October 2024 - openSUSE Updates - openSUSE Mailing Lists

SUSE-SU-2024:3860-1: important: Security update for the Linux Kernel (Live Patch 13 for SLE 15 SP5)
by OPENSUSE-UPDATES 31 Oct '24

31 Oct '24

# Security update for the Linux Kernel (Live Patch 13 for SLE 15 SP5) Announcement ID: SUSE-SU-2024:3860-1 Release Date: 2024-10-31T16:33:36Z Rating: important References: * bsc#1223363 * bsc#1223683 * bsc#1225011 * bsc#1225012 * bsc#1225013 * bsc#1225099 * bsc#1225309 * bsc#1225311 * bsc#1225312 * bsc#1225739 * bsc#1225819 * bsc#1226325 * bsc#1226327 * bsc#1227471 * bsc#1228573 * bsc#1228786 Cross-References: * CVE-2021-47598 * CVE-2023-52752 * CVE-2023-52846 * CVE-2024-26828 * CVE-2024-26923 * CVE-2024-27398 * CVE-2024-35861 * CVE-2024-35862 * CVE-2024-35863 * CVE-2024-35864 * CVE-2024-35867 * CVE-2024-35905 * CVE-2024-36899 * CVE-2024-36964 * CVE-2024-40954 * CVE-2024-41059 CVSS scores: * CVE-2021-47598 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2021-47598 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-52752 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-52752 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-52846 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-26828 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H * CVE-2024-26923 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-27398 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-35861 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-35862 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-35863 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-35864 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-35867 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-35905 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-36899 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-36964 ( SUSE ): 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H * CVE-2024-40954 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-40954 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-41059 ( SUSE ): 7.3 CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2024-41059 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-41059 ( NVD ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H Affected Products: * openSUSE Leap 15.5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Live Patching 15-SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves 16 vulnerabilities can now be installed. ## Description: This update for the Linux Kernel 5.14.21-150500_55_62 fixes several issues. The following security issues were fixed: * CVE-2024-35905: Fixed int overflow for stack access size (bsc#1226327). * CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1227471). * CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1225011). * CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225819). * CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1225311). * CVE-2024-35867: Fixed potential UAF in cifs_stats_proc_show() (bsc#1225012). * CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1225309). * CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect() (bsc#1225312). * CVE-2024-36899: gpiolib: cdev: Fix use after free in lineinfo_changed_notify (bsc#1225739). * CVE-2024-40954: net: do not leave a dangling sk pointer, when socket creation fails (bsc#1227808) * CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228573). * CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1226325). * CVE-2023-52846: hsr: Prevent use after free in prp_create_tagged_frame() (bsc#1225099). * CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1225013). * CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683). * CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Live Patching 15-SP5 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP5-2024-3860=1 * openSUSE Leap 15.5 zypper in -t patch SUSE-2024-3860=1 ## Package List: * SUSE Linux Enterprise Live Patching 15-SP5 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150500_55_62-default-6-150500.11.6.1 * kernel-livepatch-5_14_21-150500_55_62-default-debuginfo-6-150500.11.6.1 * kernel-livepatch-SLE15-SP5_Update_13-debugsource-6-150500.11.6.1 * openSUSE Leap 15.5 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150500_55_62-default-6-150500.11.6.1 * kernel-livepatch-5_14_21-150500_55_62-default-debuginfo-6-150500.11.6.1 * kernel-livepatch-SLE15-SP5_Update_13-debugsource-6-150500.11.6.1 ## References: * https://www.suse.com/security/cve/CVE-2021-47598.html * https://www.suse.com/security/cve/CVE-2023-52752.html * https://www.suse.com/security/cve/CVE-2023-52846.html * https://www.suse.com/security/cve/CVE-2024-26828.html * https://www.suse.com/security/cve/CVE-2024-26923.html * https://www.suse.com/security/cve/CVE-2024-27398.html * https://www.suse.com/security/cve/CVE-2024-35861.html * https://www.suse.com/security/cve/CVE-2024-35862.html * https://www.suse.com/security/cve/CVE-2024-35863.html * https://www.suse.com/security/cve/CVE-2024-35864.html * https://www.suse.com/security/cve/CVE-2024-35867.html * https://www.suse.com/security/cve/CVE-2024-35905.html * https://www.suse.com/security/cve/CVE-2024-36899.html * https://www.suse.com/security/cve/CVE-2024-36964.html * https://www.suse.com/security/cve/CVE-2024-40954.html * https://www.suse.com/security/cve/CVE-2024-41059.html * https://bugzilla.suse.com/show_bug.cgi?id=1223363 * https://bugzilla.suse.com/show_bug.cgi?id=1223683 * https://bugzilla.suse.com/show_bug.cgi?id=1225011 * https://bugzilla.suse.com/show_bug.cgi?id=1225012 * https://bugzilla.suse.com/show_bug.cgi?id=1225013 * https://bugzilla.suse.com/show_bug.cgi?id=1225099 * https://bugzilla.suse.com/show_bug.cgi?id=1225309 * https://bugzilla.suse.com/show_bug.cgi?id=1225311 * https://bugzilla.suse.com/show_bug.cgi?id=1225312 * https://bugzilla.suse.com/show_bug.cgi?id=1225739 * https://bugzilla.suse.com/show_bug.cgi?id=1225819 * https://bugzilla.suse.com/show_bug.cgi?id=1226325 * https://bugzilla.suse.com/show_bug.cgi?id=1226327 * https://bugzilla.suse.com/show_bug.cgi?id=1227471 * https://bugzilla.suse.com/show_bug.cgi?id=1228573 * https://bugzilla.suse.com/show_bug.cgi?id=1228786

1 0

SUSE-SU-2024:3856-1: important: Security update for the Linux Kernel RT (Live Patch 17 for SLE 15 SP5)
by OPENSUSE-UPDATES 31 Oct '24

31 Oct '24

# Security update for the Linux Kernel RT (Live Patch 17 for SLE 15 SP5) Announcement ID: SUSE-SU-2024:3856-1 Release Date: 2024-10-31T14:33:37Z Rating: important References: * bsc#1227471 * bsc#1228349 * bsc#1228573 * bsc#1228786 Cross-References: * CVE-2021-47598 * CVE-2024-40909 * CVE-2024-40954 * CVE-2024-41059 CVSS scores: * CVE-2021-47598 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2021-47598 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-40909 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-40909 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-40954 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-40954 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-41059 ( SUSE ): 7.3 CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2024-41059 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-41059 ( NVD ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H Affected Products: * openSUSE Leap 15.5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Live Patching 15-SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves four vulnerabilities can now be installed. ## Description: This update for the Linux Kernel 5.14.21-150500_13_61 fixes several issues. The following security issues were fixed: * CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1227471). * CVE-2024-40954: net: do not leave a dangling sk pointer, when socket creation fails (bsc#1227808) * CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228573). * CVE-2024-40909: bpf: Fix a potential use-after-free in bpf_link_free() (bsc#1228349). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Live Patching 15-SP5 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP5-2024-3856=1 * openSUSE Leap 15.5 zypper in -t patch SUSE-2024-3856=1 ## Package List: * SUSE Linux Enterprise Live Patching 15-SP5 (x86_64) * kernel-livepatch-SLE15-SP5-RT_Update_17-debugsource-3-150500.11.6.1 * kernel-livepatch-5_14_21-150500_13_61-rt-3-150500.11.6.1 * kernel-livepatch-5_14_21-150500_13_61-rt-debuginfo-3-150500.11.6.1 * openSUSE Leap 15.5 (x86_64) * kernel-livepatch-SLE15-SP5-RT_Update_17-debugsource-3-150500.11.6.1 * kernel-livepatch-5_14_21-150500_13_61-rt-3-150500.11.6.1 * kernel-livepatch-5_14_21-150500_13_61-rt-debuginfo-3-150500.11.6.1 ## References: * https://www.suse.com/security/cve/CVE-2021-47598.html * https://www.suse.com/security/cve/CVE-2024-40909.html * https://www.suse.com/security/cve/CVE-2024-40954.html * https://www.suse.com/security/cve/CVE-2024-41059.html * https://bugzilla.suse.com/show_bug.cgi?id=1227471 * https://bugzilla.suse.com/show_bug.cgi?id=1228349 * https://bugzilla.suse.com/show_bug.cgi?id=1228573 * https://bugzilla.suse.com/show_bug.cgi?id=1228786

1 0

SUSE-SU-2024:3857-1: important: Security update for the Linux Kernel (Live Patch 14 for SLE 15 SP5)
by OPENSUSE-UPDATES 31 Oct '24

31 Oct '24

# Security update for the Linux Kernel (Live Patch 14 for SLE 15 SP5) Announcement ID: SUSE-SU-2024:3857-1 Release Date: 2024-10-31T15:04:06Z Rating: important References: * bsc#1223363 * bsc#1223683 * bsc#1225011 * bsc#1225012 * bsc#1225013 * bsc#1225099 * bsc#1225309 * bsc#1225311 * bsc#1225312 * bsc#1225739 * bsc#1225819 * bsc#1226325 * bsc#1226327 * bsc#1227471 * bsc#1228573 * bsc#1228786 Cross-References: * CVE-2021-47598 * CVE-2023-52752 * CVE-2023-52846 * CVE-2024-26828 * CVE-2024-26923 * CVE-2024-27398 * CVE-2024-35861 * CVE-2024-35862 * CVE-2024-35863 * CVE-2024-35864 * CVE-2024-35867 * CVE-2024-35905 * CVE-2024-36899 * CVE-2024-36964 * CVE-2024-40954 * CVE-2024-41059 CVSS scores: * CVE-2021-47598 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2021-47598 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-52752 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-52752 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-52846 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-26828 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H * CVE-2024-26923 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-27398 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-35861 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-35862 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-35863 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-35864 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-35867 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-35905 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-36899 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-36964 ( SUSE ): 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H * CVE-2024-40954 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-40954 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-41059 ( SUSE ): 7.3 CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2024-41059 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-41059 ( NVD ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H Affected Products: * openSUSE Leap 15.5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Live Patching 15-SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves 16 vulnerabilities can now be installed. ## Description: This update for the Linux Kernel 5.14.21-150500_55_65 fixes several issues. The following security issues were fixed: * CVE-2024-35905: Fixed int overflow for stack access size (bsc#1226327). * CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1227471). * CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1225011). * CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225819). * CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1225311). * CVE-2024-35867: Fixed potential UAF in cifs_stats_proc_show() (bsc#1225012). * CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1225309). * CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect() (bsc#1225312). * CVE-2024-36899: gpiolib: cdev: Fix use after free in lineinfo_changed_notify (bsc#1225739). * CVE-2024-40954: net: do not leave a dangling sk pointer, when socket creation fails (bsc#1227808) * CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228573). * CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1226325). * CVE-2023-52846: hsr: Prevent use after free in prp_create_tagged_frame() (bsc#1225099). * CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1225013). * CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683). * CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2024-3857=1 * SUSE Linux Enterprise Live Patching 15-SP5 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP5-2024-3857=1 ## Package List: * openSUSE Leap 15.5 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150500_55_65-default-debuginfo-6-150500.11.6.1 * kernel-livepatch-5_14_21-150500_55_65-default-6-150500.11.6.1 * kernel-livepatch-SLE15-SP5_Update_14-debugsource-6-150500.11.6.1 * SUSE Linux Enterprise Live Patching 15-SP5 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150500_55_65-default-debuginfo-6-150500.11.6.1 * kernel-livepatch-5_14_21-150500_55_65-default-6-150500.11.6.1 * kernel-livepatch-SLE15-SP5_Update_14-debugsource-6-150500.11.6.1 ## References: * https://www.suse.com/security/cve/CVE-2021-47598.html * https://www.suse.com/security/cve/CVE-2023-52752.html * https://www.suse.com/security/cve/CVE-2023-52846.html * https://www.suse.com/security/cve/CVE-2024-26828.html * https://www.suse.com/security/cve/CVE-2024-26923.html * https://www.suse.com/security/cve/CVE-2024-27398.html * https://www.suse.com/security/cve/CVE-2024-35861.html * https://www.suse.com/security/cve/CVE-2024-35862.html * https://www.suse.com/security/cve/CVE-2024-35863.html * https://www.suse.com/security/cve/CVE-2024-35864.html * https://www.suse.com/security/cve/CVE-2024-35867.html * https://www.suse.com/security/cve/CVE-2024-35905.html * https://www.suse.com/security/cve/CVE-2024-36899.html * https://www.suse.com/security/cve/CVE-2024-36964.html * https://www.suse.com/security/cve/CVE-2024-40954.html * https://www.suse.com/security/cve/CVE-2024-41059.html * https://bugzilla.suse.com/show_bug.cgi?id=1223363 * https://bugzilla.suse.com/show_bug.cgi?id=1223683 * https://bugzilla.suse.com/show_bug.cgi?id=1225011 * https://bugzilla.suse.com/show_bug.cgi?id=1225012 * https://bugzilla.suse.com/show_bug.cgi?id=1225013 * https://bugzilla.suse.com/show_bug.cgi?id=1225099 * https://bugzilla.suse.com/show_bug.cgi?id=1225309 * https://bugzilla.suse.com/show_bug.cgi?id=1225311 * https://bugzilla.suse.com/show_bug.cgi?id=1225312 * https://bugzilla.suse.com/show_bug.cgi?id=1225739 * https://bugzilla.suse.com/show_bug.cgi?id=1225819 * https://bugzilla.suse.com/show_bug.cgi?id=1226325 * https://bugzilla.suse.com/show_bug.cgi?id=1226327 * https://bugzilla.suse.com/show_bug.cgi?id=1227471 * https://bugzilla.suse.com/show_bug.cgi?id=1228573 * https://bugzilla.suse.com/show_bug.cgi?id=1228786

1 0

SUSE-SU-2024:3859-1: important: Security update for the Linux Kernel (Live Patch 8 for SLE 15 SP5)
by OPENSUSE-UPDATES 31 Oct '24

31 Oct '24

# Security update for the Linux Kernel (Live Patch 8 for SLE 15 SP5) Announcement ID: SUSE-SU-2024:3859-1 Release Date: 2024-10-31T15:34:40Z Rating: important References: * bsc#1225011 * bsc#1225012 * bsc#1225309 * bsc#1225311 * bsc#1225819 * bsc#1226327 * bsc#1227471 Cross-References: * CVE-2021-47598 * CVE-2023-52752 * CVE-2024-35862 * CVE-2024-35863 * CVE-2024-35864 * CVE-2024-35867 * CVE-2024-35905 CVSS scores: * CVE-2021-47598 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2021-47598 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-52752 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-52752 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-35862 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-35863 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-35864 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-35867 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-35905 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Live Patching 15-SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves seven vulnerabilities can now be installed. ## Description: This update for the Linux Kernel 5.14.21-150500_55_39 fixes several issues. The following security issues were fixed: * CVE-2024-35905: Fixed int overflow for stack access size (bsc#1226327). * CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1227471). * CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1225011). * CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225819). * CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1225311). * CVE-2024-35867: Fixed potential UAF in cifs_stats_proc_show() (bsc#1225012). * CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1225309). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2024-3859=1 SUSE-2024-3858=1 * SUSE Linux Enterprise Live Patching 15-SP5 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP5-2024-3859=1 SUSE-SLE- Module-Live-Patching-15-SP5-2024-3858=1 ## Package List: * openSUSE Leap 15.5 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150500_55_36-default-13-150500.2.1 * kernel-livepatch-SLE15-SP5_Update_8-debugsource-13-150500.2.1 * kernel-livepatch-5_14_21-150500_55_39-default-debuginfo-13-150500.2.1 * kernel-livepatch-5_14_21-150500_55_39-default-13-150500.2.1 * kernel-livepatch-SLE15-SP5_Update_7-debugsource-13-150500.2.1 * kernel-livepatch-5_14_21-150500_55_36-default-debuginfo-13-150500.2.1 * SUSE Linux Enterprise Live Patching 15-SP5 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150500_55_36-default-13-150500.2.1 * kernel-livepatch-SLE15-SP5_Update_8-debugsource-13-150500.2.1 * kernel-livepatch-5_14_21-150500_55_39-default-debuginfo-13-150500.2.1 * kernel-livepatch-5_14_21-150500_55_39-default-13-150500.2.1 * kernel-livepatch-SLE15-SP5_Update_7-debugsource-13-150500.2.1 * kernel-livepatch-5_14_21-150500_55_36-default-debuginfo-13-150500.2.1 ## References: * https://www.suse.com/security/cve/CVE-2021-47598.html * https://www.suse.com/security/cve/CVE-2023-52752.html * https://www.suse.com/security/cve/CVE-2024-35862.html * https://www.suse.com/security/cve/CVE-2024-35863.html * https://www.suse.com/security/cve/CVE-2024-35864.html * https://www.suse.com/security/cve/CVE-2024-35867.html * https://www.suse.com/security/cve/CVE-2024-35905.html * https://bugzilla.suse.com/show_bug.cgi?id=1225011 * https://bugzilla.suse.com/show_bug.cgi?id=1225012 * https://bugzilla.suse.com/show_bug.cgi?id=1225309 * https://bugzilla.suse.com/show_bug.cgi?id=1225311 * https://bugzilla.suse.com/show_bug.cgi?id=1225819 * https://bugzilla.suse.com/show_bug.cgi?id=1226327 * https://bugzilla.suse.com/show_bug.cgi?id=1227471

1 0

SUSE-SU-2024:3843-1: important: Security update for 389-ds
by OPENSUSE-UPDATES 31 Oct '24

31 Oct '24

# Security update for 389-ds Announcement ID: SUSE-SU-2024:3843-1 Release Date: 2024-10-31T08:50:13Z Rating: important References: * bsc#1230852 * bsc#1231462 Cross-References: * CVE-2024-2199 * CVE-2024-3657 * CVE-2024-5953 CVSS scores: * CVE-2024-2199 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2024-3657 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-3657 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-5953 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2024-5953 ( NVD ): 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: * openSUSE Leap 15.5 * Server Applications Module 15-SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves three vulnerabilities can now be installed. ## Description: This update for 389-ds fixes the following issues: * Persist extracted key path for ldap_ssl_client_init over repeat invocations (bsc#1230852) * Re-enable use of .dsrc basedn for dsidm commands (bsc#1231462) * Update to version 2.2.10~git18.20ce9289: * RFE: Use previously extracted key path * Update dsidm to prioritize basedn from .dsrc over interactive input * UI: Instance fails to load when DB backup directory doesn't exist * Improve online import robustness when the server is under load * Ensure all slapi_log_err calls end format strings with newline character \n * RFE: when memberof is enabled, defer updates of members from the update of the group * Provide more information in the error message during setup_ol_tls_conn() * Wrong set of entries returned for some search filters * Schema lib389 object is not keeping custom schema data upon editing * UI: Fix audit issue with npm - micromatch * Fix long delay when setting replication agreement with dsconf * Changelog trims updates from a given RID even if a consumer has not received any of them * test_password_modify_non_utf8 should set default password storage scheme * Update Cargo.lock * Rearrange includes for 32-bit support logic * Fix fedora cop RawHide builds * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console * Enabling replication for a sub suffix crashes browser * d2entry - Could not open id2entry err 0 - at startup when having sub- suffixes * Slow ldif2db import on a newly created BDB backend * Audit log buffering doesn't handle large updates * RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) * passwordHistory is not updated with a pre-hashed password * ns-slapd crash in referint_get_config * Fix the UTC offset print * Fix OpenLDAP version autodetection * RFE: add new operation note for MFA authentications * Add log buffering to audit log * Fix connection timeout error breaking errormap * Improve dsidm CLI No Such Entry handling * Improve connection timeout error logging * Add hidden -v and -j options to each CLI subcommand * Fix various issues with logconv.pl * Fix certificate lifetime displayed as NaN * Enhance Rust and JS bundling and add SPDX licenses for both * Remove audit-ci from dependencies * Fix unused variable warning from previous commit * covscan: fix memory leak in audit log when adding entries * Add a check for tagged commits * dscreate ds-root - accepts relative path * Change replica_id from str to int * Attribute Names changed to lowercase after adding the Attributes * ns-slapd crashes at startup if a backend has no suffix * During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it * Reversion of the entry cache should be limited to BETXN plugin failures * Disable Transparent Huge Pages * Freelist ordering causes high wtime * Security fix for CVE-2024-2199 * VUL-0: CVE-2024-3657: 389-ds: potential denial of service via specially crafted kerberos AS-REQ request (bsc#1225512) * VUL-0: CVE-2024-5953: 389-ds: malformed userPassword hashes may cause a denial of service (bsc#1226277) * 389ds crash when user does change password using iso-8859-1 encoding (bsc#1228912) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2024-3843=1 openSUSE-SLE-15.5-2024-3843=1 * Server Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP5-2024-3843=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * 389-ds-debuginfo-2.2.10~git18.20ce9289-150500.3.24.1 * 389-ds-devel-2.2.10~git18.20ce9289-150500.3.24.1 * libsvrcore0-2.2.10~git18.20ce9289-150500.3.24.1 * libsvrcore0-debuginfo-2.2.10~git18.20ce9289-150500.3.24.1 * 389-ds-debugsource-2.2.10~git18.20ce9289-150500.3.24.1 * 389-ds-snmp-2.2.10~git18.20ce9289-150500.3.24.1 * 389-ds-snmp-debuginfo-2.2.10~git18.20ce9289-150500.3.24.1 * lib389-2.2.10~git18.20ce9289-150500.3.24.1 * 389-ds-2.2.10~git18.20ce9289-150500.3.24.1 * Server Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64) * 389-ds-debuginfo-2.2.10~git18.20ce9289-150500.3.24.1 * 389-ds-devel-2.2.10~git18.20ce9289-150500.3.24.1 * libsvrcore0-2.2.10~git18.20ce9289-150500.3.24.1 * libsvrcore0-debuginfo-2.2.10~git18.20ce9289-150500.3.24.1 * 389-ds-debugsource-2.2.10~git18.20ce9289-150500.3.24.1 * lib389-2.2.10~git18.20ce9289-150500.3.24.1 * 389-ds-2.2.10~git18.20ce9289-150500.3.24.1 ## References: * https://www.suse.com/security/cve/CVE-2024-2199.html * https://www.suse.com/security/cve/CVE-2024-3657.html * https://www.suse.com/security/cve/CVE-2024-5953.html * https://bugzilla.suse.com/show_bug.cgi?id=1230852 * https://bugzilla.suse.com/show_bug.cgi?id=1231462

1 0

SUSE-SU-2024:3844-1: important: Security update for 389-ds
by OPENSUSE-UPDATES 31 Oct '24

31 Oct '24

# Security update for 389-ds Announcement ID: SUSE-SU-2024:3844-1 Release Date: 2024-10-31T08:50:28Z Rating: important References: * bsc#1225512 * bsc#1226277 * bsc#1228912 * bsc#1230852 * bsc#1231462 Cross-References: * CVE-2024-2199 * CVE-2024-3657 * CVE-2024-5953 CVSS scores: * CVE-2024-2199 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2024-3657 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-3657 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-5953 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2024-5953 ( NVD ): 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: * openSUSE Leap 15.6 * Server Applications Module 15-SP6 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 An update that solves three vulnerabilities and has two security fixes can now be installed. ## Description: This update for 389-ds fixes the following issues: * Persist extracted key path for ldap_ssl_client_init over repeat invocations (bsc#1230852) * Re-enable use of .dsrc basedn for dsidm commands (bsc#1231462) * Update to version 2.2.10~git18.20ce9289: * RFE: Use previously extracted key path * Update dsidm to prioritize basedn from .dsrc over interactive input * UI: Instance fails to load when DB backup directory doesn't exist * Improve online import robustness when the server is under load * Ensure all slapi_log_err calls end format strings with newline character \n * RFE: when memberof is enabled, defer updates of members from the update of the group * Provide more information in the error message during setup_ol_tls_conn() * Wrong set of entries returned for some search filters * Schema lib389 object is not keeping custom schema data upon editing * UI: Fix audit issue with npm - micromatch * Fix long delay when setting replication agreement with dsconf * Changelog trims updates from a given RID even if a consumer has not received any of them * test_password_modify_non_utf8 should set default password storage scheme * Update Cargo.lock * Rearrange includes for 32-bit support logic * Fix fedora cop RawHide builds * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console * Enabling replication for a sub suffix crashes browser * d2entry - Could not open id2entry err 0 - at startup when having sub- suffixes * Slow ldif2db import on a newly created BDB backend * Audit log buffering doesn't handle large updates * RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) * passwordHistory is not updated with a pre-hashed password * ns-slapd crash in referint_get_config * Fix the UTC offset print * Fix OpenLDAP version autodetection * RFE: add new operation note for MFA authentications * Add log buffering to audit log * Fix connection timeout error breaking errormap * Improve dsidm CLI No Such Entry handling * Improve connection timeout error logging * Add hidden -v and -j options to each CLI subcommand * Fix various issues with logconv.pl * Fix certificate lifetime displayed as NaN * Enhance Rust and JS bundling and add SPDX licenses for both * Remove audit-ci from dependencies * Fix unused variable warning from previous commit * covscan: fix memory leak in audit log when adding entries * Add a check for tagged commits * dscreate ds-root - accepts relative path * Change replica_id from str to int * Attribute Names changed to lowercase after adding the Attributes * ns-slapd crashes at startup if a backend has no suffix * During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it * Reversion of the entry cache should be limited to BETXN plugin failures * Disable Transparent Huge Pages * Freelist ordering causes high wtime * Security fix for CVE-2024-2199 * VUL-0: CVE-2024-3657: 389-ds: potential denial of service via specially crafted kerberos AS-REQ request (bsc#1225512) * VUL-0: CVE-2024-5953: 389-ds: malformed userPassword hashes may cause a denial of service (bsc#1226277) * 389ds crash when user does change password using iso-8859-1 encoding (bsc#1228912) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch SUSE-2024-3844=1 openSUSE-SLE-15.6-2024-3844=1 * Server Applications Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP6-2024-3844=1 ## Package List: * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64) * libsvrcore0-debuginfo-2.2.10~git18.20ce9289-150600.8.10.1 * 389-ds-debuginfo-2.2.10~git18.20ce9289-150600.8.10.1 * 389-ds-debugsource-2.2.10~git18.20ce9289-150600.8.10.1 * libsvrcore0-2.2.10~git18.20ce9289-150600.8.10.1 * 389-ds-snmp-2.2.10~git18.20ce9289-150600.8.10.1 * 389-ds-devel-2.2.10~git18.20ce9289-150600.8.10.1 * 389-ds-snmp-debuginfo-2.2.10~git18.20ce9289-150600.8.10.1 * 389-ds-2.2.10~git18.20ce9289-150600.8.10.1 * lib389-2.2.10~git18.20ce9289-150600.8.10.1 * Server Applications Module 15-SP6 (aarch64 ppc64le s390x x86_64) * libsvrcore0-debuginfo-2.2.10~git18.20ce9289-150600.8.10.1 * 389-ds-debuginfo-2.2.10~git18.20ce9289-150600.8.10.1 * 389-ds-debugsource-2.2.10~git18.20ce9289-150600.8.10.1 * libsvrcore0-2.2.10~git18.20ce9289-150600.8.10.1 * 389-ds-devel-2.2.10~git18.20ce9289-150600.8.10.1 * 389-ds-2.2.10~git18.20ce9289-150600.8.10.1 * lib389-2.2.10~git18.20ce9289-150600.8.10.1 ## References: * https://www.suse.com/security/cve/CVE-2024-2199.html * https://www.suse.com/security/cve/CVE-2024-3657.html * https://www.suse.com/security/cve/CVE-2024-5953.html * https://bugzilla.suse.com/show_bug.cgi?id=1225512 * https://bugzilla.suse.com/show_bug.cgi?id=1226277 * https://bugzilla.suse.com/show_bug.cgi?id=1228912 * https://bugzilla.suse.com/show_bug.cgi?id=1230852 * https://bugzilla.suse.com/show_bug.cgi?id=1231462

1 0

SUSE-RU-2024:3845-1: moderate: Recommended update for sof-firmware
by OPENSUSE-UPDATES 31 Oct '24

31 Oct '24

# Recommended update for sof-firmware Announcement ID: SUSE-RU-2024:3845-1 Release Date: 2024-10-31T09:47:23Z Rating: moderate References: * bsc#1230236 * jsc#PED-10202 * jsc#PED-9993 Affected Products: * Desktop Applications Module 15-SP6 * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 An update that contains two features and has one fix can now be installed. ## Description: This update for sof-firmware fixes the following issues: * update to v2024.09 ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2024-3845=1 SUSE-2024-3845=1 * Desktop Applications Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP6-2024-3845=1 ## Package List: * openSUSE Leap 15.6 (noarch) * sof-firmware-2024.09-150600.3.3.1 * Desktop Applications Module 15-SP6 (noarch) * sof-firmware-2024.09-150600.3.3.1 ## References: * https://bugzilla.suse.com/show_bug.cgi?id=1230236 * https://jira.suse.com/browse/PED-10202 * https://jira.suse.com/browse/PED-9993

1 0

SUSE-RU-2024:3846-1: moderate: Recommended update for gnutls
by OPENSUSE-UPDATES 31 Oct '24

31 Oct '24

# Recommended update for gnutls Announcement ID: SUSE-RU-2024:3846-1 Release Date: 2024-10-31T10:07:18Z Rating: moderate References: * bsc#1226724 * bsc#1226731 * bsc#1226733 * bsc#1227642 * bsc#1227669 * bsc#1227670 * bsc#1227671 * bsc#1230166 Affected Products: * Basesystem Module 15-SP6 * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 An update that has eight fixes can now be installed. ## Description: This update for gnutls fixes the following issues: * FIPS: Do not allow curve P-192 for signature or keypair verification [bsc#1227669] * FIPS: Allow to perform the integrity check with the hmac provided by each library [bsc#1226724] * FIPS: Mark gnutls_hash_fast operations as approved in SLI. [bsc#1230166] * FIPS: Run pairwise consistency test only in FIPS mode. [bsc#1226733] * FIPS: Use full hash+sign operations, not low level primitives in PCT test. [bsc#1226733] * FIPS: Mark SHA1 as not allowed for signature verification in both RSA and ECDSA sigVer. [bsc#1227642] * FIPS: Allow RSA signature verification with min of 2048 bit modulus. [bsc#1227670] * FIPS: Remove not needed DSA in selfchecks in FIPS mode. [bsc#1227671, bsc#1226731] ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch SUSE-2024-3846=1 openSUSE-SLE-15.6-2024-3846=1 * Basesystem Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP6-2024-3846=1 ## Package List: * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586) * libgnutlsxx30-debuginfo-3.8.3-150600.4.3.1 * libgnutlsxx30-3.8.3-150600.4.3.1 * gnutls-debugsource-3.8.3-150600.4.3.1 * gnutls-3.8.3-150600.4.3.1 * libgnutls-devel-3.8.3-150600.4.3.1 * gnutls-debuginfo-3.8.3-150600.4.3.1 * libgnutls30-debuginfo-3.8.3-150600.4.3.1 * libgnutlsxx-devel-3.8.3-150600.4.3.1 * libgnutls30-3.8.3-150600.4.3.1 * openSUSE Leap 15.6 (x86_64) * libgnutls30-32bit-3.8.3-150600.4.3.1 * libgnutls30-32bit-debuginfo-3.8.3-150600.4.3.1 * libgnutls-devel-32bit-3.8.3-150600.4.3.1 * openSUSE Leap 15.6 (aarch64_ilp32) * libgnutls30-64bit-3.8.3-150600.4.3.1 * libgnutls30-64bit-debuginfo-3.8.3-150600.4.3.1 * libgnutls-devel-64bit-3.8.3-150600.4.3.1 * Basesystem Module 15-SP6 (aarch64 ppc64le s390x x86_64) * libgnutlsxx30-debuginfo-3.8.3-150600.4.3.1 * libgnutlsxx30-3.8.3-150600.4.3.1 * gnutls-debugsource-3.8.3-150600.4.3.1 * gnutls-3.8.3-150600.4.3.1 * gnutls-debuginfo-3.8.3-150600.4.3.1 * libgnutls30-debuginfo-3.8.3-150600.4.3.1 * libgnutls30-3.8.3-150600.4.3.1 * libgnutlsxx-devel-3.8.3-150600.4.3.1 * libgnutls-devel-3.8.3-150600.4.3.1 * Basesystem Module 15-SP6 (x86_64) * libgnutls30-32bit-3.8.3-150600.4.3.1 * libgnutls30-32bit-debuginfo-3.8.3-150600.4.3.1 ## References: * https://bugzilla.suse.com/show_bug.cgi?id=1226724 * https://bugzilla.suse.com/show_bug.cgi?id=1226731 * https://bugzilla.suse.com/show_bug.cgi?id=1226733 * https://bugzilla.suse.com/show_bug.cgi?id=1227642 * https://bugzilla.suse.com/show_bug.cgi?id=1227669 * https://bugzilla.suse.com/show_bug.cgi?id=1227670 * https://bugzilla.suse.com/show_bug.cgi?id=1227671 * https://bugzilla.suse.com/show_bug.cgi?id=1230166

1 0

SUSE-RU-2024:3847-1: moderate: Recommended update for tpm2-openssl
by OPENSUSE-UPDATES 31 Oct '24

31 Oct '24

# Recommended update for tpm2-openssl Announcement ID: SUSE-RU-2024:3847-1 Release Date: 2024-10-31T10:07:28Z Rating: moderate References: * bsc#1222899 * jsc#PED-11053 Affected Products: * Basesystem Module 15-SP6 * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 An update that contains one feature and has one fix can now be installed. ## Description: This update for tpm2-openssl fixes the following issues: This update ships tpm2-openssl. (bsc#1222899, jsc#PED-11053) Added: * Added support for ECDH with a KDF, which is used by ECC-based CMS (S/MIME). * Added retrieval of OSSL_PKEY_PARAM_ENCODED_PUBLIC_KEY for EC keys and retrieval of TLS-GROUP provider capabilities to enable mTLS authentication (thanks to @rshearman). * Added mTLS example to documentation (thanks to @hoinmic). * Added missing RAND parameters: 'state' and 'strength' (thanks to @mccarey). * Added ability to run tests in a container (thanks to @afreof). * Added Visual Studio properties to simplify the Windows build (thanks to @philippun1). Changed: * Symmetric operations are disabled by default. In most situations these are not needed and cause a huge performance penalty. To enable, configure with --enable-op-digest or \--enable-op-cipher. Removed: * Removed unofficial support for tpm2-tss < 3.2.0, which do not support the openssl 3.x. Fixed: * Fixed key export: the private keys are not exportable, which shall fix some TPM-based sign operations (thanks to @fhars). * Fixed handle related operations on 32b machines (thanks to @dezgeg). * Fixed OSSL_FUNC_KEYMGMT_HAS operations with NULL keys. * Fixed a heap exception on some machines (thanks to @philippun1). * Fixed build warnings when building on the Fedora Linux. * In documentation and tests applied a correct order of providers (thanks to @hoinmic). * Modified documentation: the user-space resource manager (abrmd) is almost mandatory for complex scenarios such as SSL or X.509 operations. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch SUSE-2024-3847=1 openSUSE-SLE-15.6-2024-3847=1 * Basesystem Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP6-2024-3847=1 ## Package List: * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586) * tpm2-openssl-1.2.0-150600.13.3.1 * tpm2-openssl-debuginfo-1.2.0-150600.13.3.1 * tpm2-openssl-debugsource-1.2.0-150600.13.3.1 * Basesystem Module 15-SP6 (aarch64 ppc64le s390x x86_64) * tpm2-openssl-1.2.0-150600.13.3.1 * tpm2-openssl-debuginfo-1.2.0-150600.13.3.1 * tpm2-openssl-debugsource-1.2.0-150600.13.3.1 ## References: * https://bugzilla.suse.com/show_bug.cgi?id=1222899 * https://jira.suse.com/browse/PED-11053

1 0

SUSE-SU-2024:3853-1: moderate: Security update for uwsgi
by OPENSUSE-UPDATES 31 Oct '24

31 Oct '24

# Security update for uwsgi Announcement ID: SUSE-SU-2024:3853-1 Release Date: 2024-10-31T11:01:18Z Rating: moderate References: * bsc#1222332 Cross-References: * CVE-2024-24795 CVSS scores: * CVE-2024-24795 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affected Products: * openSUSE Leap 15.3 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Package Hub 15 15-SP5 * SUSE Package Hub 15 15-SP6 An update that solves one vulnerability can now be installed. ## Description: This update for uwsgi fixes the following issues: * CVE-2024-24795: Fixed HTTP Response Splitting in multiple modules (bsc#1222332) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.3 zypper in -t patch SUSE-2024-3853=1 * SUSE Package Hub 15 15-SP5 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2024-3853=1 * SUSE Package Hub 15 15-SP6 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2024-3853=1 ## Package List: * openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64 i586) * uwsgi-sqlite3-debuginfo-2.0.19.1-150300.3.3.1 * uwsgi-debuginfo-2.0.19.1-150300.3.3.1 * uwsgi-ldap-2.0.19.1-150300.3.3.1 * uwsgi-pypy-debuginfo-2.0.19.1-150300.3.3.1 * uwsgi-2.0.19.1-150300.3.3.1 * uwsgi-python3-2.0.19.1-150300.3.3.1 * uwsgi-glusterfs-2.0.19.1-150300.3.3.1 * uwsgi-libffi-debuginfo-2.0.19.1-150300.3.3.1 * uwsgi-pypy-2.0.19.1-150300.3.3.1 * uwsgi-emperor_pg-2.0.19.1-150300.3.3.1 * uwsgi-logzmq-2.0.19.1-150300.3.3.1 * uwsgi-xslt-2.0.19.1-150300.3.3.1 * uwsgi-emperor_zeromq-2.0.19.1-150300.3.3.1 * uwsgi-lua-debuginfo-2.0.19.1-150300.3.3.1 * uwsgi-sqlite3-2.0.19.1-150300.3.3.1 * uwsgi-python3-debuginfo-2.0.19.1-150300.3.3.1 * uwsgi-php7-debuginfo-2.0.19.1-150300.3.3.1 * uwsgi-jvm-2.0.19.1-150300.3.3.1 * uwsgi-php7-2.0.19.1-150300.3.3.1 * uwsgi-debugsource-2.0.19.1-150300.3.3.1 * uwsgi-greenlet-debuginfo-2.0.19.1-150300.3.3.1 * uwsgi-logzmq-debuginfo-2.0.19.1-150300.3.3.1 * uwsgi-emperor_zeromq-debuginfo-2.0.19.1-150300.3.3.1 * apache2-mod_uwsgi-debuginfo-2.0.19.1-150300.3.3.1 * uwsgi-libffi-2.0.19.1-150300.3.3.1 * uwsgi-python-2.0.19.1-150300.3.3.1 * uwsgi-psgi-2.0.19.1-150300.3.3.1 * uwsgi-lua-2.0.19.1-150300.3.3.1 * uwsgi-pam-debuginfo-2.0.19.1-150300.3.3.1 * uwsgi-gevent-2.0.19.1-150300.3.3.1 * uwsgi-psgi-debuginfo-2.0.19.1-150300.3.3.1 * uwsgi-emperor_pg-debuginfo-2.0.19.1-150300.3.3.1 * uwsgi-python-debuginfo-2.0.19.1-150300.3.3.1 * uwsgi-pam-2.0.19.1-150300.3.3.1 * uwsgi-xslt-debuginfo-2.0.19.1-150300.3.3.1 * uwsgi-greenlet-2.0.19.1-150300.3.3.1 * apache2-mod_uwsgi-2.0.19.1-150300.3.3.1 * uwsgi-glusterfs-debuginfo-2.0.19.1-150300.3.3.1 * uwsgi-gevent-debuginfo-2.0.19.1-150300.3.3.1 * uwsgi-jvm-debuginfo-2.0.19.1-150300.3.3.1 * uwsgi-ldap-debuginfo-2.0.19.1-150300.3.3.1 * SUSE Package Hub 15 15-SP5 (aarch64 ppc64le s390x x86_64) * uwsgi-python-debuginfo-2.0.19.1-150300.3.3.1 * uwsgi-debuginfo-2.0.19.1-150300.3.3.1 * uwsgi-python-2.0.19.1-150300.3.3.1 * uwsgi-debugsource-2.0.19.1-150300.3.3.1 * SUSE Package Hub 15 15-SP6 (aarch64 ppc64le s390x x86_64) * uwsgi-python-debuginfo-2.0.19.1-150300.3.3.1 * uwsgi-debuginfo-2.0.19.1-150300.3.3.1 * uwsgi-python-2.0.19.1-150300.3.3.1 * uwsgi-debugsource-2.0.19.1-150300.3.3.1 ## References: * https://www.suse.com/security/cve/CVE-2024-24795.html * https://bugzilla.suse.com/show_bug.cgi?id=1222332

1 0