March 2022 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2022:0681-1: critical: Recommended update for cloud-regionsrv-client
by maintenance＠opensuse.org 03 Mar '22

03 Mar '22

openSUSE Recommended Update: Recommended update for cloud-regionsrv-client ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0681-1 Rating: critical References: #1195414 #1195564 #1196305 Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for cloud-regionsrv-client fixes the following issues: - Update -addon-azure to 1.0.2 (bsc#1196305) - Fix regression in the cloud-regionsrv-client' with OnDemand images - Update to version 10.0.0 (bsc#1195414, bsc#1195564) - Refactor removes check_registration() function in utils implementation - Only start the registration service for PAYG images - addon-azure sub-package to version 1.0.1 Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-681=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-681=1 Package List: - openSUSE Leap 15.4 (noarch): cloud-regionsrv-client-10.0.0-6.62.1 cloud-regionsrv-client-addon-azure-1.0.2-6.62.1 cloud-regionsrv-client-generic-config-1.0.0-6.62.1 cloud-regionsrv-client-plugin-azure-2.0.0-6.62.1 cloud-regionsrv-client-plugin-ec2-1.0.2-6.62.1 cloud-regionsrv-client-plugin-gce-1.0.0-6.62.1 - openSUSE Leap 15.3 (noarch): cloud-regionsrv-client-10.0.0-6.62.1 cloud-regionsrv-client-generic-config-1.0.0-6.62.1 cloud-regionsrv-client-plugin-azure-2.0.0-6.62.1 cloud-regionsrv-client-plugin-ec2-1.0.2-6.62.1 cloud-regionsrv-client-plugin-gce-1.0.0-6.62.1 References: https://bugzilla.suse.com/1195414 https://bugzilla.suse.com/1195564 https://bugzilla.suse.com/1196305

1 0

openSUSE-RU-2022:0682-1: important: Recommended update for supportutils-plugin-suse-public-cloud
by maintenance＠opensuse.org 03 Mar '22

03 Mar '22

openSUSE Recommended Update: Recommended update for supportutils-plugin-suse-public-cloud ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0682-1 Rating: important References: #1195095 #1195096 Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for supportutils-plugin-suse-public-cloud fixes the following issues: - Update to version 1.0.6 (bsc#1195095, bsc#1195096) - Include cloud-init logs whenever they are present - Update the packages we track in AWS, Azure, and Google - Include the ecs logs for AWS ECS instances Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-682=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-682=1 Package List: - openSUSE Leap 15.4 (noarch): supportutils-plugin-suse-public-cloud-1.0.6-3.9.1 - openSUSE Leap 15.3 (noarch): supportutils-plugin-suse-public-cloud-1.0.6-3.9.1 References: https://bugzilla.suse.com/1195095 https://bugzilla.suse.com/1195096

1 0

openSUSE-RU-2022:0069-1: moderate: Recommended update for strawberry
by maintenance＠opensuse.org 03 Mar '22

03 Mar '22

openSUSE Recommended Update: Recommended update for strawberry ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0069-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for strawberry fixes the following issues: Update to version 1.0.2 + Bugfixes: + Fixed showing menu when clicking icon for collection and internet search tool buttons + Fixed ignoring devices with system mounts as defined by GIO (#410). + Fixed updating database when deleting songs from filesystem devices. + Fixed unregistered metatype when listing songs from MTP devices with Qt 6. + Fixed using entered password when testing Subsonic settings before pressing save (#879). + Fixed downloading Subsonic album covers. + Fixed subsonic album covers downloaded several times for each album when MD5 authentication was enabled (#885). + Fixed volume going to 100% when pressing volume down with MRPIS2 and global shortcuts (#884). + Fixed incorrect rounding when setting volume through MPRIS2 (#894). + Fixed delete from disk not showing up in the menu when one or more CUE songs were selected. + Fixed possible crashes when switching songs when fading is enabled (#890). + Fixed X11 global shortcuts not working unless window was in focus with Qt 6.2 and higher (#893). + Fixed scrobbler re-sending scrobbles to fast on error (#898). + Enhancements + Log Qt version on startup. + Added button for deleting existing Subsonic songs (#883). + Make collection watcher ignore files with "qt_temp" filename and tmp extension. + Require Qt 5.9 or higher. + Added scrollbars to edit tag dialog (#888). + Added advanced settings for configuring collection watcher. + Disable open audio CD menu when compiled without audio CD support. + Replaced use of deprecated QMouseEvent constructor as of Qt 6.4. + Replaced use of deprecated QCryptographicHash::addData overload as of Qt 6.4. + Removed features: + Removed broken "nomedia" / "nomusic" file handling. Update to version 1.0.1 + Bugfixes: + Fixed collection and internet search filter tool button menu arrow overlap (#796). + Fixed stop after this track button with Qt 6 (#795). + Fixed not updating the URL when songs were moved on disk when the fingerprinting feature is enabled. + Fixed SQL query error for songs with an invalid modification time (#815). + Fixed blocky rendering of the currently playing track with high resolution screens (#794). + Fixed incorrect playlist column filesize for radio streams. + Fixed deleting embedded album cover from Ogg songs. + Fixed parsing of Cue tracks with 1-digit minutes (#836). + Fixed updating of playlist summary after reloading items when adding songs from files outside of the collection (#848). + Fixed always saving metadata when saving playlists for Tidal, Qobuz and Subsonic songs independent of playlist setting (#851). + Fixed setting media shortcuts when using kglobalaccel (#849). + Fixed parsing of Genius lyrics when they are sometimes received in a different HTML format. + Fixed saving MP4 specific tags as UTF-8 (#830). + Fixed clearing "manually set" cover when saving album covers embedded from outside of the tag editor (#858). + Fixed aborting collection scan when Strawberry exists to avoid hang on exit. + Fixed resuming collection scan when adding a new directory after collection scan was aborted. + Fixed excluding hidden songs from the collection. + Disabled moodbar for CUE songs since they can not be supported properly (#865). + Enhancements: + Made playlist header column text elided (#801). + Added support for reading and writing playcounts and ratings from/to tags. + Added support for setting rating using the edit tag dialog. + Added setting to enable/disable playlist toolbar (#809). + Added component type, content_rating type and releases to AppStream data file (#806). + Removed unused "mark as listened" option in organize dialog. + Fixed some clazy warnings and narrowing conversions in the source code. + Replaced uses of macros in the source code. + Added a more user-friendly error message when receiving encrypted streams from Tidal (#824). + Added support for port-pattern entered in the device textbox when using Jack as output (#828). + Added Spanish (Spain) translation. + Added support for more CUE filenames (#835). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-69=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 ppc64le s390x x86_64): strawberry-1.0.2-bp153.2.6.1 References:

1 0

openSUSE-SU-2022:0068-1: important: Security update for shapelib
by opensuse-security＠opensuse.org 03 Mar '22

03 Mar '22

openSUSE Security Update: Security update for shapelib ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0068-1 Rating: important References: #1196236 Cross-References: CVE-2022-0699 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for shapelib fixes the following issues: - CVE-2022-0699: Fixed a Double-free vulnerability in contrib/shpsort.c Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-68=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): libshp-devel-1.5.0-bp153.2.3.1 libshp2-1.5.0-bp153.2.3.1 shapelib-1.5.0-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2022-0699.html https://bugzilla.suse.com/1196236

1 0

openSUSE-SU-2022:0067-1: important: Security update for libdxfrw, librecad
by opensuse-security＠opensuse.org 03 Mar '22

03 Mar '22

openSUSE Security Update: Security update for libdxfrw, librecad ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0067-1 Rating: important References: #1192936 #1192937 #1192938 Cross-References: CVE-2021-21898 CVE-2021-21899 CVE-2021-21900 CVSS scores: CVE-2021-21898 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21899 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21900 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for libdxfrw, librecad fixes the following issues: - Update to version 1.0.1+git.20220109: * fixed ambiguous error for DRW_Dimension::parseDwg() * fixed enless while()-loop for pre 2004 versions * dwgReader::readDwgObjects() stop reading after 1st error * dwgReader::readDwgEntities() stop reading after 1st error * replace ENTRY_PARSE macro with template method * remove unused DRW_Class::parseCode() method * protect vector<>.reserve() calls * Added NULL check for hatch code 93 * Fix bounds check in DRW_LWPolyline * fix, check maxClassNum for valid value * fixed wrong 2010+ check for 64-bit size * Set compiler warnings on by default, because makes harder for bugs to go undetected. modified: CMakeLists.txt * Fixed fall through and other warnings (#54) * fix "Vertex ID" printout - Update to version 1.0.1+git.20211110: * fixed heap use after free vulnerability CVE-2021-21900 (boo#1192938) * minor improvements to dwg2dxf, formatting and message output on success * fixed heap buffer overflow vulnerability CVE-2021-21899 (boo#1192937) * dwg2dxf - enable debug output of libdxfrw by command line switch * fixed out-of-bounds write vulnerability CVE-2021-21898 (boo#1192936) * fixed please note section formatting * updated README.md for LibreCAD_3 branch and sf.net successor * fixed LibreCAD 2 issue #1371, read failed with binary DXF * Use ununordered_map instead of map * manual merge changes from LibreCAD2 * and much more - Update to version 1.0.1+git.20200429: * Fix includes install dir * Export target as libdxfrw::libdxfrw to keep consistency with Conan packages * Add archive destination in install * Install DXFRW::dxfrw target * Remove duplicate target properties * Remove version from pkg-config file * Let CMake handle C++11 compiler definition * Change minimal required CMake version to 3.0 * cmake: add doc target * README.md: fix typo * cmake: generate and install pkgconfig * cmake: add one for dwg2dxf * cmake: set library VERSIONs * cmake: use GNUInstallDirs - Update to version 0.6.3+git.20190501: * Add build status and update example link * Add Travis-CI script * [#10] Fix compilation on GCC * Fix bugs with .dwg import of TEXT and MTEXT entities * This was unnecessary * Link libdxfrw against libstdc++ * Return an error when the file ends prematurely * Add version getter * Fix polyline 2d/3d write * Initialize return buffers in GetRawChar8 et al. - update to 2.2.0-rc3 * major release * DWG imports are more reliable now * and a lot more of bugfixes and improvements Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-67=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): libdxfrw-devel-1.0.1+git.20220109-bp153.2.3.1 libdxfrw-tools-1.0.1+git.20220109-bp153.2.3.1 libdxfrw1-1.0.1+git.20220109-bp153.2.3.1 - openSUSE Backports SLE-15-SP3 (aarch64 ppc64le s390x x86_64): librecad-2.2.0~rc3-bp153.2.3.1 librecad-debuginfo-2.2.0~rc3-bp153.2.3.1 librecad-debugsource-2.2.0~rc3-bp153.2.3.1 - openSUSE Backports SLE-15-SP3 (noarch): librecad-parts-2.2.0~rc3-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-21898.html https://www.suse.com/security/cve/CVE-2021-21899.html https://www.suse.com/security/cve/CVE-2021-21900.html https://bugzilla.suse.com/1192936 https://bugzilla.suse.com/1192937 https://bugzilla.suse.com/1192938

1 0

openSUSE-SU-2022:0675-1: moderate: Security update for ldns
by opensuse-security＠opensuse.org 02 Mar '22

02 Mar '22

openSUSE Security Update: Security update for ldns ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0675-1 Rating: moderate References: #1195057 #1195058 Cross-References: CVE-2020-19860 CVE-2020-19861 CVSS scores: CVE-2020-19860 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2020-19860 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L CVE-2020-19861 (SUSE): 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for ldns fixes the following issues: - CVE-2020-19860: Fixed heap-based out of bounds read when verifying a zone file (bsc#1195057). - CVE-2020-19861: Fixed heap-based out of bounds read in ldns_nsec3_salt_data() (bsc#1195058). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-675=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-675=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): ldns-1.7.0-4.6.1 ldns-debuginfo-1.7.0-4.6.1 ldns-debugsource-1.7.0-4.6.1 ldns-devel-1.7.0-4.6.1 libldns2-1.7.0-4.6.1 libldns2-debuginfo-1.7.0-4.6.1 perl-DNS-LDNS-1.7.0-4.6.1 perl-DNS-LDNS-debuginfo-1.7.0-4.6.1 python3-ldns-1.7.0-4.6.1 python3-ldns-debuginfo-1.7.0-4.6.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): ldns-1.7.0-4.6.1 ldns-debuginfo-1.7.0-4.6.1 ldns-debugsource-1.7.0-4.6.1 ldns-devel-1.7.0-4.6.1 libldns2-1.7.0-4.6.1 libldns2-debuginfo-1.7.0-4.6.1 perl-DNS-LDNS-1.7.0-4.6.1 perl-DNS-LDNS-debuginfo-1.7.0-4.6.1 python3-ldns-1.7.0-4.6.1 python3-ldns-debuginfo-1.7.0-4.6.1 References: https://www.suse.com/security/cve/CVE-2020-19860.html https://www.suse.com/security/cve/CVE-2020-19861.html https://bugzilla.suse.com/1195057 https://bugzilla.suse.com/1195058

1 0

openSUSE-SU-2022:0679-1: moderate: Security update for php7
by opensuse-security＠opensuse.org 02 Mar '22

02 Mar '22

openSUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0679-1 Rating: moderate References: #1038980 #1081790 #1192050 #1193041 Cross-References: CVE-2015-9253 CVE-2017-8923 CVE-2021-21703 CVE-2021-21707 CVSS scores: CVE-2015-9253 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2015-9253 (SUSE): 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2017-8923 (NVD) : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2017-8923 (SUSE): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-21703 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-21703 (SUSE): 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-21707 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2021-21707 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affected Products: openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for php7 fixes the following issues: - CVE-2021-21703: Fixed local privilege escalation via PHP-FPM (bsc#1192050). - CVE-2021-21707: Fixed special character breaks path in xml parsing (bsc#1193041). - CVE-2017-8923: Fixed denial of service (application crash) when using .= with a long string (zend_string_extend func in Zend/zend_string.h) (bsc#1038980). - CVE-2015-9253: Fixed endless loop when the master process restarts a child process using program execution functions (bsc#1081790). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-679=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): php7-wddx-7.2.5-4.89.4 php7-wddx-debuginfo-7.2.5-4.89.4 References: https://www.suse.com/security/cve/CVE-2015-9253.html https://www.suse.com/security/cve/CVE-2017-8923.html https://www.suse.com/security/cve/CVE-2021-21703.html https://www.suse.com/security/cve/CVE-2021-21707.html https://bugzilla.suse.com/1038980 https://bugzilla.suse.com/1081790 https://bugzilla.suse.com/1192050 https://bugzilla.suse.com/1193041

1 0

openSUSE-RU-2022:0064-1: moderate: Recommended update for trivy
by maintenance＠opensuse.org 02 Mar '22

02 Mar '22

openSUSE Recommended Update: Recommended update for trivy ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0064-1 Rating: moderate References: SLE-18339 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that has 0 recommended fixes and contains one feature can now be installed. Description: This update for trivy fixes the following issues: This adds the Container security scanner Trivy 0.22.0 to PackageHub and openSUSE Leap 15.3. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-64=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): trivy-0.22.0-bp153.2.1 References:

1 0

openSUSE-RU-2022:0066-1: moderate: Recommended update for python-attrs, python-configparser, python-importlib-metadata, python-zipp
by maintenance＠opensuse.org 02 Mar '22

02 Mar '22

openSUSE Recommended Update: Recommended update for python-attrs, python-configparser, python-importlib-metadata, python-zipp ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0066-1 Rating: moderate References: #1073845 SLE-18626 SLE-18627 Affected Products: openSUSE Backports SLE-15-SP3 openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix and contains two features can now be installed. Description: This update for python-attrs, python-configparser, python-importlib-metadata, python-zipp fixes the following issues: python-attrs was updated to 19.3.0 * Fixed auto_attribs usage when default values cannot be compared directly with ==, such as numpy arrays. - update to version 19.2.0: * Backward-incompatible Changes + Removed deprecated "Attribute" attribute "convert" per scheduled removal on 2019/1. This planned deprecation is tracked in issue `#307 <https://github.com/python-attrs/attrs/issues/307>`_. `#504 <https://github.com/python-attrs/attrs/issues/504>`_ + "__lt__", "__le__", "__gt__", and "__ge__" do not consider subclasses comparable anymore. This has been deprecated since 18.2.0 and was raising a "DeprecationWarning" for over a year. `#570 <https://github.com/python-attrs/attrs/issues/570>`_ * Deprecations + The "cmp" argument to "attr.s()" and "attr.ib()" is now deprecated. Please use "eq" to add equality methods ("__eq__" and "__ne__") and "order" to add ordering methods ("__lt__", "__le__", "__gt__", and "__ge__") instead �� just like with `dataclasses <https://docs.python.org/3/library/dataclasses.html>`_. Both are effectively "True" by default but it's enough to set "eq=False" to disable both at once. Passing "eq=False, order=True" explicitly will raise a "ValueError" though. Since this is arguably a deeper backward-compatibility break, it will have an extended deprecation period until 2021-06-01. After that day, the "cmp" argument will be removed. "attr.Attribute" also isn't orderable anymore. `#574 <https://github.com/python-attrs/attrs/issues/574>`_ * Changes + Updated "attr.validators.__all__" to include new validators added in `#425`_. `#517 <https://github.com/python-attrs/attrs/issues/517>`_ + Slotted classes now use a pure Python mechanism to rewrite the "__class__" cell when rebuilding the class, so "super()" works even on environments where "ctypes" is not installed. `#522 <https://github.com/python-attrs/attrs/issues/522>`_ + When collecting attributes using "@attr.s(auto_attribs=True)", attributes with a default of "None" are now deleted too. `#523 <https://github.com/python-attrs/attrs/issues/523>`_, `#556 <https://github.com/python-attrs/attrs/issues/556>`_ + Fixed "attr.validators.deep_iterable()" and "attr.validators.deep_mapping()" type stubs. `#533 <https://github.com/python-attrs/attrs/issues/533>`_ + "attr.validators.is_callable()" validator now raises an exception "attr.exceptions.NotCallableError", a subclass of "TypeError", informing the received value. `#536 <https://github.com/python-attrs/attrs/issues/536>`_ + "@attr.s(auto_exc=True)" now generates classes that are hashable by ID, as the documentation always claimed it would. `#543 <https://github.com/python-attrs/attrs/issues/543>`_, `#563 <https://github.com/python-attrs/attrs/issues/563>`_ + Added "attr.validators.matches_re()" that checks string attributes whether they match a regular expression. `#552 <https://github.com/python-attrs/attrs/issues/552>`_ + Keyword-only attributes ("kw_only=True") and attributes that are excluded from the "attrs"'s "__init__" ("init=False") now can appear before mandatory attributes. `#559 <https://github.com/python-attrs/attrs/issues/559>`_ + The fake filename for generated methods is now more stable. It won't change when you restart the process. `#560 <https://github.com/python-attrs/attrs/issues/560>`_ + The value passed to "@attr.ib(repr=��)" can now be either a boolean (as before) or a callable. That callable must return a string and is then used for formatting the attribute by the generated "__repr__()" method. `#568 <https://github.com/python-attrs/attrs/issues/568>`_ + Added "attr.__version_info__" that can be used to reliably check the version of "attrs" and write forward- and backward-compatible code. Please check out the `section on deprecated APIs <http://www.attrs.org/en/stable/api.html#deprecated-apis>`_ on how to use it. `#580 <https://github.com/python-attrs/attrs/issues/580>`_ - update to 19.1.0 * Fixed a bug where deserialized objects with cache_hash=True could have incorrect hash code values * Add is_callable, deep_iterable, and deep_mapping validators. * Fixed stub files to prevent errors raised by mypy's disallow_any_generics = True option. * Attributes with init=False now can follow after kw_only=True attributes. * attrs now has first class support for defining exception classes. * Clarified documentation for hashing to warn that hashable objects should be deeply immutable - update to version 18.2.0: * Deprecations + Comparing subclasses using "<", ">", "<=", and ">=" is now deprecated. The docs always claimed that instances are only compared if the types are identical, so this is a first step to conform to the docs. Equality operators ("==" and "!=") were always strict in this regard. issue 394 * Changes + "attrs" now ships its own PEP 484 type hints. Together with mypy's "attrs" plugin, you've got all you need for writing statically typed code in both Python 2 and 3! At that occasion, we've also added `narrative docs` about type annotations in "attrs". issue #238 + Added *kw_only* arguments to "attr.ib" and "attr.s", and a corresponding *kw_only* attribute to "attr.Attribute". This change makes it possible to have a generated "__init__" with keyword-only arguments on Python 3, relaxing the required ordering of default and non-default valued attributes. issues #281, #411 + The test suite now runs with "hypothesis.HealthCheck.too_slow" disabled to prevent CI breakage on slower computers. issues #364, #396 + "attr.validators.in_()" now raises a "ValueError" with a useful message even if the options are a string and the value is not a string. issue #383 + "attr.asdict()" now properly handles deeply nested lists and dictionaries. issue #395 + Added "attr.converters.default_if_none()" that allows to replace "None" values in attributes. For example "attr.ib(converter=default_if_none(""))" replaces "None" by empty strings. issues #400, #414 + Fixed a reference leak where the original class would remain live after being replaced when "slots=True" is set. isue #407 + Slotted classes can now be made weakly referenceable by passing "@attr.s(weakref_slot=True)". issue #420 + Added *cache_hash* option to "@attr.s" which causes the hash code to be computed once and stored on the object. issue #425 + Attributes can be named "property" and "itemgetter" now. issue #430 + It is now possible to override a base class' class variable using only class annotations. issue #431 - update to version 18.1.0: * "x=X(); x.cycle = x; repr(x)" will no longer raise a "RecursionError", and will instead show as "X(x=...)". * "attr.ib(factory=f)" is now syntactic sugar for the common case of "attr.ib(default=attr.Factory(f))". * Added "attr.field_dict()" to return an ordered dictionary of "attrs" attributes for a class, whose keys are the attribute names. * The order of attributes that are passed into "attr.make_class()" or the "these" argument of "@attr.s()" is now retained if the dictionary is ordered (i.e. "dict" on Python 3.6 and later, "collections.OrderedDict" otherwise). * Before, the order was always determined by the order in which the attributes have been defined which may not be desirable when creating classes programatically. * In slotted classes, "__getstate__" and "__setstate__" now ignore the "__weakref__" attribute. * Setting the cell type is now completely best effort. This fixes "attrs" on Jython. We cannot make any guarantees regarding Jython though, because our test suite cannot run due to dependency incompatabilities. * If "attr.s" is passed a *these* argument, it will not attempt to remove attributes with the same name from the class body anymore. * The hash of "attr.NOTHING" is now vegan and faster on 32bit Python builds. * The overhead of instantiating frozen dict classes is virtually eliminated. * Generated "__init__" methods now have an "__annotations__" attribute derived from the types of the fields. * We have restructured the documentation a bit to account for "attrs"' growth in scope. Instead of putting everything into the `examples <http://www.attrs.org/en/stable/examples.html>`_ page, we have started to extract narrative chapters. - update to version 17.4.0: * Backward-incompatible Changes + The traversal of MROs when using multiple inheritance was backward: If you defined a class "C" that subclasses "A" and "B" like "C(A, B)", "attrs" would have collected the attributes from "B" *before* those of "A". This is now fixed and means that in classes that employ multiple inheritance, the output of "__repr__" and the order of positional arguments in "__init__" changes. Due to the nature of this bug, a proper deprecation cycle was unfortunately impossible. Generally speaking, it's advisable to prefer "kwargs"-based initialization anyways �� *especially* if you employ multiple inheritance and diamond-shaped hierarchies. + The "__repr__" set by "attrs" no longer produces an "AttributeError" when the instance is missing some of the specified attributes (either through deleting or after using "init=False" on some attributes). This can break code that relied on "repr(attr_cls_instance)" raising "AttributeError" to check if any attr-specified members were unset. If you were using this, you can implement a custom method for checking this:: def has_unset_members(self): for field in attr.fields(type(self)): try: getattr(self, field.name) except AttributeError: return True return False * Deprecations + The "attr.ib(convert=callable)" option is now deprecated in favor of "attr.ib(converter=callable)". This is done to achieve consistency with other noun-based arguments like *validator*. *convert* will keep working until at least January 2019 while raising a "DeprecationWarning". * Changes + Generated "__hash__" methods now hash the class type along with the attribute values. Until now the hashes of two classes with the same values were identical which was a bug. The generated method is also *much* faster now. + "attr.ib"��s "metadata" argument now defaults to a unique empty "dict" instance instead of sharing a common empty "dict" for all. The singleton empty "dict" is still enforced. + "ctypes" is optional now however if it's missing, a bare "super()" will not work in slots classes. This should only happen in special environments like Google App Engine. + The attribute redefinition feature introduced in 17.3.0 now takes into account if an attribute is redefined via multiple inheritance. In that case, the definition that is closer to the base of the class hierarchy wins. + Subclasses of "auto_attribs=True" can be empty now. + Equality tests are *much* faster now. + All generated methods now have correct "__module__", "__name__", and (on Python 3) "__qualname__" attributes. - add test requirements, run tests conditionally (not BuildRequiring pytest fixes boo#1073845) - update to version 17.3.0: * Backward-incompatible Changes + Attributes are not defined on the class body anymore. This means that if you define a class "C" with an attribute "x", the class will *not* have an attribute "x" for introspection anymore. Instead of "C.x", use "attr.fields(C).x" or look at "C.__attrs_attrs__". The old behavior has been deprecated since version 16.1. (`#253 <https://github.com/python-attrs/attrs/issues/253>`_) * Changes + "super()" and "__class__" now work on Python 3 when "slots=True". (`#102 <https://github.com/python-attrs/attrs/issues/102>`_, `#226 <https://github.com/python-attrs/attrs/issues/226>`_, `#269 <https://github.com/python-attrs/attrs/issues/269>`_, `#270 <https://github.com/python-attrs/attrs/issues/270>`_, `#272 <https://github.com/python-attrs/attrs/issues/272>`_)- Added "type" argument to "attr.ib()" and corresponding "type" attribute to "attr.Attribute". This change paves the way for automatic type checking and serialization (though as of this release "attrs" does not make use of it). In Python 3.6 or higher, the value of "attr.Attribute.type" can alternately be set using variable type annotations (see `PEP 526 <https://www.python.org/dev/peps/pep-0526/>`_). (`#151 <https://github.com/python-attrs/attrs/issues/151>`_, `#214 <https://github.com/python-attrs/attrs/issues/214>`_, `#215 <https://github.com/python-attrs/attrs/issues/215>`_, `#239 <https://github.com/python-attrs/attrs/issues/239>`_) + The combination of "str=True" and "slots=True" now works on Python 2. (`#198 <https://github.com/python-attrs/attrs/issues/198>`_) + "attr.Factory" is hashable again. (`#204 <https://github.com/python-attrs/attrs/issues/204>`_) + Subclasses now can overwrite attribute definitions of their superclass. That means that you can -- for example -- change the default value for an attribute by redefining it. (`#221 <https://github.com/python-attrs/attrs/issues/221>`_, `#229 <https://github.com/python-attrs/attrs/issues/229>`_) + Added new option "auto_attribs" to "@attr.s" that allows to collect annotated fields without setting them to "attr.ib()". Setting a field to an "attr.ib()" is still possible to supply options like validators. Setting it to any other value is treated like it was passed as "attr.ib(default=value)" -- passing an instance of "attr.Factory" also works as expected. (`#262 <https://github.com/python-attrs/attrs/issues/262>`_, `#277 <https://github.com/python-attrs/attrs/issues/277>`_) + Instances of classes created using "attr.make_class()" can now be pickled. (`#282 <https://github.com/python-attrs/attrs/issues/282>`_) - update to 17.2.0: - Validators are hashable again. - ``attrs`` will set the ``__hash__()`` method to ``None`` by default now. The way hashes were handled before was in conflict with `Python's specification This *may* break some software although this breakage is most likely just surfacing of latent bugs. You can always make ``attrs`` create the ``__hash__()`` method using ``(a)attr.s(hash=True)``. See `#136`_ for the rationale of this change. - Correspondingly, ``attr.ib``'s ``hash`` argument is ``None`` by default too and mirrors the ``cmp`` argument as it should. - ``attr.assoc()`` is now deprecated in favor of ``attr.evolve()`` and will stop working in 2018. - Fix default hashing behavior. Now *hash* mirrors the value of *cmp* and classes are unhashable by default. - Added ``attr.evolve()`` that, given an instance of an ``attrs`` class and field changes as keyword arguments, will instantiate a copy of the given instance with the changes applied. - ``FrozenInstanceError`` is now raised when trying to delete an attribute from a frozen class. - Frozen-ness of classes is now inherited. - ``__attrs_post_init__()`` is now run if validation is disabled. - Added ``attr.validators.in_(options)`` that, given the allowed `options`, checks whether the attribute value is in it. This can be used to check constants, enums, mappings, etc. - Added ``attr.validators.and_()`` that composes multiple validators into one. - For convenience, the ``validator`` argument of ``(a)attr.s`` now can take a ``list`` of validators that are wrapped using ``and_()``. - Accordingly, ``attr.validators.optional()`` now can take a ``list`` of validators too. - Validators can now be defined conveniently inline by using the attribute as a decorator. - ``attr.Factory()`` now has a ``takes_self`` argument that makes the initializer to pass the partially initialized instance into the factory. In other words you can define attribute defaults based on other attributes. - Default factories can now also be defined inline using decorators. They are *always* passed the partially initialized instance. - Conversion can now be made optional using ``attr.converters.optional()``. - ``attr.make_class()`` now accepts the keyword argument ``bases`` which allows for subclassing. - Metaclasses are now preserved with ``slots=True``. - Attributes now can have user-defined metadata which greatly improves ``attrs``'s extensibility. - Allow for a ``__attrs_post_init__()`` method that -- if defined -- will get called at the end of the ``attrs``-generated ``__init__()`` method. - Added ``(a)attr.s(str=True)`` that will optionally create a ``__str__()`` method that is identical to ``__repr__()``. - ``__name__`` is not overwritten with ``__qualname__`` for ``attr.s(slots=True)`` classes anymore. - Added ``attr.astuple()`` that -- similarly to ``attr.asdict()`` -- returns the instance as a tuple. - Converts now work with frozen classes. - Instantiation of ``attrs`` classes with converters is now significantly faster. - Pickling now works with ``__slots__`` classes. - ``attr.assoc()`` now works with ``__slots__`` classes. - The tuple returned by ``attr.fields()`` now also allows to access the ``Attribute`` instances by name. - All instances where function arguments were called ``cl`` have been changed to the more Pythonic ``cls``. - Accessing ``Attribute`` instances on class objects is now deprecated and will stop working in 2017. - The serious business aliases ``attr.attributes`` and ``attr.attr`` have been deprecated in favor of ``attr.attrs`` and ``attr.attrib`` which are much more consistent and frankly obvious in hindsight. - ``attr.asdict()``\ 's ``dict_factory`` arguments is now propagated on recursion. - ``attr.asdict()``, ``attr.has()`` and ``attr.fields()`` are significantly faster. - Add ``attr.attrs`` and ``attr.attrib`` as a more consistent aliases for ``attr.s`` and ``attr.ib``. - Add ``frozen`` option to ``attr.s`` that will make instances best-effort immutable. - ``attr.asdict()`` now takes ``retain_collection_types`` as an argument. - Convert to singlespec - update to 16.0.0 Backward-incompatible changes: * Python 3.3 and 2.6 aren��t supported anymore. They may work by chance but any effort to keep them working has ceased. The last Python 2.6 release was on October 29, 2013 and isn��t supported by the CPython core team anymore. Major Python packages like Django and Twisted dropped Python 2.6 a while ago already. Python 3.3 never had a significant user base and wasn��t part of any distribution��s LTS release. Changes: * __slots__ have arrived! Classes now can automatically be slots-style (and save your precious memory) just by passing slots=True. #35 * Allow the case of initializing attributes that are set to init=False. This allows for clean initializer parameter lists while being able to initialize attributes to default values. #32 * attr.asdict can now produce arbitrary mappings instead of Python dicts when provided with a dict_factory argument. #40 Multiple performance improvements. python-configparser was updated to 3.7.3: * Issue #34: Temporarily degrade to use ASCII for author's name. * Repackaged using setuptools_scm for file discovery and other features from `skeleton <https://pypi.org/project/skeleton`_. Fixes #33. * Package now unconditionally installs the configparser module. - Update to 3.7.1 * Fixed issue on Python 2.x when future is present (gh#jaraco/configparser#30) - Update to 3.7.0 * Merge functionality from Python 3.7.2. Now ConfigParser accepts bytes paths as well as any PathLike object, including those found in the pathlib2 backport <https://pypi.org/project/pathlib2/>. - Update to 3.5.3 * Reverted the limit on DeprecationWarning, as it had unintended consequences (gh#jaraco/configparser#27) - Update to 3.5.2 * Use environment markers to indicate the 'ordereddict' dependency for Python 2.6 (gh#jaraco/configparser#23) * Limit DeprecationWarning when a filename is indicated as a bytestring on Python 2. Now the warning is only emitted when py3kwarning is indicated (gh#jaraco/configparser#24) - Update to 3.5.1 * jaraco adopts the package. * Moved hosting to GitHub. * Updated backports namespace package to conform with other packages sharing the namespace (gh#jaraco/configparser#21) - Remove superfluous devel dependency for noarch package - Switch to singlespec package - Build for python3 < 3.5 - Make structure consistent with other backports packages - Remove backports subpackage. Since configparser is unmaintained, this is being moved to the maintained configparser2 package. - %{python_sitelib}/backports is a namespace package, and so under python 2.x it must have a proper %{python_sitelib}/backports/__init__.py file. python-backports provides this __init__.py to prevent backports packages from conflicting. Please see the following links for more details: https://pypi.python.org/pypi/backports/ https://www.python.org/dev/peps/pep-0420/%23namespace-packages-today - Split backports directory into subpackage to allow the various packages that share the backports namespace to avoid conflicts. python-importlib-metadata was updated to 1.5.0: * Additional performance optimizations in FastPath now saves an additional 20% on a typical call. * Correct for issue where PyOxidizer finder has no ``__module__`` attribute. Closes #110. - update to 1.4.0 * Renamed package parameter to distribution_name. * For better compatibility with the stdlib implementation and to avoid the same distributions being discovered by the stdlib and backport implementations, the backport now disables the stdlib DistributionFinder during initialization (import time). * Project adopts semver for versioning. * EntryPoints are now pickleable. * Dropped support for Python 3.4. * Fixed repr(EntryPoint) on PyPy. * Repaired project metadata to correctly declare the python_requires directive. * Through careful optimization, distribution() is 3-4x faster. * When searching through sys.path, if any error occurs attempting to list a path entry, that entry is skipped, making the system much more lenient to errors. - Update to 0.21: * various minor fixes - update to 0.19 * restrain over-eager egg metadata resolution. * Add support for entry points with colons in the name. * Parse entry points case sensitively. * Add a version constraint on the backport configparser package - This package is part of python 3.8 and we don't need to build it there - Do not require importlib_resources on python3.7 where it is part of core python - Fixup the requires for the SLE-12 build - Enable python-pathlib2 build dependency for suse_version < 1500 to fix SLE-12 build - Remove do-not-test-pip.patch as it seems no longer needed - Update to 0.17: * Don't crash if there exists an EGG-INFO directory on sys.path. * Update docstrings to match PEP 8. Closes #63. * Merged modules into one module. Closes #62. * Add support for eggs. !65; Closes #19. * Support generic zip files (not just wheels). Closes #59 * Support zip files with multiple distributions in them. Closes #60 * Fully expose the public API in importlib_metadata.__all__. * The Distribution ABC is now officially part of the public API. * Fixed support for older single file egg-info formats. Closes #43. * Fixed a testing bug when $CWD has spaces in the path. Closes #50. * Fixed issue where entry points without an attribute would raise an Exception. * Removed unused name parameter from entry_points(). Closes #44. * DistributionFinder classes must now be instantiated before being placed on sys.meta_path. - Add missing setuptools_scm dependency to fix generated egg.info - Some packages request importlib_metadata to ease living provide this symbol too - Add do-not-test-pip.patch so tests depending on pip are not used (they fail when the tests are run without tox) python-zipp was updated to 0.6.0: * When adding implicit dirs, ensure that ancestral directories are added and that duplicates are excluded. * The library now relies on more_itertools. - update to 0.5.1 * Declared package as backport. - Update to 0.5.0 * no changelog found * Added runtime dependencies python-unittest2 and python-contextlib2 - version update to 0.4.0 * #4: Add support for zip files with implied directories. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-66=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-66=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): cargo-1.56.1-21.12.1 cargo1.56-1.56.1-7.3.2 cargo1.56-debuginfo-1.56.1-7.3.2 rust-1.56.1-21.12.1 rust1.56-1.56.1-7.3.2 rust1.56-debuginfo-1.56.1-7.3.2 - openSUSE Backports SLE-15-SP3 (noarch): python2-attrs-19.3.0-bp153.2.1 python2-configparser-3.7.3-bp153.2.1 python2-importlib-metadata-1.5.0-bp153.2.1 python2-zipp-0.6.0-bp153.2.1 python3-attrs-19.3.0-bp153.2.1 python3-importlib-metadata-1.5.0-bp153.2.1 python3-zipp-0.6.0-bp153.2.1 References: https://bugzilla.suse.com/1073845

1 0

openSUSE-SU-2022:0065-1: important: Security update for envoy-proxy
by opensuse-security＠opensuse.org 02 Mar '22

02 Mar '22

openSUSE Security Update: Security update for envoy-proxy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0065-1 Rating: important References: #1167073 #1173559 #1180121 Cross-References: CVE-2020-12603 CVE-2020-12604 CVE-2020-12605 CVE-2020-35471 CVE-2020-8663 CVSS scores: CVE-2020-12603 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-12604 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-12605 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-35471 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-35471 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for envoy-proxy fixes the following issues: Update to 1.14.6: - CVE-2020-35471: Fixed a denial of service via dropped and truncated UDP datagrams (boo#1180121). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-65=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 ppc64le x86_64): envoy-proxy-1.14.6-bp153.3.4.1 envoy-proxy-source-1.14.6-bp153.3.4.1 References: https://www.suse.com/security/cve/CVE-2020-12603.html https://www.suse.com/security/cve/CVE-2020-12604.html https://www.suse.com/security/cve/CVE-2020-12605.html https://www.suse.com/security/cve/CVE-2020-35471.html https://www.suse.com/security/cve/CVE-2020-8663.html https://bugzilla.suse.com/1167073 https://bugzilla.suse.com/1173559 https://bugzilla.suse.com/1180121

1 0