September 2022 - openSUSE Updates - openSUSE Mailing Lists

SUSE-SU-2022:3333-1: important: Security update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container
by opensuse-security＠opensuse.org 22 Sep '22

22 Sep '22

SUSE Security Update: Security update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3333-1 Rating: important References: #1199392 #1199460 #1199603 #1200528 #1202516 Cross-References: CVE-2022-1798 CVE-2022-1996 CVE-2022-29162 CVSS scores: CVE-2022-1798 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2022-1798 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2022-1996 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2022-1996 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-29162 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-29162 (SUSE): 4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Containers 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves three vulnerabilities and has two fixes is now available. Description: This update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container fixes the following issues: The kubevirt stack was updated to version 0.54.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.54.0 Security fixes: - CVE-2022-1798: Fix arbitrary file read on the host from KubeVirt VMs (bsc#1202516) Security fixes in vendored dependencies: - CVE-2022-1996: Fixed go-restful CORS bypass bsc#1200528) - CVE-2022-29162: Fixed runc incorrect handling of inheritable capabilities in default configuration (bsc#1199460) - Fix containerdisk unmount logic - Support topology spread constraints - Update libvirt-go to fix memory leak - Pack nft rules and nsswitch.conf for virt-handler - Only create 1MiB-aligned disk images (bsc#1199603) - Avoid to return nil failure message - Use semantic equality comparison - Drop kubevirt-psp-caasp.yaml - Allow to configure utility containers for update test - Symlink nsswitch.conf and nft rules to proper locations - Drop unused package libvirt-client - Install vim-small instead of vim - Remove unneeded libvirt-daemon-driver-storage-core - Install missing packages ethtool and gawk. Fixes bsc#1199392 Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3333=1 - SUSE Linux Enterprise Module for Containers 15-SP4: zypper in -t patch SUSE-SLE-Module-Containers-15-SP4-2022-3333=1 Package List: - openSUSE Leap 15.4 (x86_64): kubevirt-container-disk-0.54.0-150400.3.3.2 kubevirt-container-disk-debuginfo-0.54.0-150400.3.3.2 kubevirt-manifests-0.54.0-150400.3.3.2 kubevirt-tests-0.54.0-150400.3.3.2 kubevirt-tests-debuginfo-0.54.0-150400.3.3.2 kubevirt-virt-api-0.54.0-150400.3.3.2 kubevirt-virt-api-debuginfo-0.54.0-150400.3.3.2 kubevirt-virt-controller-0.54.0-150400.3.3.2 kubevirt-virt-controller-debuginfo-0.54.0-150400.3.3.2 kubevirt-virt-handler-0.54.0-150400.3.3.2 kubevirt-virt-handler-debuginfo-0.54.0-150400.3.3.2 kubevirt-virt-launcher-0.54.0-150400.3.3.2 kubevirt-virt-launcher-debuginfo-0.54.0-150400.3.3.2 kubevirt-virt-operator-0.54.0-150400.3.3.2 kubevirt-virt-operator-debuginfo-0.54.0-150400.3.3.2 kubevirt-virtctl-0.54.0-150400.3.3.2 kubevirt-virtctl-debuginfo-0.54.0-150400.3.3.2 obs-service-kubevirt_containers_meta-0.54.0-150400.3.3.2 - SUSE Linux Enterprise Module for Containers 15-SP4 (x86_64): kubevirt-manifests-0.54.0-150400.3.3.2 kubevirt-virtctl-0.54.0-150400.3.3.2 kubevirt-virtctl-debuginfo-0.54.0-150400.3.3.2 References: https://www.suse.com/security/cve/CVE-2022-1798.html https://www.suse.com/security/cve/CVE-2022-1996.html https://www.suse.com/security/cve/CVE-2022-29162.html https://bugzilla.suse.com/1199392 https://bugzilla.suse.com/1199460 https://bugzilla.suse.com/1199603 https://bugzilla.suse.com/1200528 https://bugzilla.suse.com/1202516

1 0

SUSE-SU-2022:3335-1: important: Security update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer
by opensuse-security＠opensuse.org 22 Sep '22

22 Sep '22

SUSE Security Update: Security update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3335-1 Rating: important References: #1200528 Cross-References: CVE-2022-1996 CVSS scores: CVE-2022-1996 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2022-1996 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Containers 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer fixes the following issues: Update to version 1.43.2 - Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43. 2 Security issues fixed: - CVE-2022-1996: Fixed CORS bypass in go-restful vendored dependency (bsc#1200528) Other fixes: - Include additional tools used by cdi-importer: cdi-containerimage-server cdi-source-update-poller - Pack only cdi-{cr,operator}.yaml into the manifests RPM - Install tar package (used for cloning filesystem PVCs) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3335=1 - SUSE Linux Enterprise Module for Containers 15-SP3: zypper in -t patch SUSE-SLE-Module-Containers-15-SP3-2022-3335=1 Package List: - openSUSE Leap 15.3 (x86_64): containerized-data-importer-api-1.43.2-150300.8.9.3 containerized-data-importer-api-debuginfo-1.43.2-150300.8.9.3 containerized-data-importer-cloner-1.43.2-150300.8.9.3 containerized-data-importer-cloner-debuginfo-1.43.2-150300.8.9.3 containerized-data-importer-controller-1.43.2-150300.8.9.3 containerized-data-importer-controller-debuginfo-1.43.2-150300.8.9.3 containerized-data-importer-importer-1.43.2-150300.8.9.3 containerized-data-importer-importer-debuginfo-1.43.2-150300.8.9.3 containerized-data-importer-manifests-1.43.2-150300.8.9.3 containerized-data-importer-operator-1.43.2-150300.8.9.3 containerized-data-importer-operator-debuginfo-1.43.2-150300.8.9.3 containerized-data-importer-uploadproxy-1.43.2-150300.8.9.3 containerized-data-importer-uploadproxy-debuginfo-1.43.2-150300.8.9.3 containerized-data-importer-uploadserver-1.43.2-150300.8.9.3 containerized-data-importer-uploadserver-debuginfo-1.43.2-150300.8.9.3 obs-service-cdi_containers_meta-1.43.2-150300.8.9.3 - SUSE Linux Enterprise Module for Containers 15-SP3 (x86_64): containerized-data-importer-manifests-1.43.2-150300.8.9.3 References: https://www.suse.com/security/cve/CVE-2022-1996.html https://bugzilla.suse.com/1200528

1 0

SUSE-SU-2022:3326-1: important: Security update for go1.19
by opensuse-security＠opensuse.org 21 Sep '22

21 Sep '22

SUSE Security Update: Security update for go1.19 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3326-1 Rating: important References: #1200441 #1203185 #1203186 Cross-References: CVE-2022-27664 CVE-2022-32190 CVSS scores: CVE-2022-27664 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-27664 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-32190 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Development Tools 15-SP3 SUSE Linux Enterprise Module for Development Tools 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for go1.19 fixes the following issues: Update to go version 1.19.1 (bsc#1200441): - CVE-2022-27664: Fixed DoS in net/http caused by mishandled server errors after sending GOAWAY (bsc#1203185). - CVE-2022-32190: Fixed missing stripping of relative path components in net/url JoinPath (bsc#1203186). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3326=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3326=1 - SUSE Linux Enterprise Module for Development Tools 15-SP4: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2022-3326=1 - SUSE Linux Enterprise Module for Development Tools 15-SP3: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP3-2022-3326=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): go1.19-1.19.1-150000.1.9.1 go1.19-doc-1.19.1-150000.1.9.1 - openSUSE Leap 15.4 (aarch64 x86_64): go1.19-race-1.19.1-150000.1.9.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): go1.19-1.19.1-150000.1.9.1 go1.19-doc-1.19.1-150000.1.9.1 - openSUSE Leap 15.3 (aarch64 x86_64): go1.19-race-1.19.1-150000.1.9.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 ppc64le s390x x86_64): go1.19-1.19.1-150000.1.9.1 go1.19-doc-1.19.1-150000.1.9.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 x86_64): go1.19-race-1.19.1-150000.1.9.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 ppc64le s390x x86_64): go1.19-1.19.1-150000.1.9.1 go1.19-doc-1.19.1-150000.1.9.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 x86_64): go1.19-race-1.19.1-150000.1.9.1 References: https://www.suse.com/security/cve/CVE-2022-27664.html https://www.suse.com/security/cve/CVE-2022-32190.html https://bugzilla.suse.com/1200441 https://bugzilla.suse.com/1203185 https://bugzilla.suse.com/1203186

1 0

SUSE-SU-2022:3327-1: important: Security update for oniguruma
by opensuse-security＠opensuse.org 21 Sep '22

21 Sep '22

SUSE Security Update: Security update for oniguruma ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3327-1 Rating: important References: #1142847 #1150130 #1157805 #1164550 #1164569 #1177179 Cross-References: CVE-2019-13224 CVE-2019-16163 CVE-2019-19203 CVE-2019-19204 CVE-2019-19246 CVE-2020-26159 CVSS scores: CVE-2019-13224 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-13224 (SUSE): 6.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H CVE-2019-16163 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-16163 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2019-19203 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-19203 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-19204 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-19204 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-19246 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-19246 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-26159 (NVD) : 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H CVE-2020-26159 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: SUSE CaaS Platform 4.0 SUSE Enterprise Storage 6 SUSE Enterprise Storage 7 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP1-BCL SUSE Linux Enterprise Server 15-SP1-LTSS SUSE Linux Enterprise Server 15-SP2-BCL SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP 15-SP1 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.1 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.1 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 openSUSE Leap Micro 5.2 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for oniguruma fixes the following issues: - CVE-2019-19246: Fixed an out of bounds access during regular expression matching (bsc#1157805). - CVE-2019-19204: Fixed an out of bounds access when compiling a crafted regular expression (bsc#1164569). - CVE-2019-19203: Fixed an out of bounds access when performing a string search (bsc#1164550). - CVE-2019-16163: Fixed an uncontrolled recursion issue when compiling a crafted regular expression, which could lead to denial of service (bsc#1150130). - CVE-2020-26159: Fixed an off-by-one buffer overflow (bsc#1177179). - CVE-2019-13224: Fixed a potential use-after-free when handling multiple different encodings (bsc#1142847). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap Micro 5.2: zypper in -t patch openSUSE-Leap-Micro-5.2-2022-3327=1 - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3327=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3327=1 - SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-3327=1 - SUSE Manager Retail Branch Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-3327=1 - SUSE Manager Proxy 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-3327=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-3327=1 - SUSE Linux Enterprise Server for SAP 15-SP1: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2022-3327=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-3327=1 - SUSE Linux Enterprise Server 15-SP2-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-3327=1 - SUSE Linux Enterprise Server 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-3327=1 - SUSE Linux Enterprise Server 15-SP1-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-BCL-2022-3327=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-3327=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-3327=1 - SUSE Linux Enterprise Micro 5.2: zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-3327=1 - SUSE Linux Enterprise Micro 5.1: zypper in -t patch SUSE-SUSE-MicroOS-5.1-2022-3327=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-3327=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-3327=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-3327=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-3327=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2022-3327=1 - SUSE Enterprise Storage 6: zypper in -t patch SUSE-Storage-6-2022-3327=1 - SUSE CaaS Platform 4.0: To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. Package List: - openSUSE Leap Micro 5.2 (aarch64 x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - SUSE Manager Server 4.1 (ppc64le s390x x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - SUSE Manager Retail Branch Server 4.1 (x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - SUSE Manager Proxy 4.1 (x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (ppc64le x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - SUSE Linux Enterprise Server 15-SP2-BCL (x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (aarch64 ppc64le s390x x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - SUSE Linux Enterprise Server 15-SP1-BCL (x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 - SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (aarch64 x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (aarch64 x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - SUSE Enterprise Storage 7 (aarch64 x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - SUSE Enterprise Storage 6 (aarch64 x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 - SUSE CaaS Platform 4.0 (x86_64): libonig4-6.7.0-150000.3.3.1 libonig4-debuginfo-6.7.0-150000.3.3.1 oniguruma-debugsource-6.7.0-150000.3.3.1 oniguruma-devel-6.7.0-150000.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-13224.html https://www.suse.com/security/cve/CVE-2019-16163.html https://www.suse.com/security/cve/CVE-2019-19203.html https://www.suse.com/security/cve/CVE-2019-19204.html https://www.suse.com/security/cve/CVE-2019-19246.html https://www.suse.com/security/cve/CVE-2020-26159.html https://bugzilla.suse.com/1142847 https://bugzilla.suse.com/1150130 https://bugzilla.suse.com/1157805 https://bugzilla.suse.com/1164550 https://bugzilla.suse.com/1164569 https://bugzilla.suse.com/1177179

1 0

SUSE-RU-2022:3328-1: moderate: Recommended update for jitterentropy
by maintenance＠opensuse.org 21 Sep '22

21 Sep '22

SUSE Recommended Update: Recommended update for jitterentropy ______________________________________________________________________________ Announcement ID: SUSE-RU-2022:3328-1 Rating: moderate References: #1202870 Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for jitterentropy fixes the following issues: - Hide the non-GNUC constructs that are library internal from the exported header, to make it usable in builds with strict C99 compliance. (bsc#1202870) Patch Instructions: To install this SUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3328=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-3328=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): jitterentropy-devel-3.4.0-150000.1.6.1 jitterentropy-devel-static-3.4.0-150000.1.6.1 libjitterentropy3-3.4.0-150000.1.6.1 - openSUSE Leap 15.4 (x86_64): jitterentropy-devel-32bit-3.4.0-150000.1.6.1 libjitterentropy3-32bit-3.4.0-150000.1.6.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): jitterentropy-devel-3.4.0-150000.1.6.1 jitterentropy-devel-static-3.4.0-150000.1.6.1 libjitterentropy3-3.4.0-150000.1.6.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (x86_64): jitterentropy-devel-32bit-3.4.0-150000.1.6.1 libjitterentropy3-32bit-3.4.0-150000.1.6.1 References: https://bugzilla.suse.com/1202870

1 0

SUSE-SU-2022:3325-1: important: Security update for go1.18
by opensuse-security＠opensuse.org 21 Sep '22

21 Sep '22

SUSE Security Update: Security update for go1.18 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3325-1 Rating: important References: #1193742 #1203185 Cross-References: CVE-2022-27664 CVSS scores: CVE-2022-27664 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-27664 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Development Tools 15-SP3 SUSE Linux Enterprise Module for Development Tools 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for go1.18 fixes the following issues: Update to go version 1.18.6 (bsc#1193742): - CVE-2022-27664: Fixed DoS in net/http caused by mishandled server errors after sending GOAWAY (bsc#1203185). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3325=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3325=1 - SUSE Linux Enterprise Module for Development Tools 15-SP4: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2022-3325=1 - SUSE Linux Enterprise Module for Development Tools 15-SP3: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP3-2022-3325=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): go1.18-1.18.6-150000.1.31.1 go1.18-doc-1.18.6-150000.1.31.1 - openSUSE Leap 15.4 (aarch64 x86_64): go1.18-race-1.18.6-150000.1.31.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): go1.18-1.18.6-150000.1.31.1 go1.18-doc-1.18.6-150000.1.31.1 - openSUSE Leap 15.3 (aarch64 x86_64): go1.18-race-1.18.6-150000.1.31.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 ppc64le s390x x86_64): go1.18-1.18.6-150000.1.31.1 go1.18-doc-1.18.6-150000.1.31.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 x86_64): go1.18-race-1.18.6-150000.1.31.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 ppc64le s390x x86_64): go1.18-1.18.6-150000.1.31.1 go1.18-doc-1.18.6-150000.1.31.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 x86_64): go1.18-race-1.18.6-150000.1.31.1 References: https://www.suse.com/security/cve/CVE-2022-27664.html https://bugzilla.suse.com/1193742 https://bugzilla.suse.com/1203185

1 0

SUSE-SU-2022:3321-1: important: Security update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container
by opensuse-security＠opensuse.org 20 Sep '22

20 Sep '22

SUSE Security Update: Security update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3321-1 Rating: important References: #1199392 #1199460 #1199603 #1200528 #1202516 Cross-References: CVE-2022-1798 CVE-2022-1996 CVE-2022-29162 CVSS scores: CVE-2022-1798 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2022-1798 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2022-1996 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2022-1996 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-29162 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-29162 (SUSE): 4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Containers 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves three vulnerabilities and has two fixes is now available. Description: This update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container fixes the following issues: Security issues fixed: - CVE-2022-1798: Fix arbitrary file read on the host from KubeVirt VMs (bsc#1202516) Security issues fixed in vendored dependencies: - CVE-2022-1996: Fixed go-restful CORS bypass (bsc#1200528) - CVE-2022-29162: Fixed runc incorrect handling of inheritable capabilities in default configuration (bsc#1199460) Other fixes: - Pack nft rules and nsswitch.conf for virt-handler - Only create 1MiB-aligned disk images (bsc#1199603) - Avoid to return nil failure message - Use semantic equality comparison - Allow to configure utility containers for update test - Install nftables to manage network rules - Install tar to allow kubectl cp ... - Symlink nsswitch.conf and nft rules to proper locations - Enable USB redirection support for QEMU - Install vim-small instread of vim - Drop libvirt-daemon-driver-storage-core - Install ethtool and gawk (bsc#1199392) - Use non-versioned appliance to avoid redundant rpm query - Explicitly state the dependency on kubevirt main package Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3321=1 - SUSE Linux Enterprise Module for Containers 15-SP3: zypper in -t patch SUSE-SLE-Module-Containers-15-SP3-2022-3321=1 Package List: - openSUSE Leap 15.3 (x86_64): kubevirt-container-disk-0.49.0-150300.8.13.1 kubevirt-container-disk-debuginfo-0.49.0-150300.8.13.1 kubevirt-manifests-0.49.0-150300.8.13.1 kubevirt-tests-0.49.0-150300.8.13.1 kubevirt-tests-debuginfo-0.49.0-150300.8.13.1 kubevirt-virt-api-0.49.0-150300.8.13.1 kubevirt-virt-api-debuginfo-0.49.0-150300.8.13.1 kubevirt-virt-controller-0.49.0-150300.8.13.1 kubevirt-virt-controller-debuginfo-0.49.0-150300.8.13.1 kubevirt-virt-handler-0.49.0-150300.8.13.1 kubevirt-virt-handler-debuginfo-0.49.0-150300.8.13.1 kubevirt-virt-launcher-0.49.0-150300.8.13.1 kubevirt-virt-launcher-debuginfo-0.49.0-150300.8.13.1 kubevirt-virt-operator-0.49.0-150300.8.13.1 kubevirt-virt-operator-debuginfo-0.49.0-150300.8.13.1 kubevirt-virtctl-0.49.0-150300.8.13.1 kubevirt-virtctl-debuginfo-0.49.0-150300.8.13.1 obs-service-kubevirt_containers_meta-0.49.0-150300.8.13.1 - SUSE Linux Enterprise Module for Containers 15-SP3 (x86_64): kubevirt-manifests-0.49.0-150300.8.13.1 kubevirt-virtctl-0.49.0-150300.8.13.1 kubevirt-virtctl-debuginfo-0.49.0-150300.8.13.1 References: https://www.suse.com/security/cve/CVE-2022-1798.html https://www.suse.com/security/cve/CVE-2022-1996.html https://www.suse.com/security/cve/CVE-2022-29162.html https://bugzilla.suse.com/1199392 https://bugzilla.suse.com/1199460 https://bugzilla.suse.com/1199603 https://bugzilla.suse.com/1200528 https://bugzilla.suse.com/1202516

1 0

SUSE-RU-2022:3319-1: Recommended update for perl-DBD-Pg
by maintenance＠opensuse.org 20 Sep '22

20 Sep '22

SUSE Recommended Update: Recommended update for perl-DBD-Pg ______________________________________________________________________________ Announcement ID: SUSE-RU-2022:3319-1 Rating: low References: #1197797 Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Development Tools 15-SP3 SUSE Linux Enterprise Module for Development Tools 15-SP4 SUSE Linux Enterprise Module for SUSE Manager Server 4.1 SUSE Linux Enterprise Module for SUSE Manager Server 4.2 SUSE Linux Enterprise Module for SUSE Manager Server 4.3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.1 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for perl-DBD-Pg fixes the following issues: - Adjust tests for reltuples being -1 for new relations (bsc#1197797) Patch Instructions: To install this SUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3319=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3319=1 - SUSE Linux Enterprise Module for SUSE Manager Server 4.3: zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Server-4.3-2022-3319=1 - SUSE Linux Enterprise Module for SUSE Manager Server 4.2: zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Server-4.2-2022-3319=1 - SUSE Linux Enterprise Module for SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Server-4.1-2022-3319=1 - SUSE Linux Enterprise Module for Development Tools 15-SP4: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2022-3319=1 - SUSE Linux Enterprise Module for Development Tools 15-SP3: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP3-2022-3319=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): perl-DBD-Pg-3.10.4-150200.3.3.1 perl-DBD-Pg-debuginfo-3.10.4-150200.3.3.1 perl-DBD-Pg-debugsource-3.10.4-150200.3.3.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): perl-DBD-Pg-3.10.4-150200.3.3.1 perl-DBD-Pg-debuginfo-3.10.4-150200.3.3.1 perl-DBD-Pg-debugsource-3.10.4-150200.3.3.1 - SUSE Linux Enterprise Module for SUSE Manager Server 4.3 (aarch64 ppc64le s390x x86_64): perl-DBD-Pg-3.10.4-150200.3.3.1 perl-DBD-Pg-debuginfo-3.10.4-150200.3.3.1 perl-DBD-Pg-debugsource-3.10.4-150200.3.3.1 - SUSE Linux Enterprise Module for SUSE Manager Server 4.2 (aarch64 ppc64le s390x x86_64): perl-DBD-Pg-3.10.4-150200.3.3.1 perl-DBD-Pg-debuginfo-3.10.4-150200.3.3.1 perl-DBD-Pg-debugsource-3.10.4-150200.3.3.1 - SUSE Linux Enterprise Module for SUSE Manager Server 4.1 (aarch64 ppc64le s390x x86_64): perl-DBD-Pg-3.10.4-150200.3.3.1 perl-DBD-Pg-debuginfo-3.10.4-150200.3.3.1 perl-DBD-Pg-debugsource-3.10.4-150200.3.3.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 ppc64le s390x x86_64): perl-DBD-Pg-3.10.4-150200.3.3.1 perl-DBD-Pg-debuginfo-3.10.4-150200.3.3.1 perl-DBD-Pg-debugsource-3.10.4-150200.3.3.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 ppc64le s390x x86_64): perl-DBD-Pg-3.10.4-150200.3.3.1 perl-DBD-Pg-debuginfo-3.10.4-150200.3.3.1 perl-DBD-Pg-debugsource-3.10.4-150200.3.3.1 References: https://bugzilla.suse.com/1197797

1 0

SUSE-SU-2022:3320-1: important: Security update for vsftpd
by opensuse-security＠opensuse.org 20 Sep '22

20 Sep '22

SUSE Security Update: Security update for vsftpd ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3320-1 Rating: important References: #1021387 #1052900 #1187678 #1187686 #786024 PM-3322 Cross-References: CVE-2021-3618 CVSS scores: CVE-2021-3618 (NVD) : 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2021-3618 (SUSE): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Server Applications 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves one vulnerability, contains one feature and has four fixes is now available. Description: This update for vsftpd fixes the following issues: - CVE-2021-3618: Enforced security checks against ALPACA attack (bsc#1187678, bsc#1187686, PM-3322). Bugfixes: - Fixed a seccomp failure in FIPS mode when SSL was enabled (bsc#1052900). - Allowed wait4() to be called so that the broker can wait for its child processes (bsc#1021387). - Allowed sendto() syscall when /dev/log support is enabled (bsc#786024). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3320=1 - SUSE Linux Enterprise Module for Server Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2022-3320=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): vsftpd-3.0.5-150400.3.3.1 vsftpd-debuginfo-3.0.5-150400.3.3.1 vsftpd-debugsource-3.0.5-150400.3.3.1 - SUSE Linux Enterprise Module for Server Applications 15-SP4 (aarch64 ppc64le s390x x86_64): vsftpd-3.0.5-150400.3.3.1 vsftpd-debuginfo-3.0.5-150400.3.3.1 vsftpd-debugsource-3.0.5-150400.3.3.1 References: https://www.suse.com/security/cve/CVE-2021-3618.html https://bugzilla.suse.com/1021387 https://bugzilla.suse.com/1052900 https://bugzilla.suse.com/1187678 https://bugzilla.suse.com/1187686 https://bugzilla.suse.com/786024

1 0

SUSE-RU-2022:3317-1: moderate: Recommended update for live-langset-data
by maintenance＠opensuse.org 20 Sep '22

20 Sep '22

SUSE Recommended Update: Recommended update for live-langset-data ______________________________________________________________________________ Announcement ID: SUSE-RU-2022:3317-1 Rating: moderate References: #1187618 Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Development Tools 15-SP3 SUSE Linux Enterprise Module for Development Tools 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for live-langset-data fixes the following issues: - Don't restart systemd-vconsole-setup.service explicitly (bsc#1187618) - Use command `y2start` instead of `y2base` that caused issues with nokogiri Patch Instructions: To install this SUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3317=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3317=1 - SUSE Linux Enterprise Module for Development Tools 15-SP4: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2022-3317=1 - SUSE Linux Enterprise Module for Development Tools 15-SP3: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP3-2022-3317=1 Package List: - openSUSE Leap 15.4 (noarch): live-langset-data-2.0-150300.13.3.1 - openSUSE Leap 15.3 (noarch): live-langset-data-2.0-150300.13.3.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (noarch): live-langset-data-2.0-150300.13.3.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (noarch): live-langset-data-2.0-150300.13.3.1 References: https://bugzilla.suse.com/1187618

1 0