March 2022 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2022:0063-1: moderate: Recommended update for fish3
by maintenance＠opensuse.org 02 Mar '22

02 Mar '22

openSUSE Recommended Update: Recommended update for fish3 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0063-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update ships the new package fish3 to openSUSE Leap 15.3 and Package Hub 15-SP3. Update to 3.3.1: * The prompt and command line are redrawn correctly in response to universal variable changes. * A superfluous error that was produced when setting the PATH or CDPATH environment variables to include colon-delimited components that do not exist was removed. * The Vi mode indicator in the prompt is repainted correctly after Ctrl-C cancels the current command. Update to 3.2.2: * Background jobs no longer interfere with syntax highlighting (fish 3.2.1 regression) * The command-not-found handler used suggestions from pacman on Arch Linux, but this caused major slowdowns on some systems and has been disabled * Certain programs (such as lazygit) could create situations where fish would not receive keystrokes correctly, but it is now more robust in these situations * Completions for aura and tshark should no longer produce errors. * fish will no longer hang on exit if another process is in the foreground on macOS * Arguments longer than 1024 characters no longer trigger excessive CPU usage on macOS Update to 3.2.1: * Commands in key bindings are run with fish's internal terminal modes, instead of the terminal modes typically used for commands. This fixes a bug introduced in 3.2.0, where text would unexpectedly appear on the terminal, especially when pasting * Prompts which use the internal __fish_print_pipestatus function will display correctly rather than carrying certain modifiers (such as bold) further than intended * Redirections to internal file descriptors is allowed again, reversing the changes in 3.2.0. This fixes a problem with Midnight Commander Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-63=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): fish3-3.3.1-bp153.2.7.1 fish3-devel-3.3.1-bp153.2.7.1 References:

1 0

openSUSE-RU-2022:0674-1: moderate: Recommended update for yast2-network
by maintenance＠opensuse.org 02 Mar '22

02 Mar '22

openSUSE Recommended Update: Recommended update for yast2-network ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0674-1 Rating: moderate References: #1187512 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-network fixes the following issues: - Don't crash at the end of installation when storing wifi configuration for NetworkManager. (bsc#1187512) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-674=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): augeas-1.10.1-3.5.1 augeas-debuginfo-1.10.1-3.5.1 augeas-debugsource-1.10.1-3.5.1 augeas-devel-1.10.1-3.5.1 augeas-lense-tests-1.10.1-3.5.1 augeas-lenses-1.10.1-3.5.1 libaugeas0-1.10.1-3.5.1 libaugeas0-debuginfo-1.10.1-3.5.1 - openSUSE Leap 15.3 (noarch): yast2-network-4.3.81-150300.3.25.1 - openSUSE Leap 15.3 (x86_64): augeas-devel-32bit-1.10.1-3.5.1 libaugeas0-32bit-1.10.1-3.5.1 libaugeas0-32bit-debuginfo-1.10.1-3.5.1 References: https://bugzilla.suse.com/1187512

1 0

openSUSE-SU-2022:0658-1: moderate: Security update for mysql-connector-java
by opensuse-security＠opensuse.org 02 Mar '22

02 Mar '22

openSUSE Security Update: Security update for mysql-connector-java ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0658-1 Rating: moderate References: #1195557 PM-3307 Cross-References: CVE-2021-2471 CVSS scores: CVE-2021-2471 (NVD) : 5.9 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H CVE-2021-2471 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability, contains one feature is now available. Description: This update for mysql-connector-java fixes the following issues: - CVE-2021-2471: Fixed unauthorized access to critical data or complete access to all MySQL Connectors (bsc#1195557). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-658=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-658=1 Package List: - openSUSE Leap 15.4 (noarch): mysql-connector-java-5.1.47-3.6.1 - openSUSE Leap 15.3 (noarch): mysql-connector-java-5.1.47-3.6.1 References: https://www.suse.com/security/cve/CVE-2021-2471.html https://bugzilla.suse.com/1195557

1 0

openSUSE-SU-2022:0657-1: important: Security update for nodejs12
by opensuse-security＠opensuse.org 02 Mar '22

02 Mar '22

openSUSE Security Update: Security update for nodejs12 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0657-1 Rating: important References: #1191962 #1191963 #1192153 #1192154 #1192696 Cross-References: CVE-2021-23343 CVE-2021-32803 CVE-2021-32804 CVE-2021-3807 CVE-2021-3918 CVSS scores: CVE-2021-23343 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-23343 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-32803 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-32803 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-32804 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-32804 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-3807 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-3918 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for nodejs12 fixes the following issues: - CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153). - CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963). - CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962). - CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696). - CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-657=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-657=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): nodejs12-12.22.10-4.29.3 nodejs12-debuginfo-12.22.10-4.29.3 nodejs12-debugsource-12.22.10-4.29.3 nodejs12-devel-12.22.10-4.29.3 npm12-12.22.10-4.29.3 - openSUSE Leap 15.4 (noarch): nodejs12-docs-12.22.10-4.29.3 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): nodejs12-12.22.10-4.29.3 nodejs12-debuginfo-12.22.10-4.29.3 nodejs12-debugsource-12.22.10-4.29.3 nodejs12-devel-12.22.10-4.29.3 npm12-12.22.10-4.29.3 - openSUSE Leap 15.3 (noarch): nodejs12-docs-12.22.10-4.29.3 References: https://www.suse.com/security/cve/CVE-2021-23343.html https://www.suse.com/security/cve/CVE-2021-32803.html https://www.suse.com/security/cve/CVE-2021-32804.html https://www.suse.com/security/cve/CVE-2021-3807.html https://www.suse.com/security/cve/CVE-2021-3918.html https://bugzilla.suse.com/1191962 https://bugzilla.suse.com/1191963 https://bugzilla.suse.com/1192153 https://bugzilla.suse.com/1192154 https://bugzilla.suse.com/1192696

1 0

openSUSE-SU-2022:0058-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 01 Mar '22

01 Mar '22

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0058-1 Rating: important References: #1144018 #1181400 #1194020 #1194215 #1194681 Cross-References: CVE-2020-15803 CVE-2021-27927 CVE-2021-4126 CVE-2021-44538 CVE-2022-23134 CVSS scores: CVE-2020-15803 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2020-15803 (SUSE): 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N CVE-2021-4126 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2021-44538 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-23134 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-23134 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Affected Products: openSUSE Backports SLE-15-SP3 openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: - Mozilla Thunderbird 91.4.1 - CVE-2021-4126: OpenPGP signature status doesn't consider additional message content. (bsc#1194215) - CVE-2021-44538: Matrix chat library libolm bundled with Thunderbird vulnerable to a buffer overflow. (bsc#1194020) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-58=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-58=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): MozillaThunderbird-91.4.1-8.48.1 MozillaThunderbird-debuginfo-91.4.1-8.48.1 MozillaThunderbird-debugsource-91.4.1-8.48.1 MozillaThunderbird-translations-common-91.4.1-8.48.1 MozillaThunderbird-translations-other-91.4.1-8.48.1 - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): zabbix-agent-4.0.38-bp153.2.3.1 zabbix-java-gateway-4.0.38-bp153.2.3.1 zabbix-phpfrontend-4.0.38-bp153.2.3.1 zabbix-proxy-4.0.38-bp153.2.3.1 zabbix-proxy-mysql-4.0.38-bp153.2.3.1 zabbix-proxy-postgresql-4.0.38-bp153.2.3.1 zabbix-proxy-sqlite-4.0.38-bp153.2.3.1 zabbix-server-4.0.38-bp153.2.3.1 zabbix-server-mysql-4.0.38-bp153.2.3.1 zabbix-server-postgresql-4.0.38-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-15803.html https://www.suse.com/security/cve/CVE-2021-27927.html https://www.suse.com/security/cve/CVE-2021-4126.html https://www.suse.com/security/cve/CVE-2021-44538.html https://www.suse.com/security/cve/CVE-2022-23134.html https://bugzilla.suse.com/1144018 https://bugzilla.suse.com/1181400 https://bugzilla.suse.com/1194020 https://bugzilla.suse.com/1194215 https://bugzilla.suse.com/1194681

1 0

openSUSE-RU-2022:0057-1: moderate: Recommended update for python-apiron
by maintenance＠opensuse.org 01 Mar '22

01 Mar '22

openSUSE Recommended Update: Recommended update for python-apiron ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0057-1 Rating: moderate References: Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: python-apiron was updated to last version with python 3.6 support. Update to 5.1.0: * Ability to specify proxies for a Service definition so all calls to the service use the defined proxies * Ability to specify auth for a Service definition so all calls to the service use the defined authentication * Ability to specify return_raw_response_object at the endpoint level, overridden by any value specified at call time Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-2022-57=1 Package List: - openSUSE Leap 15.3 (noarch): python3-apiron-5.1.0-lp153.2.3.1 References:

1 0

openSUSE-SU-2022:0061-1: moderate: Security update for mc
by opensuse-security＠opensuse.org 01 Mar '22

01 Mar '22

openSUSE Security Update: Security update for mc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0061-1 Rating: moderate References: #1190180 Cross-References: CVE-2021-36370 CVSS scores: CVE-2021-36370 (SUSE): 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mc fixes the following issues: Midnight Commander 4.8.27: * Core - Reimplement version detection (#3603, #4249) - Significantly reduce rebuilt time after version change (#2252, #4266) - Drop automatic migration of configuration from ~/.mc to XDG-based directories (#3682) - zsh: support custom configuration file: ~/.local/share/mc/.zshrc (#4203) - Widgets: implement WST_VISIBLE state to show/hide widgets (#2919) - Find File: add Follow symlinks option (#2020) * VFS - extfs: support unrar-6 (#4154) - extfs: support official 7z binary (7zz) (#4239) - ftpfs: apply file list parser from lftp project (#2841, #3174) * Editor - Word completion: get candidates from all open files (#4160) - etags: get rid of hardcoded list length and window width (#4132) - Update syntax files: - python (#4140) - Add syntax highlighting: - Verilog and SystemVerilog? header files (#4215) - JSON (#4250) - openrc-run scripts (#4246) * Misc - Filehighlight of c++ and h++ files as sources (#4194) - Filehighlight of JSON files as documents (#4250) - Support of alacritty terminal emulator (��https://github.com/alacritty/alacritty) (#4248) - Support of foot terminal emulator (��https://codeberg.org/dnkl/foot) (#4251) - Support of (alt+)shift+arrow keys in st terminal emulator (st.suckless.org) (#4267) - Mouse support in screen: don't check variable (#4233) - mc.ext: support fb2 e-books (#4167) - ext.d: use mediainfo to view info about various media files (#4167) - Remove OS/distro-specific package-related stuff from source tree (#4217) * Fixes - FTBFS against NCurses on OS X 10.9.5 (#4181) - Segfault on dialog before panels get visible (#4244) - Crash if shadow is out of screen (build against NCurses) (#4192) - Crash in search (#4222) - Crash on startup with enabled subshell in FreeBSD (workaround) (#4213) - Hang on start randomly with zsh as subshell (#4198) - If command line is invisible it's partially displayed (#4182) - Broken handling of zip archives (#4180, #4183) - Broken handling of jar files as zip archives (#4223) - Timestamps of symlinks, sockets, fifos, etc are not preserved after copy/move (#3985) - %view action in the user menu doesn't work on no-exec filesystem (#4242) - Hardlinks are not colored by file type or extension (#3375) - mcedit: silent macro makes terminal disrupted (#4171) - mcedit: disrupting of TAGS file path (#4207) - vfs: unable to browse compressed tar archives (#4191) - sftpfs vfs: CVE-2021-36370: server fingerprint isn't verified (discovered by AUT-milCERT during an audit of open source software) (#4259) - ftpfs vfs: month of file is always January (#4260) - Tests: log files are written by libcheck and automake simultaneously (#3986) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-61=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): mc-4.8.27-bp153.2.3.1 - openSUSE Backports SLE-15-SP3 (noarch): mc-lang-4.8.27-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-36370.html https://bugzilla.suse.com/1190180

1 0

openSUSE-RU-2022:0059-1: moderate: Recommended update for gnuhealth
by maintenance＠opensuse.org 01 Mar '22

01 Mar '22

openSUSE Recommended Update: Recommended update for gnuhealth ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0059-1 Rating: moderate References: #1181400 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: gnuhealth was updated to fix: - Added missing dependency python3-Pillow. - Added hardening to systemd service(s) (bsc#1181400). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-2022-59=1 Package List: - openSUSE Leap 15.3 (noarch): gnuhealth-3.8.0-lp153.4.3.1 gnuhealth-orthanc-3.8.0-lp153.4.3.1 References: https://bugzilla.suse.com/1181400

1 0

openSUSE-RU-2022:0060-1: moderate: Recommended update for python-congressclient, python-ironic-inspector-client, python-masakariclient, python-mistralclient, python-saharaclient, python-senlinclient
by maintenance＠opensuse.org 01 Mar '22

01 Mar '22

openSUSE Recommended Update: Recommended update for python-congressclient, python-ironic-inspector-client, python-masakariclient, python-mistralclient, python-saharaclient, python-senlinclient ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0060-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for python-congressclient, python-ironic-inspector-client, python-masakariclient, python-mistralclient, python-saharaclient, python-senlinclient fixes the following issues: Various openstack related python modules have been updated: - python-congressclient, python-ironic-inspector-client, python-masakariclient, python-mistralclient, python-saharaclient, python-senlinclient Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-60=1 Package List: - openSUSE Backports SLE-15-SP3 (noarch): python-congressclient-doc-2.0.1-bp153.2.3.1 python-masakariclient-doc-6.0.0-bp153.2.3.1 python-mistralclient-doc-4.0.1-bp153.2.3.1 python-saharaclient-doc-3.1.0-bp153.2.3.1 python-senlinclient-doc-2.0.1-bp153.2.3.1 python3-congressclient-2.0.1-bp153.2.3.1 python3-ironic-inspector-client-4.1.0-bp153.2.3.1 python3-masakariclient-6.0.0-bp153.2.3.1 python3-mistralclient-4.0.1-bp153.2.3.1 python3-saharaclient-3.1.0-bp153.2.3.1 python3-senlinclient-2.0.1-bp153.2.3.1 References:

1 0

openSUSE-SU-2022:0062-1: important: Security update for cobbler
by opensuse-security＠opensuse.org 01 Mar '22

01 Mar '22

openSUSE Security Update: Security update for cobbler ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0062-1 Rating: important References: #1184561 #1185679 #1186124 #1189458 #1193671 #1193673 #1193675 #1193676 #1193678 #1194333 #1195906 #1195918 Cross-References: CVE-2021-40323 CVE-2021-40324 CVE-2021-40325 CVE-2021-45082 CVE-2021-45083 CVE-2021-45942 CVSS scores: CVE-2021-40323 (SUSE): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2021-40324 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-40325 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2021-45082 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-45083 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVE-2021-45083 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N CVE-2021-45942 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-45942 (SUSE): 6.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H Affected Products: openSUSE Backports SLE-15-SP3 openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves 6 vulnerabilities and has 6 fixes is now available. Description: This update for cobbler fixes the following issues: - CVE-2021-45083: Fixed unsafe permissions on sensitive files (bsc#1193671). - CVE-2021-45082: Fixed incomplete template sanitation (bsc#1193678). - CVE-2021-40323, CVE-2021-40324, CVE-2021-40325: Fixed Remote Code Execution in the XMLRPC API which additionally allowed arbitrary file read and write as root (boo#1189458). The following non-security bugs were fixed: - Fix issues with installation module logging and validation (boo#1195918) - Move configuration files ownership to apache (boo#1195906) - Remove hardcoded test credentials (boo#1193673) - Prevent log pollution (boo#1193675) - Missing sanity check on MongoDB configuration file (boo#1193676) - Avoid traceback when building tftp files for ppc arch system when boot_loader is not set (boo#1185679) - Prevent some race conditions when writting tftpboot files and the destination directory is not existing (boo#1186124) - Fix trail stripping in case of using UTF symbols (boo#1184561) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-62=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-62=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libIlmImf-2_2-23-2.2.1-3.41.1 libIlmImf-2_2-23-debuginfo-2.2.1-3.41.1 libIlmImfUtil-2_2-23-2.2.1-3.41.1 libIlmImfUtil-2_2-23-debuginfo-2.2.1-3.41.1 openexr-2.2.1-3.41.1 openexr-debuginfo-2.2.1-3.41.1 openexr-debugsource-2.2.1-3.41.1 openexr-devel-2.2.1-3.41.1 openexr-doc-2.2.1-3.41.1 - openSUSE Leap 15.3 (x86_64): libIlmImf-2_2-23-32bit-2.2.1-3.41.1 libIlmImf-2_2-23-32bit-debuginfo-2.2.1-3.41.1 libIlmImfUtil-2_2-23-32bit-2.2.1-3.41.1 libIlmImfUtil-2_2-23-32bit-debuginfo-2.2.1-3.41.1 - openSUSE Backports SLE-15-SP3 (noarch): cobbler-3.1.2-bp153.2.3.1 cobbler-tests-3.1.2-bp153.2.3.1 cobbler-web-3.1.2-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-40323.html https://www.suse.com/security/cve/CVE-2021-40324.html https://www.suse.com/security/cve/CVE-2021-40325.html https://www.suse.com/security/cve/CVE-2021-45082.html https://www.suse.com/security/cve/CVE-2021-45083.html https://www.suse.com/security/cve/CVE-2021-45942.html https://bugzilla.suse.com/1184561 https://bugzilla.suse.com/1185679 https://bugzilla.suse.com/1186124 https://bugzilla.suse.com/1189458 https://bugzilla.suse.com/1193671 https://bugzilla.suse.com/1193673 https://bugzilla.suse.com/1193675 https://bugzilla.suse.com/1193676 https://bugzilla.suse.com/1193678 https://bugzilla.suse.com/1194333 https://bugzilla.suse.com/1195906 https://bugzilla.suse.com/1195918

1 0