-tools-4.13.3_04-lp152.2.30.1 xen-tools-debuginfo-4.13.3_04-lp152.2.30.1 References: https://www.suse.com/security/cve/CVE-2021-28701.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1189632

1 0

openSUSE-RU-2021:1298-1: moderate: Recommended update for salt
by maintenance＠opensuse.org 21 Sep '21

21 Sep '21

openSUSE Recommended Update: Recommended update for salt ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1298-1 Rating: moderate References: #1168327 #1188259 #1188647 #1189040 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for salt fixes the following issues: - Fix wrong relative paths resolution with Jinja renderer when importing subdirectories - Don't pass 'shell="/sbin/nologin"' to 'onlyif/unless' checks (bsc#1188259) - Add missing 'aarch64' to rpm package architectures - Fix failing tests for 'CMDRunRedirect' - Fix failing unit test for systemd - Fix error handling in openscap module (bsc#1188647) - Better handling of bad public keys from minions (bsc#1189040) - Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1298=1 Package List: - openSUSE Leap 15.2 (noarch): salt-bash-completion-3002.2-lp152.3.42.1 salt-fish-completion-3002.2-lp152.3.42.1 salt-zsh-completion-3002.2-lp152.3.42.1 - openSUSE Leap 15.2 (x86_64): python3-salt-3002.2-lp152.3.42.1 salt-3002.2-lp152.3.42.1 salt-api-3002.2-lp152.3.42.1 salt-cloud-3002.2-lp152.3.42.1 salt-doc-3002.2-lp152.3.42.1 salt-master-3002.2-lp152.3.42.1 salt-minion-3002.2-lp152.3.42.1 salt-proxy-3002.2-lp152.3.42.1 salt-ssh-3002.2-lp152.3.42.1 salt-standalone-formulas-configuration-3002.2-lp152.3.42.1 salt-syndic-3002.2-lp152.3.42.1 salt-transactional-update-3002.2-lp152.3.42.1 References: https://bugzilla.suse.com/1168327 https://bugzilla.suse.com/1188259 https://bugzilla.suse.com/1188647 https://bugzilla.suse.com/1189040

1 0

openSUSE-SU-2021:1294-1: moderate: Security update for libcroco
by opensuse-security＠opensuse.org 21 Sep '21

21 Sep '21

openSUSE Security Update: Security update for libcroco ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1294-1 Rating: moderate References: #1171685 Cross-References: CVE-2020-12825 CVSS scores: CVE-2020-12825 (NVD) : 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H CVE-2020-12825 (SUSE): 2.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libcroco fixes the following issues: - CVE-2020-12825: Fixed recursion issue in block and any productions (bsc#1171685). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1294=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libcroco-0.6.13-lp152.2.3.1 libcroco-0_6-3-0.6.13-lp152.2.3.1 libcroco-0_6-3-debuginfo-0.6.13-lp152.2.3.1 libcroco-debuginfo-0.6.13-lp152.2.3.1 libcroco-debugsource-0.6.13-lp152.2.3.1 libcroco-devel-0.6.13-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): libcroco-0_6-3-32bit-0.6.13-lp152.2.3.1 libcroco-0_6-3-32bit-debuginfo-0.6.13-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-12825.html https://bugzilla.suse.com/1171685

1 0

openSUSE-RU-2021:1297-1: moderate: Recommended update for rpmlint
by maintenance＠opensuse.org 21 Sep '21

21 Sep '21

openSUSE Recommended Update: Recommended update for rpmlint ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1297-1 Rating: moderate References: #1169494 #1189106 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for rpmlint fixes the following issues: - Backport whitelisting of oddjob (bsc#1189106, bsc#1169494). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1297=1 Package List: - openSUSE Leap 15.2 (x86_64): rpmlint-tests-debugsource-84.87+git20181018.60e0249-lp152.12.9.1 - openSUSE Leap 15.2 (noarch): rpmlint-1.10-lp152.12.9.1 References: https://bugzilla.suse.com/1169494 https://bugzilla.suse.com/1189106

1 0

openSUSE-RU-2021:1296-1: moderate: Recommended update for xorg-x11-fonts
by maintenance＠opensuse.org 21 Sep '21

21 Sep '21

openSUSE Recommended Update: Recommended update for xorg-x11-fonts ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1296-1 Rating: moderate References: #1174895 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for xorg-x11-fonts fixes the following issues: - Convert the 'helv*.otb' and 'cour*.otb' files in a different way, generating all available font sizes. (bsc#1174895) - As part of the above fix, don't remove the "Regular" suffix from the full name of fonts in 'convertfont.py' This update for fonttosfnt fixes the following issues: - Fix more metric calculations (bsc#1174895): This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1296=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): fonttosfnt-1.1.0-lp152.2.5.1 fonttosfnt-debuginfo-1.1.0-lp152.2.5.1 fonttosfnt-debugsource-1.1.0-lp152.2.5.1 - openSUSE Leap 15.2 (noarch): xorg-x11-fonts-7.6-lp152.7.6.1 xorg-x11-fonts-converted-7.6-lp152.7.6.1 xorg-x11-fonts-core-7.6-lp152.7.6.1 xorg-x11-fonts-legacy-7.6-lp152.7.6.1 References: https://bugzilla.suse.com/1174895

1 0

openSUSE-RU-2021:1295-1: moderate: Recommended update for gimp
by maintenance＠opensuse.org 21 Sep '21

21 Sep '21

openSUSE Recommended Update: Recommended update for gimp ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1295-1 Rating: moderate References: #1178726 #1180362 #1180770 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for gimp fixes the following issues: - Recurse directories when looking for python plugins (bsc#1180362) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1295=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): gimp-2.10.12-lp152.2.6.1 gimp-debuginfo-2.10.12-lp152.2.6.1 gimp-debugsource-2.10.12-lp152.2.6.1 gimp-devel-2.10.12-lp152.2.6.1 gimp-devel-debuginfo-2.10.12-lp152.2.6.1 gimp-plugin-aa-2.10.12-lp152.2.6.1 gimp-plugin-aa-debuginfo-2.10.12-lp152.2.6.1 gimp-plugins-python-2.10.12-lp152.2.6.1 gimp-plugins-python-debuginfo-2.10.12-lp152.2.6.1 libgimp-2_0-0-2.10.12-lp152.2.6.1 libgimp-2_0-0-debuginfo-2.10.12-lp152.2.6.1 libgimpui-2_0-0-2.10.12-lp152.2.6.1 libgimpui-2_0-0-debuginfo-2.10.12-lp152.2.6.1 - openSUSE Leap 15.2 (noarch): gimp-lang-2.10.12-lp152.2.6.1 - openSUSE Leap 15.2 (x86_64): libgimp-2_0-0-32bit-2.10.12-lp152.2.6.1 libgimp-2_0-0-32bit-debuginfo-2.10.12-lp152.2.6.1 libgimpui-2_0-0-32bit-2.10.12-lp152.2.6.1 libgimpui-2_0-0-32bit-debuginfo-2.10.12-lp152.2.6.1 References: https://bugzilla.suse.com/1178726 https://bugzilla.suse.com/1180362 https://bugzilla.suse.com/1180770

1 0

openSUSE-RU-2021:1291-1: important: Recommended update for java-11-openjdk
by maintenance＠opensuse.org 21 Sep '21

21 Sep '21

openSUSE Recommended Update: Recommended update for java-11-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1291-1 Rating: important References: #1189201 #1190252 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for java-11-openjdk fixes the following issues: - Implement FIPS support in OpenJDK - Fix build with 'glibc-2.34' (bsc#1189201) - Add support for 'riscv64' (zero VM) - Make NSS the default security provider. (bsc#1190252) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1291=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): java-11-openjdk-11.0.12.0-lp152.2.18.1 java-11-openjdk-accessibility-11.0.12.0-lp152.2.18.1 java-11-openjdk-accessibility-debuginfo-11.0.12.0-lp152.2.18.1 java-11-openjdk-debuginfo-11.0.12.0-lp152.2.18.1 java-11-openjdk-debugsource-11.0.12.0-lp152.2.18.1 java-11-openjdk-demo-11.0.12.0-lp152.2.18.1 java-11-openjdk-devel-11.0.12.0-lp152.2.18.1 java-11-openjdk-headless-11.0.12.0-lp152.2.18.1 java-11-openjdk-jmods-11.0.12.0-lp152.2.18.1 java-11-openjdk-src-11.0.12.0-lp152.2.18.1 - openSUSE Leap 15.2 (noarch): java-11-openjdk-javadoc-11.0.12.0-lp152.2.18.1 References: https://bugzilla.suse.com/1189201 https://bugzilla.suse.com/1190252

1 0

openSUSE-RU-2021:1293-1: moderate: Recommended update for mozilla-nspr, mozilla-nss
by maintenance＠opensuse.org 21 Sep '21

21 Sep '21

openSUSE Recommended Update: Recommended update for mozilla-nspr, mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1293-1 Rating: moderate References: #1029961 #1174697 #1176206 #1176934 #1179382 #1188891 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 6 recommended fixes can now be installed. Description: This update for mozilla-nspr fixes the following issues: mozilla-nspr was updated to version 4.32: * implement new socket option PR_SockOpt_DontFrag * support larger DNS records by increasing the default buffer size for DNS queries * Lock access to PRCallOnceType members in PR_CallOnce* for thread safety bmo#1686138 * PR_GetSystemInfo supports a new flag PR_SI_RELEASE_BUILD to get information about the operating system build version. Mozilla NSS was updated to version 3.68: * bmo#1713562 - Fix test leak. * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32. * bmo#1693206 - Implement PKCS8 export of ECDSA keys. * bmo#1712883 - DTLS 1.3 draft-43. * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension. * bmo#1713562 - Validate ECH public names. * bmo#1717610 - Add function to get seconds from epoch from pkix::Time. update to NSS 3.67 * bmo#1683710 - Add a means to disable ALPN. * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66). * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja. * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c. * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte. update to NSS 3.66 * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS. * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority. * bmo#1708307 - Remove Trustis FPS Root CA from NSS. * bmo#1707097 - Add Certum Trusted Root CA to NSS. * bmo#1707097 - Add Certum EC-384 CA to NSS. * bmo#1703942 - Add ANF Secure Server Root CA to NSS. * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS. * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database. * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler. * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h. * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators. * bmo#1709291 - Add VerifyCodeSigningCertificateChain. update to NSS 3.65 * bmo#1709654 - Update for NetBSD configuration. * bmo#1709750 - Disable HPKE test when fuzzing. * bmo#1566124 - Optimize AES-GCM for ppc64le. * bmo#1699021 - Add AES-256-GCM to HPKE. * bmo#1698419 - ECH -10 updates. * bmo#1692930 - Update HPKE to final version. * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default. * bmo#1703936 - New coverity/cpp scanner errors. * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards. * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms. * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens. update to NSS 3.64 * bmo#1705286 - Properly detect mips64. * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and disable_crypto_vsx. * bmo#1698320 - replace __builtin_cpu_supports("vsx") with ppc_crypto_support() for clang. * bmo#1613235 - Add POWER ChaCha20 stream cipher vector acceleration. Fixed in 3.63 * bmo#1697380 - Make a clang-format run on top of helpful contributions. * bmo#1683520 - ECCKiila P384, change syntax of nested structs initialization to prevent build isses with GCC 4.8. * bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual scalar multiplication. * bmo#1683520 - ECCKiila P521, change syntax of nested structs initialization to prevent build isses with GCC 4.8. * bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual scalar multiplication. * bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683. * bmo#1694214 - tstclnt can't enable middlebox compat mode. * bmo#1694392 - NSS does not work with PKCS #11 modules not supporting profiles. * bmo#1685880 - Minor fix to prevent unused variable on early return. * bmo#1685880 - Fix for the gcc compiler version 7 to support setenv with nss build. * bmo#1693217 - Increase nssckbi.h version number for March 2021 batch of root CA changes, CA list version 2.48. * bmo#1692094 - Set email distrust after to 21-03-01 for Camerfirma's 'Chambers of Commerce' and 'Global Chambersign' roots. * bmo#1618407 - Symantec root certs - Set CKA_NSS_EMAIL_DISTRUST_AFTER. * bmo#1693173 - Add GlobalSign R45, E45, R46, and E46 root certs to NSS. * bmo#1683738 - Add AC RAIZ FNMT-RCM SERVIDORES SEGUROS root cert to NSS. * bmo#1686854 - Remove GeoTrust PCA-G2 and VeriSign Universal root certs from NSS. * bmo#1687822 - Turn off Websites trust bit for the ��Staat der Nederlanden Root CA - G3�� root cert in NSS. * bmo#1692094 - Turn off Websites Trust Bit for 'Chambers of Commerce Root - 2008' and 'Global Chambersign Root - 2008��. * bmo#1694291 - Tracing fixes for ECH. update to NSS 3.62 * bmo#1688374 - Fix parallel build NSS-3.61 with make * bmo#1682044 - pkix_Build_GatherCerts() + pkix_CacheCert_Add() can corrupt "cachedCertTable" * bmo#1690583 - Fix CH padding extension size calculation * bmo#1690421 - Adjust 3.62 ABI report formatting for new libabigail * bmo#1690421 - Install packaged libabigail in docker-builds image * bmo#1689228 - Minor ECH -09 fixes for interop testing, fuzzing * bmo#1674819 - Fixup a51fae403328, enum type may be signed * bmo#1681585 - Add ECH support to selfserv * bmo#1681585 - Update ECH to Draft-09 * bmo#1678398 - Add Export/Import functions for HPKE context * bmo#1678398 - Update HPKE to draft-07 update to NSS 3.61 * bmo#1682071 - Fix issue with IKE Quick mode deriving incorrect key values under certain conditions. * bmo#1684300 - Fix default PBE iteration count when NSS is compiled with NSS_DISABLE_DBM. * bmo#1651411 - Improve constant-timeness in RSA operations. * bmo#1677207 - Upgrade Google Test version to latest release. * bmo#1654332 - Add aarch64-make target to nss-try. Update to NSS 3.60.1: Notable changes in NSS 3.60: * TLS 1.3 Encrypted Client Hello (draft-ietf-tls-esni-08) support has been added, replacing the previous ESNI (draft-ietf-tls-esni-01) implementation. See bmo#1654332 for more information. * December 2020 batch of Root CA changes, builtins library updated to version 2.46. See bmo#1678189, bmo#1678166, and bmo#1670769 for more information. Update to NSS 3.59.1: * bmo#1679290 - Fix potential deadlock with certain third-party PKCS11 modules Update to NSS 3.59: Notable changes: * Exported two existing functions from libnss: CERT_AddCertToListHeadWithData and CERT_AddCertToListTailWithData Bugfixes * bmo#1607449 - Lock cert->nssCertificate to prevent a potential data race * bmo#1672823 - Add Wycheproof test cases for HMAC, HKDF, and DSA * bmo#1663661 - Guard against NULL token in nssSlot_IsTokenPresent * bmo#1670835 - Support enabling and disabling signatures via Crypto Policy * bmo#1672291 - Resolve libpkix OCSP failures on SHA1 self-signed root certs when SHA1 signatures are disabled. * bmo#1644209 - Fix broken SelectedCipherSuiteReplacer filter to solve some test intermittents * bmo#1672703 - Tolerate the first CCS in TLS 1.3 to fix a regression in our CVE-2020-25648 fix that broke purple-discord (boo#1179382) * bmo#1666891 - Support key wrap/unwrap with RSA-OAEP * bmo#1667989 - Fix gyp linking on Solaris * bmo#1668123 - Export CERT_AddCertToListHeadWithData and CERT_AddCertToListTailWithData from libnss * bmo#1634584 - Set CKA_NSS_SERVER_DISTRUST_AFTER for Trustis FPS Root CA * bmo#1663091 - Remove unnecessary assertions in the streaming ASN.1 decoder that affected decoding certain PKCS8 private keys when using NSS debug builds * bmo#670839 - Use ARM crypto extension for AES, SHA1 and SHA2 on MacOS. update to NSS 3.58 Bugs fixed: * bmo#1641480 (CVE-2020-25648) Tighten CCS handling for middlebox compatibility mode. * bmo#1631890 - Add support for Hybrid Public Key Encryption (draft-irtf-cfrg-hpke) support for TLS Encrypted Client Hello (draft-ietf-tls-esni). * bmo#1657255 - Add CI tests that disable SHA1/SHA2 ARM crypto extensions. * bmo#1668328 - Handle spaces in the Python path name when using gyp on Windows. * bmo#1667153 - Add PK11_ImportDataKey for data object import. * bmo#1665715 - Pass the embedded SCT list extension (if present) to TrustDomain::CheckRevocation instead of the notBefore value. update to NSS 3.57 * The following CA certificates were Added: bmo#1663049 - CN=Trustwave Global Certification Authority SHA-256 Fingerprint: 97552015F5DDFC3C8788C006944555408894450084F100867086BC1A2BB58DC8 bmo#1663049 - CN=Trustwave Global ECC P256 Certification Authority SHA-256 Fingerprint: 945BBC825EA554F489D1FD51A73DDF2EA624AC7019A05205225C22A78CCFA8B4 bmo#1663049 - CN=Trustwave Global ECC P384 Certification Authority SHA-256 Fingerprint: 55903859C8C0C3EBB8759ECE4E2557225FF5758BBD38EBD48276601E1BD58097 * The following CA certificates were Removed: bmo#1651211 - CN=EE Certification Centre Root CA SHA-256 Fingerprint: 3E84BA4342908516E77573C0992F0979CA084E4685681FF195CCBA8A229B8A76 bmo#1656077 - O=Government Root Certification Authority; C=TW SHA-256 Fingerprint: 7600295EEFE85B9E1FD624DB76062AAAAE59818A54D2774CD4C0B2C01131E1B3 * Trust settings for the following CA certificates were Modified: bmo#1653092 - CN=OISTE WISeKey Global Root GA CA Websites (server authentication) trust bit removed. * https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.57_rele ase_notes update to NSS 3.56 Notable changes * bmo#1650702 - Support SHA-1 HW acceleration on ARMv8 * bmo#1656981 - Use MPI comba and mulq optimizations on x86-64 MacOS. * bmo#1654142 - Add CPU feature detection for Intel SHA extension. * bmo#1648822 - Add stricter validation of DH keys in FIPS mode. * bmo#1656986 - Properly detect arm64 during GYP build architecture detection. * bmo#1652729 - Add build flag to disable RC2 and relocate to lib/freebl/deprecated. * bmo#1656429 - Correct RTT estimate used in 0-RTT anti-replay. * bmo#1588941 - Send empty certificate message when scheme selection fails. * bmo#1652032 - Fix failure to build in Windows arm64 makefile cross-compilation. * bmo#1625791 - Fix deadlock issue in nssSlot_IsTokenPresent. * bmo#1653975 - Fix 3.53 regression by setting "all" as the default makefile target. * bmo#1659792 - Fix broken libpkix tests with unexpired PayPal cert. * bmo#1659814 - Fix interop.sh failures with newer tls-interop commit and dependencies. * bmo#1656519 - NSPR dependency updated to 4.28 update to NSS 3.55 Notable changes * P384 and P521 elliptic curve implementations are replaced with verifiable implementations from Fiat-Crypto [0] and ECCKiila [1]. * PK11_FindCertInSlot is added. With this function, a given slot can be queried with a DER-Encoded certificate, providing performance and usability improvements over other mechanisms. (bmo#1649633) * DTLS 1.3 implementation is updated to draft-38. (bmo#1647752) Relevant Bugfixes * bmo#1631583 (CVE-2020-6829, CVE-2020-12400) - Replace P384 and P521 with new, verifiable implementations from Fiat-Crypto and ECCKiila. * bmo#1649487 - Move overzealous assertion in VFY_EndWithSignature. * bmo#1631573 (CVE-2020-12401) - Remove unnecessary scalar padding. * bmo#1636771 (CVE-2020-12403) - Explicitly disable multi-part ChaCha20 (which was not functioning correctly) and more strictly enforce tag length. * bmo#1649648 - Don't memcpy zero bytes (sanitizer fix). * bmo#1649316 - Don't memcpy zero bytes (sanitizer fix). * bmo#1649322 - Don't memcpy zero bytes (sanitizer fix). * bmo#1653202 - Fix initialization bug in blapitest when compiled with NSS_DISABLE_DEPRECATED_SEED. * bmo#1646594 - Fix AVX2 detection in makefile builds. * bmo#1649633 - Add PK11_FindCertInSlot to search a given slot for a DER-encoded certificate. * bmo#1651520 - Fix slotLock race in NSC_GetTokenInfo. * bmo#1647752 - Update DTLS 1.3 implementation to draft-38. * bmo#1649190 - Run cipher, sdr, and ocsp tests under standard test cycle in CI. * bmo#1649226 - Add Wycheproof ECDSA tests. * bmo#1637222 - Consistently enforce IV requirements for DES and 3DES. * bmo#1067214 - Enforce minimum PKCS#1 v1.5 padding length in RSA_CheckSignRecover. * bmo#1646324 - Advertise PKCS#1 schemes for certificates in the signature_algorithms extension. update to NSS 3.54 Notable changes * Support for TLS 1.3 external pre-shared keys (bmo#1603042). * Use ARM Cryptography Extension for SHA256, when available (bmo#1528113) * The following CA certificates were Added: bmo#1645186 - certSIGN Root CA G2. bmo#1645174 - e-Szigno Root CA 2017. bmo#1641716 - Microsoft ECC Root Certificate Authority 2017. bmo#1641716 - Microsoft RSA Root Certificate Authority 2017. * The following CA certificates were Removed: bmo#1645199 - AddTrust Class 1 CA Root. bmo#1645199 - AddTrust External CA Root. bmo#1641718 - LuxTrust Global Root 2. bmo#1639987 - Staat der Nederlanden Root CA - G2. bmo#1618402 - Symantec Class 2 Public Primary Certification Authority - G4. bmo#1618402 - Symantec Class 1 Public Primary Certification Authority - G4. bmo#1618402 - VeriSign Class 3 Public Primary Certification Authority - G3. * A number of certificates had their Email trust bit disabled. See bmo#1618402 for a complete list. Bugs fixed * bmo#1528113 - Use ARM Cryptography Extension for SHA256. * bmo#1603042 - Add TLS 1.3 external PSK support. * bmo#1642802 - Add uint128 support for HACL* curve25519 on Windows. * bmo#1645186 - Add "certSIGN Root CA G2" root certificate. * bmo#1645174 - Add Microsec's "e-Szigno Root CA 2017" root certificate. * bmo#1641716 - Add Microsoft's non-EV root certificates. * bmo1621151 - Disable email trust bit for "O=Government Root Certification Authority; C=TW" root. * bmo#1645199 - Remove AddTrust root certificates. * bmo#1641718 - Remove "LuxTrust Global Root 2" root certificate. * bmo#1639987 - Remove "Staat der Nederlanden Root CA - G2" root certificate. * bmo#1618402 - Remove Symantec root certificates and disable email trust bit. * bmo#1640516 - NSS 3.54 should depend on NSPR 4.26. * bmo#1642146 - Fix undefined reference to `PORT_ZAlloc_stub' in seed.c. * bmo#1642153 - Fix infinite recursion building NSS. * bmo#1642638 - Fix fuzzing assertion crash. * bmo#1642871 - Enable SSL_SendSessionTicket after resumption. * bmo#1643123 - Support SSL_ExportEarlyKeyingMaterial with External PSKs. * bmo#1643557 - Fix numerous compile warnings in NSS. * bmo#1644774 - SSL gtests to use ClearServerCache when resetting self-encrypt keys. * bmo#1645479 - Don't use SECITEM_MakeItem in secutil.c. * bmo#1646520 - Stricter enforcement of ASN.1 INTEGER encoding. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1293=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libfreebl3-3.68-lp152.2.10.1 libfreebl3-debuginfo-3.68-lp152.2.10.1 libfreebl3-hmac-3.68-lp152.2.10.1 libsoftokn3-3.68-lp152.2.10.1 libsoftokn3-debuginfo-3.68-lp152.2.10.1 libsoftokn3-hmac-3.68-lp152.2.10.1 mozilla-nspr-4.32-lp152.2.6.1 mozilla-nspr-debuginfo-4.32-lp152.2.6.1 mozilla-nspr-debugsource-4.32-lp152.2.6.1 mozilla-nspr-devel-4.32-lp152.2.6.1 mozilla-nss-3.68-lp152.2.10.1 mozilla-nss-certs-3.68-lp152.2.10.1 mozilla-nss-certs-debuginfo-3.68-lp152.2.10.1 mozilla-nss-debuginfo-3.68-lp152.2.10.1 mozilla-nss-debugsource-3.68-lp152.2.10.1 mozilla-nss-devel-3.68-lp152.2.10.1 mozilla-nss-sysinit-3.68-lp152.2.10.1 mozilla-nss-sysinit-debuginfo-3.68-lp152.2.10.1 mozilla-nss-tools-3.68-lp152.2.10.1 mozilla-nss-tools-debuginfo-3.68-lp152.2.10.1 - openSUSE Leap 15.2 (x86_64): libfreebl3-32bit-3.68-lp152.2.10.1 libfreebl3-32bit-debuginfo-3.68-lp152.2.10.1 libfreebl3-hmac-32bit-3.68-lp152.2.10.1 libsoftokn3-32bit-3.68-lp152.2.10.1 libsoftokn3-32bit-debuginfo-3.68-lp152.2.10.1 libsoftokn3-hmac-32bit-3.68-lp152.2.10.1 mozilla-nspr-32bit-4.32-lp152.2.6.1 mozilla-nspr-32bit-debuginfo-4.32-lp152.2.6.1 mozilla-nss-32bit-3.68-lp152.2.10.1 mozilla-nss-32bit-debuginfo-3.68-lp152.2.10.1 mozilla-nss-certs-32bit-3.68-lp152.2.10.1 mozilla-nss-certs-32bit-debuginfo-3.68-lp152.2.10.1 mozilla-nss-sysinit-32bit-3.68-lp152.2.10.1 mozilla-nss-sysinit-32bit-debuginfo-3.68-lp152.2.10.1 References: https://bugzilla.suse.com/1029961 https://bugzilla.suse.com/1174697 https://bugzilla.suse.com/1176206 https://bugzilla.suse.com/1176934 https://bugzilla.suse.com/1179382 https://bugzilla.suse.com/1188891

1 0