February 2024 - openSUSE Updates - openSUSE Mailing Lists

SUSE-RU-2024:0432-1: moderate: Recommended update for obs-service-kiwi_metainfo_helper
by OPENSUSE-UPDATES 08 Feb '24

08 Feb '24

# Recommended update for obs-service-kiwi_metainfo_helper Announcement ID: SUSE-RU-2024:0432-1 Rating: moderate References: Affected Products: * openSUSE Leap 15.5 An update that can now be installed. ## Description: This update for obs-service-kiwi_metainfo_helper fixes the following issues: * Replace %ARCH% with the architecture in images for supporting subscriptions in SCC based on architectures * cpio on SLE12 does not support -D option, emulate it ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-432=1 ## Package List: * openSUSE Leap 15.5 (noarch) * obs-service-kiwi_metainfo_helper-0.6-150000.1.21.1

1 0

SUSE-SU-2024:0429-1: important: Security update for the Linux Kernel (Live Patch 21 for SLE 15 SP4)
by OPENSUSE-UPDATES 08 Feb '24

08 Feb '24

# Security update for the Linux Kernel (Live Patch 21 for SLE 15 SP4) Announcement ID: SUSE-SU-2024:0429-1 Rating: important References: * bsc#1218255 Cross-References: * CVE-2023-6932 CVSS scores: * CVE-2023-6932 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-6932 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise Live Patching 15-SP4 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 An update that solves one vulnerability can now be installed. ## Description: This update for the Linux Kernel 5.14.21-150400_24_100 fixes one issue. The following security issue was fixed: * CVE-2023-6932: Fixed a use-after-free vulnerability in the ipv4 igmp component that could lead to local privilege escalation (bsc#1218255). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Live Patching 15-SP4 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP4-2024-429=1 * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-429=1 ## Package List: * SUSE Linux Enterprise Live Patching 15-SP4 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150400_24_100-default-2-150400.2.1 * kernel-livepatch-SLE15-SP4_Update_21-debugsource-2-150400.2.1 * kernel-livepatch-5_14_21-150400_24_100-default-debuginfo-2-150400.2.1 * openSUSE Leap 15.4 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150400_24_100-default-2-150400.2.1 * kernel-livepatch-SLE15-SP4_Update_21-debugsource-2-150400.2.1 * kernel-livepatch-5_14_21-150400_24_100-default-debuginfo-2-150400.2.1 ## References: * https://www.suse.com/security/cve/CVE-2023-6932.html * https://bugzilla.suse.com/show_bug.cgi?id=1218255

1 0

SUSE-SU-2024:0423-1: important: Security update for libavif
by OPENSUSE-UPDATES 08 Feb '24

08 Feb '24

# Security update for libavif Announcement ID: SUSE-SU-2024:0423-1 Rating: important References: * bsc#1218303 Cross-References: * CVE-2023-6704 CVSS scores: * CVE-2023-6704 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-6704 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves one vulnerability can now be installed. ## Description: This update for libavif fixes the following issues: * CVE-2023-6704: Fixed use after free by not storing colorproperties until alpha item is found (bsc#1218303). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-423=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-423=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2024-423=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-423=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-423=1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-423=1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-423=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-423=1 * SUSE Manager Proxy 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2024-423=1 * SUSE Manager Retail Branch Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.3-2024-423=1 * SUSE Manager Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.3-2024-423=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * libavif-debugsource-0.9.3-150400.3.3.1 * libavif-devel-0.9.3-150400.3.3.1 * gdk-pixbuf-loader-libavif-debuginfo-0.9.3-150400.3.3.1 * gdk-pixbuf-loader-libavif-0.9.3-150400.3.3.1 * libavif13-0.9.3-150400.3.3.1 * libavif13-debuginfo-0.9.3-150400.3.3.1 * avif-tools-debuginfo-0.9.3-150400.3.3.1 * avif-tools-0.9.3-150400.3.3.1 * openSUSE Leap 15.4 (x86_64) * libavif13-32bit-debuginfo-0.9.3-150400.3.3.1 * libavif13-32bit-0.9.3-150400.3.3.1 * openSUSE Leap 15.4 (aarch64_ilp32) * libavif13-64bit-debuginfo-0.9.3-150400.3.3.1 * libavif13-64bit-0.9.3-150400.3.3.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * libavif-debugsource-0.9.3-150400.3.3.1 * libavif-devel-0.9.3-150400.3.3.1 * gdk-pixbuf-loader-libavif-debuginfo-0.9.3-150400.3.3.1 * gdk-pixbuf-loader-libavif-0.9.3-150400.3.3.1 * libavif13-0.9.3-150400.3.3.1 * libavif13-debuginfo-0.9.3-150400.3.3.1 * avif-tools-debuginfo-0.9.3-150400.3.3.1 * avif-tools-0.9.3-150400.3.3.1 * openSUSE Leap 15.5 (x86_64) * libavif13-32bit-debuginfo-0.9.3-150400.3.3.1 * libavif13-32bit-0.9.3-150400.3.3.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * libavif-debugsource-0.9.3-150400.3.3.1 * libavif13-0.9.3-150400.3.3.1 * libavif13-debuginfo-0.9.3-150400.3.3.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * libavif-debugsource-0.9.3-150400.3.3.1 * libavif13-0.9.3-150400.3.3.1 * libavif13-debuginfo-0.9.3-150400.3.3.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * libavif-debugsource-0.9.3-150400.3.3.1 * libavif13-0.9.3-150400.3.3.1 * libavif13-debuginfo-0.9.3-150400.3.3.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (x86_64) * libavif-debugsource-0.9.3-150400.3.3.1 * libavif13-0.9.3-150400.3.3.1 * libavif13-debuginfo-0.9.3-150400.3.3.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (aarch64 ppc64le s390x x86_64) * libavif-debugsource-0.9.3-150400.3.3.1 * libavif13-0.9.3-150400.3.3.1 * libavif13-debuginfo-0.9.3-150400.3.3.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * libavif-debugsource-0.9.3-150400.3.3.1 * libavif13-0.9.3-150400.3.3.1 * libavif13-debuginfo-0.9.3-150400.3.3.1 * SUSE Manager Proxy 4.3 (x86_64) * libavif-debugsource-0.9.3-150400.3.3.1 * libavif13-0.9.3-150400.3.3.1 * libavif13-debuginfo-0.9.3-150400.3.3.1 * SUSE Manager Retail Branch Server 4.3 (x86_64) * libavif-debugsource-0.9.3-150400.3.3.1 * libavif13-0.9.3-150400.3.3.1 * libavif13-debuginfo-0.9.3-150400.3.3.1 * SUSE Manager Server 4.3 (ppc64le s390x x86_64) * libavif-debugsource-0.9.3-150400.3.3.1 * libavif13-0.9.3-150400.3.3.1 * libavif13-debuginfo-0.9.3-150400.3.3.1 ## References: * https://www.suse.com/security/cve/CVE-2023-6704.html * https://bugzilla.suse.com/show_bug.cgi?id=1218303

1 0

SUSE-RU-2024:0424-1: moderate: Recommended update for python3-M2Crypto
by OPENSUSE-UPDATES 08 Feb '24

08 Feb '24

# Recommended update for python3-M2Crypto Announcement ID: SUSE-RU-2024:0424-1 Rating: moderate References: * bsc#1205042 * bsc#1212757 * bsc#1217782 Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * openSUSE Leap Micro 5.3 * openSUSE Leap Micro 5.4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that has three fixes can now be installed. ## Description: This update for python3-M2Crypto fixes the following issues: * Packaging changes (bsc#1217782, bsc#1212757) * Set OpenSSL 3.0 as the default openssl in Tumbleweed (bsc#1205042) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-424=1 * openSUSE Leap Micro 5.3 zypper in -t patch openSUSE-Leap-Micro-5.3-2024-424=1 * openSUSE Leap Micro 5.4 zypper in -t patch openSUSE-Leap-Micro-5.4-2024-424=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-424=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2024-424=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2024-424=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2024-424=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2024-424=1 * SUSE Linux Enterprise Micro 5.5 zypper in -t patch SUSE-SLE-Micro-5.5-2024-424=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2024-424=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * python3-M2Crypto-debuginfo-0.38.0-150400.10.1 * python3-M2Crypto-debugsource-0.38.0-150400.10.1 * python3-M2Crypto-0.38.0-150400.10.1 * openSUSE Leap 15.4 (noarch) * python3-M2Crypto-doc-0.38.0-150400.10.1 * openSUSE Leap Micro 5.3 (aarch64 ppc64le s390x x86_64) * python3-M2Crypto-debuginfo-0.38.0-150400.10.1 * python3-M2Crypto-debugsource-0.38.0-150400.10.1 * python3-M2Crypto-0.38.0-150400.10.1 * openSUSE Leap Micro 5.4 (aarch64 ppc64le s390x x86_64) * python3-M2Crypto-debuginfo-0.38.0-150400.10.1 * python3-M2Crypto-debugsource-0.38.0-150400.10.1 * python3-M2Crypto-0.38.0-150400.10.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * python3-M2Crypto-debuginfo-0.38.0-150400.10.1 * python3-M2Crypto-debugsource-0.38.0-150400.10.1 * python3-M2Crypto-0.38.0-150400.10.1 * openSUSE Leap 15.5 (noarch) * python3-M2Crypto-doc-0.38.0-150400.10.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64) * python3-M2Crypto-debuginfo-0.38.0-150400.10.1 * python3-M2Crypto-debugsource-0.38.0-150400.10.1 * python3-M2Crypto-0.38.0-150400.10.1 * SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64) * python3-M2Crypto-debuginfo-0.38.0-150400.10.1 * python3-M2Crypto-debugsource-0.38.0-150400.10.1 * python3-M2Crypto-0.38.0-150400.10.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64) * python3-M2Crypto-debuginfo-0.38.0-150400.10.1 * python3-M2Crypto-debugsource-0.38.0-150400.10.1 * python3-M2Crypto-0.38.0-150400.10.1 * SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64) * python3-M2Crypto-debuginfo-0.38.0-150400.10.1 * python3-M2Crypto-debugsource-0.38.0-150400.10.1 * python3-M2Crypto-0.38.0-150400.10.1 * SUSE Linux Enterprise Micro 5.5 (aarch64 s390x x86_64) * python3-M2Crypto-debuginfo-0.38.0-150400.10.1 * python3-M2Crypto-debugsource-0.38.0-150400.10.1 * python3-M2Crypto-0.38.0-150400.10.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * python3-M2Crypto-debuginfo-0.38.0-150400.10.1 * python3-M2Crypto-debugsource-0.38.0-150400.10.1 * python3-M2Crypto-0.38.0-150400.10.1 ## References: * https://bugzilla.suse.com/show_bug.cgi?id=1205042 * https://bugzilla.suse.com/show_bug.cgi?id=1212757 * https://bugzilla.suse.com/show_bug.cgi?id=1217782

1 0

SUSE-RU-2024:0427-1: moderate: Recommended update for supportutils
by OPENSUSE-UPDATES 08 Feb '24

08 Feb '24

# Recommended update for supportutils Announcement ID: SUSE-RU-2024:0427-1 Rating: moderate References: * bsc#1183663 * bsc#1193173 * bsc#1196293 * bsc#1211547 * bsc#1216049 * bsc#1216388 * bsc#1216390 * bsc#1216522 * bsc#1216827 * bsc#1217287 * bsc#1218201 * bsc#1218282 Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.3 * openSUSE Leap 15.5 * openSUSE Leap Micro 5.3 * openSUSE Leap Micro 5.4 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Micro 5.1 * SUSE Linux Enterprise Micro 5.2 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Micro for Rancher 5.2 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that has 12 fixes can now be installed. ## Description: This update for supportutils fixes the following issues: * Update to version 3.1.28 * Correctly detects Xen Dom0 (bsc#1218201) * Fixed smart disk error (bsc#1218282) * Remove supportutils requires for util-linux-systemd and kmod (bsc#1193173) * Added missing klp information to kernel-livepatch.txt (bsc#1216390) * Fixed plugins creating empty files when using supportconfig.rc (bsc#1216388) * Provides long listing for /etc/sssd/sssd.conf (bsc#1211547) * Optimize lsof usage (bsc#1183663) * Collects chrony or ntp as needed (bsc#1196293) * Fixed podman display issue (bsc#1217287) * Added nvme-stas configuration to nvme.txt (bsc#1216049) * Added timed command to fs-files.txt (bsc#1216827) * Collects zypp history file issue#166 (bsc#1216522) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.3 zypper in -t patch SUSE-2024-427=1 * openSUSE Leap Micro 5.3 zypper in -t patch openSUSE-Leap-Micro-5.3-2024-427=1 * openSUSE Leap Micro 5.4 zypper in -t patch openSUSE-Leap-Micro-5.4-2024-427=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-427=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2024-427=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2024-427=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2024-427=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2024-427=1 * SUSE Linux Enterprise Micro 5.5 zypper in -t patch SUSE-SLE-Micro-5.5-2024-427=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2024-427=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-427=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-427=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-427=1 * SUSE Linux Enterprise Real Time 15 SP4 zypper in -t patch SUSE-SLE-Product-RT-15-SP4-2024-427=1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-427=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-427=1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-427=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-427=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-427=1 * SUSE Manager Proxy 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2024-427=1 * SUSE Manager Retail Branch Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.3-2024-427=1 * SUSE Manager Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.3-2024-427=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2024-427=1 * SUSE Linux Enterprise Micro 5.1 zypper in -t patch SUSE-SUSE-MicroOS-5.1-2024-427=1 * SUSE Linux Enterprise Micro 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2024-427=1 * SUSE Linux Enterprise Micro for Rancher 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2024-427=1 ## Package List: * openSUSE Leap 15.3 (noarch) * supportutils-3.1.28-150300.7.35.24.1 * openSUSE Leap Micro 5.3 (noarch) * supportutils-3.1.28-150300.7.35.24.1 * openSUSE Leap Micro 5.4 (noarch) * supportutils-3.1.28-150300.7.35.24.1 * openSUSE Leap 15.5 (noarch) * supportutils-3.1.28-150300.7.35.24.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (noarch) * supportutils-3.1.28-150300.7.35.24.1 * SUSE Linux Enterprise Micro 5.3 (noarch) * supportutils-3.1.28-150300.7.35.24.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (noarch) * supportutils-3.1.28-150300.7.35.24.1 * SUSE Linux Enterprise Micro 5.4 (noarch) * supportutils-3.1.28-150300.7.35.24.1 * SUSE Linux Enterprise Micro 5.5 (noarch) * supportutils-3.1.28-150300.7.35.24.1 * Basesystem Module 15-SP5 (noarch) * supportutils-3.1.28-150300.7.35.24.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch) * supportutils-3.1.28-150300.7.35.24.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch) * supportutils-3.1.28-150300.7.35.24.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch) * supportutils-3.1.28-150300.7.35.24.1 * SUSE Linux Enterprise Real Time 15 SP4 (noarch) * supportutils-3.1.28-150300.7.35.24.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (noarch) * supportutils-3.1.28-150300.7.35.24.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (noarch) * supportutils-3.1.28-150300.7.35.24.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (noarch) * supportutils-3.1.28-150300.7.35.24.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (noarch) * supportutils-3.1.28-150300.7.35.24.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch) * supportutils-3.1.28-150300.7.35.24.1 * SUSE Manager Proxy 4.3 (noarch) * supportutils-3.1.28-150300.7.35.24.1 * SUSE Manager Retail Branch Server 4.3 (noarch) * supportutils-3.1.28-150300.7.35.24.1 * SUSE Manager Server 4.3 (noarch) * supportutils-3.1.28-150300.7.35.24.1 * SUSE Enterprise Storage 7.1 (noarch) * supportutils-3.1.28-150300.7.35.24.1 * SUSE Linux Enterprise Micro 5.1 (noarch) * supportutils-3.1.28-150300.7.35.24.1 * SUSE Linux Enterprise Micro 5.2 (noarch) * supportutils-3.1.28-150300.7.35.24.1 * SUSE Linux Enterprise Micro for Rancher 5.2 (noarch) * supportutils-3.1.28-150300.7.35.24.1 ## References: * https://bugzilla.suse.com/show_bug.cgi?id=1183663 * https://bugzilla.suse.com/show_bug.cgi?id=1193173 * https://bugzilla.suse.com/show_bug.cgi?id=1196293 * https://bugzilla.suse.com/show_bug.cgi?id=1211547 * https://bugzilla.suse.com/show_bug.cgi?id=1216049 * https://bugzilla.suse.com/show_bug.cgi?id=1216388 * https://bugzilla.suse.com/show_bug.cgi?id=1216390 * https://bugzilla.suse.com/show_bug.cgi?id=1216522 * https://bugzilla.suse.com/show_bug.cgi?id=1216827 * https://bugzilla.suse.com/show_bug.cgi?id=1217287 * https://bugzilla.suse.com/show_bug.cgi?id=1218201 * https://bugzilla.suse.com/show_bug.cgi?id=1218282

1 0

SUSE-SU-2024:0414-1: important: Security update for the Linux Kernel (Live Patch 8 for SLE 15 SP4)
by OPENSUSE-UPDATES 07 Feb '24

07 Feb '24

# Security update for the Linux Kernel (Live Patch 8 for SLE 15 SP4) Announcement ID: SUSE-SU-2024:0414-1 Rating: important References: * bsc#1216044 * bsc#1217522 * bsc#1218255 Cross-References: * CVE-2023-5178 * CVE-2023-6176 * CVE-2023-6932 CVSS scores: * CVE-2023-5178 ( SUSE ): 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H * CVE-2023-5178 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2023-6176 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-6176 ( NVD ): 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2023-6932 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-6932 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise Live Patching 15-SP4 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 An update that solves three vulnerabilities can now be installed. ## Description: This update for the Linux Kernel 5.14.21-150400_24_46 fixes several issues. The following security issues were fixed: * CVE-2023-6932: Fixed a use-after-free vulnerability in the ipv4 igmp component that could lead to local privilege escalation (bsc#1218255). * CVE-2023-6176: Fixed a denial of service in the cryptographic algorithm scatterwalk functionality (bsc#1217522). * CVE-2023-5178: Fixed a use-after-free vulnerability in queue intialization setup (bsc#1215768). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Live Patching 15-SP4 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP4-2024-412=1 SUSE-SLE- Module-Live-Patching-15-SP4-2024-414=1 SUSE-SLE-Module-Live- Patching-15-SP4-2024-413=1 * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-414=1 SUSE-2024-413=1 SUSE-2024-412=1 ## Package List: * SUSE Linux Enterprise Live Patching 15-SP4 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150400_24_46-default-debuginfo-11-150400.2.2 * kernel-livepatch-SLE15-SP4_Update_8-debugsource-11-150400.2.2 * kernel-livepatch-5_14_21-150400_24_46-default-11-150400.2.2 * kernel-livepatch-5_14_21-150400_24_66-default-7-150400.2.1 * kernel-livepatch-5_14_21-150400_24_55-default-10-150400.2.1 * kernel-livepatch-SLE15-SP4_Update_13-debugsource-7-150400.2.1 * kernel-livepatch-SLE15-SP4_Update_10-debugsource-10-150400.2.1 * kernel-livepatch-5_14_21-150400_24_66-default-debuginfo-7-150400.2.1 * kernel-livepatch-5_14_21-150400_24_55-default-debuginfo-10-150400.2.1 * openSUSE Leap 15.4 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150400_24_46-default-debuginfo-11-150400.2.2 * kernel-livepatch-SLE15-SP4_Update_8-debugsource-11-150400.2.2 * kernel-livepatch-5_14_21-150400_24_46-default-11-150400.2.2 * kernel-livepatch-5_14_21-150400_24_66-default-7-150400.2.1 * kernel-livepatch-5_14_21-150400_24_55-default-10-150400.2.1 * kernel-livepatch-SLE15-SP4_Update_13-debugsource-7-150400.2.1 * kernel-livepatch-SLE15-SP4_Update_10-debugsource-10-150400.2.1 * kernel-livepatch-5_14_21-150400_24_66-default-debuginfo-7-150400.2.1 * kernel-livepatch-5_14_21-150400_24_55-default-debuginfo-10-150400.2.1 ## References: * https://www.suse.com/security/cve/CVE-2023-5178.html * https://www.suse.com/security/cve/CVE-2023-6176.html * https://www.suse.com/security/cve/CVE-2023-6932.html * https://bugzilla.suse.com/show_bug.cgi?id=1216044 * https://bugzilla.suse.com/show_bug.cgi?id=1217522 * https://bugzilla.suse.com/show_bug.cgi?id=1218255

1 0

SUSE-SU-2024:0418-1: important: Security update for the Linux Kernel (Live Patch 37 for SLE 15 SP1)
by OPENSUSE-UPDATES 07 Feb '24

07 Feb '24

# Security update for the Linux Kernel (Live Patch 37 for SLE 15 SP1) Announcement ID: SUSE-SU-2024:0418-1 Rating: important References: * bsc#1218255 Cross-References: * CVE-2023-6932 CVSS scores: * CVE-2023-6932 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-6932 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.5 * SUSE Linux Enterprise High Performance Computing 15 SP1 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Live Patching 15-SP1 * SUSE Linux Enterprise Live Patching 15-SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP1 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves one vulnerability can now be installed. ## Description: This update for the Linux Kernel 4.12.14-150100_197_134 fixes one issue. The following security issue was fixed: * CVE-2023-6932: Fixed a use-after-free vulnerability in the ipv4 igmp component that could lead to local privilege escalation (bsc#1218255). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Live Patching 15-SP1 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP1-2024-418=1 SUSE-SLE- Module-Live-Patching-15-SP1-2024-415=1 * openSUSE Leap 15.5 zypper in -t patch SUSE-2024-417=1 * SUSE Linux Enterprise Live Patching 15-SP5 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP5-2024-417=1 ## Package List: * SUSE Linux Enterprise Live Patching 15-SP1 (ppc64le x86_64) * kernel-livepatch-4_12_14-150100_197_134-default-11-150100.2.2 * kernel-livepatch-4_12_14-150100_197_160-default-3-150100.2.1 * openSUSE Leap 15.5 (ppc64le s390x x86_64) * kernel-livepatch-SLE15-SP5_Update_8-debugsource-2-150500.2.1 * kernel-livepatch-5_14_21-150500_55_39-default-debuginfo-2-150500.2.1 * kernel-livepatch-5_14_21-150500_55_39-default-2-150500.2.1 * SUSE Linux Enterprise Live Patching 15-SP5 (ppc64le s390x x86_64) * kernel-livepatch-SLE15-SP5_Update_8-debugsource-2-150500.2.1 * kernel-livepatch-5_14_21-150500_55_39-default-debuginfo-2-150500.2.1 * kernel-livepatch-5_14_21-150500_55_39-default-2-150500.2.1 ## References: * https://www.suse.com/security/cve/CVE-2023-6932.html * https://bugzilla.suse.com/show_bug.cgi?id=1218255

1 0

SUSE-RU-2024:0408-1: moderate: Recommended update for podman
by OPENSUSE-UPDATES 07 Feb '24

07 Feb '24

# Recommended update for podman Announcement ID: SUSE-RU-2024:0408-1 Rating: moderate References: * bsc#1217828 Affected Products: * Containers Module 15-SP5 * openSUSE Leap 15.5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that has one fix can now be installed. ## Description: This update for podman fixes the following issues: * Update to version 4.8.3: * Update RELEASE_NOTES.md * update module golang.org/x/crypto [security] * Error on HyperV VM start when gvproxy has failed to start * Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available * Update to version 4.8.2: * Update RELEASE_NOTES.md * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * Default to the new networking backend, netavark, on openSUSE (bsc#1217828) * Update to version 4.8.1: * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Update to version 4.8.0: * Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Cirrus: Update operating branch * rootless_tutorial: modernize * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups [JetBrains] * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to root * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman-kube-apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * \--env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address * Use crun only on selected archs ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-408=1 SUSE-2024-408=1 * SUSE Linux Enterprise Micro 5.5 zypper in -t patch SUSE-SLE-Micro-5.5-2024-408=1 * Containers Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Containers-15-SP5-2024-408=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * podman-debuginfo-4.8.3-150500.3.6.1 * podman-remote-debuginfo-4.8.3-150500.3.6.1 * podmansh-4.8.3-150500.3.6.1 * podman-4.8.3-150500.3.6.1 * podman-remote-4.8.3-150500.3.6.1 * openSUSE Leap 15.5 (noarch) * podman-docker-4.8.3-150500.3.6.1 * SUSE Linux Enterprise Micro 5.5 (aarch64 s390x x86_64) * podman-debuginfo-4.8.3-150500.3.6.1 * podman-remote-debuginfo-4.8.3-150500.3.6.1 * podmansh-4.8.3-150500.3.6.1 * podman-4.8.3-150500.3.6.1 * podman-remote-4.8.3-150500.3.6.1 * SUSE Linux Enterprise Micro 5.5 (noarch) * podman-docker-4.8.3-150500.3.6.1 * Containers Module 15-SP5 (aarch64 ppc64le s390x x86_64) * podman-debuginfo-4.8.3-150500.3.6.1 * podman-remote-debuginfo-4.8.3-150500.3.6.1 * podmansh-4.8.3-150500.3.6.1 * podman-4.8.3-150500.3.6.1 * podman-remote-4.8.3-150500.3.6.1 * Containers Module 15-SP5 (noarch) * podman-docker-4.8.3-150500.3.6.1 ## References: * https://bugzilla.suse.com/show_bug.cgi?id=1217828

1 0

SUSE-SU-2024:0409-1: important: Security update for the Linux Kernel (Live Patch 7 for SLE 15 SP5)
by OPENSUSE-UPDATES 07 Feb '24

07 Feb '24

# Security update for the Linux Kernel (Live Patch 7 for SLE 15 SP5) Announcement ID: SUSE-SU-2024:0409-1 Rating: important References: * bsc#1217522 * bsc#1218255 Cross-References: * CVE-2023-6176 * CVE-2023-6932 CVSS scores: * CVE-2023-6176 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-6176 ( NVD ): 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2023-6932 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-6932 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.5 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Live Patching 15-SP2 * SUSE Linux Enterprise Live Patching 15-SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves two vulnerabilities can now be installed. ## Description: This update for the Linux Kernel 5.14.21-150500_55_36 fixes several issues. The following security issues were fixed: * CVE-2023-6932: Fixed a use-after-free vulnerability in the ipv4 igmp component that could lead to local privilege escalation (bsc#1218255). * CVE-2023-6176: Fixed a denial of service in the cryptographic algorithm scatterwalk functionality (bsc#1217522). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Live Patching 15-SP2 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP2-2024-409=1 * openSUSE Leap 15.5 zypper in -t patch SUSE-2024-407=1 * SUSE Linux Enterprise Live Patching 15-SP5 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP5-2024-407=1 ## Package List: * SUSE Linux Enterprise Live Patching 15-SP2 (ppc64le s390x x86_64) * kernel-livepatch-SLE15-SP2_Update_42-debugsource-3-150200.2.1 * kernel-livepatch-5_3_18-150200_24_169-default-debuginfo-3-150200.2.1 * kernel-livepatch-5_3_18-150200_24_169-default-3-150200.2.1 * openSUSE Leap 15.5 (ppc64le s390x x86_64) * kernel-livepatch-SLE15-SP5_Update_7-debugsource-2-150500.2.1 * kernel-livepatch-5_14_21-150500_55_36-default-debuginfo-2-150500.2.1 * kernel-livepatch-5_14_21-150500_55_36-default-2-150500.2.1 * SUSE Linux Enterprise Live Patching 15-SP5 (ppc64le s390x x86_64) * kernel-livepatch-SLE15-SP5_Update_7-debugsource-2-150500.2.1 * kernel-livepatch-5_14_21-150500_55_36-default-debuginfo-2-150500.2.1 * kernel-livepatch-5_14_21-150500_55_36-default-2-150500.2.1 ## References: * https://www.suse.com/security/cve/CVE-2023-6176.html * https://www.suse.com/security/cve/CVE-2023-6932.html * https://bugzilla.suse.com/show_bug.cgi?id=1217522 * https://bugzilla.suse.com/show_bug.cgi?id=1218255

1 0

SUSE-SU-2024:0394-1: important: Security update for the Linux Kernel (Live Patch 40 for SLE 15 SP3)
by OPENSUSE-UPDATES 07 Feb '24

07 Feb '24

# Security update for the Linux Kernel (Live Patch 40 for SLE 15 SP3) Announcement ID: SUSE-SU-2024:0394-1 Rating: important References: * bsc#1210619 Cross-References: * CVE-2023-1829 CVSS scores: * CVE-2023-1829 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-1829 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.3 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise Live Patching 15-SP3 * SUSE Linux Enterprise Micro 5.1 * SUSE Linux Enterprise Micro 5.2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 An update that solves one vulnerability can now be installed. ## Description: This update for the Linux Kernel 5.3.18-150300_59_147 fixes one issue. The following security issue was fixed: * CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Live Patching 15-SP3 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP3-2024-394=1 * openSUSE Leap 15.3 zypper in -t patch SUSE-2024-394=1 ## Package List: * SUSE Linux Enterprise Live Patching 15-SP3 (ppc64le s390x x86_64) * kernel-livepatch-5_3_18-150300_59_147-default-2-150300.2.1 * openSUSE Leap 15.3 (ppc64le s390x x86_64) * kernel-livepatch-5_3_18-150300_59_147-default-debuginfo-2-150300.2.1 * kernel-livepatch-5_3_18-150300_59_147-default-2-150300.2.1 * kernel-livepatch-SLE15-SP3_Update_40-debugsource-2-150300.2.1 * openSUSE Leap 15.3 (x86_64) * kernel-livepatch-5_3_18-150300_59_147-preempt-debuginfo-2-150300.2.1 * kernel-livepatch-5_3_18-150300_59_147-preempt-2-150300.2.1 ## References: * https://www.suse.com/security/cve/CVE-2023-1829.html * https://bugzilla.suse.com/show_bug.cgi?id=1210619

1 0