December 2023 - openSUSE Updates - openSUSE Mailing Lists

SUSE-SU-2023:4895-1: moderate: Security update for libsass
by OPENSUSE-UPDATES 18 Dec '23

18 Dec '23

# Security update for libsass Announcement ID: SUSE-SU-2023:4895-1 Rating: moderate References: * bsc#1214573 * bsc#1214575 * bsc#1214576 Cross-References: * CVE-2022-26592 * CVE-2022-43357 * CVE-2022-43358 CVSS scores: * CVE-2022-26592 ( SUSE ): 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H * CVE-2022-26592 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2022-43357 ( SUSE ): 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H * CVE-2022-43357 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2022-43358 ( SUSE ): 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H * CVE-2022-43358 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 * SUSE Package Hub 15 15-SP4 * SUSE Package Hub 15 15-SP5 An update that solves three vulnerabilities can now be installed. ## Description: This update for libsass fixes the following issues: * CVE-2022-26592: Fixed Stack Overflow vulnerability in libsass 3.6.5 via the CompoundSelector:has_real_parent_ref function (bsc#1214576) * CVE-2022-43358: Fixed Stack overflow vulnerability in ast_selectors.cpp (bsc#1214575). * CVE-2022-43357: Fixed Stack overflow vulnerability in ast_selectors.cpp (bsc#1214573). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Package Hub 15 15-SP4 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2023-4895=1 * SUSE Package Hub 15 15-SP5 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2023-4895=1 * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-4895=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-4895=1 ## Package List: * SUSE Package Hub 15 15-SP4 (aarch64 ppc64le s390x x86_64) * libsass-debugsource-3.6.5-150200.4.10.1 * libsass-3_6_5-1-debuginfo-3.6.5-150200.4.10.1 * libsass-devel-3.6.5-150200.4.10.1 * libsass-3_6_5-1-3.6.5-150200.4.10.1 * SUSE Package Hub 15 15-SP5 (aarch64 ppc64le s390x x86_64) * libsass-debugsource-3.6.5-150200.4.10.1 * libsass-devel-3.6.5-150200.4.10.1 * libsass-3_6_5-1-3.6.5-150200.4.10.1 * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * libsass-debugsource-3.6.5-150200.4.10.1 * libsass-3_6_5-1-debuginfo-3.6.5-150200.4.10.1 * libsass-devel-3.6.5-150200.4.10.1 * libsass-3_6_5-1-3.6.5-150200.4.10.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * libsass-debugsource-3.6.5-150200.4.10.1 * libsass-3_6_5-1-debuginfo-3.6.5-150200.4.10.1 * libsass-devel-3.6.5-150200.4.10.1 * libsass-3_6_5-1-3.6.5-150200.4.10.1 ## References: * https://www.suse.com/security/cve/CVE-2022-26592.html * https://www.suse.com/security/cve/CVE-2022-43357.html * https://www.suse.com/security/cve/CVE-2022-43358.html * https://bugzilla.suse.com/show_bug.cgi?id=1214573 * https://bugzilla.suse.com/show_bug.cgi?id=1214575 * https://bugzilla.suse.com/show_bug.cgi?id=1214576

1 0

SUSE-RU-2023:4890-1: moderate: Recommended update for python-websocket-client
by OPENSUSE-UPDATES 18 Dec '23

18 Dec '23

# Recommended update for python-websocket-client Announcement ID: SUSE-RU-2023:4890-1 Rating: moderate References: * bsc#1215314 Affected Products: * Basesystem Module 15-SP4 * Basesystem Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * Public Cloud Module 15-SP1 * SUSE CaaS Platform 4.0 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP1 * SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.0 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.0 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.0 * SUSE Manager Server 4.3 An update that has one fix can now be installed. ## Description: This update for python-websocket-client fixes the following issues: * Re-enable Python 3.6 to fix pip3 install (bsc#1215314) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-4890=1 * Public Cloud Module 15-SP1 zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP1-2023-4890=1 * SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2023-4890=1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2023-4890=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-4890=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-4890=1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2023-4890=1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2023-4890=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-4890=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2023-4890=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2023-4890=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-4890=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2023-4890=1 * SUSE CaaS Platform 4.0 To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-4890=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-4890=1 * Basesystem Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-4890=1 ## Package List: * Basesystem Module 15-SP5 (noarch) * python3-websocket-client-1.3.2-150100.6.10.5 * Public Cloud Module 15-SP1 (noarch) * python3-websocket-client-1.3.2-150100.6.10.5 * SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (noarch) * python3-websocket-client-1.3.2-150100.6.10.5 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (noarch) * python3-websocket-client-1.3.2-150100.6.10.5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (noarch) * python3-websocket-client-1.3.2-150100.6.10.5 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch) * python3-websocket-client-1.3.2-150100.6.10.5 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (noarch) * python3-websocket-client-1.3.2-150100.6.10.5 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (noarch) * python3-websocket-client-1.3.2-150100.6.10.5 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (noarch) * python3-websocket-client-1.3.2-150100.6.10.5 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 (noarch) * python3-websocket-client-1.3.2-150100.6.10.5 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (noarch) * python3-websocket-client-1.3.2-150100.6.10.5 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (noarch) * python3-websocket-client-1.3.2-150100.6.10.5 * SUSE Enterprise Storage 7.1 (noarch) * python3-websocket-client-1.3.2-150100.6.10.5 * SUSE CaaS Platform 4.0 (noarch) * python3-websocket-client-1.3.2-150100.6.10.5 * openSUSE Leap 15.4 (noarch) * python3-websocket-client-1.3.2-150100.6.10.5 * openSUSE Leap 15.5 (noarch) * python3-websocket-client-1.3.2-150100.6.10.5 * Basesystem Module 15-SP4 (noarch) * python3-websocket-client-1.3.2-150100.6.10.5 ## References: * https://bugzilla.suse.com/show_bug.cgi?id=1215314

1 0

SUSE-SU-2023:4893-1: moderate: Security update for freerdp
by OPENSUSE-UPDATES 18 Dec '23

18 Dec '23

# Security update for freerdp Announcement ID: SUSE-SU-2023:4893-1 Rating: moderate References: * bsc#1214856 * bsc#1214857 * bsc#1214858 * bsc#1214859 * bsc#1214860 * bsc#1214862 * bsc#1214863 * bsc#1214864 * bsc#1214866 * bsc#1214867 * bsc#1214868 * bsc#1214869 * bsc#1214870 * bsc#1214871 * bsc#1214872 Cross-References: * CVE-2023-39350 * CVE-2023-39351 * CVE-2023-39352 * CVE-2023-39353 * CVE-2023-39354 * CVE-2023-39356 * CVE-2023-40181 * CVE-2023-40186 * CVE-2023-40188 * CVE-2023-40567 * CVE-2023-40569 * CVE-2023-40574 * CVE-2023-40575 * CVE-2023-40576 * CVE-2023-40589 CVSS scores: * CVE-2023-39350 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-39350 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-39351 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2023-39351 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2023-39352 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2023-39352 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2023-39353 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2023-39353 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2023-39354 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-39354 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-39356 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2023-39356 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2023-40181 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2023-40181 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2023-40186 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L * CVE-2023-40186 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L * CVE-2023-40188 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2023-40188 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2023-40567 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L * CVE-2023-40567 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L * CVE-2023-40569 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L * CVE-2023-40569 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L * CVE-2023-40574 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L * CVE-2023-40574 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L * CVE-2023-40575 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2023-40575 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2023-40576 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2023-40576 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2023-40589 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L * CVE-2023-40589 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Workstation Extension 15 SP4 * SUSE Linux Enterprise Workstation Extension 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 * SUSE Package Hub 15 15-SP4 * SUSE Package Hub 15 15-SP5 An update that solves 15 vulnerabilities can now be installed. ## Description: This update for freerdp fixes the following issues: * CVE-2023-39350: Fixed incorrect offset calculation leading to DoS (bsc#1214856). * CVE-2023-39351: Fixed Null Pointer Dereference leading DoS in RemoteFX (bsc#1214857). * CVE-2023-39352: Fixed Invalid offset validation leading to Out Of Bound Write (bsc#1214858). * CVE-2023-39353: Fixed Missing offset validation leading to Out Of Bound Read (bsc#1214859). * CVE-2023-39354: Fixed Out-Of-Bounds Read in nsc_rle_decompress_data (bsc#1214860). * CVE-2023-39356: Fixed Missing offset validation leading to Out-of-Bounds Read in gdi_multi_opaque_rect (bsc#1214862). * CVE-2023-40181: Fixed Integer-Underflow leading to Out-Of-Bound Read in zgfx_decompress_segment (bsc#1214863). * CVE-2023-40186: Fixed IntegerOverflow leading to Out-Of-Bound Write Vulnerability in gdi_CreateSurface (bsc#1214864). * CVE-2023-40188: Fixed Out-Of-Bounds Read in general_LumaToYUV444 (bsc#1214866). * CVE-2023-40567: Fixed Out-Of-Bounds Write in clear_decompress_bands_data (bsc#1214867). * CVE-2023-40569: Fixed Out-Of-Bounds Write in progressive_decompress (bsc#1214868). * CVE-2023-40574: Fixed Out-Of-Bounds Write in general_YUV444ToRGB_8u_P3AC4R_BGRX (bsc#1214869). * CVE-2023-40575: Fixed Out-Of-Bounds Read in general_YUV444ToRGB_8u_P3AC4R_BGRX (bsc#1214870). * CVE-2023-40576: Fixed Out-Of-Bounds Read in RleDecompress (bsc#1214871). * CVE-2023-40589: Fixed Global-Buffer-Overflow in ncrush_decompress (bsc#1214872). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-4893=1 SUSE-2023-4893=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-4893=1 * SUSE Package Hub 15 15-SP4 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2023-4893=1 * SUSE Package Hub 15 15-SP5 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2023-4893=1 * SUSE Linux Enterprise Workstation Extension 15 SP4 zypper in -t patch SUSE-SLE-Product-WE-15-SP4-2023-4893=1 * SUSE Linux Enterprise Workstation Extension 15 SP5 zypper in -t patch SUSE-SLE-Product-WE-15-SP5-2023-4893=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * libwinpr2-2.4.0-150400.3.23.1 * freerdp-server-debuginfo-2.4.0-150400.3.23.1 * libwinpr2-debuginfo-2.4.0-150400.3.23.1 * libfreerdp2-2.4.0-150400.3.23.1 * freerdp-devel-2.4.0-150400.3.23.1 * freerdp-debugsource-2.4.0-150400.3.23.1 * libuwac0-0-2.4.0-150400.3.23.1 * freerdp-debuginfo-2.4.0-150400.3.23.1 * uwac0-0-devel-2.4.0-150400.3.23.1 * libuwac0-0-debuginfo-2.4.0-150400.3.23.1 * freerdp-wayland-2.4.0-150400.3.23.1 * freerdp-proxy-2.4.0-150400.3.23.1 * freerdp-server-2.4.0-150400.3.23.1 * freerdp-2.4.0-150400.3.23.1 * winpr2-devel-2.4.0-150400.3.23.1 * freerdp-wayland-debuginfo-2.4.0-150400.3.23.1 * libfreerdp2-debuginfo-2.4.0-150400.3.23.1 * freerdp-proxy-debuginfo-2.4.0-150400.3.23.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * libwinpr2-2.4.0-150400.3.23.1 * freerdp-server-debuginfo-2.4.0-150400.3.23.1 * libwinpr2-debuginfo-2.4.0-150400.3.23.1 * libfreerdp2-2.4.0-150400.3.23.1 * freerdp-devel-2.4.0-150400.3.23.1 * freerdp-debugsource-2.4.0-150400.3.23.1 * libuwac0-0-2.4.0-150400.3.23.1 * freerdp-debuginfo-2.4.0-150400.3.23.1 * uwac0-0-devel-2.4.0-150400.3.23.1 * libuwac0-0-debuginfo-2.4.0-150400.3.23.1 * freerdp-wayland-2.4.0-150400.3.23.1 * freerdp-proxy-2.4.0-150400.3.23.1 * freerdp-server-2.4.0-150400.3.23.1 * freerdp-2.4.0-150400.3.23.1 * winpr2-devel-2.4.0-150400.3.23.1 * freerdp-wayland-debuginfo-2.4.0-150400.3.23.1 * libfreerdp2-debuginfo-2.4.0-150400.3.23.1 * freerdp-proxy-debuginfo-2.4.0-150400.3.23.1 * SUSE Package Hub 15 15-SP4 (aarch64 ppc64le s390x) * libwinpr2-2.4.0-150400.3.23.1 * libwinpr2-debuginfo-2.4.0-150400.3.23.1 * libfreerdp2-2.4.0-150400.3.23.1 * freerdp-devel-2.4.0-150400.3.23.1 * freerdp-debugsource-2.4.0-150400.3.23.1 * freerdp-debuginfo-2.4.0-150400.3.23.1 * freerdp-proxy-2.4.0-150400.3.23.1 * freerdp-2.4.0-150400.3.23.1 * winpr2-devel-2.4.0-150400.3.23.1 * libfreerdp2-debuginfo-2.4.0-150400.3.23.1 * freerdp-proxy-debuginfo-2.4.0-150400.3.23.1 * SUSE Package Hub 15 15-SP5 (aarch64 ppc64le s390x) * libwinpr2-2.4.0-150400.3.23.1 * freerdp-server-debuginfo-2.4.0-150400.3.23.1 * libwinpr2-debuginfo-2.4.0-150400.3.23.1 * libfreerdp2-2.4.0-150400.3.23.1 * freerdp-devel-2.4.0-150400.3.23.1 * freerdp-debugsource-2.4.0-150400.3.23.1 * libuwac0-0-2.4.0-150400.3.23.1 * freerdp-debuginfo-2.4.0-150400.3.23.1 * uwac0-0-devel-2.4.0-150400.3.23.1 * libuwac0-0-debuginfo-2.4.0-150400.3.23.1 * freerdp-wayland-2.4.0-150400.3.23.1 * freerdp-proxy-2.4.0-150400.3.23.1 * freerdp-server-2.4.0-150400.3.23.1 * freerdp-2.4.0-150400.3.23.1 * winpr2-devel-2.4.0-150400.3.23.1 * freerdp-wayland-debuginfo-2.4.0-150400.3.23.1 * libfreerdp2-debuginfo-2.4.0-150400.3.23.1 * freerdp-proxy-debuginfo-2.4.0-150400.3.23.1 * SUSE Linux Enterprise Workstation Extension 15 SP4 (x86_64) * libwinpr2-2.4.0-150400.3.23.1 * libwinpr2-debuginfo-2.4.0-150400.3.23.1 * libfreerdp2-2.4.0-150400.3.23.1 * freerdp-devel-2.4.0-150400.3.23.1 * freerdp-debugsource-2.4.0-150400.3.23.1 * freerdp-debuginfo-2.4.0-150400.3.23.1 * freerdp-proxy-2.4.0-150400.3.23.1 * freerdp-2.4.0-150400.3.23.1 * winpr2-devel-2.4.0-150400.3.23.1 * libfreerdp2-debuginfo-2.4.0-150400.3.23.1 * freerdp-proxy-debuginfo-2.4.0-150400.3.23.1 * SUSE Linux Enterprise Workstation Extension 15 SP5 (x86_64) * libwinpr2-2.4.0-150400.3.23.1 * libwinpr2-debuginfo-2.4.0-150400.3.23.1 * libfreerdp2-2.4.0-150400.3.23.1 * freerdp-devel-2.4.0-150400.3.23.1 * freerdp-debugsource-2.4.0-150400.3.23.1 * freerdp-debuginfo-2.4.0-150400.3.23.1 * freerdp-proxy-2.4.0-150400.3.23.1 * freerdp-2.4.0-150400.3.23.1 * winpr2-devel-2.4.0-150400.3.23.1 * libfreerdp2-debuginfo-2.4.0-150400.3.23.1 * freerdp-proxy-debuginfo-2.4.0-150400.3.23.1 ## References: * https://www.suse.com/security/cve/CVE-2023-39350.html * https://www.suse.com/security/cve/CVE-2023-39351.html * https://www.suse.com/security/cve/CVE-2023-39352.html * https://www.suse.com/security/cve/CVE-2023-39353.html * https://www.suse.com/security/cve/CVE-2023-39354.html * https://www.suse.com/security/cve/CVE-2023-39356.html * https://www.suse.com/security/cve/CVE-2023-40181.html * https://www.suse.com/security/cve/CVE-2023-40186.html * https://www.suse.com/security/cve/CVE-2023-40188.html * https://www.suse.com/security/cve/CVE-2023-40567.html * https://www.suse.com/security/cve/CVE-2023-40569.html * https://www.suse.com/security/cve/CVE-2023-40574.html * https://www.suse.com/security/cve/CVE-2023-40575.html * https://www.suse.com/security/cve/CVE-2023-40576.html * https://www.suse.com/security/cve/CVE-2023-40589.html * https://bugzilla.suse.com/show_bug.cgi?id=1214856 * https://bugzilla.suse.com/show_bug.cgi?id=1214857 * https://bugzilla.suse.com/show_bug.cgi?id=1214858 * https://bugzilla.suse.com/show_bug.cgi?id=1214859 * https://bugzilla.suse.com/show_bug.cgi?id=1214860 * https://bugzilla.suse.com/show_bug.cgi?id=1214862 * https://bugzilla.suse.com/show_bug.cgi?id=1214863 * https://bugzilla.suse.com/show_bug.cgi?id=1214864 * https://bugzilla.suse.com/show_bug.cgi?id=1214866 * https://bugzilla.suse.com/show_bug.cgi?id=1214867 * https://bugzilla.suse.com/show_bug.cgi?id=1214868 * https://bugzilla.suse.com/show_bug.cgi?id=1214869 * https://bugzilla.suse.com/show_bug.cgi?id=1214870 * https://bugzilla.suse.com/show_bug.cgi?id=1214871 * https://bugzilla.suse.com/show_bug.cgi?id=1214872

1 0

SUSE-FU-2023:4885-1: moderate: Feature update for Jackson
by null＠suse.de 18 Dec '23

18 Dec '23

# Feature update for Jackson Announcement ID: SUSE-FU-2023:4885-1 Rating: moderate References: * jsc#MSC-611 * jsc#SLE-23217 Affected Products: * Basesystem Module 15-SP4 * Basesystem Module 15-SP5 * Development Tools Module 15-SP4 * Development Tools Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise Real Time 15 SP3 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.2 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.2 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.2 * SUSE Manager Server 4.3 * SUSE Manager Server 4.3 Module 4.3 An update that contains two features can now be installed. ## Description: This update for Jackson fixes the following issues: jackson-annotations was updated from version 2.13.0 to 2.15.2: * Add 'JsonFormat.Feature's: READ_UNKNOWN_ENUM_VALUES_AS_NULL, READ_UNKNOWN_ENUM_VALUES_USING_DEFAULT_VALUE * Add NOTICE file with copyright information * Add 'JsonFormat.Feature.READ_DATE_TIMESTAMPS_AS_NANOSECONDS' * Allow explicit 'JsonSubTypes' repeated names check * Version allignment to other jackson packages jackson-bom was updated from version 2.13.0 to 2.15.2: * Update 'de.jjohannes:gradle-module-metadata-maven-plugin' to 0.4.0 * Add override for 'version.plugin.moditect' to be '1.0.0.Final' until upgraded in 'oss-parent'/51 * Change defaults for Felix OSGi Bundle plug-in to fix timestamps for Reproducible Builds * Add version for 'jackson-datatype-hibernate6' * Add version for 'jackson-module-jsonSchema-jakarta' * Gradle reports incorrect jackson-bom dependency version * Moved 'module-info.java' to 'META-INF/versions/11' instead of 'META- INF/versions/9' jackson-core was updated from version 2.13.0 to 2.15.2: * Version 2.15.2: * Allow override of 'StreamReadContraints' default with 'overrideDefaultStreamReadConstraints()' * Version 2.15.1: * Add FastDoubleParser section to 'NOTICE' * Increase default max allowed String value length from 5 megs to 20 megs * Problem with 'FilteringGeneratorDelegate' wrt 'TokenFilter.Inclusion.INCLUDE_NON_NULL' * Version 2.15.0: * Add numeric value size limits via 'StreamReadConstraints' * Add SLSA provenance via build script * Add 'StreamReadFeature.USE_FAST_BIG_DECIMAL_PARSER' to enable faster 'BigDecimal', 'BigInteger' parsing * Add 'StreamReadConstraints' limit for longest textual value to allow (default: 5M) * Optimize parsing 19 digit longs * Fix possible flaw in 'TokenFilterContext#skipParentChecks()' * Add 'Object JsonParser.getNumberValueDeferred()' method to allow for deferred decoding in some cases * Add 'JsonFactory.Feature.CHARSET_DETECTION' to disable charset detection * Use 'StreamConstraintsException' in name canonicalizers * Offer a way to directly set 'StreamReadConstraints' via 'JsonFactory' (not just Builder) * Prevent inefficient internal conversion from 'BigDecimal' to 'BigInteger' wrt ultra-large scale * Add 'JsonGenerator.copyCurrentEventExact' as alternative to 'copyCurrentEvent()' * Version 2.14.3: * Optional padding Base64Variant still throws exception on missing padding character * Address performance issue with 'BigDecimalParser' * Backport removal of BigDecimal to BigInt conersio * FastDoubleParser license * Got 'NegativeArraySizeException' when calling 'writeValueAsString()' * Version 2.14.2: * Allow TokenFIlter to skip last elements in arrays * Avoid instance creations in fast parser code * Fix 'FilteringGeneratorDelegate' not creating new 'filterContext' if 'tokenFilter' is null * Version 2.14.0: * Add 'NumberInput.parseFloat()' * Add 'StreamReadCapability.EXACT_FLOATS' to indicate whether parser reports exact floating-point values or not * Add "JsonPointer#appendProperty" and "JsonPointer#appendIndex" * Add a feature to allow leading plus sign ('JsonReadFeature.ALLOW_LEADING_PLUS_SIGN_FOR_NUMBERS') * Add explicit bounds checks for 'JsonFactory.createParser()' methods that take 'byte[]'/'char[]'-with-offsets input * Add explicit bounds checks for 'JsonGenerator' methods that take 'byte[]'/'char[]'/String-with-offsets input * Add option to accept non-standard trailing decimal point ('JsonReadFeature.ALLOW_TRAILING_DECIMAL_POINT_FOR_NUMBERS') * Allow TokenFilters to keep empty arrays and objects * Allow use of faster floating-point number parsing with 'StreamReadFeature.USE_FAST_DOUBLE_PARSER' * Allow use of faster floating-point number serialization ('StreamWriteFeature.USE_FAST_DOUBLE_WRITER') * Avoid copy when parsing 'BigDecimal' * Change minimum Java version to 8 * Fix 'JsonFactory.createGenerator()' with 'File' that may leak 'OutputStream's * Fix 'JsonFactory.createParser()' with 'File' that may leak 'InputStream's * Fix 'JsonPointer.empty()' should NOT indicate match of a property with key of "" * Fix 'JsonPointer' quadratic memory use: Out Of Memory (OOME) on deep inputs * Fix calling 'JsonPointer.compile(...)' on very deeply nested expression throwing 'StackOverflowError' * Fix Hex capitalization for JsonWriter to be configurable (add 'JsonWriteFeature.WRITE_HEX_UPPER_CASE') * Fix ReaderBaseJsonParser._verifyRootSpace() that can cause buffer boundary failure * JsonGenerator to provide current value to the context before starting objects * Make 'BigDecimal' parsing lazy * Make 'BigInteger' parsing lazy * Make 'JsonPointer' 'java.io.Serializable' * Provide implementation of async JSON parser fed by 'ByteBufferFeeder' * Remove workaround for old issue with a particular double * Update ParserBase to support floats directly * Use 'BigDecimalParser' for BigInteger parsing very long numbers * Version 2.13.3: * Limit size of exception message in BigDecimalParser * Version 2.13.2: * Fix `JsonLocation` in 2.13 that only uses identity comparison for "content reference" * Update Maven wrapper * Version 2.13.1: * Fix incorrect parsing of single-quoted surrounded String values containing double quotes jackson-databind was updated from 2.13.4.2 to 2.15.2: * Version 2.15.2: * Fix record setter not included from interface (2.15 regression) * Version 2.15.1: * Fix error in creating nested 'ArrayNode's with * 'JsonNode.withArray()' * Only avoid Records fields detection for deserialization * Fix issue with deserialization when there are unexpected properties (due to null 'StreamReadConstraints') * Fix TypeId serialization for 'JsonTypeInfo.Id.DEDUCTION', native type ids * Version 2.15.0: * Add '@EnumNaming', 'EnumNamingStrategy' to allow use of naming strategies for Enums * Add 'EnumFeature.READ_ENUM_KEYS_USING_INDEX' to work with existing "WRITE_ENUM_KEYS_USING_INDEX" * Add 'MapperFeature.REQUIRE_TYPE_ID_FOR_SUBTYPES' to enable/disable strict subtype Type Id handling * Add convenience method 'SimpleBeanPropertyFilter.filterOutAll()' as counterpart of 'serializeAll()' * Add enum features into '@JsonFormat.Feature' * Add Stream-friendly alternative to 'ObjectNode.fields()': 'Set<Map.Entry<String, JsonNode>> properties()' * Add support in 'TokenBuffer' for lazily decoded (big) numbers * Allow serializing enums to lowercase ('EnumFeature.WRITE_ENUMS_TO_LOWERCASE') * Allow use of '@JsonCreator(mode = Mode.PROPERTIES)' creator for POJOs with"empty String" coercion * Cannot use both 'JsonCreator.Mode.DELEGATING' and 'JsonCreator.Mode.PROPERTIES' static creator factory methods for Enums * Case-insensitive and number-based enum deserialization are (unnecessarily) mutually exclusive * Deprecate "exact values" setting from 'JsonNodeFactory', replace with 'JsonNodeFeature.STRIP_TRAILING_BIGDECIMAL_ZEROES' * Deprecate classes in package 'com.fasterxml.jackson.databind.jsonschema' * Do not require the usage of opens in a modular app when using records * Enhance 'StdNodeBasedDeserializer' to support 'readerForUpdating' * Fix Enum Deserialisation Failing with Polymorphic type validator * Fix '@JsonDeserialize(converter = ...)' not working with Records * Fix 'DelegatingDeserializer' missing override of 'getAbsentValue()' (and couple of other methods) * Fix 'JsonTypeInfo.As.EXTERNAL_PROPERTY' not working with record wrappers * Fix 'Optional<Boolean>' not recognized as boolean field * Fix 'TypeFactory' cache performance degradation with 'constructSpecializedType()' * Fix classloader leak: DEFAULT_ANNOTATION_INTROSPECTOR holds annotation reference * Fix deserialization of '@JsonTypeInfo' annotated type fails with missing type id even for explicit concrete subtypes * Fix Incorrect target type for arrays when disabling coercion * Fix InvalidDefinitionException when calling mapper.createObjectNode().putPOJO * Fix Null coercion with '@JsonSetter' not working with 'java.lang.Record' * Fix properties naming strategy not working with Record * Fix Timestamp in classes inside jar showing 02/01/1980 * Fix TokenBuffer does not implement writeString(Reader reader, int len) * Fix transient 'Field's are not ignored as Mutators if there is visible Getter * Fix wrong schemaType of 'LongSerializer' * Flush readonly map together with shared on 'SerializerCache.flush()' * Infer '@JsonCreator(mode = Mode.DELEGATING)' from use of '@JsonValue') * Support '@JsonCreator' annotation on record classes * Try to avoid auto-detecting Fields for Record types * Version 2.14.3: * Fix 'PrimitiveArrayDeserializers$ByteDeser.deserialize' ignores 'DeserializationProblemHandler' for invalid Base64 content * Set transformer factory attributes to improve protection against XXE * Version 2.14.2: * Allow custom 'JsonNode' implementations * Fix '@JsonTypeInfo' does not work if the Type Id is an Integer value * Fix '@JsonValue' failing for Java Record * Fix 'StdDelegatingDeserializer' ignoring 'nullValue' of '_delegateDeserializer'. * Fix Enum polymorphism not working correctly with DEDUCTION * Version 2.14.1: * Fix 'Enum' values that cannot be read from single-element array even with 'DeserializationFeature.UNWRAP_SINGLE_VALUE_ARRAYS' * Version 2.14.0: * Add method 'ObjectMapper.copyWith(JsonFactory)' * Add method(s) in 'JsonNode' that works like combination of 'at()' and 'with()': 'withObject(...)' and 'withArray(...)' * Add optional explicit 'JsonSubTypes' repeated names check * Add serializer-cache size limit to avoid Metaspace issues from caching Serializers * Allow (de)serializing records using Bean(De)SerializerModifier even when reflection is unavailable * Allow disabling Integer to String coercion via 'CoercionConfig' * Allow non-boolean return type for "is-getters" with 'MapperFeature.ALLOW_IS_GETTERS_FOR_NON_BOOLEAN' * Allow use of 'JsonNode' field for '@JsonAnySetter' * Change 'JsonNode.with(String)' and 'withArray(String)' to consider argument as 'JsonPointer' if valid expression * Change 'TypeSerializerBase' to skip 'generator.writeTypePrefix()' for 'null' typeId * Change LRUMap to just evict one entry when maxEntries reached * Create DataTypeFeature abstraction (for JSTEP-7) with placeholder features * Deeply nested JsonNode throws StackOverflowError for toString() * Deserialization of Throwables with PropertyNamingStrategy does not work * Deserialize missing value of 'EXTERNAL_PROPERTY' type using custom 'NullValueProvider' * Do not strip generic type from 'Class<C>' when resolving 'JavaType' * Expose 'translate()' method of standard 'PropertyNamingStrategy' implementations * Filter method only got called once if the field is null when using '@JsonInclude(value = JsonInclude.Include.CUSTOM, valueFilter = SomeFieldFilter.class)' * Fix '@JsonIgnore' does not if together with '@JsonProperty' or '@JsonFormat' * Fix 'configOverride.setMergeable(false)' not supported by 'ArrayNode' * Fix 'StdDeserializer' that coerces ints to floats even if configured to fail * Fix 'TokenBuffer' defaults for parser/stream-read features which neither passed from parser nor use real defaults * Fix deduction deserializer with DefaultTypeResolverBuilder * Fix issue preventing merge of polymorphic objects * Implement 'float' and 'boolean' to 'String' coercion config * Implement 'JsonNodeFeature.READ_NULL_PROPERTIES' to allow skipping of JSON 'null' values on reading * Implement 'JsonNodeFeature.WRITE_NULL_PROPERTIES' to allow skipping JSON 'null' values on writing * Improve performance of 'UnresolvedForwardReference' for forward reference resolution * Legacy 'ALLOW_COERCION_OF_SCALARS' interacts poorly with Integer to Float coercion * Replace 'JsonNode.with()' with 'JsonNode.withObject()' * Support 'null'-valued 'Map' fields with "any setter" * Support use of fast double parse * Update 'MapDeserializer' to support 'StreamReadCapability.DUPLICATE_PROPERTIES' * Version 2.13.5: * Improve testing (likely via CI) to try to ensure compatibility with specific Android SDKs * Jackson 2.13 uses Class.getTypeName() that is only available on Android SDK 26 (with fix works on ASDK 24) jackson-dataformats-binary was updated from 2.13.0 to 2.15.2: * Version 2.15.2: * Fix 'logback-test.xml' in wrong place (avro/src/main/resources) * Version 2.15.0: * Add support for CBOR stringref extension ('CBORGenerator.Feature.STRINGREF') * Add 'CBORGenerat.Feature.WRITE_MINIMAL_DOUBLES' for writing 'double's as 'float's if safe to do so * Remove optimized 'CBORParser.nextTextValue()' implementation * Version 2.14.3: * Fix missing license file in Maven package for newer versions * Fix 'CBORGenerator.writeRawUTF8String()' ignoring offset * Version 2.14.1: * Possible performance improvement on jdk9+ for Smile decoding * Version 2.14.0: * Avro schema generation: allow override namespace with new '@AvroNamespace' annotation * Ensure 'IonReader' instances created within 'IonFactory' are always resource-managed * Fix 'IonObjectMapper' does not throw JacksonException for some invalid Ion * Fix missing configuration methods for format-specific parser/generator features * Short NUL-only keys incorrectly detected as duplicates * Update to Amazon Ion 1.9.5 * Use passed "current value" in 'writeStartObject()' overload * Version 2.13.3: * Fix IonValueDeserializer that does not handle getNullValue correctly for a missing property * Version 2.13.1: * Fix 'IllegalArgumentException' in 'IonParser.getEmbeddedObject()' jackson-modules-base was updated from 2.13.3 to 2.15.2: * Version 2.15.2: * Mr Bean exposing 'Asm' as Maven dependency despite shading * 'org.ow2.asm:asm' updated to 9.5 * Version 2.15.1: * Gradle metadata for 'jackson-core' '2.15.0' adds dependency on shaded 'org.ow2.asm:asm' * Version 2.15.0: * Filter annotated by JsonInclude.Include.CUSTOM does not get called if property is null with Afterburner/Blackbird module registered * Version 2.14.3: * Fix failing tests in java17 CI run * Fix Gradle Module Metadata for Afterburner, Blackbird * jaxb and jakarta-xmlbind put module-info in versions/11 * Version 2.14.0: * Blackbird doesn't work on Java 15+ * Remove stack trace from Blackbirds warnings wrt missing 'MethodHandles.lookup()' (on Java 8) * Update Asm version from 9.0 to 9.4 * Enhance SUSE Manager and Uyuni (ijsc#MSC-611) jackson-parent was updated from 2.13 to 2.15: * Remove settings for 'org.eclipse.m2e:lifecycle-mapping' * Upgrade to oss-parent 50 (many plugin version updates) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * Development Tools Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP5-2023-4885=1 * SUSE Manager Server 4.3 Module 4.3 zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Server-4.3-2023-4885=1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2023-4885=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-4885=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-4885=1 * SUSE Linux Enterprise Real Time 15 SP3 zypper in -t patch SUSE-SLE-Product-RT-15-SP3-2023-4885=1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2023-4885=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-4885=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2023-4885=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-4885=1 * SUSE Manager Proxy 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.2-2023-4885=1 * SUSE Manager Retail Branch Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.2-2023-4885=1 * SUSE Manager Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-4885=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2023-4885=1 * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-4885=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-4885=1 * Basesystem Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-4885=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-4885=1 * Development Tools Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2023-4885=1 ## Package List: * Development Tools Module 15-SP5 (noarch) * jackson-dataformat-cbor-2.15.2-150200.3.8.2 * SUSE Manager Server 4.3 Module 4.3 (noarch) * jackson-module-guice-2.15.2-150200.5.6.2 * jackson-module-paranamer-2.15.2-150200.5.6.2 * jackson-annotations-2.15.2-150200.3.11.2 * jackson-module-mrbean-2.15.2-150200.5.6.2 * jackson-module-jaxb-annotations-2.15.2-150200.5.6.2 * jackson-module-afterburner-2.15.2-150200.5.6.2 * jackson-databind-2.15.2-150200.3.15.1 * jackson-module-no-ctor-deser-2.15.2-150200.5.6.2 * jackson-module-osgi-2.15.2-150200.5.6.2 * jackson-modules-base-2.15.2-150200.5.6.2 * jackson-module-blackbird-2.15.2-150200.5.6.2 * jackson-core-2.15.2-150200.3.11.2 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (noarch) * jackson-databind-2.15.2-150200.3.15.1 * jackson-dataformat-cbor-2.15.2-150200.3.8.2 * jackson-core-2.15.2-150200.3.11.2 * jackson-annotations-2.15.2-150200.3.11.2 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (noarch) * jackson-dataformat-cbor-2.15.2-150200.3.8.2 * jackson-core-2.15.2-150200.3.11.2 * jackson-annotations-2.15.2-150200.3.11.2 * jackson-databind-2.15.2-150200.3.15.1 * jackson-databind-javadoc-2.15.2-150200.3.15.1 * jackson-core-javadoc-2.15.2-150200.3.11.2 * jackson-annotations-javadoc-2.15.2-150200.3.11.2 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch) * jackson-dataformat-cbor-2.15.2-150200.3.8.2 * jackson-core-2.15.2-150200.3.11.2 * jackson-annotations-2.15.2-150200.3.11.2 * jackson-databind-2.15.2-150200.3.15.1 * jackson-databind-javadoc-2.15.2-150200.3.15.1 * jackson-core-javadoc-2.15.2-150200.3.11.2 * jackson-annotations-javadoc-2.15.2-150200.3.11.2 * SUSE Linux Enterprise Real Time 15 SP3 (noarch) * jackson-dataformat-cbor-2.15.2-150200.3.8.2 * jackson-core-2.15.2-150200.3.11.2 * jackson-annotations-2.15.2-150200.3.11.2 * jackson-databind-2.15.2-150200.3.15.1 * jackson-databind-javadoc-2.15.2-150200.3.15.1 * jackson-core-javadoc-2.15.2-150200.3.11.2 * jackson-annotations-javadoc-2.15.2-150200.3.11.2 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (noarch) * jackson-databind-2.15.2-150200.3.15.1 * jackson-dataformat-cbor-2.15.2-150200.3.8.2 * jackson-core-2.15.2-150200.3.11.2 * jackson-annotations-2.15.2-150200.3.11.2 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (noarch) * jackson-dataformat-cbor-2.15.2-150200.3.8.2 * jackson-core-2.15.2-150200.3.11.2 * jackson-annotations-2.15.2-150200.3.11.2 * jackson-databind-2.15.2-150200.3.15.1 * jackson-databind-javadoc-2.15.2-150200.3.15.1 * jackson-core-javadoc-2.15.2-150200.3.11.2 * jackson-annotations-javadoc-2.15.2-150200.3.11.2 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (noarch) * jackson-databind-2.15.2-150200.3.15.1 * jackson-dataformat-cbor-2.15.2-150200.3.8.2 * jackson-core-2.15.2-150200.3.11.2 * jackson-annotations-2.15.2-150200.3.11.2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (noarch) * jackson-dataformat-cbor-2.15.2-150200.3.8.2 * jackson-core-2.15.2-150200.3.11.2 * jackson-annotations-2.15.2-150200.3.11.2 * jackson-databind-2.15.2-150200.3.15.1 * jackson-databind-javadoc-2.15.2-150200.3.15.1 * jackson-core-javadoc-2.15.2-150200.3.11.2 * jackson-annotations-javadoc-2.15.2-150200.3.11.2 * SUSE Manager Proxy 4.2 (noarch) * jackson-core-2.15.2-150200.3.11.2 * jackson-annotations-2.15.2-150200.3.11.2 * jackson-databind-2.15.2-150200.3.15.1 * jackson-databind-javadoc-2.15.2-150200.3.15.1 * jackson-core-javadoc-2.15.2-150200.3.11.2 * jackson-annotations-javadoc-2.15.2-150200.3.11.2 * SUSE Manager Retail Branch Server 4.2 (noarch) * jackson-core-2.15.2-150200.3.11.2 * jackson-annotations-2.15.2-150200.3.11.2 * jackson-databind-2.15.2-150200.3.15.1 * jackson-databind-javadoc-2.15.2-150200.3.15.1 * jackson-core-javadoc-2.15.2-150200.3.11.2 * jackson-annotations-javadoc-2.15.2-150200.3.11.2 * SUSE Manager Server 4.2 (noarch) * jackson-core-2.15.2-150200.3.11.2 * jackson-annotations-2.15.2-150200.3.11.2 * jackson-databind-2.15.2-150200.3.15.1 * jackson-databind-javadoc-2.15.2-150200.3.15.1 * jackson-core-javadoc-2.15.2-150200.3.11.2 * jackson-annotations-javadoc-2.15.2-150200.3.11.2 * SUSE Enterprise Storage 7.1 (noarch) * jackson-dataformat-cbor-2.15.2-150200.3.8.2 * jackson-core-2.15.2-150200.3.11.2 * jackson-annotations-2.15.2-150200.3.11.2 * jackson-databind-2.15.2-150200.3.15.1 * jackson-databind-javadoc-2.15.2-150200.3.15.1 * jackson-core-javadoc-2.15.2-150200.3.11.2 * jackson-annotations-javadoc-2.15.2-150200.3.11.2 * openSUSE Leap 15.4 (noarch) * jackson-module-guice-2.15.2-150200.5.6.2 * jackson-dataformats-binary-2.15.2-150200.3.8.2 * jackson-parent-2.15-150200.3.7.2 * jackson-dataformats-binary-javadoc-2.15.2-150200.3.8.2 * jackson-annotations-javadoc-2.15.2-150200.3.11.2 * jackson-dataformat-smile-2.15.2-150200.3.8.2 * jackson-dataformat-cbor-2.15.2-150200.3.8.2 * jackson-module-jaxb-annotations-2.15.2-150200.5.6.2 * jackson-module-afterburner-2.15.2-150200.5.6.2 * jackson-module-blackbird-2.15.2-150200.5.6.2 * jackson-annotations-2.15.2-150200.3.11.2 * jackson-module-mrbean-2.15.2-150200.5.6.2 * jackson-bom-2.15.2-150200.3.8.1 * jackson-module-osgi-2.15.2-150200.5.6.2 * jackson-modules-base-2.15.2-150200.5.6.2 * jackson-core-javadoc-2.15.2-150200.3.11.2 * jackson-module-paranamer-2.15.2-150200.5.6.2 * jackson-databind-2.15.2-150200.3.15.1 * jackson-databind-javadoc-2.15.2-150200.3.15.1 * jackson-module-no-ctor-deser-2.15.2-150200.5.6.2 * jackson-core-2.15.2-150200.3.11.2 * openSUSE Leap 15.5 (noarch) * jackson-module-guice-2.15.2-150200.5.6.2 * jackson-dataformats-binary-2.15.2-150200.3.8.2 * jackson-parent-2.15-150200.3.7.2 * jackson-dataformats-binary-javadoc-2.15.2-150200.3.8.2 * jackson-annotations-javadoc-2.15.2-150200.3.11.2 * jackson-dataformat-smile-2.15.2-150200.3.8.2 * jackson-dataformat-cbor-2.15.2-150200.3.8.2 * jackson-module-jaxb-annotations-2.15.2-150200.5.6.2 * jackson-module-afterburner-2.15.2-150200.5.6.2 * jackson-module-blackbird-2.15.2-150200.5.6.2 * jackson-annotations-2.15.2-150200.3.11.2 * jackson-module-mrbean-2.15.2-150200.5.6.2 * jackson-bom-2.15.2-150200.3.8.1 * jackson-module-osgi-2.15.2-150200.5.6.2 * jackson-modules-base-2.15.2-150200.5.6.2 * jackson-core-javadoc-2.15.2-150200.3.11.2 * jackson-module-paranamer-2.15.2-150200.5.6.2 * jackson-modules-base-javadoc-2.15.2-150200.5.6.2 * jackson-databind-2.15.2-150200.3.15.1 * jackson-databind-javadoc-2.15.2-150200.3.15.1 * jackson-module-no-ctor-deser-2.15.2-150200.5.6.2 * jackson-core-2.15.2-150200.3.11.2 * Basesystem Module 15-SP4 (noarch) * jackson-databind-2.15.2-150200.3.15.1 * jackson-core-2.15.2-150200.3.11.2 * jackson-annotations-2.15.2-150200.3.11.2 * Basesystem Module 15-SP5 (noarch) * jackson-databind-2.15.2-150200.3.15.1 * jackson-core-2.15.2-150200.3.11.2 * jackson-annotations-2.15.2-150200.3.11.2 * Development Tools Module 15-SP4 (noarch) * jackson-dataformat-cbor-2.15.2-150200.3.8.2 ## References: * https://jira.suse.com/browse/MSC-611 * https://jira.suse.com/browse/SLE-23217

1 0

SUSE-RU-2023:4886-1: moderate: Recommended update for google-guest-agent, google-guest-oslogin
by null＠suse.de 18 Dec '23

18 Dec '23

# Recommended update for google-guest-agent, google-guest-oslogin Announcement ID: SUSE-RU-2023:4886-1 Rating: moderate References: * bsc#1216546 * bsc#1216547 * bsc#1216548 * bsc#1216750 * bsc#1216751 Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * Public Cloud Module 15-SP2 * Public Cloud Module 15-SP1 * Public Cloud Module 15-SP3 * Public Cloud Module 15-SP4 * Public Cloud Module 15-SP5 * SUSE Linux Enterprise High Performance Computing 15 SP1 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Server 15 SP1 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.0 * SUSE Manager Proxy 4.1 * SUSE Manager Proxy 4.2 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.0 * SUSE Manager Retail Branch Server 4.1 * SUSE Manager Retail Branch Server 4.2 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.0 * SUSE Manager Server 4.1 * SUSE Manager Server 4.2 * SUSE Manager Server 4.3 An update that has five fixes can now be installed. ## Description: This update for google-guest-agent, google-guest-oslogin fixes the following issues: * Update to version 20231031.01 (bsc#1216547, bsc#1216751) * Bump the golang compiler version to 1.21 (bsc#1216546) * Update to version 20231101.00 (bsc#1216548, bsc#1216750) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-4886=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-4886=1 * Public Cloud Module 15-SP1 zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP1-2023-4886=1 * Public Cloud Module 15-SP2 zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP2-2023-4886=1 * Public Cloud Module 15-SP3 zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP3-2023-4886=1 * Public Cloud Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP4-2023-4886=1 * Public Cloud Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP5-2023-4886=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * google-guest-agent-20231031.01-150000.1.40.1 * google-guest-oslogin-debuginfo-20231101.00-150000.1.35.1 * google-guest-oslogin-debugsource-20231101.00-150000.1.35.1 * google-guest-oslogin-20231101.00-150000.1.35.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * google-guest-agent-20231031.01-150000.1.40.1 * google-guest-oslogin-debuginfo-20231101.00-150000.1.35.1 * google-guest-oslogin-debugsource-20231101.00-150000.1.35.1 * google-guest-oslogin-20231101.00-150000.1.35.1 * Public Cloud Module 15-SP1 (aarch64 ppc64le s390x x86_64) * google-guest-agent-20231031.01-150000.1.40.1 * google-guest-oslogin-debuginfo-20231101.00-150000.1.35.1 * google-guest-oslogin-debugsource-20231101.00-150000.1.35.1 * google-guest-oslogin-20231101.00-150000.1.35.1 * Public Cloud Module 15-SP2 (aarch64 ppc64le s390x x86_64) * google-guest-agent-20231031.01-150000.1.40.1 * google-guest-oslogin-debuginfo-20231101.00-150000.1.35.1 * google-guest-oslogin-debugsource-20231101.00-150000.1.35.1 * google-guest-oslogin-20231101.00-150000.1.35.1 * Public Cloud Module 15-SP3 (aarch64 ppc64le s390x x86_64) * google-guest-agent-20231031.01-150000.1.40.1 * google-guest-oslogin-debuginfo-20231101.00-150000.1.35.1 * google-guest-oslogin-debugsource-20231101.00-150000.1.35.1 * google-guest-oslogin-20231101.00-150000.1.35.1 * Public Cloud Module 15-SP4 (aarch64 ppc64le s390x x86_64) * google-guest-agent-20231031.01-150000.1.40.1 * google-guest-oslogin-debuginfo-20231101.00-150000.1.35.1 * google-guest-oslogin-debugsource-20231101.00-150000.1.35.1 * google-guest-oslogin-20231101.00-150000.1.35.1 * Public Cloud Module 15-SP5 (aarch64 ppc64le s390x x86_64) * google-guest-agent-20231031.01-150000.1.40.1 * google-guest-oslogin-debuginfo-20231101.00-150000.1.35.1 * google-guest-oslogin-debugsource-20231101.00-150000.1.35.1 * google-guest-oslogin-20231101.00-150000.1.35.1 ## References: * https://bugzilla.suse.com/show_bug.cgi?id=1216546 * https://bugzilla.suse.com/show_bug.cgi?id=1216547 * https://bugzilla.suse.com/show_bug.cgi?id=1216548 * https://bugzilla.suse.com/show_bug.cgi?id=1216750 * https://bugzilla.suse.com/show_bug.cgi?id=1216751

1 0

SUSE-RU-2023:4888-1: moderate: Recommended update for yast2-firewall
by null＠suse.de 18 Dec '23

18 Dec '23

# Recommended update for yast2-firewall Announcement ID: SUSE-RU-2023:4888-1 Rating: moderate References: * bsc#1216615 Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that has one fix can now be installed. ## Description: This update for yast2-firewall fixes the following issues: * In case of autoinstallation keep the firewall service state in the Installation::SecuritySettings for not conflicting with the proposal (bsc#1216615) * Update to 4.5.1 ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2023-4888=1 openSUSE-SLE-15.5-2023-4888=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-4888=1 ## Package List: * openSUSE Leap 15.5 (noarch) * yast2-firewall-4.5.1-150500.3.3.1 * Basesystem Module 15-SP5 (noarch) * yast2-firewall-4.5.1-150500.3.3.1 ## References: * https://bugzilla.suse.com/show_bug.cgi?id=1216615

1 0

openSUSE-RU-2023:0407-1: moderate: Recommended update for OpenBoard
by maintenance＠opensuse.org 18 Dec '23

18 Dec '23

openSUSE Recommended Update: Recommended update for OpenBoard ______________________________________________________________________________ Announcement ID: openSUSE-RU-2023:0407-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for OpenBoard fixes the following issues: OpenBoard was updated to version 1.7.0. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2023-407=1 Package List: - openSUSE Backports SLE-15-SP5 (aarch64 x86_64): OpenBoard-1.7.0-bp155.3.3.1 References:

1 0

openSUSE-RU-2023:0408-1: moderate: Recommended update for shadowsocks-libev
by maintenance＠opensuse.org 18 Dec '23

18 Dec '23

openSUSE Recommended Update: Recommended update for shadowsocks-libev ______________________________________________________________________________ Announcement ID: openSUSE-RU-2023:0408-1 Rating: moderate References: #1216372 #1216373 Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for shadowsocks-libev fixes the following issues: - Set permissions as 640 for /etc/shadowsocks (boo#1216372) - run systemd service as a dedicated user and group (Fix boo#1216372 and boo#1216373) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2023-408=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 i586 ppc64le s390x x86_64): libshadowsocks-libev2-3.3.5-bp154.3.3.1 shadowsocks-libev-3.3.5-bp154.3.3.1 shadowsocks-libev-devel-3.3.5-bp154.3.3.1 - openSUSE Backports SLE-15-SP4 (noarch): shadowsocks-libev-doc-3.3.5-bp154.3.3.1 References: https://bugzilla.suse.com/1216372 https://bugzilla.suse.com/1216373

1 0

openSUSE-RU-2023:0406-1: Recommended update for dkimproxy
by maintenance＠opensuse.org 16 Dec '23

16 Dec '23

openSUSE Recommended Update: Recommended update for dkimproxy ______________________________________________________________________________ Announcement ID: openSUSE-RU-2023:0406-1 Rating: low References: #1216919 Affected Products: openSUSE Backports SLE-15-SP4 openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update of dkimproxy fixes the following issue: * create /run/dkimproxy using tmpfiles (boo#1216919) * use the correct env var for the hostname (boo#1216919) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2023-406=1 - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2023-406=1 Package List: - openSUSE Backports SLE-15-SP5 (noarch): dkimproxy-1.4.1-bp155.4.3.1 - openSUSE Backports SLE-15-SP4 (noarch): dkimproxy-1.4.1-bp154.3.3.1 References: https://bugzilla.suse.com/1216919

1 0

openSUSE-SU-2023:0404-1: moderate: Security update for fish
by opensuse-security＠opensuse.org 16 Dec '23

16 Dec '23

openSUSE Security Update: Security update for fish ______________________________________________________________________________ Announcement ID: openSUSE-SU-2023:0404-1 Rating: moderate References: #1217808 Cross-References: CVE-2023-49284 CVSS scores: CVE-2023-49284 (NVD) : 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H CVE-2023-49284 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for fish fixes the following issues: - CVE-2023-49284: Fixed shell expansion triggered by command substitution output (boo#1217808). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2023-404=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 i586 ppc64le s390x x86_64): fish-3.3.1-bp154.3.3.1 fish-devel-3.3.1-bp154.3.3.1 References: https://www.suse.com/security/cve/CVE-2023-49284.html https://bugzilla.suse.com/1217808

1 0