September 2022 - openSUSE Updates - openSUSE Mailing Lists

SUSE-RU-2022:3388-1: moderate: Recommended update for google-guest-agent, google-guest-oslogin, google-osconfig-agent
by maintenance＠opensuse.org 26 Sep '22

26 Sep '22

SUSE Recommended Update: Recommended update for google-guest-agent, google-guest-oslogin, google-osconfig-agent ______________________________________________________________________________ Announcement ID: SUSE-RU-2022:3388-1 Rating: moderate References: #1191036 #1194319 #1195391 #1202100 #1202101 #1202826 Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP1 SUSE Linux Enterprise High Performance Computing 15-SP2 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Public Cloud 15-SP1 SUSE Linux Enterprise Module for Public Cloud 15-SP2 SUSE Linux Enterprise Module for Public Cloud 15-SP3 SUSE Linux Enterprise Module for Public Cloud 15-SP4 SUSE Linux Enterprise Server 15-SP1 SUSE Linux Enterprise Server 15-SP2 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP1 SUSE Linux Enterprise Server for SAP Applications 15-SP2 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 6 SUSE Linux Enterprise Storage 7 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.0 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.0 SUSE Manager Retail Branch Server 4.1 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.0 SUSE Manager Server 4.1 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that has 6 recommended fixes can now be installed. Description: This update for google-guest-agent, google-guest-oslogin, google-osconfig-agent fixes the following issues: - Update to version 20220713.00 (bsc#1202100, bsc#1202101) - Use pam_moduledir (bsc#1191036) - Use install command in %post section to create state file (bsc#1202826) - Avoid bashim in post install scripts (bsc#1195391) - Don't restart daemon on package upgrade, create a state file instead (bsc#1194319) Patch Instructions: To install this SUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3388=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3388=1 - SUSE Linux Enterprise Module for Public Cloud 15-SP4: zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP4-2022-3388=1 - SUSE Linux Enterprise Module for Public Cloud 15-SP3: zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP3-2022-3388=1 - SUSE Linux Enterprise Module for Public Cloud 15-SP2: zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP2-2022-3388=1 - SUSE Linux Enterprise Module for Public Cloud 15-SP1: zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP1-2022-3388=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): google-guest-agent-20220713.00-150000.1.29.1 google-guest-oslogin-20220721.00-150000.1.30.1 google-guest-oslogin-debuginfo-20220721.00-150000.1.30.1 google-guest-oslogin-debugsource-20220721.00-150000.1.30.1 google-osconfig-agent-20220801.00-150000.1.22.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): google-guest-agent-20220713.00-150000.1.29.1 google-guest-oslogin-20220721.00-150000.1.30.1 google-guest-oslogin-debuginfo-20220721.00-150000.1.30.1 google-guest-oslogin-debugsource-20220721.00-150000.1.30.1 google-osconfig-agent-20220801.00-150000.1.22.1 - SUSE Linux Enterprise Module for Public Cloud 15-SP4 (aarch64 ppc64le s390x x86_64): google-guest-agent-20220713.00-150000.1.29.1 google-guest-oslogin-20220721.00-150000.1.30.1 google-guest-oslogin-debuginfo-20220721.00-150000.1.30.1 google-guest-oslogin-debugsource-20220721.00-150000.1.30.1 - SUSE Linux Enterprise Module for Public Cloud 15-SP3 (aarch64 ppc64le s390x x86_64): google-guest-agent-20220713.00-150000.1.29.1 google-guest-oslogin-20220721.00-150000.1.30.1 google-guest-oslogin-debuginfo-20220721.00-150000.1.30.1 google-guest-oslogin-debugsource-20220721.00-150000.1.30.1 google-osconfig-agent-20220801.00-150000.1.22.1 - SUSE Linux Enterprise Module for Public Cloud 15-SP2 (aarch64 ppc64le s390x x86_64): google-guest-agent-20220713.00-150000.1.29.1 google-guest-oslogin-20220721.00-150000.1.30.1 google-guest-oslogin-debuginfo-20220721.00-150000.1.30.1 google-guest-oslogin-debugsource-20220721.00-150000.1.30.1 google-osconfig-agent-20220801.00-150000.1.22.1 - SUSE Linux Enterprise Module for Public Cloud 15-SP1 (aarch64 ppc64le s390x x86_64): google-guest-agent-20220713.00-150000.1.29.1 google-guest-oslogin-20220721.00-150000.1.30.1 google-guest-oslogin-debuginfo-20220721.00-150000.1.30.1 google-guest-oslogin-debugsource-20220721.00-150000.1.30.1 google-osconfig-agent-20220801.00-150000.1.22.1 References: https://bugzilla.suse.com/1191036 https://bugzilla.suse.com/1194319 https://bugzilla.suse.com/1195391 https://bugzilla.suse.com/1202100 https://bugzilla.suse.com/1202101 https://bugzilla.suse.com/1202826

1 0

SUSE-SU-2022:3391-1: important: Security update for mariadb
by opensuse-security＠opensuse.org 26 Sep '22

26 Sep '22

SUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3391-1 Rating: important References: #1200105 #1201161 #1201162 #1201163 #1201164 #1201165 #1201166 #1201167 #1201168 #1201169 #1201170 #1202863 Cross-References: CVE-2022-32081 CVE-2022-32082 CVE-2022-32083 CVE-2022-32084 CVE-2022-32085 CVE-2022-32086 CVE-2022-32087 CVE-2022-32088 CVE-2022-32089 CVE-2022-32091 CVE-2022-38791 CVSS scores: CVE-2022-32081 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-32081 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-32082 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-32082 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-32083 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-32083 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-32084 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-32084 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-32085 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-32085 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-32086 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-32086 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-32087 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-32087 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-32088 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-32088 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-32089 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-32089 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-32091 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-32091 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-38791 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-38791 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 SUSE Linux Enterprise Module for Server Applications 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves 11 vulnerabilities and has one errata is now available. Description: This update for mariadb fixes the following issues: Update to 10.5.17: - CVE-2022-32082: Fixed assertion failure at table->get_ref_count() == 0 in dict0dict.cc (bsc#1201162). - CVE-2022-32089: Fixed segmentation fault via the component st_select_lex_unit::exclude_level (bsc#1201169). - CVE-2022-32081: Fixed use-after-poison in prepare_inplace_add_virtual at /storage/innobase/handler/handler0alter.cc (bsc#1201161). - CVE-2022-32091: Fixed use-after-poison in __interceptor_memset at /libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc (bsc#1201170). - CVE-2022-32084: Fixed segmentation fault via the component sub_select (bsc#1201164). - CVE-2022-38791: Fixed deadlock in compress_write in extra/mariabackup/ds_compress.cc (bsc#1202863). - CVE-2022-32088: Fixed segmentation fault via the component Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort (bsc#1201168). - CVE-2022-32087: Fixed segmentation fault via the component Item_args::walk_args (bsc#1201167). - CVE-2022-32086: Fixed segmentation fault via the component Item_field::fix_outer_field (bsc#1201166). - CVE-2022-32085: Fixed segmentation fault via the component Item_func_in::cleanup/Item::cleanup_processor (bsc#1201165). - CVE-2022-32083: Fixed segmentation fault via the component Item_subselect::init_expr_cache_tracker (bsc#1201163). Bugfixes: - Fixed mysql-systemd-helper being unaware of custom group (bsc#1200105). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3391=1 - SUSE Linux Enterprise Module for Server Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP3-2022-3391=1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3: zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP3-2022-3391=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libmariadbd-devel-10.5.17-150300.3.21.1 libmariadbd19-10.5.17-150300.3.21.1 libmariadbd19-debuginfo-10.5.17-150300.3.21.1 mariadb-10.5.17-150300.3.21.1 mariadb-bench-10.5.17-150300.3.21.1 mariadb-bench-debuginfo-10.5.17-150300.3.21.1 mariadb-client-10.5.17-150300.3.21.1 mariadb-client-debuginfo-10.5.17-150300.3.21.1 mariadb-debuginfo-10.5.17-150300.3.21.1 mariadb-debugsource-10.5.17-150300.3.21.1 mariadb-rpm-macros-10.5.17-150300.3.21.1 mariadb-test-10.5.17-150300.3.21.1 mariadb-test-debuginfo-10.5.17-150300.3.21.1 mariadb-tools-10.5.17-150300.3.21.1 mariadb-tools-debuginfo-10.5.17-150300.3.21.1 - openSUSE Leap 15.3 (noarch): mariadb-errormessages-10.5.17-150300.3.21.1 - SUSE Linux Enterprise Module for Server Applications 15-SP3 (aarch64 ppc64le s390x x86_64): libmariadbd-devel-10.5.17-150300.3.21.1 libmariadbd19-10.5.17-150300.3.21.1 libmariadbd19-debuginfo-10.5.17-150300.3.21.1 mariadb-10.5.17-150300.3.21.1 mariadb-client-10.5.17-150300.3.21.1 mariadb-client-debuginfo-10.5.17-150300.3.21.1 mariadb-debuginfo-10.5.17-150300.3.21.1 mariadb-debugsource-10.5.17-150300.3.21.1 mariadb-tools-10.5.17-150300.3.21.1 mariadb-tools-debuginfo-10.5.17-150300.3.21.1 - SUSE Linux Enterprise Module for Server Applications 15-SP3 (noarch): mariadb-errormessages-10.5.17-150300.3.21.1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (aarch64 ppc64le s390x x86_64): mariadb-galera-10.5.17-150300.3.21.1 References: https://www.suse.com/security/cve/CVE-2022-32081.html https://www.suse.com/security/cve/CVE-2022-32082.html https://www.suse.com/security/cve/CVE-2022-32083.html https://www.suse.com/security/cve/CVE-2022-32084.html https://www.suse.com/security/cve/CVE-2022-32085.html https://www.suse.com/security/cve/CVE-2022-32086.html https://www.suse.com/security/cve/CVE-2022-32087.html https://www.suse.com/security/cve/CVE-2022-32088.html https://www.suse.com/security/cve/CVE-2022-32089.html https://www.suse.com/security/cve/CVE-2022-32091.html https://www.suse.com/security/cve/CVE-2022-38791.html https://bugzilla.suse.com/1200105 https://bugzilla.suse.com/1201161 https://bugzilla.suse.com/1201162 https://bugzilla.suse.com/1201163 https://bugzilla.suse.com/1201164 https://bugzilla.suse.com/1201165 https://bugzilla.suse.com/1201166 https://bugzilla.suse.com/1201167 https://bugzilla.suse.com/1201168 https://bugzilla.suse.com/1201169 https://bugzilla.suse.com/1201170 https://bugzilla.suse.com/1202863

1 0

SUSE-SU-2022:3390-1: important: Security update for dpdk
by opensuse-security＠opensuse.org 26 Sep '22

26 Sep '22

SUSE Security Update: Security update for dpdk ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3390-1 Rating: important References: #1202903 #1202956 Cross-References: CVE-2022-2132 CVE-2022-28199 CVSS scores: CVE-2022-2132 (NVD) : 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H CVE-2022-2132 (SUSE): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H CVE-2022-28199 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-28199 (SUSE): 7.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Server Applications 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for dpdk fixes the following issues: - CVE-2022-2132: Fixed DoS when a vhost header crosses more than two descriptors and exhausts all mbufs (bsc#1202903). - CVE-2022-28199: Fixed buffer overflow in the vhost code (bsc#1202956). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3390=1 - SUSE Linux Enterprise Module for Server Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP3-2022-3390=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le x86_64): dpdk-19.11.4-150300.16.1 dpdk-debuginfo-19.11.4-150300.16.1 dpdk-debugsource-19.11.4-150300.16.1 dpdk-devel-19.11.4-150300.16.1 dpdk-devel-debuginfo-19.11.4-150300.16.1 dpdk-examples-19.11.4-150300.16.1 dpdk-examples-debuginfo-19.11.4-150300.16.1 dpdk-kmp-default-19.11.4_k5.3.18_150300.59.93-150300.16.1 dpdk-kmp-default-debuginfo-19.11.4_k5.3.18_150300.59.93-150300.16.1 dpdk-tools-19.11.4-150300.16.1 dpdk-tools-debuginfo-19.11.4-150300.16.1 libdpdk-20_0-19.11.4-150300.16.1 libdpdk-20_0-debuginfo-19.11.4-150300.16.1 - openSUSE Leap 15.3 (aarch64 x86_64): dpdk-kmp-preempt-19.11.4_k5.3.18_150300.59.93-150300.16.1 dpdk-kmp-preempt-debuginfo-19.11.4_k5.3.18_150300.59.93-150300.16.1 - openSUSE Leap 15.3 (aarch64): dpdk-thunderx-19.11.4-150300.16.1 dpdk-thunderx-debuginfo-19.11.4-150300.16.1 dpdk-thunderx-debugsource-19.11.4-150300.16.1 dpdk-thunderx-devel-19.11.4-150300.16.1 dpdk-thunderx-devel-debuginfo-19.11.4-150300.16.1 dpdk-thunderx-examples-19.11.4-150300.16.1 dpdk-thunderx-examples-debuginfo-19.11.4-150300.16.1 dpdk-thunderx-kmp-default-19.11.4_k5.3.18_150300.59.93-150300.16.1 dpdk-thunderx-kmp-default-debuginfo-19.11.4_k5.3.18_150300.59.93-150300.16.1 dpdk-thunderx-kmp-preempt-19.11.4_k5.3.18_150300.59.93-150300.16.1 dpdk-thunderx-kmp-preempt-debuginfo-19.11.4_k5.3.18_150300.59.93-150300.16.1 dpdk-thunderx-tools-19.11.4-150300.16.1 dpdk-thunderx-tools-debuginfo-19.11.4-150300.16.1 - openSUSE Leap 15.3 (noarch): dpdk-doc-19.11.4-150300.16.1 dpdk-thunderx-doc-19.11.4-150300.16.1 - SUSE Linux Enterprise Module for Server Applications 15-SP3 (aarch64 ppc64le x86_64): dpdk-19.11.4-150300.16.1 dpdk-debuginfo-19.11.4-150300.16.1 dpdk-debugsource-19.11.4-150300.16.1 dpdk-devel-19.11.4-150300.16.1 dpdk-devel-debuginfo-19.11.4-150300.16.1 dpdk-kmp-default-19.11.4_k5.3.18_150300.59.93-150300.16.1 dpdk-kmp-default-debuginfo-19.11.4_k5.3.18_150300.59.93-150300.16.1 dpdk-tools-19.11.4-150300.16.1 dpdk-tools-debuginfo-19.11.4-150300.16.1 libdpdk-20_0-19.11.4-150300.16.1 libdpdk-20_0-debuginfo-19.11.4-150300.16.1 - SUSE Linux Enterprise Module for Server Applications 15-SP3 (aarch64): dpdk-thunderx-19.11.4-150300.16.1 dpdk-thunderx-debuginfo-19.11.4-150300.16.1 dpdk-thunderx-debugsource-19.11.4-150300.16.1 dpdk-thunderx-devel-19.11.4-150300.16.1 dpdk-thunderx-devel-debuginfo-19.11.4-150300.16.1 dpdk-thunderx-kmp-default-19.11.4_k5.3.18_150300.59.93-150300.16.1 dpdk-thunderx-kmp-default-debuginfo-19.11.4_k5.3.18_150300.59.93-150300.16.1 References: https://www.suse.com/security/cve/CVE-2022-2132.html https://www.suse.com/security/cve/CVE-2022-28199.html https://bugzilla.suse.com/1202903 https://bugzilla.suse.com/1202956

1 0

SUSE-SU-2022:3353-1: moderate: Security update for permissions
by opensuse-security＠opensuse.org 23 Sep '22

23 Sep '22

SUSE Security Update: Security update for permissions ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3353-1 Rating: moderate References: #1203018 Cross-References: CVE-2022-31252 CVSS scores: CVE-2022-31252 (SUSE): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for permissions fixes the following issues: - CVE-2022-31252: Fixed chkstat group controlled paths (bsc#1203018). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3353=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-3353=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): permissions-20201225-150400.5.11.1 permissions-debuginfo-20201225-150400.5.11.1 permissions-debugsource-20201225-150400.5.11.1 - openSUSE Leap 15.4 (noarch): permissions-zypp-plugin-20201225-150400.5.11.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): permissions-20201225-150400.5.11.1 permissions-debuginfo-20201225-150400.5.11.1 permissions-debugsource-20201225-150400.5.11.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (noarch): permissions-zypp-plugin-20201225-150400.5.11.1 References: https://www.suse.com/security/cve/CVE-2022-31252.html https://bugzilla.suse.com/1203018

1 0

SUSE-SU-2022:3351-1: important: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 23 Sep '22

23 Sep '22

SUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3351-1 Rating: important References: #1202169 #1202807 Cross-References: CVE-2022-32893 CVSS scores: CVE-2022-32893 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-32893 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Desktop Applications 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for webkit2gtk3 fixes the following issues: - CVE-2022-32893: Fixed several crashes and rendering issues (bsc#1202807). - Fixed WebKitGTK not allow to be used from non-main threads (bsc#1202169). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3351=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3351=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP3-2022-3351=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-3351=1 Package List: - openSUSE Leap 15.4 (noarch): libwebkit2gtk3-lang-2.36.7-150200.44.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libjavascriptcoregtk-4_0-18-2.36.7-150200.44.1 libjavascriptcoregtk-4_0-18-debuginfo-2.36.7-150200.44.1 libwebkit2gtk-4_0-37-2.36.7-150200.44.1 libwebkit2gtk-4_0-37-debuginfo-2.36.7-150200.44.1 typelib-1_0-JavaScriptCore-4_0-2.36.7-150200.44.1 typelib-1_0-WebKit2-4_0-2.36.7-150200.44.1 typelib-1_0-WebKit2WebExtension-4_0-2.36.7-150200.44.1 webkit-jsc-4-2.36.7-150200.44.1 webkit-jsc-4-debuginfo-2.36.7-150200.44.1 webkit2gtk-4_0-injected-bundles-2.36.7-150200.44.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.36.7-150200.44.1 webkit2gtk3-debugsource-2.36.7-150200.44.1 webkit2gtk3-devel-2.36.7-150200.44.1 webkit2gtk3-minibrowser-2.36.7-150200.44.1 webkit2gtk3-minibrowser-debuginfo-2.36.7-150200.44.1 - openSUSE Leap 15.3 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.36.7-150200.44.1 libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.36.7-150200.44.1 libwebkit2gtk-4_0-37-32bit-2.36.7-150200.44.1 libwebkit2gtk-4_0-37-32bit-debuginfo-2.36.7-150200.44.1 - openSUSE Leap 15.3 (noarch): libwebkit2gtk3-lang-2.36.7-150200.44.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (aarch64 ppc64le s390x x86_64): typelib-1_0-JavaScriptCore-4_0-2.36.7-150200.44.1 typelib-1_0-WebKit2-4_0-2.36.7-150200.44.1 typelib-1_0-WebKit2WebExtension-4_0-2.36.7-150200.44.1 webkit2gtk3-debugsource-2.36.7-150200.44.1 webkit2gtk3-devel-2.36.7-150200.44.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): libjavascriptcoregtk-4_0-18-2.36.7-150200.44.1 libjavascriptcoregtk-4_0-18-debuginfo-2.36.7-150200.44.1 libwebkit2gtk-4_0-37-2.36.7-150200.44.1 libwebkit2gtk-4_0-37-debuginfo-2.36.7-150200.44.1 webkit2gtk-4_0-injected-bundles-2.36.7-150200.44.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.36.7-150200.44.1 webkit2gtk3-debugsource-2.36.7-150200.44.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (noarch): libwebkit2gtk3-lang-2.36.7-150200.44.1 References: https://www.suse.com/security/cve/CVE-2022-32893.html https://bugzilla.suse.com/1202169 https://bugzilla.suse.com/1202807

1 0

SUSE-SU-2022:3347-1: moderate: Security update for rubygem-rack
by opensuse-security＠opensuse.org 23 Sep '22

23 Sep '22

SUSE Security Update: Security update for rubygem-rack ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3347-1 Rating: moderate References: #1172037 #1173351 Cross-References: CVE-2020-8161 CVE-2020-8184 CVSS scores: CVE-2020-8161 (NVD) : 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N CVE-2020-8161 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2020-8184 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2020-8184 (SUSE): 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N Affected Products: SUSE Linux Enterprise High Availability 15 SUSE Linux Enterprise High Availability 15-SP1 SUSE Linux Enterprise High Availability 15-SP2 SUSE Linux Enterprise High Availability 15-SP3 SUSE Linux Enterprise High Availability 15-SP4 SUSE Linux Enterprise High Performance Computing 15 SUSE Linux Enterprise High Performance Computing 15-SP1 SUSE Linux Enterprise High Performance Computing 15-SP2 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Server 15 SUSE Linux Enterprise Server 15-SP1 SUSE Linux Enterprise Server 15-SP2 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15 SUSE Linux Enterprise Server for SAP Applications 15-SP1 SUSE Linux Enterprise Server for SAP Applications 15-SP2 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 6 SUSE Linux Enterprise Storage 7 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.0 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.0 SUSE Manager Retail Branch Server 4.1 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.0 SUSE Manager Server 4.1 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for rubygem-rack fixes the following issues: - CVE-2020-8184: Fixed vulnerability where percent-encoded cookies can be used to overwrite existing prefixed cookie names (bsc#1173351). - CVE-2020-8161: Fixed directory traversal in Rack:Directory (bsc#1172037). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3347=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3347=1 - SUSE Linux Enterprise High Availability 15-SP4: zypper in -t patch SUSE-SLE-Product-HA-15-SP4-2022-3347=1 - SUSE Linux Enterprise High Availability 15-SP3: zypper in -t patch SUSE-SLE-Product-HA-15-SP3-2022-3347=1 - SUSE Linux Enterprise High Availability 15-SP2: zypper in -t patch SUSE-SLE-Product-HA-15-SP2-2022-3347=1 - SUSE Linux Enterprise High Availability 15-SP1: zypper in -t patch SUSE-SLE-Product-HA-15-SP1-2022-3347=1 - SUSE Linux Enterprise High Availability 15: zypper in -t patch SUSE-SLE-Product-HA-15-2022-3347=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-rack-2.0.8-150000.3.9.1 ruby2.5-rubygem-rack-doc-2.0.8-150000.3.9.1 ruby2.5-rubygem-rack-testsuite-2.0.8-150000.3.9.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-rack-2.0.8-150000.3.9.1 ruby2.5-rubygem-rack-doc-2.0.8-150000.3.9.1 ruby2.5-rubygem-rack-testsuite-2.0.8-150000.3.9.1 - SUSE Linux Enterprise High Availability 15-SP4 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-rack-2.0.8-150000.3.9.1 - SUSE Linux Enterprise High Availability 15-SP3 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-rack-2.0.8-150000.3.9.1 - SUSE Linux Enterprise High Availability 15-SP2 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-rack-2.0.8-150000.3.9.1 - SUSE Linux Enterprise High Availability 15-SP1 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-rack-2.0.8-150000.3.9.1 - SUSE Linux Enterprise High Availability 15 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-rack-2.0.8-150000.3.9.1 References: https://www.suse.com/security/cve/CVE-2020-8161.html https://www.suse.com/security/cve/CVE-2020-8184.html https://bugzilla.suse.com/1172037 https://bugzilla.suse.com/1173351

1 0

SUSE-SU-2022:3341-1: important: Security update for dpdk
by opensuse-security＠opensuse.org 23 Sep '22

23 Sep '22

SUSE Security Update: Security update for dpdk ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3341-1 Rating: important References: #1202903 #1202956 Cross-References: CVE-2022-2132 CVE-2022-28199 CVSS scores: CVE-2022-2132 (NVD) : 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H CVE-2022-2132 (SUSE): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H CVE-2022-28199 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-28199 (SUSE): 7.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Server Applications 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for dpdk fixes the following issues: - CVE-2022-2132: Fixed DoS when a vhost header crosses more than two descriptors and exhausts all mbufs (bsc#1202903). - CVE-2022-28199: Fixed buffer overflow in the vhost code (bsc#1202956). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3341=1 - SUSE Linux Enterprise Module for Server Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2022-3341=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le x86_64): dpdk-19.11.10-150400.4.7.1 dpdk-debuginfo-19.11.10-150400.4.7.1 dpdk-debugsource-19.11.10-150400.4.7.1 dpdk-devel-19.11.10-150400.4.7.1 dpdk-devel-debuginfo-19.11.10-150400.4.7.1 dpdk-examples-19.11.10-150400.4.7.1 dpdk-examples-debuginfo-19.11.10-150400.4.7.1 dpdk-kmp-default-19.11.10_k5.14.21_150400.24.18-150400.4.7.1 dpdk-kmp-default-debuginfo-19.11.10_k5.14.21_150400.24.18-150400.4.7.1 dpdk-tools-19.11.10-150400.4.7.1 dpdk-tools-debuginfo-19.11.10-150400.4.7.1 libdpdk-20_0-19.11.10-150400.4.7.1 libdpdk-20_0-debuginfo-19.11.10-150400.4.7.1 - openSUSE Leap 15.4 (aarch64): dpdk-thunderx-19.11.10-150400.4.7.1 dpdk-thunderx-debuginfo-19.11.10-150400.4.7.1 dpdk-thunderx-debugsource-19.11.10-150400.4.7.1 dpdk-thunderx-devel-19.11.10-150400.4.7.1 dpdk-thunderx-devel-debuginfo-19.11.10-150400.4.7.1 dpdk-thunderx-examples-19.11.10-150400.4.7.1 dpdk-thunderx-examples-debuginfo-19.11.10-150400.4.7.1 dpdk-thunderx-kmp-default-19.11.10_k5.14.21_150400.24.18-150400.4.7.1 dpdk-thunderx-kmp-default-debuginfo-19.11.10_k5.14.21_150400.24.18-150400.4.7.1 dpdk-thunderx-tools-19.11.10-150400.4.7.1 dpdk-thunderx-tools-debuginfo-19.11.10-150400.4.7.1 - openSUSE Leap 15.4 (noarch): dpdk-doc-19.11.10-150400.4.7.1 dpdk-thunderx-doc-19.11.10-150400.4.7.1 - SUSE Linux Enterprise Module for Server Applications 15-SP4 (aarch64 ppc64le x86_64): dpdk-19.11.10-150400.4.7.1 dpdk-debuginfo-19.11.10-150400.4.7.1 dpdk-debugsource-19.11.10-150400.4.7.1 dpdk-devel-19.11.10-150400.4.7.1 dpdk-devel-debuginfo-19.11.10-150400.4.7.1 dpdk-kmp-default-19.11.10_k5.14.21_150400.24.18-150400.4.7.1 dpdk-kmp-default-debuginfo-19.11.10_k5.14.21_150400.24.18-150400.4.7.1 dpdk-tools-19.11.10-150400.4.7.1 dpdk-tools-debuginfo-19.11.10-150400.4.7.1 libdpdk-20_0-19.11.10-150400.4.7.1 libdpdk-20_0-debuginfo-19.11.10-150400.4.7.1 - SUSE Linux Enterprise Module for Server Applications 15-SP4 (aarch64): dpdk-thunderx-19.11.10-150400.4.7.1 dpdk-thunderx-debuginfo-19.11.10-150400.4.7.1 dpdk-thunderx-debugsource-19.11.10-150400.4.7.1 dpdk-thunderx-devel-19.11.10-150400.4.7.1 dpdk-thunderx-devel-debuginfo-19.11.10-150400.4.7.1 dpdk-thunderx-kmp-default-19.11.10_k5.14.21_150400.24.18-150400.4.7.1 dpdk-thunderx-kmp-default-debuginfo-19.11.10_k5.14.21_150400.24.18-150400.4.7.1 References: https://www.suse.com/security/cve/CVE-2022-2132.html https://www.suse.com/security/cve/CVE-2022-28199.html https://bugzilla.suse.com/1202903 https://bugzilla.suse.com/1202956

1 0

openSUSE-SU-2022:10129-1: important: Security update for virtualbox
by opensuse-security＠opensuse.org 23 Sep '22

23 Sep '22

openSUSE Security Update: Security update for virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10129-1 Rating: important References: #1201720 #1203086 #1203306 #1203370 Cross-References: CVE-2022-21554 CVE-2022-21571 CVSS scores: CVE-2022-21554 (NVD) : 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-21554 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-21571 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2022-21571 (SUSE): 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for virtualbox fixes the following issues: Version bump to 6.1.38r86 released by Oracle September 02 2022 This is a maintenance release. The following items were fixed and/or added: - GUI: Improvements in Native Language Support area - Main: OVF Export: Added support for exporting VMs containing Virtio-SCSI controllers - Recording settings: Fixed a regression which could cause not starting the COM server (VBoxSVC) under certain circumstances (bug #21034) - Recording: More deterministic naming for recorded files (will now overwrite old .webm files if present) - Linux Host and Guest Additions installer: Improved check for systemd presence in the system (bug #19033) - Linux Guest Additions: Introduced initial support for kernel 6.0 - Linux Guest Additions: Additional fixes for kernel RHEL 9.1 (bug #21065) - Windows Guest Additions: Improvements in Drag and Drop area - Fixes permission problem with /dev/vboxuser (boo#1203370) - Fixes missing firewall opening (boo#1203086) - Fixes boo#1201720 CVE items for CVE-2022-21571, CVE-2022-21554 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-2022-10129=1 Package List: - openSUSE Leap 15.3 (x86_64): python3-virtualbox-6.1.38-lp153.2.36.1 python3-virtualbox-debuginfo-6.1.38-lp153.2.36.1 virtualbox-6.1.38-lp153.2.36.1 virtualbox-debuginfo-6.1.38-lp153.2.36.1 virtualbox-debugsource-6.1.38-lp153.2.36.1 virtualbox-devel-6.1.38-lp153.2.36.1 virtualbox-guest-tools-6.1.38-lp153.2.36.1 virtualbox-guest-tools-debuginfo-6.1.38-lp153.2.36.1 virtualbox-kmp-debugsource-6.1.38-lp153.2.36.1 virtualbox-kmp-default-6.1.38_k5.3.18_150300.59.93-lp153.2.36.1 virtualbox-kmp-default-debuginfo-6.1.38_k5.3.18_150300.59.93-lp153.2.36.1 virtualbox-kmp-preempt-6.1.38_k5.3.18_150300.59.93-lp153.2.36.1 virtualbox-kmp-preempt-debuginfo-6.1.38_k5.3.18_150300.59.93-lp153.2.36.1 virtualbox-qt-6.1.38-lp153.2.36.1 virtualbox-qt-debuginfo-6.1.38-lp153.2.36.1 virtualbox-vnc-6.1.38-lp153.2.36.1 virtualbox-websrv-6.1.38-lp153.2.36.1 virtualbox-websrv-debuginfo-6.1.38-lp153.2.36.1 - openSUSE Leap 15.3 (noarch): virtualbox-guest-desktop-icons-6.1.38-lp153.2.36.1 virtualbox-guest-source-6.1.38-lp153.2.36.1 virtualbox-host-source-6.1.38-lp153.2.36.1 References: https://www.suse.com/security/cve/CVE-2022-21554.html https://www.suse.com/security/cve/CVE-2022-21571.html https://bugzilla.suse.com/1201720 https://bugzilla.suse.com/1203086 https://bugzilla.suse.com/1203306 https://bugzilla.suse.com/1203370

1 0

SUSE-RU-2022:3336-1: moderate: Recommended update for distribution
by maintenance＠opensuse.org 22 Sep '22

22 Sep '22

SUSE Recommended Update: Recommended update for distribution ______________________________________________________________________________ Announcement ID: SUSE-RU-2022:3336-1 Rating: moderate References: #1203324 Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Containers 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for distribution fixes the following issues: - Explicitly require nologin shell which is needed for registry system user (bsc#1203324) Patch Instructions: To install this SUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3336=1 - SUSE Linux Enterprise Module for Containers 15-SP4: zypper in -t patch SUSE-SLE-Module-Containers-15-SP4-2022-3336=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): distribution-registry-2.8.1-150400.9.11.1 - SUSE Linux Enterprise Module for Containers 15-SP4 (aarch64 ppc64le s390x x86_64): distribution-registry-2.8.1-150400.9.11.1 References: https://bugzilla.suse.com/1203324

1 0

SUSE-SU-2022:3334-1: important: Security update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer
by opensuse-security＠opensuse.org 22 Sep '22

22 Sep '22

SUSE Security Update: Security update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3334-1 Rating: important References: #1200528 Cross-References: CVE-2022-1996 CVSS scores: CVE-2022-1996 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2022-1996 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Containers 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer fixes the following issues: Update to version 1.51.0 - Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51. 0 Security issues fixed in vendored dependencies: - CVE-2022-1996: Fixed CORS bypass (bsc#1200528) - Include additional tools used by cdi-importer: cdi-containerimage-server cdi-image-size-detection cdi-source-update-poller - Pack only cdi-operator and cdi-cr release manifests - Install tar for cloning filesystem PVCs Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3334=1 - SUSE Linux Enterprise Module for Containers 15-SP4: zypper in -t patch SUSE-SLE-Module-Containers-15-SP4-2022-3334=1 Package List: - openSUSE Leap 15.4 (x86_64): containerized-data-importer-api-1.51.0-150400.4.3.1 containerized-data-importer-api-debuginfo-1.51.0-150400.4.3.1 containerized-data-importer-cloner-1.51.0-150400.4.3.1 containerized-data-importer-cloner-debuginfo-1.51.0-150400.4.3.1 containerized-data-importer-controller-1.51.0-150400.4.3.1 containerized-data-importer-controller-debuginfo-1.51.0-150400.4.3.1 containerized-data-importer-importer-1.51.0-150400.4.3.1 containerized-data-importer-importer-debuginfo-1.51.0-150400.4.3.1 containerized-data-importer-manifests-1.51.0-150400.4.3.1 containerized-data-importer-operator-1.51.0-150400.4.3.1 containerized-data-importer-operator-debuginfo-1.51.0-150400.4.3.1 containerized-data-importer-uploadproxy-1.51.0-150400.4.3.1 containerized-data-importer-uploadproxy-debuginfo-1.51.0-150400.4.3.1 containerized-data-importer-uploadserver-1.51.0-150400.4.3.1 containerized-data-importer-uploadserver-debuginfo-1.51.0-150400.4.3.1 obs-service-cdi_containers_meta-1.51.0-150400.4.3.1 - SUSE Linux Enterprise Module for Containers 15-SP4 (x86_64): containerized-data-importer-manifests-1.51.0-150400.4.3.1 References: https://www.suse.com/security/cve/CVE-2022-1996.html https://bugzilla.suse.com/1200528

1 0