February 2022 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2022:0029-1: moderate: Recommended update for lighttpd
by maintenance＠opensuse.org 07 Feb '22

07 Feb '22

openSUSE Recommended Update: Recommended update for lighttpd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0029-1 Rating: moderate References: #1195465 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for lighttpd fixes the following issues: - Set ProtectHome to read-only, otherwise access to the users public_html can break (boo#1195465) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-29=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): lighttpd-1.4.64-bp153.2.6.1 lighttpd-mod_authn_gssapi-1.4.64-bp153.2.6.1 lighttpd-mod_authn_ldap-1.4.64-bp153.2.6.1 lighttpd-mod_authn_pam-1.4.64-bp153.2.6.1 lighttpd-mod_authn_sasl-1.4.64-bp153.2.6.1 lighttpd-mod_magnet-1.4.64-bp153.2.6.1 lighttpd-mod_maxminddb-1.4.64-bp153.2.6.1 lighttpd-mod_rrdtool-1.4.64-bp153.2.6.1 lighttpd-mod_vhostdb_dbi-1.4.64-bp153.2.6.1 lighttpd-mod_vhostdb_ldap-1.4.64-bp153.2.6.1 lighttpd-mod_vhostdb_mysql-1.4.64-bp153.2.6.1 lighttpd-mod_vhostdb_pgsql-1.4.64-bp153.2.6.1 lighttpd-mod_webdav-1.4.64-bp153.2.6.1 References: https://bugzilla.suse.com/1195465

1 0

openSUSE-RU-2022:0028-1: moderate: Recommended update for apache2-mod_auth_kerb
by maintenance＠opensuse.org 06 Feb '22

06 Feb '22

openSUSE Recommended Update: Recommended update for apache2-mod_auth_kerb ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0028-1 Rating: moderate References: #1195445 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: apache2-mod_auth_kerb was updated to build against new version of krb5. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-28=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): apache2-mod_auth_kerb-5.4-bp153.2.4.1 apache2-mod_auth_kerb-debuginfo-5.4-bp153.2.4.1 apache2-mod_auth_kerb-debugsource-5.4-bp153.2.4.1 References: https://bugzilla.suse.com/1195445

1 0

openSUSE-RU-2022:0335-1: moderate: Recommended update for coreutils
by maintenance＠opensuse.org 04 Feb '22

04 Feb '22

openSUSE Recommended Update: Recommended update for coreutils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0335-1 Rating: moderate References: #1189152 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for coreutils fixes the following issues: - Add "fuse.portal" as a dummy file system (used in flatpak implementations) (bsc#1189152). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-335=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): coreutils-8.32-150300.3.5.1 coreutils-debuginfo-8.32-150300.3.5.1 coreutils-debugsource-8.32-150300.3.5.1 coreutils-single-8.32-150300.3.5.1 coreutils-single-debuginfo-8.32-150300.3.5.1 coreutils-single-debugsource-8.32-150300.3.5.1 coreutils-testsuite-8.32-150300.3.5.1 - openSUSE Leap 15.3 (noarch): coreutils-doc-8.32-150300.3.5.1 coreutils-lang-8.32-150300.3.5.1 References: https://bugzilla.suse.com/1189152

1 0

openSUSE-RU-2022:0336-1: moderate: Recommended update for yast2-add-on
by maintenance＠opensuse.org 04 Feb '22

04 Feb '22

openSUSE Recommended Update: Recommended update for yast2-add-on ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0336-1 Rating: moderate References: #1194851 #972046 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for yast2-add-on fixes the following issues: - Restore the repo unexpanded URL to get it properly saved in the /etc/zypp/repos.d file (bsc#972046, bsc#1194851). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-336=1 Package List: - openSUSE Leap 15.3 (noarch): yast2-add-on-4.3.10-150300.3.8.1 References: https://bugzilla.suse.com/1194851 https://bugzilla.suse.com/972046

1 0

openSUSE-SU-2022:0330-1: important: Security update for glibc
by opensuse-security＠opensuse.org 04 Feb '22

04 Feb '22

openSUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0330-1 Rating: important References: #1194640 #1194768 #1194770 #1194785 SLE-18195 Cross-References: CVE-2021-3999 CVE-2022-23218 CVE-2022-23219 CVSS scores: CVE-2021-3999 (SUSE): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-23218 (SUSE): 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVE-2022-23219 (SUSE): 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Affected Products: openSUSE Leap 15.4 openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves three vulnerabilities, contains one feature and has one errata is now available. Description: This update for glibc fixes the following issues: - CVE-2021-3999: Fixed incorrect errno in getcwd (bsc#1194640) - CVE-2022-23219: Fixed buffer overflow in sunrpc clnt_create for "unix" (bsc#1194768) - CVE-2022-23218: Fixed buffer overflow in sunrpc svcunix_create (bsc#1194770) Features added: - IBM Power 10 string operation improvements (bsc#1194785, jsc#SLE-18195) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-330=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-330=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): glibc-2.31-150300.9.12.1 glibc-debuginfo-2.31-150300.9.12.1 glibc-debugsource-2.31-150300.9.12.1 glibc-devel-2.31-150300.9.12.1 glibc-devel-debuginfo-2.31-150300.9.12.1 glibc-devel-static-2.31-150300.9.12.1 glibc-extra-2.31-150300.9.12.1 glibc-extra-debuginfo-2.31-150300.9.12.1 glibc-locale-2.31-150300.9.12.1 glibc-locale-base-2.31-150300.9.12.1 glibc-locale-base-debuginfo-2.31-150300.9.12.1 glibc-profile-2.31-150300.9.12.1 glibc-utils-2.31-150300.9.12.1 glibc-utils-debuginfo-2.31-150300.9.12.1 glibc-utils-src-debugsource-2.31-150300.9.12.1 nscd-2.31-150300.9.12.1 nscd-debuginfo-2.31-150300.9.12.1 - openSUSE Leap 15.4 (noarch): glibc-html-2.31-150300.9.12.1 glibc-i18ndata-2.31-150300.9.12.1 glibc-info-2.31-150300.9.12.1 glibc-lang-2.31-150300.9.12.1 - openSUSE Leap 15.4 (x86_64): glibc-32bit-2.31-150300.9.12.1 glibc-32bit-debuginfo-2.31-150300.9.12.1 glibc-devel-32bit-2.31-150300.9.12.1 glibc-devel-32bit-debuginfo-2.31-150300.9.12.1 glibc-devel-static-32bit-2.31-150300.9.12.1 glibc-locale-base-32bit-2.31-150300.9.12.1 glibc-locale-base-32bit-debuginfo-2.31-150300.9.12.1 glibc-profile-32bit-2.31-150300.9.12.1 glibc-utils-32bit-2.31-150300.9.12.1 glibc-utils-32bit-debuginfo-2.31-150300.9.12.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): glibc-2.31-150300.9.12.1 glibc-debuginfo-2.31-150300.9.12.1 glibc-debugsource-2.31-150300.9.12.1 glibc-devel-2.31-150300.9.12.1 glibc-devel-debuginfo-2.31-150300.9.12.1 glibc-devel-static-2.31-150300.9.12.1 glibc-extra-2.31-150300.9.12.1 glibc-extra-debuginfo-2.31-150300.9.12.1 glibc-locale-2.31-150300.9.12.1 glibc-locale-base-2.31-150300.9.12.1 glibc-locale-base-debuginfo-2.31-150300.9.12.1 glibc-profile-2.31-150300.9.12.1 glibc-utils-2.31-150300.9.12.1 glibc-utils-debuginfo-2.31-150300.9.12.1 glibc-utils-src-debugsource-2.31-150300.9.12.1 nscd-2.31-150300.9.12.1 nscd-debuginfo-2.31-150300.9.12.1 - openSUSE Leap 15.3 (noarch): glibc-html-2.31-150300.9.12.1 glibc-i18ndata-2.31-150300.9.12.1 glibc-info-2.31-150300.9.12.1 glibc-lang-2.31-150300.9.12.1 - openSUSE Leap 15.3 (x86_64): glibc-32bit-2.31-150300.9.12.1 glibc-32bit-debuginfo-2.31-150300.9.12.1 glibc-devel-32bit-2.31-150300.9.12.1 glibc-devel-32bit-debuginfo-2.31-150300.9.12.1 glibc-devel-static-32bit-2.31-150300.9.12.1 glibc-locale-base-32bit-2.31-150300.9.12.1 glibc-locale-base-32bit-debuginfo-2.31-150300.9.12.1 glibc-profile-32bit-2.31-150300.9.12.1 glibc-utils-32bit-2.31-150300.9.12.1 glibc-utils-32bit-debuginfo-2.31-150300.9.12.1 References: https://www.suse.com/security/cve/CVE-2021-3999.html https://www.suse.com/security/cve/CVE-2022-23218.html https://www.suse.com/security/cve/CVE-2022-23219.html https://bugzilla.suse.com/1194640 https://bugzilla.suse.com/1194768 https://bugzilla.suse.com/1194770 https://bugzilla.suse.com/1194785

1 0

openSUSE-SU-2022:0333-1: important: Security update for xen
by opensuse-security＠opensuse.org 04 Feb '22

04 Feb '22

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0333-1 Rating: important References: #1194576 #1194581 #1194588 Cross-References: CVE-2022-23033 CVE-2022-23034 CVE-2022-23035 CVSS scores: CVE-2022-23034 (SUSE): 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-23035 (SUSE): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for xen fixes the following issues: - CVE-2022-23033: Fixed guest_physmap_remove_page not removing the p2m mappings. (XSA-393) (bsc#1194576) - CVE-2022-23034: Fixed possible DoS by a PV guest Xen while unmapping a grant. (XSA-394) (bsc#1194581) - CVE-2022-23035: Fixed insufficient cleanup of passed-through device IRQs. (XSA-395) (bsc#1194588) Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-333=1 Package List: - openSUSE Leap 15.3 (aarch64 x86_64): xen-4.14.3_06-150300.3.18.2 xen-debugsource-4.14.3_06-150300.3.18.2 xen-devel-4.14.3_06-150300.3.18.2 xen-doc-html-4.14.3_06-150300.3.18.2 xen-libs-4.14.3_06-150300.3.18.2 xen-libs-debuginfo-4.14.3_06-150300.3.18.2 xen-tools-4.14.3_06-150300.3.18.2 xen-tools-debuginfo-4.14.3_06-150300.3.18.2 xen-tools-domU-4.14.3_06-150300.3.18.2 xen-tools-domU-debuginfo-4.14.3_06-150300.3.18.2 - openSUSE Leap 15.3 (noarch): xen-tools-xendomains-wait-disk-4.14.3_06-150300.3.18.2 - openSUSE Leap 15.3 (x86_64): xen-libs-32bit-4.14.3_06-150300.3.18.2 xen-libs-32bit-debuginfo-4.14.3_06-150300.3.18.2 References: https://www.suse.com/security/cve/CVE-2022-23033.html https://www.suse.com/security/cve/CVE-2022-23034.html https://www.suse.com/security/cve/CVE-2022-23035.html https://bugzilla.suse.com/1194576 https://bugzilla.suse.com/1194581 https://bugzilla.suse.com/1194588

1 0

openSUSE-SU-2022:0334-1: moderate: Security update for containerd, docker
by opensuse-security＠opensuse.org 04 Feb '22

04 Feb '22

openSUSE Security Update: Security update for containerd, docker ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0334-1 Rating: moderate References: #1191015 #1191121 #1191334 #1191434 #1193273 Cross-References: CVE-2021-41089 CVE-2021-41091 CVE-2021-41092 CVE-2021-41103 CVE-2021-41190 CVSS scores: CVE-2021-41089 (NVD) : 6.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L CVE-2021-41089 (SUSE): 3.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N CVE-2021-41091 (NVD) : 6.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L CVE-2021-41091 (SUSE): 6.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L CVE-2021-41092 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2021-41092 (SUSE): 5.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N CVE-2021-41103 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-41103 (SUSE): 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVE-2021-41190 (NVD) : 3 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N CVE-2021-41190 (SUSE): 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for containerd, docker fixes the following issues: - CVE-2021-41089: Fixed "cp" can chmod host files (bsc#1191015). - CVE-2021-41091: Fixed flaw that could lead to data directory traversal in moby (bsc#1191434). - CVE-2021-41092: Fixed exposed user credentials with a misconfigured configuration file (bsc#1191334). - CVE-2021-41103: Fixed file access to local users in containerd (bsc#1191121). - CVE-2021-41190: Fixed OCI manifest and index parsing confusion (bsc#1193273). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-334=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): containerd-1.4.12-60.1 containerd-ctr-1.4.12-60.1 docker-20.10.12_ce-159.1 docker-debuginfo-20.10.12_ce-159.1 docker-kubic-20.10.12_ce-159.1 docker-kubic-debuginfo-20.10.12_ce-159.1 docker-kubic-kubeadm-criconfig-20.10.12_ce-159.1 - openSUSE Leap 15.3 (noarch): docker-bash-completion-20.10.12_ce-159.1 docker-fish-completion-20.10.12_ce-159.1 docker-kubic-bash-completion-20.10.12_ce-159.1 docker-kubic-fish-completion-20.10.12_ce-159.1 docker-kubic-zsh-completion-20.10.12_ce-159.1 docker-zsh-completion-20.10.12_ce-159.1 References: https://www.suse.com/security/cve/CVE-2021-41089.html https://www.suse.com/security/cve/CVE-2021-41091.html https://www.suse.com/security/cve/CVE-2021-41092.html https://www.suse.com/security/cve/CVE-2021-41103.html https://www.suse.com/security/cve/CVE-2021-41190.html https://bugzilla.suse.com/1191015 https://bugzilla.suse.com/1191121 https://bugzilla.suse.com/1191334 https://bugzilla.suse.com/1191434 https://bugzilla.suse.com/1193273

1 0

openSUSE-RU-2022:0324-1: moderate: Recommended update for supportutils-plugin-cloud-init
by maintenance＠opensuse.org 04 Feb '22

04 Feb '22

openSUSE Recommended Update: Recommended update for supportutils-plugin-cloud-init ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0324-1 Rating: moderate References: SLE-19069 SLE-20508 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has 0 recommended fixes and contains two features can now be installed. Description: This update for supportutils-plugin-cloud-init fixes the following issues: - This plugin adds functionality to the supportconfig tool, making it include logs and status of systemd services relating to cloud-init in the supportconfig tarballs. (jsc#SLE-19069, jsc#SLE-20508) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-324=1 Package List: - openSUSE Leap 15.3 (noarch): supportutils-plugin-cloud-init-1.0-3.3.1 References:

1 0

openSUSE-RU-2022:0027-1: moderate: Recommended update for scap-workbench
by maintenance＠opensuse.org 03 Feb '22

03 Feb '22

openSUSE Recommended Update: Recommended update for scap-workbench ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0027-1 Rating: moderate References: #1194604 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for scap-workbench fixes the following issues: - require "ssh" at buildtime to enable remote mode. (boo#1194604) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-27=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): scap-workbench-1.2.1+git20210604.1fc6def-bp153.2.3.1 scap-workbench-doc-1.2.1+git20210604.1fc6def-bp153.2.3.1 References: https://bugzilla.suse.com/1194604

1 0

openSUSE-RU-2022:0322-1: moderate: Recommended update for dracut
by maintenance＠opensuse.org 03 Feb '22

03 Feb '22

openSUSE Recommended Update: Recommended update for dracut ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0322-1 Rating: moderate References: #1192685 #1194716 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for dracut fixes the following issues: - Fix(network): consistent use of "$gw" for gateway (bsc#1192685) - Fix(install): handle builtin modules (bsc#1194716) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-322=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): dracut-049.1+suse.228.g07676562-3.54.1 dracut-debuginfo-049.1+suse.228.g07676562-3.54.1 dracut-debugsource-049.1+suse.228.g07676562-3.54.1 dracut-extra-049.1+suse.228.g07676562-3.54.1 dracut-fips-049.1+suse.228.g07676562-3.54.1 dracut-ima-049.1+suse.228.g07676562-3.54.1 dracut-tools-049.1+suse.228.g07676562-3.54.1 References: https://bugzilla.suse.com/1192685 https://bugzilla.suse.com/1194716

1 0