November 2022 - openSUSE Updates - openSUSE Mailing Lists

SUSE-RU-2022:3869-1: moderate: Recommended update for openssl-1_0_0
by maintenance＠opensuse.org 04 Nov '22

04 Nov '22

SUSE Recommended Update: Recommended update for openssl-1_0_0 ______________________________________________________________________________ Announcement ID: SUSE-RU-2022:3869-1 Rating: moderate References: #1180995 Affected Products: SUSE CaaS Platform 4.0 SUSE Enterprise Storage 6 SUSE Enterprise Storage 7 SUSE Linux Enterprise High Performance Computing SUSE Linux Enterprise Module for Legacy Software 15-SP3 SUSE Linux Enterprise Module for Legacy Software 15-SP4 SUSE Linux Enterprise Server SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server 15-SP1-BCL SUSE Linux Enterprise Server 15-SP1-LTSS SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server for SAP 15 SUSE Linux Enterprise Server for SAP 15-SP1 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Linux Enterprise Server for SAP Applications SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.1 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.1 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for openssl-1_0_0 fixes the following issues: - Default to RFC7919 groups when generating ECDH parameters using 'genpkey' or 'dhparam' in FIPS mode (bsc#1180995) Patch Instructions: To install this SUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3869=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3869=1 - SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-3869=1 - SUSE Manager Retail Branch Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-3869=1 - SUSE Manager Proxy 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-3869=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-3869=1 - SUSE Linux Enterprise Server for SAP 15-SP1: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2022-3869=1 - SUSE Linux Enterprise Server for SAP 15: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2022-3869=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-3869=1 - SUSE Linux Enterprise Server 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-3869=1 - SUSE Linux Enterprise Server 15-SP1-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-BCL-2022-3869=1 - SUSE Linux Enterprise Server 15-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-2022-3869=1 - SUSE Linux Enterprise Module for Legacy Software 15-SP4: zypper in -t patch SUSE-SLE-Module-Legacy-15-SP4-2022-3869=1 - SUSE Linux Enterprise Module for Legacy Software 15-SP3: zypper in -t patch SUSE-SLE-Module-Legacy-15-SP3-2022-3869=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2022-3869=1 - SUSE Enterprise Storage 6: zypper in -t patch SUSE-Storage-6-2022-3869=1 - SUSE CaaS Platform 4.0: To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.59.1 libopenssl10-1.0.2p-150000.3.59.1 libopenssl10-debuginfo-1.0.2p-150000.3.59.1 libopenssl1_0_0-1.0.2p-150000.3.59.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.59.1 libopenssl1_0_0-hmac-1.0.2p-150000.3.59.1 libopenssl1_0_0-steam-1.0.2p-150000.3.59.1 libopenssl1_0_0-steam-debuginfo-1.0.2p-150000.3.59.1 openssl-1_0_0-1.0.2p-150000.3.59.1 openssl-1_0_0-cavs-1.0.2p-150000.3.59.1 openssl-1_0_0-cavs-debuginfo-1.0.2p-150000.3.59.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.59.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.59.1 - openSUSE Leap 15.4 (x86_64): libopenssl-1_0_0-devel-32bit-1.0.2p-150000.3.59.1 libopenssl1_0_0-32bit-1.0.2p-150000.3.59.1 libopenssl1_0_0-32bit-debuginfo-1.0.2p-150000.3.59.1 libopenssl1_0_0-hmac-32bit-1.0.2p-150000.3.59.1 libopenssl1_0_0-steam-32bit-1.0.2p-150000.3.59.1 libopenssl1_0_0-steam-32bit-debuginfo-1.0.2p-150000.3.59.1 - openSUSE Leap 15.4 (noarch): openssl-1_0_0-doc-1.0.2p-150000.3.59.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.59.1 libopenssl10-1.0.2p-150000.3.59.1 libopenssl10-debuginfo-1.0.2p-150000.3.59.1 libopenssl1_0_0-1.0.2p-150000.3.59.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.59.1 libopenssl1_0_0-hmac-1.0.2p-150000.3.59.1 libopenssl1_0_0-steam-1.0.2p-150000.3.59.1 libopenssl1_0_0-steam-debuginfo-1.0.2p-150000.3.59.1 openssl-1_0_0-1.0.2p-150000.3.59.1 openssl-1_0_0-cavs-1.0.2p-150000.3.59.1 openssl-1_0_0-cavs-debuginfo-1.0.2p-150000.3.59.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.59.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.59.1 - openSUSE Leap 15.3 (x86_64): libopenssl-1_0_0-devel-32bit-1.0.2p-150000.3.59.1 libopenssl1_0_0-32bit-1.0.2p-150000.3.59.1 libopenssl1_0_0-32bit-debuginfo-1.0.2p-150000.3.59.1 libopenssl1_0_0-hmac-32bit-1.0.2p-150000.3.59.1 libopenssl1_0_0-steam-32bit-1.0.2p-150000.3.59.1 libopenssl1_0_0-steam-32bit-debuginfo-1.0.2p-150000.3.59.1 - openSUSE Leap 15.3 (noarch): openssl-1_0_0-doc-1.0.2p-150000.3.59.1 - SUSE Manager Server 4.1 (ppc64le s390x x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.59.1 libopenssl1_0_0-1.0.2p-150000.3.59.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.59.1 openssl-1_0_0-1.0.2p-150000.3.59.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.59.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.59.1 - SUSE Manager Retail Branch Server 4.1 (x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.59.1 libopenssl1_0_0-1.0.2p-150000.3.59.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.59.1 openssl-1_0_0-1.0.2p-150000.3.59.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.59.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.59.1 - SUSE Manager Proxy 4.1 (x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.59.1 libopenssl1_0_0-1.0.2p-150000.3.59.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.59.1 openssl-1_0_0-1.0.2p-150000.3.59.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.59.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.59.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.59.1 libopenssl1_0_0-1.0.2p-150000.3.59.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.59.1 openssl-1_0_0-1.0.2p-150000.3.59.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.59.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.59.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (ppc64le x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.59.1 libopenssl1_0_0-1.0.2p-150000.3.59.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.59.1 openssl-1_0_0-1.0.2p-150000.3.59.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.59.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.59.1 - SUSE Linux Enterprise Server for SAP 15 (ppc64le x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.59.1 libopenssl1_0_0-1.0.2p-150000.3.59.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.59.1 openssl-1_0_0-1.0.2p-150000.3.59.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.59.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.59.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.59.1 libopenssl1_0_0-1.0.2p-150000.3.59.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.59.1 openssl-1_0_0-1.0.2p-150000.3.59.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.59.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.59.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (aarch64 ppc64le s390x x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.59.1 libopenssl1_0_0-1.0.2p-150000.3.59.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.59.1 openssl-1_0_0-1.0.2p-150000.3.59.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.59.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.59.1 - SUSE Linux Enterprise Server 15-SP1-BCL (x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.59.1 libopenssl1_0_0-1.0.2p-150000.3.59.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.59.1 openssl-1_0_0-1.0.2p-150000.3.59.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.59.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.59.1 - SUSE Linux Enterprise Server 15-LTSS (aarch64 s390x): libopenssl-1_0_0-devel-1.0.2p-150000.3.59.1 libopenssl1_0_0-1.0.2p-150000.3.59.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.59.1 openssl-1_0_0-1.0.2p-150000.3.59.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.59.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.59.1 - SUSE Linux Enterprise Module for Legacy Software 15-SP4 (aarch64 ppc64le s390x x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.59.1 libopenssl10-1.0.2p-150000.3.59.1 libopenssl10-debuginfo-1.0.2p-150000.3.59.1 libopenssl1_0_0-1.0.2p-150000.3.59.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.59.1 openssl-1_0_0-1.0.2p-150000.3.59.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.59.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.59.1 - SUSE Linux Enterprise Module for Legacy Software 15-SP3 (aarch64 ppc64le s390x x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.59.1 libopenssl10-1.0.2p-150000.3.59.1 libopenssl10-debuginfo-1.0.2p-150000.3.59.1 libopenssl1_0_0-1.0.2p-150000.3.59.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.59.1 openssl-1_0_0-1.0.2p-150000.3.59.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.59.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.59.1 - SUSE Enterprise Storage 7 (aarch64 x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.59.1 libopenssl1_0_0-1.0.2p-150000.3.59.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.59.1 openssl-1_0_0-1.0.2p-150000.3.59.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.59.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.59.1 - SUSE Enterprise Storage 6 (aarch64 x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.59.1 libopenssl1_0_0-1.0.2p-150000.3.59.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.59.1 openssl-1_0_0-1.0.2p-150000.3.59.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.59.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.59.1 - SUSE CaaS Platform 4.0 (x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.59.1 libopenssl1_0_0-1.0.2p-150000.3.59.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.59.1 openssl-1_0_0-1.0.2p-150000.3.59.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.59.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.59.1 References: https://bugzilla.suse.com/1180995

1 0

SUSE-SU-2022:3867-1: moderate: Security update for python-Flask-Security-Too
by opensuse-security＠opensuse.org 03 Nov '22

03 Nov '22

SUSE Security Update: Security update for python-Flask-Security-Too ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3867-1 Rating: moderate References: #1202105 Cross-References: CVE-2021-23385 CVSS scores: CVE-2021-23385 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-23385 (SUSE): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-Flask-Security-Too fixes the following issues: - CVE-2021-23385: Fixed open redirect (bsc#1202105). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3867=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3867=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-3867=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-3867=1 Package List: - openSUSE Leap 15.4 (noarch): python3-Flask-Security-Too-3.4.2-150200.3.6.1 - openSUSE Leap 15.3 (noarch): python3-Flask-Security-Too-3.4.2-150200.3.6.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (noarch): python3-Flask-Security-Too-3.4.2-150200.3.6.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (noarch): python3-Flask-Security-Too-3.4.2-150200.3.6.1 References: https://www.suse.com/security/cve/CVE-2021-23385.html https://bugzilla.suse.com/1202105

1 0

SUSE-SU-2022:3866-1: important: Security update for ntfs-3g_ntfsprogs
by opensuse-security＠opensuse.org 03 Nov '22

03 Nov '22

SUSE Security Update: Security update for ntfs-3g_ntfsprogs ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3866-1 Rating: important References: #1204734 Cross-References: CVE-2022-40284 CVSS scores: CVE-2022-40284 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Workstation Extension 15-SP3 SUSE Linux Enterprise Workstation Extension 15-SP4 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ntfs-3g_ntfsprogs fixes the following issues: - CVE-2022-40284: Fixed incorrect validation of some of the NTFS metadata that could cause buffer overflow (bsc#1204734). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3866=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3866=1 - SUSE Linux Enterprise Workstation Extension 15-SP4: zypper in -t patch SUSE-SLE-Product-WE-15-SP4-2022-3866=1 - SUSE Linux Enterprise Workstation Extension 15-SP3: zypper in -t patch SUSE-SLE-Product-WE-15-SP3-2022-3866=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libntfs-3g-devel-2022.5.17-150000.3.16.1 libntfs-3g87-2022.5.17-150000.3.16.1 libntfs-3g87-debuginfo-2022.5.17-150000.3.16.1 ntfs-3g-2022.5.17-150000.3.16.1 ntfs-3g-debuginfo-2022.5.17-150000.3.16.1 ntfs-3g_ntfsprogs-debuginfo-2022.5.17-150000.3.16.1 ntfs-3g_ntfsprogs-debugsource-2022.5.17-150000.3.16.1 ntfsprogs-2022.5.17-150000.3.16.1 ntfsprogs-debuginfo-2022.5.17-150000.3.16.1 ntfsprogs-extra-2022.5.17-150000.3.16.1 ntfsprogs-extra-debuginfo-2022.5.17-150000.3.16.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libntfs-3g-devel-2022.5.17-150000.3.16.1 libntfs-3g87-2022.5.17-150000.3.16.1 libntfs-3g87-debuginfo-2022.5.17-150000.3.16.1 ntfs-3g-2022.5.17-150000.3.16.1 ntfs-3g-debuginfo-2022.5.17-150000.3.16.1 ntfs-3g_ntfsprogs-debuginfo-2022.5.17-150000.3.16.1 ntfs-3g_ntfsprogs-debugsource-2022.5.17-150000.3.16.1 ntfsprogs-2022.5.17-150000.3.16.1 ntfsprogs-debuginfo-2022.5.17-150000.3.16.1 ntfsprogs-extra-2022.5.17-150000.3.16.1 ntfsprogs-extra-debuginfo-2022.5.17-150000.3.16.1 - SUSE Linux Enterprise Workstation Extension 15-SP4 (x86_64): libntfs-3g-devel-2022.5.17-150000.3.16.1 libntfs-3g87-2022.5.17-150000.3.16.1 libntfs-3g87-debuginfo-2022.5.17-150000.3.16.1 ntfs-3g-2022.5.17-150000.3.16.1 ntfs-3g-debuginfo-2022.5.17-150000.3.16.1 ntfs-3g_ntfsprogs-debuginfo-2022.5.17-150000.3.16.1 ntfs-3g_ntfsprogs-debugsource-2022.5.17-150000.3.16.1 ntfsprogs-2022.5.17-150000.3.16.1 ntfsprogs-debuginfo-2022.5.17-150000.3.16.1 - SUSE Linux Enterprise Workstation Extension 15-SP3 (x86_64): libntfs-3g-devel-2022.5.17-150000.3.16.1 libntfs-3g87-2022.5.17-150000.3.16.1 libntfs-3g87-debuginfo-2022.5.17-150000.3.16.1 ntfs-3g-2022.5.17-150000.3.16.1 ntfs-3g-debuginfo-2022.5.17-150000.3.16.1 ntfs-3g_ntfsprogs-debuginfo-2022.5.17-150000.3.16.1 ntfs-3g_ntfsprogs-debugsource-2022.5.17-150000.3.16.1 ntfsprogs-2022.5.17-150000.3.16.1 ntfsprogs-debuginfo-2022.5.17-150000.3.16.1 References: https://www.suse.com/security/cve/CVE-2022-40284.html https://bugzilla.suse.com/1204734

1 0

SUSE-SU-2022:3862-1: important: Security update for xorg-x11-server
by opensuse-security＠opensuse.org 03 Nov '22

03 Nov '22

SUSE Security Update: Security update for xorg-x11-server ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3862-1 Rating: important References: #1204412 #1204416 Cross-References: CVE-2022-3550 CVE-2022-3551 CVSS scores: CVE-2022-3550 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-3550 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-3551 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-3551 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Module for Development Tools 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for xorg-x11-server fixes the following issues: - CVE-2022-3550: Fixed out of bounds read/write in _GetCountedString() (bsc#1204412). - CVE-2022-3551: Fixed various leaks of the return value of GetComponentSpec() (bsc#1204416). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3862=1 - SUSE Linux Enterprise Module for Development Tools 15-SP4: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2022-3862=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-3862=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): xorg-x11-server-1.20.3-150400.38.8.1 xorg-x11-server-debuginfo-1.20.3-150400.38.8.1 xorg-x11-server-debugsource-1.20.3-150400.38.8.1 xorg-x11-server-extra-1.20.3-150400.38.8.1 xorg-x11-server-extra-debuginfo-1.20.3-150400.38.8.1 xorg-x11-server-sdk-1.20.3-150400.38.8.1 xorg-x11-server-source-1.20.3-150400.38.8.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 ppc64le s390x x86_64): xorg-x11-server-debuginfo-1.20.3-150400.38.8.1 xorg-x11-server-debugsource-1.20.3-150400.38.8.1 xorg-x11-server-sdk-1.20.3-150400.38.8.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): xorg-x11-server-1.20.3-150400.38.8.1 xorg-x11-server-debuginfo-1.20.3-150400.38.8.1 xorg-x11-server-debugsource-1.20.3-150400.38.8.1 xorg-x11-server-extra-1.20.3-150400.38.8.1 xorg-x11-server-extra-debuginfo-1.20.3-150400.38.8.1 References: https://www.suse.com/security/cve/CVE-2022-3550.html https://www.suse.com/security/cve/CVE-2022-3551.html https://bugzilla.suse.com/1204412 https://bugzilla.suse.com/1204416

1 0

SUSE-FU-2022:3847-1: important: Feature update for powerpc-utils
by maintenance＠opensuse.org 02 Nov '22

02 Nov '22

SUSE Feature Update: Feature update for powerpc-utils ______________________________________________________________________________ Announcement ID: SUSE-FU-2022:3847-1 Rating: important References: #1198956 #1200465 #1202777 PED-1946 SLE-18129 SLE-18644 Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that has three feature fixes and contains three features can now be installed. Description: This feature update for powerpc-utils fixes the following issues: Version update from 1.3.9 to 1.3.10 (jsc#PED-1946): - Fix `lsslot -c mem` output when LMB size is set to 4GB (bsc#1202777) - ppc64_cpu: Add support to parse PAPR information for energy and frequency (bsc#1200465, jsc#SLE-18129, jsc#PED-519) - powerpc-utils: Enhance error message when `lparstat -E` fails on max config systems (bsc#1198956) - drmgr: Add support for 'acc' command (jsc#SLE-18644) - hcn-init.service: Add 'RemainAfterExit=yes' - man/drmgr: fix multiple typos - hcnmgr: Add new feature "wicked" in HNV FEATURE list - hcnmgr: Update Makefile and powerpc-utils spec file to support HNV and wicked - hcnmgr: Fix NM HNV setting primary slave - hcnmgr: Add hcn-init.service.suse - hcnmgr: Maintain hcnid state for later cleanup - hcnmgr: Support wicked HNV using new wicked functions for bonding - hcnmgr: Add new wicked functions for SUSE to manage bonding - hcnmgr: Factor out NetworkManager `nmcli` code - hcnmgr: Validate connection manager and add tracing option - bootlist: Fix invalid hex number message - bootlist: Fix passing `-l` flag to `kpartx` as `-p` delimiter value - lsslot: Fix memory leak when listing IO slots - lsslot: Add new DRC type description strings for latest PCIe slot types - lparstat: Report LPAR name from lparcfg - errinjct: Sanitize devspec output of a newline if one is present - lparstat: Fix reported online memory in legacy format - ofpathname: Add support for NVMf devices - ofpathname: Fix nvme support in ANA mode - hcnmgr: Support vNIC as backup device - hcnmgr: Avoid hexdump squeezing consecutive identical bytes - lsdevinfo: Optimize criteria filtering Patch Instructions: To install this SUSE Feature Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3847=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-3847=1 Package List: - openSUSE Leap 15.3 (ppc64le): powerpc-utils-1.3.10-150300.9.26.1 powerpc-utils-debuginfo-1.3.10-150300.9.26.1 powerpc-utils-debugsource-1.3.10-150300.9.26.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (ppc64le): powerpc-utils-1.3.10-150300.9.26.1 powerpc-utils-debuginfo-1.3.10-150300.9.26.1 powerpc-utils-debugsource-1.3.10-150300.9.26.1 References: https://bugzilla.suse.com/1198956 https://bugzilla.suse.com/1200465 https://bugzilla.suse.com/1202777

1 0

openSUSE-SU-2022:10185-1: important: Security update for EternalTerminal
by opensuse-security＠opensuse.org 02 Nov '22

02 Nov '22

openSUSE Security Update: Security update for EternalTerminal ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10185-1 Rating: important References: #1202432 #1202433 #1202434 #1202435 Cross-References: CVE-2022-24949 CVE-2022-24950 CVE-2022-24951 CVE-2022-24952 CVSS scores: CVE-2022-24949 (NVD) : 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-24950 (NVD) : 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-24951 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-24952 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for EternalTerminal fixes the following issues: Update to 6.2.1: * CVE-2022-24949: Fixed race condition allows local attacker to hijack IPC socket (boo#1202435) * CVE-2022-24950: Fixed privilege escalation to root (boo#1202434) * CVE-2022-24951: Fixed DoS triggered remotely by invalid sequence numbers (boo#1202433) * CVE-2022-24952: Fixed race condition allows authenticated attacker to hijack other users' SSH authorization socket (boo#1202432) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10185=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 x86_64): EternalTerminal-6.2.1-bp154.2.3.1 References: https://www.suse.com/security/cve/CVE-2022-24949.html https://www.suse.com/security/cve/CVE-2022-24950.html https://www.suse.com/security/cve/CVE-2022-24951.html https://www.suse.com/security/cve/CVE-2022-24952.html https://bugzilla.suse.com/1202432 https://bugzilla.suse.com/1202433 https://bugzilla.suse.com/1202434 https://bugzilla.suse.com/1202435

1 0

SUSE-RU-2022:3851-1: important: Recommended update for rsync
by maintenance＠opensuse.org 02 Nov '22

02 Nov '22

SUSE Recommended Update: Recommended update for rsync ______________________________________________________________________________ Announcement ID: SUSE-RU-2022:3851-1 Rating: important References: #1202970 #1204538 Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for rsync fixes the following issues: - Fix regression with `--delay-updates` where files never update after interruption (bsc#1204538) - Add support for `--trust-sender` parameter (bsc#1202970) Patch Instructions: To install this SUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3851=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-3851=1 - SUSE Linux Enterprise Micro 5.3: zypper in -t patch SUSE-SLE-Micro-5.3-2022-3851=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): rsync-3.2.3-150400.3.8.1 rsync-debuginfo-3.2.3-150400.3.8.1 rsync-debugsource-3.2.3-150400.3.8.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): rsync-3.2.3-150400.3.8.1 rsync-debuginfo-3.2.3-150400.3.8.1 rsync-debugsource-3.2.3-150400.3.8.1 - SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64): rsync-3.2.3-150400.3.8.1 rsync-debuginfo-3.2.3-150400.3.8.1 rsync-debugsource-3.2.3-150400.3.8.1 References: https://bugzilla.suse.com/1202970 https://bugzilla.suse.com/1204538

1 0

SUSE-RU-2022:3855-1: important: Recommended update for mariadb
by maintenance＠opensuse.org 02 Nov '22

02 Nov '22

SUSE Recommended Update: Recommended update for mariadb ______________________________________________________________________________ Announcement ID: SUSE-RU-2022:3855-1 Rating: important References: #1202863 Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Server Applications 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mariadb fixes the following issues: Update version from 10.6.9 to 10.6.10: - Fix regression causing full text index corruption if shutdown before changes are fully flushed - Fix regression causing frequent "Data structure corruption" in InnoDB after OOM - Fix incorrect recovery or backup of instant ALTER TABLE - Fix issue with InnoDB Temporary Tablespace (ibtmp1) causing it to continuously grow in size until the disk is full - For full list of changes please check https://mariadb.com/kb/en/library/mariadb-10610-release-notes and https://mariadb.com/kb/en/library/mariadb-10610-changelog Patch Instructions: To install this SUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3855=1 - SUSE Linux Enterprise Module for Server Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2022-3855=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libmariadbd-devel-10.6.10-150400.3.17.1 libmariadbd19-10.6.10-150400.3.17.1 libmariadbd19-debuginfo-10.6.10-150400.3.17.1 mariadb-10.6.10-150400.3.17.1 mariadb-bench-10.6.10-150400.3.17.1 mariadb-bench-debuginfo-10.6.10-150400.3.17.1 mariadb-client-10.6.10-150400.3.17.1 mariadb-client-debuginfo-10.6.10-150400.3.17.1 mariadb-debuginfo-10.6.10-150400.3.17.1 mariadb-debugsource-10.6.10-150400.3.17.1 mariadb-galera-10.6.10-150400.3.17.1 mariadb-rpm-macros-10.6.10-150400.3.17.1 mariadb-test-10.6.10-150400.3.17.1 mariadb-test-debuginfo-10.6.10-150400.3.17.1 mariadb-tools-10.6.10-150400.3.17.1 mariadb-tools-debuginfo-10.6.10-150400.3.17.1 - openSUSE Leap 15.4 (noarch): mariadb-errormessages-10.6.10-150400.3.17.1 - SUSE Linux Enterprise Module for Server Applications 15-SP4 (aarch64 ppc64le s390x x86_64): libmariadbd-devel-10.6.10-150400.3.17.1 libmariadbd19-10.6.10-150400.3.17.1 libmariadbd19-debuginfo-10.6.10-150400.3.17.1 mariadb-10.6.10-150400.3.17.1 mariadb-client-10.6.10-150400.3.17.1 mariadb-client-debuginfo-10.6.10-150400.3.17.1 mariadb-debuginfo-10.6.10-150400.3.17.1 mariadb-debugsource-10.6.10-150400.3.17.1 mariadb-tools-10.6.10-150400.3.17.1 mariadb-tools-debuginfo-10.6.10-150400.3.17.1 - SUSE Linux Enterprise Module for Server Applications 15-SP4 (noarch): mariadb-errormessages-10.6.10-150400.3.17.1 References: https://www.suse.com/security/cve/CVE-2022-38791.html https://bugzilla.suse.com/1202863

1 0

openSUSE-SU-2022:10186-1: important: Security update for privoxy
by opensuse-security＠opensuse.org 02 Nov '22

02 Nov '22

openSUSE Security Update: Security update for privoxy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10186-1 Rating: important References: #1193584 Cross-References: CVE-2021-44540 CVE-2021-44541 CVE-2021-44542 CVE-2021-44543 CVSS scores: CVE-2021-44540 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-44541 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-44542 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-44543 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for privoxy fixes the following issues: privoxy was updated to 3.0.33 (boo#1193584): * CVE-2021-44543: Encode the template name to prevent XSS (cross-side scripting) when Privoxy is configured to servce the user-manual itself * CVE-2021-44540: Free memory of compiled pattern spec before bailing * CVE-2021-44541: Free header memory when failing to get the request destination. * CVE-2021-44542: Prevent memory leaks when handling errors * Disable fast-redirects for a number of domains * Update default block lists * Many bug fixes and minor enhancements Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10186=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 i586 ppc64le s390x x86_64): privoxy-3.0.33-bp154.3.3.1 - openSUSE Backports SLE-15-SP4 (noarch): privoxy-doc-3.0.33-bp154.3.3.1 References: https://www.suse.com/security/cve/CVE-2021-44540.html https://www.suse.com/security/cve/CVE-2021-44541.html https://www.suse.com/security/cve/CVE-2021-44542.html https://www.suse.com/security/cve/CVE-2021-44543.html https://bugzilla.suse.com/1193584

1 0

openSUSE-SU-2022:10187-1: important: Security update for EternalTerminal
by opensuse-security＠opensuse.org 02 Nov '22

02 Nov '22

openSUSE Security Update: Security update for EternalTerminal ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10187-1 Rating: important References: #1202432 #1202433 #1202434 #1202435 Cross-References: CVE-2022-24949 CVE-2022-24950 CVE-2022-24951 CVE-2022-24952 CVSS scores: CVE-2022-24949 (NVD) : 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-24950 (NVD) : 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-24951 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-24952 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for EternalTerminal fixes the following issues: Update to 6.2.1: * CVE-2022-24949: Fixed race condition allows local attacker to hijack IPC socket (boo#1202435) * CVE-2022-24950: Fixed privilege escalation to root (boo#1202434) * CVE-2022-24951: Fixed DoS triggered remotely by invalid sequence numbers (boo#1202433) * CVE-2022-24952: Fixed race condition allows authenticated attacker to hijack other users' SSH authorization socket (boo#1202432) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-10187=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 x86_64): EternalTerminal-6.2.1-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2022-24949.html https://www.suse.com/security/cve/CVE-2022-24950.html https://www.suse.com/security/cve/CVE-2022-24951.html https://www.suse.com/security/cve/CVE-2022-24952.html https://bugzilla.suse.com/1202432 https://bugzilla.suse.com/1202433 https://bugzilla.suse.com/1202434 https://bugzilla.suse.com/1202435

1 0