February 2023 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2023:0062-1: moderate: Security update for python-Django
by opensuse-security＠opensuse.org 28 Feb '23

28 Feb '23

openSUSE Security Update: Security update for python-Django ______________________________________________________________________________ Announcement ID: openSUSE-SU-2023:0062-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: python-Django was updated to fix a security issues: - CVE-2023-24580: prevent DOS in file uploads (bsc#1208082) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2023-62=1 Package List: - openSUSE Backports SLE-15-SP4 (noarch): python3-Django-2.2.28-bp154.2.9.1 References:

1 0

openSUSE-SU-2023:0061-1: important: Security update for chromium
by opensuse-security＠opensuse.org 27 Feb '23

27 Feb '23

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2023:0061-1 Rating: important References: #1208589 Cross-References: CVE-2023-0927 CVE-2023-0928 CVE-2023-0929 CVE-2023-0930 CVE-2023-0931 CVE-2023-0932 CVE-2023-0933 CVE-2023-0941 Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium 110.0.5481.177 (boo#1208589) * CVE-2023-0927: Use after free in Web Payments API * CVE-2023-0928: Use after free in SwiftShader * CVE-2023-0929: Use after free in Vulkan * CVE-2023-0930: Heap buffer overflow in Video * CVE-2023-0931: Use after free in Video * CVE-2023-0932: Use after free in WebRTC * CVE-2023-0933: Integer overflow in PDF * CVE-2023-0941: Use after free in Prompts * Various fixes from internal audits, fuzzing and other initiatives Chromium 110.0.5481.100 * fix regression on SAP Business Objects web UI * fix date formatting behavior change from ICU 72 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2023-61=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 x86_64): chromedriver-110.0.5481.177-bp154.2.70.1 chromium-110.0.5481.177-bp154.2.70.1 References: https://www.suse.com/security/cve/CVE-2023-0927.html https://www.suse.com/security/cve/CVE-2023-0928.html https://www.suse.com/security/cve/CVE-2023-0929.html https://www.suse.com/security/cve/CVE-2023-0930.html https://www.suse.com/security/cve/CVE-2023-0931.html https://www.suse.com/security/cve/CVE-2023-0932.html https://www.suse.com/security/cve/CVE-2023-0933.html https://www.suse.com/security/cve/CVE-2023-0941.html https://bugzilla.suse.com/1208589

1 0

openSUSE-RU-2023:0060-1: moderate: Recommended update for tryton, trytond, trytond_account, trytond_purchase_request
by maintenance＠opensuse.org 24 Feb '23

24 Feb '23

openSUSE Recommended Update: Recommended update for tryton, trytond, trytond_account, trytond_purchase_request ______________________________________________________________________________ Announcement ID: openSUSE-RU-2023:0060-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for tryton, trytond, trytond_account, trytond_purchase_request fixes the following issues: Changes in trytond_purchase_request: - Version 6.0.4 - Bugfix Release - Version 6.0.3 - Bugfix Release Changes in trytond_account: - Version 6.0.15 - Bugfix Release - Version 6.0.14 - Bugfix Release Changes in trytond: - Version 6.0.28 - Bugfix Release - Version 6.0.27 - Bugfix Release Changes in tryton: - Version 6.0.25 - Bugfix Release - Version 6.0.24 - Bugfix Release Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2023-60=1 Package List: - openSUSE Backports SLE-15-SP4 (noarch): tryton-6.0.25-bp154.2.15.1 trytond-6.0.28-bp154.2.21.1 trytond_account-6.0.15-bp154.2.12.1 trytond_purchase_request-6.0.4-bp154.2.6.1 References:

1 0

openSUSE-SU-2023:0058-1: moderate: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 22 Feb '23

22 Feb '23

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2023:0058-1 Rating: moderate References: #1208186 Cross-References: CVE-2023-25727 Affected Products: SUSE Linux Enterprise High Performance Computing 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP4 SUSE Linux Enterprise Server 12-SP5 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12-SP3 SUSE Linux Enterprise Server for SAP Applications 12-SP4 SUSE Linux Enterprise Server for SAP Applications 12-SP5 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for phpMyAdmin fixes the following issues: Update to 4.9.11: * Fix an XSS attack through the drag-and-drop upload feature (PMASA-2023-01, CWE-661, boo#1208186, CVE-2023-25727) * Fix broken pagination links in the navigation sidebar * Fix syntax error for PHP 5 * Fix hide_connection_errors being undefined when a controluser is set Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2023-58=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): phpMyAdmin-4.9.11-58.1 References: https://www.suse.com/security/cve/CVE-2023-25727.html https://bugzilla.suse.com/1208186

1 0

openSUSE-RU-2023:0059-1: moderate: Recommended update for nginx
by maintenance＠opensuse.org 22 Feb '23

22 Feb '23

openSUSE Recommended Update: Recommended update for nginx ______________________________________________________________________________ Announcement ID: openSUSE-RU-2023:0059-1 Rating: moderate References: #1208008 Affected Products: SUSE Linux Enterprise High Performance Computing 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP4 SUSE Linux Enterprise Server 12-SP5 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12-SP3 SUSE Linux Enterprise Server for SAP Applications 12-SP4 SUSE Linux Enterprise Server for SAP Applications 12-SP5 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for nginx fixes the following issue: - rebuild nginx so the vim plugin matches the current vim releases. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2023-59=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): nginx-1.14.2-2.10.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): vim-plugin-nginx-1.14.2-2.10.1 References: https://bugzilla.suse.com/1208008

1 0

openSUSE-SU-2023:0057-1: moderate: Security update for python-Django
by opensuse-security＠opensuse.org 21 Feb '23

21 Feb '23

openSUSE Security Update: Security update for python-Django ______________________________________________________________________________ Announcement ID: openSUSE-SU-2023:0057-1 Rating: moderate References: #1203793 #1207565 Cross-References: CVE-2022-41323 CVE-2023-23969 CVSS scores: CVE-2022-41323 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2023-23969 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2023-23969 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for python-Django fixes the following issues: - CVE-2023-23969: Fixed potential denial-of-service via Accept-Language headers (boo#1207565) - CVE-2022-41323: Fixed potential denial-of-service vulnerability in internationalized URLs (boo#1203793) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2023-57=1 Package List: - openSUSE Backports SLE-15-SP4 (noarch): python3-Django-2.2.28-bp154.2.6.1 References: https://www.suse.com/security/cve/CVE-2022-41323.html https://www.suse.com/security/cve/CVE-2023-23969.html https://bugzilla.suse.com/1203793 https://bugzilla.suse.com/1207565

1 0

openSUSE-RU-2023:0056-1: moderate: Recommended update for AusweisApp2
by maintenance＠opensuse.org 21 Feb '23

21 Feb '23

openSUSE Recommended Update: Recommended update for AusweisApp2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2023:0056-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for AusweisApp2 fixes the following issues: + Version 1.26.2 - Fixed notification when another application is running on the port in use. - Fixed crashes on Android. - Optimization of forwarding to "CommunicationErrorAddress" on iOS. - Improved installation of the proxy service for terminal server environments. - Fixed the setting for the setup wizard when installing in corporate networks. + Version 1.26.1 - Fixed the loss of settings on Android. - Fixed the use of non-public or deprecated APIs on macOS to comply with App Store Guidelines. + from version 1.26.0 - Support for macOS 13. - Support for Windows Server 2016 (version 1607). - Support for Windows Server 2019. - Support for Windows Server 2022. - A proxy service is now available for multi-user operation in terminal server environments. Details can be found in the document "Guide To Installation In Corporate Networks". - Fixed crashes on Android. - The iOS SDK now supports the arm64 simulator. - Updated OpenSSL to version 3.0.7. - Updated Qt to version 6.4.1. - Add BuildRequires, so it can also build for Leap >= 15.4. + Version 1.24.4 * Fixed potential crashes due to OpenSSL (denial of service). * Updated OpenSSL to version 3.0.7. + Version 1.24.3 * Fixed crashes on Android. * Disabled (cloud) backup on Android and iOS. * Fixed the A11y display of the SaK pairing code on Android and iOS. * Blocked installation on unsupported versions of Windows 10. * Fixed compatibility with Qt 6.4. * Enabled the simulator in the Android and iOS SDK. - Upgrade Qt build and runtime dependencies for Qt6 + Add Qt6 packages to BuildRequires * qt6-concurrent-devel * qt6-core-devel * qt6-linguist-devel * qt6-network-devel * qt6-qml-devel * qt6-qmlworkerscript-devel * qt6-quick-devel * qt6-quickcontrols2-devel * qt6-shadertools-devel * qt6-statemachine-devel * qt6-svg-devel * qt6-websockets-devel + Drop all Qt5 packages from BuildRequires and Requires + Version 1.24.2 * Fixed crashes on Android. * Fixed a bug with changing the transport PIN on desktop systems. + Version 1.24.1 * Support for the Russian and Ukrainian languages has been added. * Fixed some issues with regards to PersoSim. + Version 1.24.0 * Technical overhaul of the "Smartphone as card reader" function. The use of an ID card app2 older than 1.22.1 is no longer possible in combination with 1.24.0. * Various optimizations with regards to accessibility. * Support for "IPv6 only" home networks. * AusweisApp2 is now provided as a 64-bit application on Windows. * Official support for Windows 11. * Support for Windows 7 and Windows 8.1 has been discontinued. * Support for macOS 10.13 and 10.14 has been discontinued. * Support for Android 5 and 6 and has been discontinued. * Added an integrated ID card simulator for testing. * An automatic mode for authentication for tests is now possible. * AusweisApp2 is now available as a container SDK or Docker image. This can be controlled using WebSocket or the new automatic authentication. * Command line parameters can now be passed in the iOS SDK. * Support for SHA224 and SECP224 has been discontinued. * The partially-embedded SDK on Android has been discontinued. * The SDK now uses API level v2. * Updated OpenSSL to version 3.0.5. * Updated Qt to version 6.3.1. + Version 1.22.7 * Fixed a crash with the new system notifications on macOS 10.14+. + Version 1.22.6 * Problems with card communication when using the "Smartphone as card reader" function in Comfort mode have been fixed. * Starting with macOS 10.14, system notifications are now being used. * On macOS, the tray icon is now disabled by default. This can be re-enabled in the preferences. * On iOS, a new NFC scan was not possible under certain circumstances. This has been fixed. * When canceling an authentication, the app sometimes crashed on iOS. This has been fixed. * Minor bug fixes and optimizations. * Updated OpenSSL to version 1.1.1o. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2023-56=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 ppc64le s390x x86_64): AusweisApp2-1.26.2-bp154.2.3.1 References:

1 0

openSUSE-RU-2023:0055-1: moderate: Recommended update for phpunit
by maintenance＠opensuse.org 21 Feb '23

21 Feb '23

openSUSE Recommended Update: Recommended update for phpunit ______________________________________________________________________________ Announcement ID: openSUSE-RU-2023:0055-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for phpunit fixes the following issues: phpunit was added in version 9.5.28. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2023-55=1 Package List: - openSUSE Backports SLE-15-SP4 (noarch): php7-phpunit-9.5.28-bp154.2.1 php8-phpunit-9.5.28-bp154.2.1 References:

1 0

SUSE-SU-2023:0465-1: important: Security update for prometheus-ha_cluster_exporter
by opensuse-security＠opensuse.org 20 Feb '23

20 Feb '23

SUSE Security Update: Security update for prometheus-ha_cluster_exporter ______________________________________________________________________________ Announcement ID: SUSE-SU-2023:0465-1 Rating: important References: #1208046 #1208047 Cross-References: CVE-2022-46146 CVSS scores: CVE-2022-46146 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-46146 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise Module for SAP Applications 15-SP2 SUSE Linux Enterprise Module for SAP Applications 15-SP3 SUSE Linux Enterprise Module for SAP Applications 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP2 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for prometheus-ha_cluster_exporter fixes the following issues: Updated to version 1.3.1: - CVE-2022-46146: Fixed authentication bypass via cache poisoning in prometheus/exporter-toolkit (bsc#1208046, bsc#1208047). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2023-465=1 - SUSE Linux Enterprise Module for SAP Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-SAP-Applications-15-SP4-2023-465=1 - SUSE Linux Enterprise Module for SAP Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-SAP-Applications-15-SP3-2023-465=1 - SUSE Linux Enterprise Module for SAP Applications 15-SP2: zypper in -t patch SUSE-SLE-Module-SAP-Applications-15-SP2-2023-465=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): prometheus-ha_cluster_exporter-1.3.1+git.1676027782.ad3c0e9-150200.3.21.1 - SUSE Linux Enterprise Module for SAP Applications 15-SP4 (aarch64 ppc64le s390x x86_64): prometheus-ha_cluster_exporter-1.3.1+git.1676027782.ad3c0e9-150200.3.21.1 - SUSE Linux Enterprise Module for SAP Applications 15-SP3 (aarch64 ppc64le s390x x86_64): prometheus-ha_cluster_exporter-1.3.1+git.1676027782.ad3c0e9-150200.3.21.1 - SUSE Linux Enterprise Module for SAP Applications 15-SP2 (aarch64 ppc64le s390x x86_64): prometheus-ha_cluster_exporter-1.3.1+git.1676027782.ad3c0e9-150200.3.21.1 References: https://www.suse.com/security/cve/CVE-2022-46146.html https://bugzilla.suse.com/1208046 https://bugzilla.suse.com/1208047

1 0

openSUSE-SU-2023:0054-1: moderate: Security update for jhead
by opensuse-security＠opensuse.org 20 Feb '23

20 Feb '23

openSUSE Security Update: Security update for jhead ______________________________________________________________________________ Announcement ID: openSUSE-SU-2023:0054-1 Rating: moderate References: #1207150 Cross-References: CVE-2022-41751 CVSS scores: CVE-2022-41751 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for jhead fixes the following issues: - Fixed autorotation problem caused by CVE-2022-41751 patch. [boo#1207150] Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2023-54=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 i586 ppc64le s390x x86_64): jhead-3.06.0.1-bp154.2.9.1 References: https://www.suse.com/security/cve/CVE-2022-41751.html https://bugzilla.suse.com/1207150

1 0