September 2023 - openSUSE Updates - openSUSE Mailing Lists

SUSE-RU-2023:3758-1: moderate: Recommended update for slurm_23_02
by maintenance＠opensuse.org 25 Sep '23

25 Sep '23

# Recommended update for slurm_23_02 Announcement ID: SUSE-RU-2023:3758-1 Rating: moderate References: * #1214983 Affected Products: * HPC Module 15-SP4 * openSUSE Leap 15.4 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 An update that has one fix can now be installed. ## Description: This update for slurm_23_02 fixes the following issues: * Updated to 23.02.4 with the following changes: * Bug Fixes: * Fix main scheduler loop not starting after a failover to backup controller. Avoid slurmctld segfault when specifying `AccountingStorageExternalHost` (bsc#1214983). * Fix sbatch return code when `--wait` is requested on a job array. * Fix collected `GPUUtilization` values for `acct_gather_profile` plugins. * Fix `slurmrestd` handling of job hold/release operations. * Fix step running indefinitely when slurmctld takes more than `MessageTimeout` to respond. Now, `slurmctld` will cancel the step when detected, preventing following steps from getting stuck waiting for resources to be released. * Fix regression to make `job_desc.min_cpus` accurate again in `job_submit` when requesting a job with `--ntasks-per-node`. * Fix handling of `ArrayTaskThrottle` in backfill. * Fix regression in 23.02.2 when checking gres state on `slurmctld` startup or reconfigure. Gres changes in the configuration were not updated on slurmctld startup. On startup or reconfigure, these messages were present in the log: `"error: Attempt to change gres/gpu Count`". * Fix potential double count of gres when dealing with limits. * Fix `slurmstepd` segfault when `ContainerPath` is not set in `oci.conf` * Fixed an issue where jobs requesting licenses were incorrectly rejected. * `scrontab` \- Fix cutting off the final character of quoted variables. * `smail` \- Fix issues where e-mails at job completion were not being sent. * `scontrol/slurmctld` \- fix comma parsing when updating a reservation's nodes. * Fix `--gpu-bind=single binding` tasks to wrong gpus, leading to some gpus having more tasks than they should and other gpus being unused. * Fix regression in 23.02 that causes slurmstepd to crash when `srun` requests more than `TreeWidth` nodes in a step and uses the pmi2 or pmix plugin. * `job_container/tmpfs` \- Fix `%h` and `%n` substitution in `BasePath` where `%h` was substituted as the NodeName instead of the hostname, and %n was substituted as an empty string. * Fix regression where `--cpu-bind=verbose` would override `TaskPluginParam`. * `scancel` \- Fix `--clusters/-M` for federations. Only filtered jobs (e.g. `-A`, `-u`, `-p`, etc.) from the specified clusters will be canceled, rather than all jobs in the federation. Specific jobids will still be routed to the origin cluster for cancellation. * Other changes: * Make spank `S_JOB_ARGV` item value hold the requested command `argv` instead of the `srun --bcast` value when `--bcast` requested (only in local context). * `scontrol` \- Permit changes to StdErr and StdIn for pending jobs. * `scontrol` \- Reset `std`{`err`,`in`,`out`} when set to empty string. * `slurmrestd` \- mark environment as a required field for job submission descriptions. * `slurmrestd` \- avoid dumping null in OpenAPI schema required fields. * `data_parser/v0.0.39` \- avoid rejecting valid `memory_per_node` formatted as dictionary provided with a job description. * `data_parser/v0.0.39` \- avoid rejecting valid `memory_per_cpu` formatted as dictionary provided with a job description. * `slurmrestd` \- Return HTTP error code 404 when job query fails. * `slurmrestd` \- Add return schema to error response to job and license query. * Change the log message warning for rate limited users from debug to verbose. * `cgroup/v2` \- Avoid capturing log output for ebpf when constraining devices, as this can lead to inadvertent failure if the log buffer is too small. * Added error message when attempting to use sattach on batch or extern steps. * Reject job `ArrayTaskThrottle` update requests from unprivileged users. * `data_parser/v0.0.39` \- populate description fields of property objects in generated OpenAPI specifications where defined. * `slurmstepd` \- Avoid segfault caused by `ContainerPath` not being terminated by `/` in `oci.conf`. * `data_parser/v0.0.39` \- Change `v0.0.39_job_info` response to tag `exit_code` field as being complex instead of only an unsigned integer. * Updated to 23.02.3 with the following changes: * Bug Fixes: * `slurmctld` \- Fix backup slurmctld crash when it takes control multiple times. * Fix regression in 23.02.2 that ignored the partition `DefCpuPerGPU` setting on the first pass of scheduling a job requesting `--gpus --ntasks`. * `srun` \- fix issue creating regular and interactive steps because environment variables were incorrectly set on non-HetSteps. * Fix dynamic nodes getting stuck in allocated states when reconfiguring. * Fix regression in 23.02.2 that set the `SLURM_NTASKS` environment variable in sbatch jobs from `--ntasks-per-node` when `--ntasks` was not requested. * Fix regression in 23.02 that caused sbatch jobs to set the wrong number of tasks when requesting `--ntasks-per-node` without `--ntasks`, and also requesting one of the following options: `--sockets-per-node`, `--cores-per-socket`, `--threads-per-core` (or `--hint=nomultithread`), or `-B,--extra-node-info`. * Fix double counting suspended job counts on nodes when reconfiguring, which prevented nodes with suspended jobs from being powered down or rebooted once the jobs completed. * Fix backfill not scheduling jobs submitted with `--prefer` and `--constraint` properly. * mpi/pmix - fix regression introduced in 23.02.2 which caused PMIx shmem backed files permissions to be incorrect. * api/submit - fix memory leaks when submission of batch regular jobs or batch HetJobs fails (response data is a return code). * Fix regression in 23.02 leading to error() messages being sent at `INFO` instead of `ERR` in syslog. * Fix `TresUsageIn[Tot|Ave]` calculation for `gres/gpumem` and `gres/gpuutil`. * Fix issue in the gpu plugins where gpu frequencies would only be set if both gpu memory and gpu frequencies were set, while one or the other suffices. * Fix reservations group ACL's not working with the root group. * Fix updating a job with a ReqNodeList greater than the job's node count. * Fix inadvertent permission denied error for `--task-prolog` and `--task-epilog` with filesystems mounted with `root_squash`. * Fix missing detailed cpu and gres information in json/yaml output from `scontrol`, `squeue` and `sinfo`. * Fix regression in 23.02 that causes a failure to allocate job steps that request `--cpus-per-gpu` and gpus with types. * Fix potentially waiting indefinitely for a defunct process to finish, which affects various scripts including `Prolog` and `Epilog`. This could have various symptoms, such as jobs getting stuck in a completing state. * Fix losing list of reservations on job when updating job with list of reservations and restarting the controller. * Fix nodes resuming after down and drain state update requests from clients older than 23.02. * Fix advanced reservation creation/update when an association that should have access to it is composed with partition(s). * Fix job layout calculations with `--ntasks-per-gpu`, especially when `--nodes` has not been explicitly provided. * Fix X11 forwarding for jobs submitted from the slurmctld host. * When a job requests `--no-kill` and one or more nodes fail during the job, fix subsequent job steps unable to use some of the remaining resources allocated to the job. * Fix shared gres allocation when using `--tres-per-task` with tasks that span multiple sockets. * `auth/jwt` \- Fix memory leak. * Other changes: * `openapi/dbv0.0.39/users` \- If a default account update failed, resulting in a no-op, the query returned success without any warning. Now a warning is sent back to the client that the default account wasn't modified. * Avoid job write lock when nodes are dynamically added/removed. * `burst_buffer/lua` \- allow jobs to get scheduled sooner after `slurm_bb_data_in` completes. * `openapi/v0.0.39` \- fix memory leak in `_job_post_het_submit()`. * Avoid possible `slurmctld` segfault caused by race condition with already completed `slurmdbd_conn` connections. * `Slurmdbd.conf` checks included conf files for 0600 permissions * `slurmrestd` \- fix regression "oversubscribe" fields were removed from job descriptions and submissions from v0.0.39 end points. * `accounting_storage/mysql` \- Query for indiviual QOS correctly when you have more than 10. * Add warning message about ignoring `--tres-per-tasks=license` when used on a step. * `sshare` \- Fix command to work when using `priority/basic`. * Avoid loading `cli_filter` plugins outside of `salloc`/`sbatch`/`scron`/ `srun`. This fixes a number of missing symbol problems that can manifest for executables linked against libslurm (and not `libslurmfull`). * Allow cloud_reg_addrs to update dynamically registered node's addrs on subsequent registrations. * Revert a change in 22.05.5 that prevented tasks from sharing a core if `--cpus-per-task` > threads per core, but caused incorrect accounting and cpu binding. Instead, `--ntasks-per-core=1` may be requested to prevent tasks from sharing a core. * Correctly send `assoc_mgr` lock to mcs plugin. * Avoid unnecessary `gres/gpumem` and `gres/gpuutil` `TRES` position lookups. * `sacct` \- when printing `PLANNED` time, use end time instead of start time for jobs cancelled before they started. * Hold the job with "`(Reservation ... invalid)`" state reason if the reservation is not usable by the job. * `sbatch` \- Added new `--export=NIL` option. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3758=1 * HPC Module 15-SP4 zypper in -t patch SUSE-SLE-Module-HPC-15-SP4-2023-3758=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-3758=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-3758=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * slurm_23_02-slurmdbd-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-cray-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-sql-23.02.4-150300.7.8.1 * libpmi0_23_02-23.02.4-150300.7.8.1 * slurm_23_02-pam_slurm-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-sview-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-lua-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-node-23.02.4-150300.7.8.1 * slurm_23_02-node-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-torque-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-23.02.4-150300.7.8.1 * libpmi0_23_02-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-sql-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-plugins-debuginfo-23.02.4-150300.7.8.1 * perl-slurm_23_02-23.02.4-150300.7.8.1 * slurm_23_02-plugin-ext-sensors-rrd-23.02.4-150300.7.8.1 * slurm_23_02-rest-23.02.4-150300.7.8.1 * slurm_23_02-auth-none-23.02.4-150300.7.8.1 * slurm_23_02-torque-23.02.4-150300.7.8.1 * slurm_23_02-auth-none-debuginfo-23.02.4-150300.7.8.1 * libslurm39-debuginfo-23.02.4-150300.7.8.1 * libnss_slurm2_23_02-23.02.4-150300.7.8.1 * slurm_23_02-plugins-23.02.4-150300.7.8.1 * slurm_23_02-rest-debuginfo-23.02.4-150300.7.8.1 * perl-slurm_23_02-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-cray-23.02.4-150300.7.8.1 * slurm_23_02-pam_slurm-23.02.4-150300.7.8.1 * libnss_slurm2_23_02-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-munge-23.02.4-150300.7.8.1 * libslurm39-23.02.4-150300.7.8.1 * slurm_23_02-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-devel-23.02.4-150300.7.8.1 * slurm_23_02-lua-23.02.4-150300.7.8.1 * slurm_23_02-munge-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-plugin-ext-sensors-rrd-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-slurmdbd-23.02.4-150300.7.8.1 * slurm_23_02-sview-23.02.4-150300.7.8.1 * slurm_23_02-debugsource-23.02.4-150300.7.8.1 * openSUSE Leap 15.4 (noarch) * slurm_23_02-config-23.02.4-150300.7.8.1 * slurm_23_02-config-man-23.02.4-150300.7.8.1 * slurm_23_02-doc-23.02.4-150300.7.8.1 * slurm_23_02-webdoc-23.02.4-150300.7.8.1 * HPC Module 15-SP4 (aarch64 x86_64) * slurm_23_02-slurmdbd-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-cray-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-sql-23.02.4-150300.7.8.1 * libpmi0_23_02-23.02.4-150300.7.8.1 * slurm_23_02-pam_slurm-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-sview-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-lua-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-node-23.02.4-150300.7.8.1 * slurm_23_02-node-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-torque-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-23.02.4-150300.7.8.1 * libpmi0_23_02-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-sql-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-plugins-debuginfo-23.02.4-150300.7.8.1 * perl-slurm_23_02-23.02.4-150300.7.8.1 * slurm_23_02-plugin-ext-sensors-rrd-23.02.4-150300.7.8.1 * slurm_23_02-rest-23.02.4-150300.7.8.1 * slurm_23_02-auth-none-23.02.4-150300.7.8.1 * slurm_23_02-torque-23.02.4-150300.7.8.1 * slurm_23_02-auth-none-debuginfo-23.02.4-150300.7.8.1 * libslurm39-debuginfo-23.02.4-150300.7.8.1 * libnss_slurm2_23_02-23.02.4-150300.7.8.1 * slurm_23_02-plugins-23.02.4-150300.7.8.1 * slurm_23_02-rest-debuginfo-23.02.4-150300.7.8.1 * perl-slurm_23_02-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-cray-23.02.4-150300.7.8.1 * slurm_23_02-pam_slurm-23.02.4-150300.7.8.1 * libnss_slurm2_23_02-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-munge-23.02.4-150300.7.8.1 * libslurm39-23.02.4-150300.7.8.1 * slurm_23_02-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-devel-23.02.4-150300.7.8.1 * slurm_23_02-lua-23.02.4-150300.7.8.1 * slurm_23_02-munge-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-plugin-ext-sensors-rrd-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-slurmdbd-23.02.4-150300.7.8.1 * slurm_23_02-sview-23.02.4-150300.7.8.1 * slurm_23_02-debugsource-23.02.4-150300.7.8.1 * HPC Module 15-SP4 (noarch) * slurm_23_02-config-23.02.4-150300.7.8.1 * slurm_23_02-config-man-23.02.4-150300.7.8.1 * slurm_23_02-doc-23.02.4-150300.7.8.1 * slurm_23_02-webdoc-23.02.4-150300.7.8.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (aarch64 x86_64) * slurm_23_02-slurmdbd-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-cray-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-sql-23.02.4-150300.7.8.1 * libpmi0_23_02-23.02.4-150300.7.8.1 * slurm_23_02-pam_slurm-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-sview-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-lua-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-node-23.02.4-150300.7.8.1 * slurm_23_02-node-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-torque-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-23.02.4-150300.7.8.1 * libpmi0_23_02-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-sql-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-plugins-debuginfo-23.02.4-150300.7.8.1 * perl-slurm_23_02-23.02.4-150300.7.8.1 * slurm_23_02-plugin-ext-sensors-rrd-23.02.4-150300.7.8.1 * slurm_23_02-rest-23.02.4-150300.7.8.1 * slurm_23_02-auth-none-23.02.4-150300.7.8.1 * slurm_23_02-torque-23.02.4-150300.7.8.1 * slurm_23_02-auth-none-debuginfo-23.02.4-150300.7.8.1 * libslurm39-debuginfo-23.02.4-150300.7.8.1 * libnss_slurm2_23_02-23.02.4-150300.7.8.1 * slurm_23_02-plugins-23.02.4-150300.7.8.1 * slurm_23_02-rest-debuginfo-23.02.4-150300.7.8.1 * perl-slurm_23_02-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-cray-23.02.4-150300.7.8.1 * slurm_23_02-pam_slurm-23.02.4-150300.7.8.1 * libnss_slurm2_23_02-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-munge-23.02.4-150300.7.8.1 * libslurm39-23.02.4-150300.7.8.1 * slurm_23_02-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-devel-23.02.4-150300.7.8.1 * slurm_23_02-lua-23.02.4-150300.7.8.1 * slurm_23_02-munge-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-plugin-ext-sensors-rrd-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-slurmdbd-23.02.4-150300.7.8.1 * slurm_23_02-sview-23.02.4-150300.7.8.1 * slurm_23_02-debugsource-23.02.4-150300.7.8.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (noarch) * slurm_23_02-config-23.02.4-150300.7.8.1 * slurm_23_02-config-man-23.02.4-150300.7.8.1 * slurm_23_02-doc-23.02.4-150300.7.8.1 * slurm_23_02-webdoc-23.02.4-150300.7.8.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) * slurm_23_02-slurmdbd-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-cray-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-sql-23.02.4-150300.7.8.1 * libpmi0_23_02-23.02.4-150300.7.8.1 * slurm_23_02-pam_slurm-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-sview-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-lua-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-node-23.02.4-150300.7.8.1 * slurm_23_02-node-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-torque-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-23.02.4-150300.7.8.1 * libpmi0_23_02-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-sql-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-plugins-debuginfo-23.02.4-150300.7.8.1 * perl-slurm_23_02-23.02.4-150300.7.8.1 * slurm_23_02-plugin-ext-sensors-rrd-23.02.4-150300.7.8.1 * slurm_23_02-rest-23.02.4-150300.7.8.1 * slurm_23_02-auth-none-23.02.4-150300.7.8.1 * slurm_23_02-torque-23.02.4-150300.7.8.1 * slurm_23_02-auth-none-debuginfo-23.02.4-150300.7.8.1 * libslurm39-debuginfo-23.02.4-150300.7.8.1 * libnss_slurm2_23_02-23.02.4-150300.7.8.1 * slurm_23_02-plugins-23.02.4-150300.7.8.1 * slurm_23_02-rest-debuginfo-23.02.4-150300.7.8.1 * perl-slurm_23_02-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-cray-23.02.4-150300.7.8.1 * slurm_23_02-pam_slurm-23.02.4-150300.7.8.1 * libnss_slurm2_23_02-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-munge-23.02.4-150300.7.8.1 * libslurm39-23.02.4-150300.7.8.1 * slurm_23_02-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-devel-23.02.4-150300.7.8.1 * slurm_23_02-lua-23.02.4-150300.7.8.1 * slurm_23_02-munge-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-plugin-ext-sensors-rrd-debuginfo-23.02.4-150300.7.8.1 * slurm_23_02-slurmdbd-23.02.4-150300.7.8.1 * slurm_23_02-sview-23.02.4-150300.7.8.1 * slurm_23_02-debugsource-23.02.4-150300.7.8.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch) * slurm_23_02-config-23.02.4-150300.7.8.1 * slurm_23_02-config-man-23.02.4-150300.7.8.1 * slurm_23_02-doc-23.02.4-150300.7.8.1 * slurm_23_02-webdoc-23.02.4-150300.7.8.1 ## References: * https://bugzilla.suse.com/show_bug.cgi?id=1214983

1 0

SUSE-RU-2023:3759-1: moderate: Recommended update for slurm
by maintenance＠opensuse.org 25 Sep '23

25 Sep '23

# Recommended update for slurm Announcement ID: SUSE-RU-2023:3759-1 Rating: moderate References: * #1214983 Affected Products: * HPC Module 15-SP5 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Package Hub 15 15-SP5 An update that has one fix can now be installed. ## Description: This update for slurm fixes the following issues: * Updated to 23.02.4 with the following changes: * Bug Fixes: * Fix main scheduler loop not starting after a failover to backup controller. Avoid slurmctld segfault when specifying `AccountingStorageExternalHost` (bsc#1214983). * Fix sbatch return code when `--wait` is requested on a job array. * Fix collected `GPUUtilization` values for `acct_gather_profile` plugins. * Fix `slurmrestd` handling of job hold/release operations. * Fix step running indefinitely when slurmctld takes more than `MessageTimeout` to respond. Now, `slurmctld` will cancel the step when detected, preventing following steps from getting stuck waiting for resources to be released. * Fix regression to make `job_desc.min_cpus` accurate again in `job_submit` when requesting a job with `--ntasks-per-node`. * Fix handling of `ArrayTaskThrottle` in backfill. * Fix regression in 23.02.2 when checking gres state on `slurmctld` startup or reconfigure. Gres changes in the configuration were not updated on slurmctld startup. On startup or reconfigure, these messages were present in the log: `"error: Attempt to change gres/gpu Count`". * Fix potential double count of gres when dealing with limits. * Fix `slurmstepd` segfault when `ContainerPath` is not set in `oci.conf` * Fixed an issue where jobs requesting licenses were incorrectly rejected. * `scrontab` \- Fix cutting off the final character of quoted variables. * `smail` \- Fix issues where e-mails at job completion were not being sent. * `scontrol/slurmctld` \- fix comma parsing when updating a reservation's nodes. * Fix `--gpu-bind=single binding` tasks to wrong gpus, leading to some gpus having more tasks than they should and other gpus being unused. * Fix regression in 23.02 that causes slurmstepd to crash when `srun` requests more than `TreeWidth` nodes in a step and uses the pmi2 or pmix plugin. * `job_container/tmpfs` \- Fix `%h` and `%n` substitution in `BasePath` where `%h` was substituted as the NodeName instead of the hostname, and %n was substituted as an empty string. * Fix regression where `--cpu-bind=verbose` would override `TaskPluginParam`. * `scancel` \- Fix `--clusters/-M` for federations. Only filtered jobs (e.g. `-A`, `-u`, `-p`, etc.) from the specified clusters will be canceled, rather than all jobs in the federation. Specific jobids will still be routed to the origin cluster for cancellation. * Other changes: * Make spank `S_JOB_ARGV` item value hold the requested command `argv` instead of the `srun --bcast` value when `--bcast` requested (only in local context). * `scontrol` \- Permit changes to StdErr and StdIn for pending jobs. * `scontrol` \- Reset `std`{`err`,`in`,`out`} when set to empty string. * `slurmrestd` \- mark environment as a required field for job submission descriptions. * `slurmrestd` \- avoid dumping null in OpenAPI schema required fields. * `data_parser/v0.0.39` \- avoid rejecting valid `memory_per_node` formatted as dictionary provided with a job description. * `data_parser/v0.0.39` \- avoid rejecting valid `memory_per_cpu` formatted as dictionary provided with a job description. * `slurmrestd` \- Return HTTP error code 404 when job query fails. * `slurmrestd` \- Add return schema to error response to job and license query. * Change the log message warning for rate limited users from debug to verbose. * `cgroup/v2` \- Avoid capturing log output for ebpf when constraining devices, as this can lead to inadvertent failure if the log buffer is too small. * Added error message when attempting to use sattach on batch or extern steps. * Reject job `ArrayTaskThrottle` update requests from unprivileged users. * `data_parser/v0.0.39` \- populate description fields of property objects in generated OpenAPI specifications where defined. * `slurmstepd` \- Avoid segfault caused by `ContainerPath` not being terminated by `/` in `oci.conf`. * `data_parser/v0.0.39` \- Change `v0.0.39_job_info` response to tag `exit_code` field as being complex instead of only an unsigned integer. * Updated to 23.02.3 with the following changes: * Bug Fixes: * `slurmctld` \- Fix backup slurmctld crash when it takes control multiple times. * Fix regression in 23.02.2 that ignored the partition `DefCpuPerGPU` setting on the first pass of scheduling a job requesting `--gpus --ntasks`. * `srun` \- fix issue creating regular and interactive steps because environment variables were incorrectly set on non-HetSteps. * Fix dynamic nodes getting stuck in allocated states when reconfiguring. * Fix regression in 23.02.2 that set the `SLURM_NTASKS` environment variable in sbatch jobs from `--ntasks-per-node` when `--ntasks` was not requested. * Fix regression in 23.02 that caused sbatch jobs to set the wrong number of tasks when requesting `--ntasks-per-node` without `--ntasks`, and also requesting one of the following options: `--sockets-per-node`, `--cores-per-socket`, `--threads-per-core` (or `--hint=nomultithread`), or `-B,--extra-node-info`. * Fix double counting suspended job counts on nodes when reconfiguring, which prevented nodes with suspended jobs from being powered down or rebooted once the jobs completed. * Fix backfill not scheduling jobs submitted with `--prefer` and `--constraint` properly. * mpi/pmix - fix regression introduced in 23.02.2 which caused PMIx shmem backed files permissions to be incorrect. * api/submit - fix memory leaks when submission of batch regular jobs or batch HetJobs fails (response data is a return code). * Fix regression in 23.02 leading to error() messages being sent at `INFO` instead of `ERR` in syslog. * Fix `TresUsageIn[Tot|Ave]` calculation for `gres/gpumem` and `gres/gpuutil`. * Fix issue in the gpu plugins where gpu frequencies would only be set if both gpu memory and gpu frequencies were set, while one or the other suffices. * Fix reservations group ACL's not working with the root group. * Fix updating a job with a ReqNodeList greater than the job's node count. * Fix inadvertent permission denied error for `--task-prolog` and `--task-epilog` with filesystems mounted with `root_squash`. * Fix missing detailed cpu and gres information in json/yaml output from `scontrol`, `squeue` and `sinfo`. * Fix regression in 23.02 that causes a failure to allocate job steps that request `--cpus-per-gpu` and gpus with types. * Fix potentially waiting indefinitely for a defunct process to finish, which affects various scripts including `Prolog` and `Epilog`. This could have various symptoms, such as jobs getting stuck in a completing state. * Fix losing list of reservations on job when updating job with list of reservations and restarting the controller. * Fix nodes resuming after down and drain state update requests from clients older than 23.02. * Fix advanced reservation creation/update when an association that should have access to it is composed with partition(s). * Fix job layout calculations with `--ntasks-per-gpu`, especially when `--nodes` has not been explicitly provided. * Fix X11 forwarding for jobs submitted from the slurmctld host. * When a job requests `--no-kill` and one or more nodes fail during the job, fix subsequent job steps unable to use some of the remaining resources allocated to the job. * Fix shared gres allocation when using `--tres-per-task` with tasks that span multiple sockets. * `auth/jwt` \- Fix memory leak. * Other changes: * `openapi/dbv0.0.39/users` \- If a default account update failed, resulting in a no-op, the query returned success without any warning. Now a warning is sent back to the client that the default account wasn't modified. * Avoid job write lock when nodes are dynamically added/removed. * `burst_buffer/lua` \- allow jobs to get scheduled sooner after `slurm_bb_data_in` completes. * `openapi/v0.0.39` \- fix memory leak in `_job_post_het_submit()`. * Avoid possible `slurmctld` segfault caused by race condition with already completed `slurmdbd_conn` connections. * `Slurmdbd.conf` checks included conf files for 0600 permissions * `slurmrestd` \- fix regression "oversubscribe" fields were removed from job descriptions and submissions from v0.0.39 end points. * `accounting_storage/mysql` \- Query for indiviual QOS correctly when you have more than 10. * Add warning message about ignoring `--tres-per-tasks=license` when used on a step. * `sshare` \- Fix command to work when using `priority/basic`. * Avoid loading `cli_filter` plugins outside of `salloc`/`sbatch`/`scron`/ `srun`. This fixes a number of missing symbol problems that can manifest for executables linked against libslurm (and not `libslurmfull`). * Allow cloud_reg_addrs to update dynamically registered node's addrs on subsequent registrations. * Revert a change in 22.05.5 that prevented tasks from sharing a core if `--cpus-per-task` > threads per core, but caused incorrect accounting and cpu binding. Instead, `--ntasks-per-core=1` may be requested to prevent tasks from sharing a core. * Correctly send `assoc_mgr` lock to mcs plugin. * Avoid unnecessary `gres/gpumem` and `gres/gpuutil` `TRES` position lookups. * `sacct` \- when printing `PLANNED` time, use end time instead of start time for jobs cancelled before they started. * Hold the job with "`(Reservation ... invalid)`" state reason if the reservation is not usable by the job. * `sbatch` \- Added new `--export=NIL` option. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2023-3759=1 openSUSE-SLE-15.5-2023-3759=1 * HPC Module 15-SP5 zypper in -t patch SUSE-SLE-Module-HPC-15-SP5-2023-3759=1 * SUSE Package Hub 15 15-SP5 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2023-3759=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * perl-slurm-23.02.4-150500.5.6.1 * slurm-cray-23.02.4-150500.5.6.1 * libslurm39-23.02.4-150500.5.6.1 * slurm-node-23.02.4-150500.5.6.1 * slurm-plugins-debuginfo-23.02.4-150500.5.6.1 * slurm-rest-debuginfo-23.02.4-150500.5.6.1 * slurm-sql-23.02.4-150500.5.6.1 * slurm-auth-none-23.02.4-150500.5.6.1 * slurm-testsuite-23.02.4-150500.5.6.1 * slurm-pam_slurm-23.02.4-150500.5.6.1 * slurm-devel-23.02.4-150500.5.6.1 * slurm-23.02.4-150500.5.6.1 * slurm-slurmdbd-debuginfo-23.02.4-150500.5.6.1 * libslurm39-debuginfo-23.02.4-150500.5.6.1 * libnss_slurm2-debuginfo-23.02.4-150500.5.6.1 * slurm-slurmdbd-23.02.4-150500.5.6.1 * slurm-munge-23.02.4-150500.5.6.1 * slurm-sview-23.02.4-150500.5.6.1 * slurm-torque-23.02.4-150500.5.6.1 * slurm-sql-debuginfo-23.02.4-150500.5.6.1 * slurm-cray-debuginfo-23.02.4-150500.5.6.1 * slurm-torque-debuginfo-23.02.4-150500.5.6.1 * libpmi0-23.02.4-150500.5.6.1 * slurm-auth-none-debuginfo-23.02.4-150500.5.6.1 * slurm-debugsource-23.02.4-150500.5.6.1 * libpmi0-debuginfo-23.02.4-150500.5.6.1 * libnss_slurm2-23.02.4-150500.5.6.1 * slurm-pam_slurm-debuginfo-23.02.4-150500.5.6.1 * slurm-hdf5-23.02.4-150500.5.6.1 * slurm-node-debuginfo-23.02.4-150500.5.6.1 * slurm-lua-debuginfo-23.02.4-150500.5.6.1 * perl-slurm-debuginfo-23.02.4-150500.5.6.1 * slurm-sview-debuginfo-23.02.4-150500.5.6.1 * slurm-plugins-23.02.4-150500.5.6.1 * slurm-debuginfo-23.02.4-150500.5.6.1 * slurm-munge-debuginfo-23.02.4-150500.5.6.1 * slurm-hdf5-debuginfo-23.02.4-150500.5.6.1 * slurm-plugin-ext-sensors-rrd-debuginfo-23.02.4-150500.5.6.1 * slurm-rest-23.02.4-150500.5.6.1 * slurm-plugin-ext-sensors-rrd-23.02.4-150500.5.6.1 * slurm-lua-23.02.4-150500.5.6.1 * openSUSE Leap 15.5 (noarch) * slurm-doc-23.02.4-150500.5.6.1 * slurm-openlava-23.02.4-150500.5.6.1 * slurm-config-23.02.4-150500.5.6.1 * slurm-config-man-23.02.4-150500.5.6.1 * slurm-webdoc-23.02.4-150500.5.6.1 * slurm-seff-23.02.4-150500.5.6.1 * slurm-sjstat-23.02.4-150500.5.6.1 * HPC Module 15-SP5 (aarch64 x86_64) * perl-slurm-23.02.4-150500.5.6.1 * slurm-cray-23.02.4-150500.5.6.1 * libslurm39-23.02.4-150500.5.6.1 * slurm-node-23.02.4-150500.5.6.1 * slurm-plugins-debuginfo-23.02.4-150500.5.6.1 * slurm-rest-debuginfo-23.02.4-150500.5.6.1 * slurm-sql-23.02.4-150500.5.6.1 * slurm-auth-none-23.02.4-150500.5.6.1 * slurm-pam_slurm-23.02.4-150500.5.6.1 * slurm-devel-23.02.4-150500.5.6.1 * slurm-23.02.4-150500.5.6.1 * slurm-slurmdbd-debuginfo-23.02.4-150500.5.6.1 * libslurm39-debuginfo-23.02.4-150500.5.6.1 * libnss_slurm2-debuginfo-23.02.4-150500.5.6.1 * slurm-slurmdbd-23.02.4-150500.5.6.1 * slurm-munge-23.02.4-150500.5.6.1 * slurm-sview-23.02.4-150500.5.6.1 * slurm-torque-23.02.4-150500.5.6.1 * slurm-sql-debuginfo-23.02.4-150500.5.6.1 * slurm-cray-debuginfo-23.02.4-150500.5.6.1 * slurm-torque-debuginfo-23.02.4-150500.5.6.1 * libpmi0-23.02.4-150500.5.6.1 * slurm-auth-none-debuginfo-23.02.4-150500.5.6.1 * slurm-debugsource-23.02.4-150500.5.6.1 * libpmi0-debuginfo-23.02.4-150500.5.6.1 * libnss_slurm2-23.02.4-150500.5.6.1 * slurm-pam_slurm-debuginfo-23.02.4-150500.5.6.1 * slurm-node-debuginfo-23.02.4-150500.5.6.1 * slurm-lua-debuginfo-23.02.4-150500.5.6.1 * perl-slurm-debuginfo-23.02.4-150500.5.6.1 * slurm-sview-debuginfo-23.02.4-150500.5.6.1 * slurm-plugins-23.02.4-150500.5.6.1 * slurm-debuginfo-23.02.4-150500.5.6.1 * slurm-munge-debuginfo-23.02.4-150500.5.6.1 * slurm-plugin-ext-sensors-rrd-debuginfo-23.02.4-150500.5.6.1 * slurm-rest-23.02.4-150500.5.6.1 * slurm-plugin-ext-sensors-rrd-23.02.4-150500.5.6.1 * slurm-lua-23.02.4-150500.5.6.1 * HPC Module 15-SP5 (noarch) * slurm-webdoc-23.02.4-150500.5.6.1 * slurm-doc-23.02.4-150500.5.6.1 * slurm-config-23.02.4-150500.5.6.1 * slurm-config-man-23.02.4-150500.5.6.1 * SUSE Package Hub 15 15-SP5 (ppc64le s390x) * perl-slurm-23.02.4-150500.5.6.1 * slurm-cray-23.02.4-150500.5.6.1 * slurm-plugins-debuginfo-23.02.4-150500.5.6.1 * slurm-node-23.02.4-150500.5.6.1 * slurm-rest-debuginfo-23.02.4-150500.5.6.1 * slurm-sql-23.02.4-150500.5.6.1 * slurm-auth-none-23.02.4-150500.5.6.1 * slurm-pam_slurm-23.02.4-150500.5.6.1 * slurm-devel-23.02.4-150500.5.6.1 * slurm-23.02.4-150500.5.6.1 * slurm-slurmdbd-debuginfo-23.02.4-150500.5.6.1 * libnss_slurm2-debuginfo-23.02.4-150500.5.6.1 * slurm-slurmdbd-23.02.4-150500.5.6.1 * slurm-munge-23.02.4-150500.5.6.1 * slurm-sview-23.02.4-150500.5.6.1 * slurm-torque-23.02.4-150500.5.6.1 * slurm-sql-debuginfo-23.02.4-150500.5.6.1 * slurm-cray-debuginfo-23.02.4-150500.5.6.1 * slurm-torque-debuginfo-23.02.4-150500.5.6.1 * libpmi0-23.02.4-150500.5.6.1 * slurm-auth-none-debuginfo-23.02.4-150500.5.6.1 * slurm-debugsource-23.02.4-150500.5.6.1 * libpmi0-debuginfo-23.02.4-150500.5.6.1 * libnss_slurm2-23.02.4-150500.5.6.1 * slurm-pam_slurm-debuginfo-23.02.4-150500.5.6.1 * slurm-hdf5-23.02.4-150500.5.6.1 * slurm-node-debuginfo-23.02.4-150500.5.6.1 * slurm-lua-debuginfo-23.02.4-150500.5.6.1 * perl-slurm-debuginfo-23.02.4-150500.5.6.1 * slurm-plugins-23.02.4-150500.5.6.1 * slurm-debuginfo-23.02.4-150500.5.6.1 * slurm-munge-debuginfo-23.02.4-150500.5.6.1 * slurm-hdf5-debuginfo-23.02.4-150500.5.6.1 * slurm-rest-23.02.4-150500.5.6.1 * slurm-sview-debuginfo-23.02.4-150500.5.6.1 * slurm-lua-23.02.4-150500.5.6.1 * SUSE Package Hub 15 15-SP5 (noarch) * slurm-doc-23.02.4-150500.5.6.1 * slurm-openlava-23.02.4-150500.5.6.1 * slurm-config-23.02.4-150500.5.6.1 * slurm-config-man-23.02.4-150500.5.6.1 * slurm-webdoc-23.02.4-150500.5.6.1 * slurm-seff-23.02.4-150500.5.6.1 * slurm-sjstat-23.02.4-150500.5.6.1 ## References: * https://bugzilla.suse.com/show_bug.cgi?id=1214983

1 0

SUSE-SU-2023:3762-1: important: Security update for frr
by maintenance＠opensuse.org 25 Sep '23

25 Sep '23

# Security update for frr Announcement ID: SUSE-SU-2023:3762-1 Rating: important References: * #1213284 * #1214735 * #1215065 Cross-References: * CVE-2023-38802 * CVE-2023-41358 * CVE-2023-41909 CVSS scores: * CVE-2023-38802 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-38802 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-41358 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-41358 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-41909 ( SUSE ): 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L * CVE-2023-41909 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * openSUSE Leap 15.4 * Server Applications Module 15-SP4 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Manager Proxy 4.2 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.2 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.2 * SUSE Manager Server 4.3 An update that solves three vulnerabilities can now be installed. ## Description: This update for frr fixes the following issues: * CVE-2023-38802: Fixed bad length handling when processing BGP attributes. (bsc#1213284) * CVE-2023-41358: Fixed a possible crash when processing NLRIs with an attribute length of zero. (bsc#1214735) * CVE-2023-41909: Fixed NULL pointer dereference due to processing in bgp_nlri_parse_flowspec (bsc#1215065). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-3762=1 * SUSE Manager Proxy 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.2-2023-3762=1 * SUSE Manager Retail Branch Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.2-2023-3762=1 * SUSE Manager Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-3762=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2023-3762=1 * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3762=1 * Server Applications Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2023-3762=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-3762=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-3762=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-3762=1 ## Package List: * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64) * libfrrzmq0-debuginfo-7.4-150300.4.17.1 * libmlag_pb0-debuginfo-7.4-150300.4.17.1 * libfrr0-7.4-150300.4.17.1 * libfrrgrpc_pb0-debuginfo-7.4-150300.4.17.1 * libfrrsnmp0-7.4-150300.4.17.1 * frr-debugsource-7.4-150300.4.17.1 * libfrr_pb0-7.4-150300.4.17.1 * libfrrospfapiclient0-debuginfo-7.4-150300.4.17.1 * libfrrospfapiclient0-7.4-150300.4.17.1 * libfrrgrpc_pb0-7.4-150300.4.17.1 * libfrrcares0-debuginfo-7.4-150300.4.17.1 * frr-debuginfo-7.4-150300.4.17.1 * libmlag_pb0-7.4-150300.4.17.1 * libfrrfpm_pb0-7.4-150300.4.17.1 * frr-7.4-150300.4.17.1 * libfrrfpm_pb0-debuginfo-7.4-150300.4.17.1 * frr-devel-7.4-150300.4.17.1 * libfrrcares0-7.4-150300.4.17.1 * libfrr_pb0-debuginfo-7.4-150300.4.17.1 * libfrr0-debuginfo-7.4-150300.4.17.1 * libfrrzmq0-7.4-150300.4.17.1 * libfrrsnmp0-debuginfo-7.4-150300.4.17.1 * SUSE Manager Proxy 4.2 (x86_64) * libfrrzmq0-debuginfo-7.4-150300.4.17.1 * libmlag_pb0-debuginfo-7.4-150300.4.17.1 * libfrr0-7.4-150300.4.17.1 * libfrrgrpc_pb0-debuginfo-7.4-150300.4.17.1 * libfrrsnmp0-7.4-150300.4.17.1 * frr-debugsource-7.4-150300.4.17.1 * libfrr_pb0-7.4-150300.4.17.1 * libfrrospfapiclient0-debuginfo-7.4-150300.4.17.1 * libfrrospfapiclient0-7.4-150300.4.17.1 * libfrrgrpc_pb0-7.4-150300.4.17.1 * libfrrcares0-debuginfo-7.4-150300.4.17.1 * frr-debuginfo-7.4-150300.4.17.1 * libmlag_pb0-7.4-150300.4.17.1 * libfrrfpm_pb0-7.4-150300.4.17.1 * frr-7.4-150300.4.17.1 * libfrrfpm_pb0-debuginfo-7.4-150300.4.17.1 * frr-devel-7.4-150300.4.17.1 * libfrrcares0-7.4-150300.4.17.1 * libfrr_pb0-debuginfo-7.4-150300.4.17.1 * libfrr0-debuginfo-7.4-150300.4.17.1 * libfrrzmq0-7.4-150300.4.17.1 * libfrrsnmp0-debuginfo-7.4-150300.4.17.1 * SUSE Manager Retail Branch Server 4.2 (x86_64) * libfrrzmq0-debuginfo-7.4-150300.4.17.1 * libmlag_pb0-debuginfo-7.4-150300.4.17.1 * libfrr0-7.4-150300.4.17.1 * libfrrgrpc_pb0-debuginfo-7.4-150300.4.17.1 * libfrrsnmp0-7.4-150300.4.17.1 * frr-debugsource-7.4-150300.4.17.1 * libfrr_pb0-7.4-150300.4.17.1 * libfrrospfapiclient0-debuginfo-7.4-150300.4.17.1 * libfrrospfapiclient0-7.4-150300.4.17.1 * libfrrgrpc_pb0-7.4-150300.4.17.1 * libfrrcares0-debuginfo-7.4-150300.4.17.1 * frr-debuginfo-7.4-150300.4.17.1 * libmlag_pb0-7.4-150300.4.17.1 * libfrrfpm_pb0-7.4-150300.4.17.1 * frr-7.4-150300.4.17.1 * libfrrfpm_pb0-debuginfo-7.4-150300.4.17.1 * frr-devel-7.4-150300.4.17.1 * libfrrcares0-7.4-150300.4.17.1 * libfrr_pb0-debuginfo-7.4-150300.4.17.1 * libfrr0-debuginfo-7.4-150300.4.17.1 * libfrrzmq0-7.4-150300.4.17.1 * libfrrsnmp0-debuginfo-7.4-150300.4.17.1 * SUSE Manager Server 4.2 (ppc64le s390x x86_64) * libfrrzmq0-debuginfo-7.4-150300.4.17.1 * libmlag_pb0-debuginfo-7.4-150300.4.17.1 * libfrr0-7.4-150300.4.17.1 * libfrrgrpc_pb0-debuginfo-7.4-150300.4.17.1 * libfrrsnmp0-7.4-150300.4.17.1 * frr-debugsource-7.4-150300.4.17.1 * libfrr_pb0-7.4-150300.4.17.1 * libfrrospfapiclient0-debuginfo-7.4-150300.4.17.1 * libfrrospfapiclient0-7.4-150300.4.17.1 * libfrrgrpc_pb0-7.4-150300.4.17.1 * libfrrcares0-debuginfo-7.4-150300.4.17.1 * frr-debuginfo-7.4-150300.4.17.1 * libmlag_pb0-7.4-150300.4.17.1 * libfrrfpm_pb0-7.4-150300.4.17.1 * frr-7.4-150300.4.17.1 * libfrrfpm_pb0-debuginfo-7.4-150300.4.17.1 * frr-devel-7.4-150300.4.17.1 * libfrrcares0-7.4-150300.4.17.1 * libfrr_pb0-debuginfo-7.4-150300.4.17.1 * libfrr0-debuginfo-7.4-150300.4.17.1 * libfrrzmq0-7.4-150300.4.17.1 * libfrrsnmp0-debuginfo-7.4-150300.4.17.1 * SUSE Enterprise Storage 7.1 (aarch64 x86_64) * libfrrzmq0-debuginfo-7.4-150300.4.17.1 * libmlag_pb0-debuginfo-7.4-150300.4.17.1 * libfrr0-7.4-150300.4.17.1 * libfrrgrpc_pb0-debuginfo-7.4-150300.4.17.1 * libfrrsnmp0-7.4-150300.4.17.1 * frr-debugsource-7.4-150300.4.17.1 * libfrr_pb0-7.4-150300.4.17.1 * libfrrospfapiclient0-debuginfo-7.4-150300.4.17.1 * libfrrospfapiclient0-7.4-150300.4.17.1 * libfrrgrpc_pb0-7.4-150300.4.17.1 * libfrrcares0-debuginfo-7.4-150300.4.17.1 * frr-debuginfo-7.4-150300.4.17.1 * libmlag_pb0-7.4-150300.4.17.1 * libfrrfpm_pb0-7.4-150300.4.17.1 * frr-7.4-150300.4.17.1 * libfrrfpm_pb0-debuginfo-7.4-150300.4.17.1 * frr-devel-7.4-150300.4.17.1 * libfrrcares0-7.4-150300.4.17.1 * libfrr_pb0-debuginfo-7.4-150300.4.17.1 * libfrr0-debuginfo-7.4-150300.4.17.1 * libfrrzmq0-7.4-150300.4.17.1 * libfrrsnmp0-debuginfo-7.4-150300.4.17.1 * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * libfrrzmq0-debuginfo-7.4-150300.4.17.1 * libmlag_pb0-debuginfo-7.4-150300.4.17.1 * libfrr0-7.4-150300.4.17.1 * libfrrgrpc_pb0-debuginfo-7.4-150300.4.17.1 * libfrrsnmp0-7.4-150300.4.17.1 * frr-debugsource-7.4-150300.4.17.1 * libfrr_pb0-7.4-150300.4.17.1 * libfrrospfapiclient0-debuginfo-7.4-150300.4.17.1 * libfrrospfapiclient0-7.4-150300.4.17.1 * libfrrgrpc_pb0-7.4-150300.4.17.1 * libfrrcares0-debuginfo-7.4-150300.4.17.1 * frr-debuginfo-7.4-150300.4.17.1 * libmlag_pb0-7.4-150300.4.17.1 * libfrrfpm_pb0-7.4-150300.4.17.1 * frr-7.4-150300.4.17.1 * libfrrfpm_pb0-debuginfo-7.4-150300.4.17.1 * frr-devel-7.4-150300.4.17.1 * libfrrcares0-7.4-150300.4.17.1 * libfrr_pb0-debuginfo-7.4-150300.4.17.1 * libfrr0-debuginfo-7.4-150300.4.17.1 * libfrrzmq0-7.4-150300.4.17.1 * libfrrsnmp0-debuginfo-7.4-150300.4.17.1 * Server Applications Module 15-SP4 (aarch64 ppc64le s390x x86_64) * libfrrzmq0-debuginfo-7.4-150300.4.17.1 * libmlag_pb0-debuginfo-7.4-150300.4.17.1 * libfrr0-7.4-150300.4.17.1 * libfrrgrpc_pb0-debuginfo-7.4-150300.4.17.1 * libfrrsnmp0-7.4-150300.4.17.1 * frr-debugsource-7.4-150300.4.17.1 * libfrr_pb0-7.4-150300.4.17.1 * libfrrospfapiclient0-debuginfo-7.4-150300.4.17.1 * libfrrospfapiclient0-7.4-150300.4.17.1 * libfrrgrpc_pb0-7.4-150300.4.17.1 * libfrrcares0-debuginfo-7.4-150300.4.17.1 * frr-debuginfo-7.4-150300.4.17.1 * libmlag_pb0-7.4-150300.4.17.1 * libfrrfpm_pb0-7.4-150300.4.17.1 * frr-7.4-150300.4.17.1 * libfrrfpm_pb0-debuginfo-7.4-150300.4.17.1 * frr-devel-7.4-150300.4.17.1 * libfrrcares0-7.4-150300.4.17.1 * libfrr_pb0-debuginfo-7.4-150300.4.17.1 * libfrr0-debuginfo-7.4-150300.4.17.1 * libfrrzmq0-7.4-150300.4.17.1 * libfrrsnmp0-debuginfo-7.4-150300.4.17.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (aarch64 x86_64) * libfrrzmq0-debuginfo-7.4-150300.4.17.1 * libmlag_pb0-debuginfo-7.4-150300.4.17.1 * libfrr0-7.4-150300.4.17.1 * libfrrgrpc_pb0-debuginfo-7.4-150300.4.17.1 * libfrrsnmp0-7.4-150300.4.17.1 * frr-debugsource-7.4-150300.4.17.1 * libfrr_pb0-7.4-150300.4.17.1 * libfrrospfapiclient0-debuginfo-7.4-150300.4.17.1 * libfrrospfapiclient0-7.4-150300.4.17.1 * libfrrgrpc_pb0-7.4-150300.4.17.1 * libfrrcares0-debuginfo-7.4-150300.4.17.1 * frr-debuginfo-7.4-150300.4.17.1 * libmlag_pb0-7.4-150300.4.17.1 * libfrrfpm_pb0-7.4-150300.4.17.1 * frr-7.4-150300.4.17.1 * libfrrfpm_pb0-debuginfo-7.4-150300.4.17.1 * frr-devel-7.4-150300.4.17.1 * libfrrcares0-7.4-150300.4.17.1 * libfrr_pb0-debuginfo-7.4-150300.4.17.1 * libfrr0-debuginfo-7.4-150300.4.17.1 * libfrrzmq0-7.4-150300.4.17.1 * libfrrsnmp0-debuginfo-7.4-150300.4.17.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) * libfrrzmq0-debuginfo-7.4-150300.4.17.1 * libmlag_pb0-debuginfo-7.4-150300.4.17.1 * libfrr0-7.4-150300.4.17.1 * libfrrgrpc_pb0-debuginfo-7.4-150300.4.17.1 * libfrrsnmp0-7.4-150300.4.17.1 * frr-debugsource-7.4-150300.4.17.1 * libfrr_pb0-7.4-150300.4.17.1 * libfrrospfapiclient0-debuginfo-7.4-150300.4.17.1 * libfrrospfapiclient0-7.4-150300.4.17.1 * libfrrgrpc_pb0-7.4-150300.4.17.1 * libfrrcares0-debuginfo-7.4-150300.4.17.1 * frr-debuginfo-7.4-150300.4.17.1 * libmlag_pb0-7.4-150300.4.17.1 * libfrrfpm_pb0-7.4-150300.4.17.1 * frr-7.4-150300.4.17.1 * libfrrfpm_pb0-debuginfo-7.4-150300.4.17.1 * frr-devel-7.4-150300.4.17.1 * libfrrcares0-7.4-150300.4.17.1 * libfrr_pb0-debuginfo-7.4-150300.4.17.1 * libfrr0-debuginfo-7.4-150300.4.17.1 * libfrrzmq0-7.4-150300.4.17.1 * libfrrsnmp0-debuginfo-7.4-150300.4.17.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x x86_64) * libfrrzmq0-debuginfo-7.4-150300.4.17.1 * libmlag_pb0-debuginfo-7.4-150300.4.17.1 * libfrr0-7.4-150300.4.17.1 * libfrrgrpc_pb0-debuginfo-7.4-150300.4.17.1 * libfrrsnmp0-7.4-150300.4.17.1 * frr-debugsource-7.4-150300.4.17.1 * libfrr_pb0-7.4-150300.4.17.1 * libfrrospfapiclient0-debuginfo-7.4-150300.4.17.1 * libfrrospfapiclient0-7.4-150300.4.17.1 * libfrrgrpc_pb0-7.4-150300.4.17.1 * libfrrcares0-debuginfo-7.4-150300.4.17.1 * frr-debuginfo-7.4-150300.4.17.1 * libmlag_pb0-7.4-150300.4.17.1 * libfrrfpm_pb0-7.4-150300.4.17.1 * frr-7.4-150300.4.17.1 * libfrrfpm_pb0-debuginfo-7.4-150300.4.17.1 * frr-devel-7.4-150300.4.17.1 * libfrrcares0-7.4-150300.4.17.1 * libfrr_pb0-debuginfo-7.4-150300.4.17.1 * libfrr0-debuginfo-7.4-150300.4.17.1 * libfrrzmq0-7.4-150300.4.17.1 * libfrrsnmp0-debuginfo-7.4-150300.4.17.1 ## References: * https://www.suse.com/security/cve/CVE-2023-38802.html * https://www.suse.com/security/cve/CVE-2023-41358.html * https://www.suse.com/security/cve/CVE-2023-41909.html * https://bugzilla.suse.com/show_bug.cgi?id=1213284 * https://bugzilla.suse.com/show_bug.cgi?id=1214735 * https://bugzilla.suse.com/show_bug.cgi?id=1215065

1 0

openSUSE-RU-2023:0261-1: moderate: Recommended update for tryton, trytond, trytond_account, trytond_account_invoice, trytond_stock, trytond_stock_lot
by maintenance＠opensuse.org 25 Sep '23

25 Sep '23

openSUSE Recommended Update: Recommended update for tryton, trytond, trytond_account, trytond_account_invoice, trytond_stock, trytond_stock_lot ______________________________________________________________________________ Announcement ID: openSUSE-RU-2023:0261-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for tryton, trytond, trytond_account, trytond_account_invoice, trytond_stock, trytond_stock_lot fixes the following issues: Changes in trytond_account_invoice: - Version 6.0.13 - Bugfix Release Changes in trytond_account: - Version 6.0.18 - Bugfix Release Changes in trytond_stock: - Version 6.0.21 - Bugfix Release - Version 6.0.20 - Bugfix Release - Version 6.0.19 - Bugfix Release Changes in trytond_stock_lot: - Version 6.0.1 - Bugfix Release Changes in trytond: - Version 6.0.35 - Bugfix Release Changes in tryton: - Version 6.0.28 - Bugfix Release Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2023-261=1 Package List: - openSUSE Backports SLE-15-SP5 (noarch): tryton-6.0.28-bp155.2.6.1 trytond-6.0.35-bp155.2.9.1 trytond_account-6.0.18-bp155.2.6.1 trytond_account_invoice-6.0.13-bp155.2.6.1 trytond_stock-6.0.21-bp155.2.3.1 trytond_stock_lot-6.0.1-bp155.3.3.1 References:

1 0

openSUSE-RU-2023:0256-1: moderate: Recommended update for owncloud-client
by maintenance＠opensuse.org 25 Sep '23

25 Sep '23

openSUSE Recommended Update: Recommended update for owncloud-client ______________________________________________________________________________ Announcement ID: openSUSE-RU-2023:0256-1 Rating: moderate References: #1106103 #1173252 #1179175 #1214904 Affected Products: openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for owncloud-client fixes the following issues: - Update to version 4.1.0: * Follow same site redirects in the Wizard * Show systray status when a sync error occurred * Owncloudcmd: Ensure plugin path is initialized on Linux * Use correct user name with basic auth and LDAP * Allow users to call commandline client from AppImage - Update to version 4.0.0 (boo#1214904) * Enable sync of locked office files * Improvements for oCIS space handling, ie display quota * Webfinger workflow for multiple instance detection * Open sharing information in Web * Improved integration of the online documentation * better error handling in the owncloudcmd client * many other small bug fixes Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2023-256=1 Package List: - openSUSE Backports SLE-15-SP5 (aarch64 ppc64le s390x x86_64): libowncloudsync-devel-4.1.0-bp155.2.3.1 libowncloudsync0-4.1.0-bp155.2.3.1 owncloud-client-4.1.0-bp155.2.3.1 owncloud-client-caja-4.1.0-bp155.2.3.1 owncloud-client-dolphin-4.1.0-bp155.2.3.1 owncloud-client-nautilus-4.1.0-bp155.2.3.1 owncloud-client-nemo-4.1.0-bp155.2.3.1 References: https://bugzilla.suse.com/1106103 https://bugzilla.suse.com/1173252 https://bugzilla.suse.com/1179175 https://bugzilla.suse.com/1214904

1 0

openSUSE-RU-2023:0254-1: moderate: Recommended update for gede
by maintenance＠opensuse.org 25 Sep '23

25 Sep '23

openSUSE Recommended Update: Recommended update for gede ______________________________________________________________________________ Announcement ID: openSUSE-RU-2023:0254-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for gede fixes the following issues: gede was updated to a new upstream release 2.19.1 * Added support for remote debugging over serial port Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2023-254=1 Package List: - openSUSE Backports SLE-15-SP5 (aarch64 i586 ppc64le s390x x86_64): gede-2.19.1-bp155.2.6.1 References:

1 0

openSUSE-SU-2023:0257-1: moderate: Security update for modsecurity
by opensuse-security＠opensuse.org 25 Sep '23

25 Sep '23

openSUSE Security Update: Security update for modsecurity ______________________________________________________________________________ Announcement ID: openSUSE-SU-2023:0257-1 Rating: moderate References: #1210993 #1213702 Cross-References: CVE-2020-15598 CVE-2021-42717 CVE-2023-28882 CVE-2023-38285 CVSS scores: CVE-2020-15598 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-42717 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-42717 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2023-28882 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2023-28882 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2023-38285 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for modsecurity fixes the following issues: Update to version 3.0.10: * Security impacting issue (fix boo#1213702, CVE-2023-38285) - Fix: worst-case time in implementation of four transformations - Additional information on this issue is available at https://www.trustwave.com/resources/blogs/spiderlabs-blog/modsecurity-v3-do s-vulnerability-in-four-transformations-cve-2023-38285/ * Enhancements and bug fixes - Add TX synonym for MSC_PCRE_LIMITS_EXCEEDED - Make MULTIPART_PART_HEADERS accessible to lua - Fix: Lua scripts cannot read whole collection at once - Fix: quoted Include config with wildcard - Support isolated PCRE match limits - Fix: meta actions not applied if multiMatch in first rule of chain - Fix: audit log may omit tags when multiMatch - Exclude CRLF from MULTIPART_PART_HEADER value - Configure: use AS_ECHO_N instead echo -n - Adjust position of memset from 2890 Update to version 3.0.9: * Add some member variable inits in Transaction class (possible segfault) * Fix: possible segfault on reload if duplicate ip+CIDR in ip match list * Resolve memory leak on reload (bison-generated variable) * Support equals sign in XPath expressions * Encode two special chars in error.log output * Add JIT support for PCRE2 * Support comments in ipMatchFromFile file via '#' token * Use name package name libmaxminddb with pkg-config * Fix: FILES_TMP_CONTENT collection key should use part name * Use AS_HELP_STRING instead of obsolete AC_HELP_STRING macro * During configure, do not check for pcre if pcre2 specified * Use pkg-config to find libxml2 first * Fix two rule-reload memory leak issues * Correct whitespace handling for Include directive - Fix CVE-2023-28882, a segfault and a resultant crash of a worker process in some configurations with certain inputs, boo#1210993 Update to version 3.0.8 * Adjust parser activation rules in modsecurity.conf-recommended [#2796] * Multipart parsing fixes and new MULTIPART_PART_HEADERS collection [#2795] * Prevent LMDB related segfault [#2755, #2761] * Fix msc_transaction_cleanup function comment typo [#2788] * Fix: MULTIPART_INVALID_PART connected to wrong internal variable [#2785] * Restore Unique_id to include random portion after timestamp [#2752, #2758] Update to version 3.0.7 * Support PCRE2 * Support SecRequestBodyNoFilesLimit * Add ctl:auditEngine action support * Move PCRE2 match block from member variable * Add SecArgumentsLimit, 200007 to modsecurity.conf-recommended * Fix memory leak when concurrent log includes REMOTE_USER * Fix LMDB initialization issues * Fix initcol error message wording * Tolerate other parameters after boundary in multipart C-T * Add DebugLog message for bad pattern in rx operator * Fix misuses of LMDB API * Fix duplication typo in code comment * Fix multiMatch msg, etc, population in audit log * Fix some name handling for ARGS_*NAMES: regex SecRuleUpdateTargetById, etc. * Adjust confusing variable name in setRequestBody method * Multipart names/filenames may include single quote if double-quote enclosed * Add SecRequestBodyJsonDepthLimit to modsecurity.conf-recommended Update to version 3.0.6 * Security issue: Support configurable limit on depth of JSON parsing, possible DoS issue. CVE-2021-42717 Update to version 3.0.5 * New: Having ARGS_NAMES, variables proxied * Fix: FILES variable does not use multipart part name for key * GeoIP: switch to GEOIP_MEMORY_CACHE from GEOIP_INDEX_CACHE * Support configurable limit on number of arguments processed * Adds support to lua 5.4 * Add support for new operator rxGlobal * Fix: Replaces put with setenv in SetEnv action * Fix: Regex key selection should not be case-sensitive * Fix: Only delete Multipart tmp files after rules have run * Fixed MatchedVar on chained rules * Fix IP address logging in Section A * Fix: rx: exit after full match (remove /g emulation); ensure capture groups occuring after unused groups still populate TX vars * Fix rule-update-target for non-regex * Fix Security Impacting Issues: * Handle URI received with uri-fragment, CVE-2020-15598 update to 3.0.4: * Fix: audit log data omitted when nolog,auditlog * Fix: ModSecurity 3.x inspectFile operator does not pass * XML: Remove error messages from stderr * Filter comment or blank line for pmFromFile operator * Additional adjustment to Cookie header parsing * Restore chained rule part H logging to be more like 2.9 behaviour * Small fixes in log messages to help debugging the file upload * Fix Cookie header parsing issues * Fix rules with nolog are logging to part H * Fix argument key-value pair parsing cases * Fix: audit log part for response body for JSON format to be E * Make sure m_rulesMessages is filled after successfull match * Fix @pm lookup for possible matches on offset zero. * Regex lookup on the key name instead of COLLECTION:key * Missing throw in Operator::instantiate * Making block action execution dependent of the SecEngine status * Making block action execution dependent of the SecEngine status * Having body limits to respect the rule engine state * Fix SecRuleUpdateTargetById does not match regular expressions * Adds missing check for runtime ctl:ruleRemoveByTag * Adds a new operator verifySVNR that checks for Austrian social security numbers. * Fix variables output in debug logs * Correct typo validade in log output * fix/minor: Error encoding hexa decimal. * Limit more log variables to 200 characters. * parser: fix parsed file names * Allow empty anchored variable * Fixed FILES_NAMES collection after the end of multipart parsing * Fixed validateByteRange parsing method * Removes a memory leak on the JSON parser * Enables LMDB on the regression tests. * Fix: Extra whitespace in some configuration directives causing error * Refactoring on Regex and SMatch classes. * Fixed buffer overflow in Utils::Md5::hexdigest() * Implemented merge() method for ConfigInt, ConfigDouble, ConfigString * Adds initially support to the drop action. * Complete merging of particular rule properties * Replaces AC_CHECK_FILE with 'test -f' * Fix inet addr handling on 64 bit big endian systems * Fix tests on FreeBSD * Changes ENV test case to read the default MODSECURTIY env var * Regression: Sets MODSECURITY env var during the tests execution * Fix setenv action to strdup key=variable * Allow 0 length JSON requests. * Fix "make dist" target to include default configuration * Replaced log locking using mutex with fcntl lock * Correct the usage of modsecurity::Phases::NUMBER_OF_PHASES * Adds support to multiple ranges in ctl:ruleRemoveById * Rule variable interpolation broken * Make the boundary check less strict as per RFC2046 * Fix buffer size for utf8toUnicode transformation * Fix double macros bug * Override the default status code if not suitable to redirect action * parser: Fix the support for CRLF configuration files * Organizes the server logs * m_lineNumber in Rule not mapping with the correct line number in file * Using shared_ptr instead of unique_ptr on rules exceptions * Changes debuglogs schema to avoid unecessary str allocation * Fix the SecUnicodeMapFile and SecUnicodeCodePage * Changes the timing to save the rule message * Fix crash in msc_rules_add_file() when using disruptive action in chain * Fix memory leak in AuditLog::init() * Fix RulesProperties::appendRules() * Fix RULE lookup in chained rules * @ipMatch "Could not add entry" on slash/32 notation in 2.9.0 * Using values after transformation at MATCHED_VARS * Adds support to UpdateActionById. * Add correct C function prototypes for msc_init and msc_create_rule_set * Allow LuaJIT 2.1 to be used * Match m_id JSON log with RuleMessage and v2 format * Adds support to setenv action. * Adds new transaction constructor that accepts the transaction id as parameter. * Adds request IDs and URIs to the debug log * Treating variables exception on load-time instead of run time. * Fix: function m.setvar in Lua scripts and add testcases * Fix SecResponseBodyAccess and ctl:requestBodyAccess directives * Fix OpenBSD build * Fix parser to support GeoLookup with MaxMind * parser: Fix simple quote setvar in the end of the line * Fix pc file * modsec_rules_check: uses the gnu `.la' instead of `.a' file * good practices: Initialize variables before use it * Fix utf-8 character encoding conversion * Adds support for ctl:requestBodyProcessor=URLENCODED * Add LUA compatibility for CentOS and try to use LuaJIT first if available * Allow LuaJIT to be used * Implement support for Lua 5.1 * Variable names must match fully, not partially. Match should be case insensitive. * Improves the performance while loading the rules * Allow empty strings to be evaluated by regex::searchAll * Adds basic pkg-config info * Fixed LMDB collection errors * Fixed false positive MULTIPART_UNMATCHED_BOUNDARY errors * Fix ip tree lookup on netmask content * Changes the behavior of the default sec actions * Refactoring on {global,ip,resources,session,tx,user} collections * Fix race condition in UniqueId::uniqueId() * Fix memory leak in error message for msc_rules_merge C APIs * Return false in SharedFiles::open() when an error happens * Use rvalue reference in ModSecurity::serverLog * Build System: Fix when multiple lines for curl version. * Checks if response body inspection is enabled before process it * Fix setvar parsing of quoted data * Adds time stamp back to the audit logs * Disables skip counter if debug log is disabled * Cosmetics: Represents amount of skipped rules without decimal * Add missing escapeSeqDecode, urlEncode and trimLeft/Right tfns to parser * Fix STATUS var parsing and accept STATUS_LINE var for v2 backward comp. * Fix memory leak in modsecurity::utils::expandEnv() * Initialize m_dtd member in ValidateDTD class as NULL * Fix broken @detectxss operator regression test case * Fix utils::string::ssplit() to handle delimiter in the end of string * Fix variable FILES_TMPNAMES * Fix memory leak in Collections * Fix lib version information while generating the .so file * Adds support for ctl:ruleRemoveByTag * Fix SecUploadDir configuration merge * Include all prerequisites for "make check" into dist archive * Fix: Reverse logic of checking output in @inspectFile * Adds support to libMaxMind * Adds capture action to detectXSS * Temporarily accept invalid MULTIPART_SEMICOLON_MISSING operator * Adds capture action to detectSQLi * Adds capture action to rbl * Adds capture action to verifyCC * Adds capture action to verifySSN * Adds capture action to verifyCPF * Prettier error messages for unsupported configurations (UX) * Add missing verify*** transformation statements to parser * Fix a set of compilation warnings * Check for disruptive action on SecDefaultAction. * Fix block-block infinite loop. * Correction remove_by_tag and remove_by_msg logic. * Fix LMDB compile error * Fix msc_who_am_i() to return pointer to a valid C string * Added some cosmetics to autoconf related code * Fix "make dist" target to include necessary headers for Lua * Fix "include /foo/*.conf" for single matched object in directory * Add missing Base64 transformation statements to parser * Fixed resource load on ip match from file * Fixed examples compilation while using disable-shared * Fixed compilation issue while xml is disabled * Having LDADD and LDFLAGS organized on Makefile.am * Checking std::deque size before use it * perf improvement: Added the concept of RunTimeString and removed all run time parser. * perf improvement: Checks debuglog level before format debug msg * perf. improvement/rx: Only compute dynamic regex in case of macro * Fix uri on the benchmark utility * disable Lua on systems with liblua5.1 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2023-257=1 Package List: - openSUSE Backports SLE-15-SP5 (aarch64 i586 ppc64le s390x x86_64): libmodsecurity3-3.0.10-bp155.3.3.1 modsecurity-3.0.10-bp155.3.3.1 modsecurity-devel-3.0.10-bp155.3.3.1 - openSUSE Backports SLE-15-SP5 (aarch64_ilp32): libmodsecurity3-64bit-3.0.10-bp155.3.3.1 - openSUSE Backports SLE-15-SP5 (x86_64): libmodsecurity3-32bit-3.0.10-bp155.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-15598.html https://www.suse.com/security/cve/CVE-2021-42717.html https://www.suse.com/security/cve/CVE-2023-28882.html https://www.suse.com/security/cve/CVE-2023-38285.html https://bugzilla.suse.com/1210993 https://bugzilla.suse.com/1213702

1 0

openSUSE-SU-2023:0259-1: moderate: Security update for python-GitPython
by opensuse-security＠opensuse.org 25 Sep '23

25 Sep '23

openSUSE Security Update: Security update for python-GitPython ______________________________________________________________________________ Announcement ID: openSUSE-SU-2023:0259-1 Rating: moderate References: #1214810 Cross-References: CVE-2023-41040 CVSS scores: CVE-2023-41040 (NVD) : 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2023-41040 (SUSE): 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-GitPython fixes the following issues: - CVE-2023-41040: Fixed directory traversal attack vulnerability (boo#1214810) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2023-259=1 Package List: - openSUSE Backports SLE-15-SP5 (noarch): python3-GitPython-3.1.12.1610074031.f653af66-bp155.3.3.1 References: https://www.suse.com/security/cve/CVE-2023-41040.html https://bugzilla.suse.com/1214810

1 0

openSUSE-RU-2023:0255-1: moderate: Recommended update for manpages-l10n
by maintenance＠opensuse.org 25 Sep '23

25 Sep '23

openSUSE Recommended Update: Recommended update for manpages-l10n ______________________________________________________________________________ Announcement ID: openSUSE-RU-2023:0255-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for manpages-l10n fixes the following issues: - Update to version 4.19.0: Updated and added many translations. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2023-255=1 Package List: - openSUSE Backports SLE-15-SP5 (noarch): man-pages-cs-4.19.0-bp155.2.3.1 man-pages-da-4.19.0-bp155.2.3.1 man-pages-de-4.19.0-bp155.2.3.1 man-pages-el-4.19.0-bp155.2.3.1 man-pages-es-4.19.0-bp155.2.3.1 man-pages-fi-4.19.0-bp155.2.3.1 man-pages-fr-4.19.0-bp155.2.3.1 man-pages-hu-4.19.0-bp155.2.3.1 man-pages-id-4.19.0-bp155.2.3.1 man-pages-it-4.19.0-bp155.2.3.1 man-pages-mk-4.19.0-bp155.2.3.1 man-pages-nb-4.19.0-bp155.2.3.1 man-pages-nl-4.19.0-bp155.2.3.1 man-pages-pl-4.19.0-bp155.2.3.1 man-pages-pt_BR-4.19.0-bp155.2.3.1 man-pages-ro-4.19.0-bp155.2.3.1 man-pages-ru-4.19.0-bp155.2.3.1 man-pages-sr-4.19.0-bp155.2.3.1 man-pages-sv-4.19.0-bp155.2.3.1 man-pages-uk-4.19.0-bp155.2.3.1 man-pages-vi-4.19.0-bp155.2.3.1 References:

1 0

openSUSE-SU-2023:0260-1: moderate: Security update for python-CairoSVG
by opensuse-security＠opensuse.org 25 Sep '23

25 Sep '23

openSUSE Security Update: Security update for python-CairoSVG ______________________________________________________________________________ Announcement ID: openSUSE-SU-2023:0260-1 Rating: moderate References: #1180648 #1209538 Cross-References: CVE-2021-21236 CVE-2023-27586 CVSS scores: CVE-2021-21236 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2023-27586 (NVD) : 9.9 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L Affected Products: openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for python-CairoSVG fixes the following issues: - CVE-2023-27586: Don't allow fetching external files unless explicitly asked for. (boo#1209538) - Update to version 2.5.2 * Fix marker path scale - Update to version 2.5.1 (boo#1180648, CVE-2021-21236): * Security fix: When processing SVG files, CairoSVG was using two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provided a malicious SVG, it could make CairoSVG get stuck processing the file for a very long time. * Fix marker positions for unclosed paths * Follow hint when only output_width or output_height is set * Handle opacity on raster images * Don’t crash when use tags reference unknown tags * Take care of the next letter when A/a is replaced by l * Fix misalignment in node.vertices - Updates for version 2.5.0. * Drop support of Python 3.5, add support of Python 3.9. * Add EPS export * Add background-color, negate-colors, and invert-images options * Improve support for font weights * Fix opacity of patterns and gradients * Support auto-start-reverse value for orient * Draw images contained in defs * Add Exif transposition support * Handle dominant-baseline * Support transform-origin Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2023-260=1 Package List: - openSUSE Backports SLE-15-SP5 (noarch): python3-CairoSVG-2.5.2-bp155.3.3.1 References: https://www.suse.com/security/cve/CVE-2021-21236.html https://www.suse.com/security/cve/CVE-2023-27586.html https://bugzilla.suse.com/1180648 https://bugzilla.suse.com/1209538

1 0