28 Oct
2019
28 Oct
'19
15:01
Please note that this mail was generated by a script.
The described changes are computed based on the x86_64 DVD.
The full online repo contains too many changes to be listed here.
Please check the known defects of this snapshot before upgrading:
https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=1&version=Tumbleweed&build=20191025
Please do not reply to this email to report issues, rather file a bug
on bugzilla.opensuse.org. For more information on filing bugs please
see https://en.opensuse.org/openSUSE:Submitting_bug_reports
Packages changed:
apache2
bash
busybox
chrony (3.4 -> 3.5)
dhcp
file
libssh2_org
ncurses
openssh (7.9p1 -> 8.1p1)
openvpn
perl-Cpanel-JSON-XS (4.14 -> 4.15)
pidgin
pmdk (1.6 -> 1.7)
speech-dispatcher (0.9.0 -> 0.9.1)
talloc
texinfo
vim
virtualbox (6.0.12 -> 6.0.14)
xorg-x11-server (1.20.5 -> 1.20.5+24)
yast2-schema (4.2.4 -> 4.2.5)
zlib
=== Details ===
==== apache2 ====
Subpackages: apache2-devel apache2-doc apache2-example-pages apache2-prefork apache2-utils
- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
load certificates from openssl engine
+ apache2-load-certificates-from-pkcs11.patch
load private keys from openssl engine
+ apache2-load-private-keys-from-pkcs11.patch
==== bash ====
Subpackages: bash-doc bash-lang
- Remove PILOTPORT and PILOTRATE environment variable from
default ~/.bashrc (/etc/skel/.bashrc) (bsc#1123510)
- Move definitions of environment variables from ~/.bashrc to
~/.profile (/etc/skel/.profile)
==== busybox ====
- Add man.conf to container variant
==== chrony ====
Version update (3.4 -> 3.5)
- Fix asciidoc in Tumbleweed
- Revert clknetsim to version 58c5e8b
- Fix incorrect download link for package signature
- Temporarily disable signature usage as its expired
- Update clknetsim to version ac3c832
- fix chrony-service-helper.patch
- Update to 3.5:
+ Add support for more accurate reading of PHC on Linux 5.0
+ Add support for hardware timestamping on interfaces with read-only timestamping configuration
+ Add support for memory locking and real-time priority on FreeBSD, NetBSD, Solaris
+ Update seccomp filter to work on more architectures
+ Validate refclock driver options
+ Fix bindaddress directive on FreeBSD
+ Fix transposition of hardware RX timestamp on Linux 4.13 and later
+ Fix building on non-glibc systems
==== dhcp ====
Subpackages: dhcp-client dhcp-doc dhcp-relay dhcp-server
- bsc#1134078, CVE-2019-6470, dhcp-CVE-2019-6470.patch:
DHCPv6 server crashes regularly.
- Add compile option --enable-secs-byteorder to avoid duplicate
lease warnings [bsc#1089524].
- Make systemd a weak dependency as we don't want that in a container
- bsc#1136572: Use IPv6 when called as dhclient6, dhcpd6, and
dhcrelay6 (0021-dhcp-ip-family-symlinks.patch).
==== file ====
Subpackages: file-magic libmagic1
- Add temporary patch CVE-2019-18218-46a8443f.patch from upstream
to fix bsc#1154661 -- heap-based buffer overflow in cdf_read_property_info in cdf.c
- Let python-magic build with latest rpm
==== libssh2_org ====
- Security fix: [bsc#1154862, CVE-2019-17498]
* The SSH_MSG_DISCONNECT:packet.c logic has an integer overflow in
a bounds check that might lead to disclose sensitive information
or cause a denial of service
* Add patch libssh2_org-CVE-2019-17498.patch
==== ncurses ====
Subpackages: libncurses6 ncurses-devel ncurses-utils tack terminfo terminfo-base terminfo-screen
- Add ncurses patch 20191019
+ modify make_hash to not require --disable-leaks, to simplify building
with address-sanitizer.
+ modify tic to exit if it cannot remove a conflicting name, because
treating that as a partial success can cause an infinite loop in
use-resolution (report/testcase by Hongxu Chen, cf: 20111001).
- Add ncurses patch 20191015
+ improve buffer-checks in captoinfo.c, for some cases when the
input string is shorter than expected.
> fix two errata in tic (report/testcases by Hongxu Chen):
+ check for missing character after backslash in write_it
+ check for missing characters after "%>" when converting from termcap
syntax (cf: 980530).
- Avoid recursion trouble in spec file cause by undefined _lto_cflags
- Add ncurses patch 20191012
+ amend recent changes to ncurses*-config and pc-files to filter out
Debian linker-flags (report by Sven Joachim, cf: 20150516).
+ clarify relationship between tic, infocmp and captoinfo in manpage.
+ check for invalid hashcode in _nc_find_type_entry and
_nc_find_name_entry.
> fix several errata in tic (reports/testcases by "zjuchenyuan"):
+ check for invalid hashcode in _nc_find_entry.
+ check for missing character after backslash in fmt_entry
+ check for acsc with odd length in dump_entry in check for one-one
mapping (cf: 20060415);
+ check length when converting from old AIX box_chars_1 capability,
overlooked in changes to eliminate strcpy (cf: 20001007).
- Add ncurses patch 20191005
+ modify the ncurse*-config and pc-files to more closely match for the
- I and -l options.
==== openssh ====
Version update (7.9p1 -> 8.1p1)
Subpackages: openssh-helpers
- Add openssh-7.9p1-keygen-preserve-perms.patch (bsc#1150574).
This attempts to preserve the permissions of any existing
known_hosts file when modified by ssh-keygen (for instance,
with -R).
- Add patch from upstream openssh-7.9p1-revert-new-qos-defaults.patch
- Run 'ssh-keygen -A' on startup only if SSHD_AUTO_KEYGEN="yes"
in /etc/sysconfig/ssh. This is set to "yes" by default, but
can be changed by the system administrator (bsc#1139089).
- Add openssh-7.9p1-keygen-preserve-perms.patch (bsc#1150574).
This attempts to preserve the permissions of any existing
known_hosts file when modified by ssh-keygen (for instance,
with -R).
- Version update to 8.1p1:
* ssh-keygen(1): when acting as a CA and signing certificates with
an RSA key, default to using the rsa-sha2-512 signature algorithm.
Certificates signed by RSA keys will therefore be incompatible
with OpenSSH versions prior to 7.2 unless the default is
overridden (using "ssh-keygen -t ssh-rsa -s ...").
* ssh(1): Allow %n to be expanded in ProxyCommand strings
* ssh(1), sshd(8): Allow prepending a list of algorithms to the
default set by starting the list with the '^' character, E.g.
"HostKeyAlgorithms ^ssh-ed25519"
* ssh-keygen(1): add an experimental lightweight signature and
verification ability. Signatures may be made using regular ssh keys
held on disk or stored in a ssh-agent and verified against an
authorized_keys-like list of allowed keys. Signatures embed a
namespace that prevents confusion and attacks between different
usage domains (e.g. files vs email).
* ssh-keygen(1): print key comment when extracting public key from a
private key.
* ssh-keygen(1): accept the verbose flag when searching for host keys
in known hosts (i.e. "ssh-keygen -vF host") to print the matching
host's random-art signature too.
* All: support PKCS8 as an optional format for storage of private
keys to disk. The OpenSSH native key format remains the default,
but PKCS8 is a superior format to PEM if interoperability with
non-OpenSSH software is required, as it may use a less insecure
key derivation function than PEM's.
- Additional changes from 8.0p1 release:
* scp(1): Add "-T" flag to disable client-side filtering of
server file list.
* sshd(8): Remove support for obsolete "host/port" syntax.
* ssh(1), ssh-agent(1), ssh-add(1): Add support for ECDSA keys in
PKCS#11 tokens.
* ssh(1), sshd(8): Add experimental quantum-computing resistant
key exchange method, based on a combination of Streamlined NTRU
Prime 4591^761 and X25519.
* ssh-keygen(1): Increase the default RSA key size to 3072 bits,
following NIST Special Publication 800-57's guidance for a
128-bit equivalent symmetric security level.
* ssh(1): Allow "PKCS11Provider=none" to override later instances of
the PKCS11Provider directive in ssh_config,
* sshd(8): Add a log message for situations where a connection is
dropped for attempting to run a command but a sshd_config
ForceCommand=internal-sftp restriction is in effect.
* ssh(1): When prompting whether to record a new host key, accept
the key fingerprint as a synonym for "yes". This allows the user
to paste a fingerprint obtained out of band at the prompt and
have the client do the comparison for you.
* ssh-keygen(1): When signing multiple certificates on a single
command-line invocation, allow automatically incrementing the
certificate serial number.
* scp(1), sftp(1): Accept -J option as an alias to ProxyJump on
the scp and sftp command-lines.
* ssh-agent(1), ssh-pkcs11-helper(8), ssh-add(1): Accept "-v"
command-line flags to increase the verbosity of output; pass
verbose flags though to subprocesses, such as ssh-pkcs11-helper
started from ssh-agent.
* ssh-add(1): Add a "-T" option to allowing testing whether keys in
an agent are usable by performing a signature and a verification.
* sftp-server(8): Add a "lsetstat@openssh.com" protocol extension
that replicates the functionality of the existing SSH2_FXP_SETSTAT
operation but does not follow symlinks.
* sftp(1): Add "-h" flag to chown/chgrp/chmod commands to request
they do not follow symlinks.
* sshd(8): Expose $SSH_CONNECTION in the PAM environment. This makes
the connection 4-tuple available to PAM modules that wish to use
it in decision-making.
* sshd(8): Add a ssh_config "Match final" predicate Matches in same
pass as "Match canonical" but doesn't require hostname
canonicalisation be enabled.
* sftp(1): Support a prefix of '@' to suppress echo of sftp batch
commands.
* ssh-keygen(1): When printing certificate contents using
"ssh-keygen -Lf /path/certificate", include the algorithm that
the CA used to sign the cert.
- Rebased patches:
* openssh-7.7p1-IPv6_X_forwarding.patch
* openssh-7.7p1-X_forward_with_disabled_ipv6.patch
* openssh-7.7p1-cavstest-ctr.patch
* openssh-7.7p1-cavstest-kdf.patch
* openssh-7.7p1-disable_openssl_abi_check.patch
* openssh-7.7p1-fips.patch
* openssh-7.7p1-fips_checks.patch
* openssh-7.7p1-hostname_changes_when_forwarding_X.patch
* openssh-7.7p1-ldap.patch
* openssh-7.7p1-seed-prng.patch
* openssh-7.7p1-sftp_force_permissions.patch
* openssh-7.7p1-sftp_print_diagnostic_messages.patch
* openssh-8.0p1-gssapi-keyex.patch (formerly
openssh-7.7p1-gssapi_key_exchange.patch)
* openssh-8.1p1-audit.patch (formerly openssh-7.7p1-audit.patch)
- Removed patches (integrated upstream):
* 0001-upstream-Fix-two-race-conditions-in-sshd-relating-to.patch
* openssh-7.7p1-seccomp_ioctl_s390_EP11.patch
* openssh-7.9p1-CVE-2018-20685.patch
* openssh-7.9p1-brace-expansion.patch
* openssh-CVE-2019-6109-force-progressmeter-update.patch
* openssh-CVE-2019-6109-sanitize-scp-filenames.patch
* openssh-CVE-2019-6111-scp-client-wildcard.patch
- Removed patches (obsolete):
* openssh-openssl-1_0_0-compatibility.patch
==== openvpn ====
- Add p11kit build time dependency for pkcs providers autodetection
==== perl-Cpanel-JSON-XS ====
Version update (4.14 -> 4.15)
- updated to 4.15
see /usr/share/doc/packages/perl-Cpanel-JSON-XS/Changes
4.15 2019-10-21 (rurban)
- Fix more tests for nvtype long double
==== pidgin ====
Subpackages: libpurple libpurple-lang libpurple-tcl
- Add pidgin-Leaky-deprecation-clean-ups.patch: Fix warnings of
deprecation of GParameter that result in build failures of
plugins that build with -Werror (pidgin.im#17415).
==== pmdk ====
Version update (1.6 -> 1.7)
Subpackages: libpmem1
- Update to PMDK 1.7 (jsc#SLE-9886)
- Introduces new APIs in libpmemobj for managing space used by transactions.
(see pmemobj_tx_log_append_buffer man page for details)
- Introduces new APIs in librpmem, splitting rpmem_persist into rpmem_flush
and rpmem_drain, allowing applications to use the flush + drain model
already known from libpmem. (libpmemobj does not use this feature yet)
- Optimizes large libpmemobj transactions by significantly reducing
the amount of memory modified at the commit phase.
- Optimizes tracking of libpmemobj reservations.
- Adds new flags for libpmemobj's pmemobj_tx_xadd_range[_direct] API:
POBJ_XADD_NO_SNAPSHOT and POBJ_XADD_ASSUME_INITIALIZED, allowing
applications to optimize how memory is tracked by the library.
- To support some of the above changes the libpmemobj on-media layout had
to be changed, which means that old pools have to be converted using
pmdk-convert >= 1.7.
==== speech-dispatcher ====
Version update (0.9.0 -> 0.9.1)
Subpackages: libspeechd2 python3-speechd speech-dispatcher-configure speech-dispatcher-module-espeak
- Drop -ibmtts package for now. It requires a third-party library
which we do not package.
- Drop intltool from BuildRequires. Require gettext.
- Exclude ibmtts.conf from the main package.
- Update to version 0.9.1:
* Add module for the non-free IBM TTS (voxin) speech synthesis.
* Extend licence to later versions of GPL and LGPL.
* Update mailing list address to savannah.
* Make generic modules fallback to existing voices.
- Create separate package for ibmtts module: most users won't use
this.
==== talloc ====
Subpackages: libtalloc2 libtalloc2-32bit python3-talloc
- Add two patches making build compatible with Python 3.8.0:
- waf_upgrade.patch
- waf_use_native_waf_timer.patch
==== texinfo ====
Subpackages: info info-std makeinfo
- Delete info-dir as not required anymore
- Mark /usr/share/info/dir as %ghost
- Add a rpmlintrc file to silent useless warnings
==== vim ====
Subpackages: gvim vim-data vim-data-common
- Add python38-config.patch to make vim buildable with new Python 3.8.
(gh#vim/vim#4080)
==== virtualbox ====
Version update (6.0.12 -> 6.0.14)
Subpackages: virtualbox-guest-tools virtualbox-guest-x11 virtualbox-kmp-default
- Tweak file setup for appstream.
- Add directory %{buildroot}%{_datadir}/metainfo for metafile "virtualbox.appdata.xml
- Add appstream file (boo#1154128)
- Version bumk to 6.0.14 (released October 15 2019 by Oracle)
This is a maintenance release. The following items were fixed and/or added:
Virtualization core: fixed an invalid-guest state guru meditation in some rare circumstances on Intel hosts
Virtualization core: some fixes for systems with lots of processors
Audio: relaxed VRM / VRA (variable rate audio) bit checks to provide more compatibility for guests running ALSA setups with the AC'97 emulation
USB: made device capturing for passthrough more accurate and reliable on Windows host
Network: fixed potential issue with interrupt signalling for network adapters in UEFI guests
3D: fixed flicker and redraw issues when using VBoxSVGA or VMSVGA graphics adapter (bugs #18562, #18956)
3D: fixed crash with some applications when using VBoxSVGA or VMSVGA graphics adapter (bug #18638)
macOS host: fix crash of GUI VM process which showed up frequently with 10.15 Catalina (bug #18990)
Linux host: support Linux 5.3, thank you Larry Finger (see also bug #18911)
Linux host: improve python version detection during rpm package creation, can change package dependencies and fix some installation problems
Linux guests: calls to aio_read(3) and aio_write(3) may fail inside shared folders (bug #18805)
Linux guests: fix problem with shared folder unmounting in service script, thank you Denis Ryndine (bug #18853)
Linux guests: VBox 6.0.10 GAs fail to compile on Red Hat/CentOS/Oracle Linux 7.7 and Red Hat 8.1 Beta (bug #18917)
Fix vulnerabilities CVE-2019-3028 CVE-2019-3017 CVE-2019-2944 CVE-2019-3026 CVE-2019-3021
CVE-2019-2984 CVE-2019-3002 CVE-2019-3005 CVE-2019-3031 CVE-2019-1547
CVE-2019-2926 (bsc#1154166)
Removed file "fixes_for_5.3.patch" - fixes included upstream.
==== xorg-x11-server ====
Version update (1.20.5 -> 1.20.5+24)
Subpackages: xorg-x11-server-Xvfb xorg-x11-server-extra xorg-x11-server-sdk xorg-x11-server-wayland
- Update to version 1.20.5+24:
* Fix crash on XkbSetMap
- Drop unneeded obsinfo file and tweak _service.
- Update to version 1.20.5+22:
* miext/sync:
- Make struct _SyncObject::initialized fully ABI compatible
- Fix needless ABI change
* xf86: Disable unused crtc functions when a lease is revoked
* xwayland:
- Handle the case of windows being realized before redirection
- Refactor surface creation into a separate function
- Separate DamagePtr into separate window data
- Do not free a NULL GBM bo
- Expand the RANDR screen size limits
- Update screen pixmap on output resize
- Reset scheduled frames after hiding tablet cursor
- Check status in GBM pixmap creation
- Avoid a crash on pointer enter with a grab
* GLX:
- Fix previous context validation in xorgGlxMakeCurrent
- Set GlxServerExports::{major,minor}Version
- Add a function to change a clients vendor list
- Use the sending client for looking up XID's
- Add a per-client vendor mapping
* xsync: Add resource inside of SyncCreate, export SyncCreate
* dri2: Sync i965_pci_ids.h from mesa
* Xi: Use current device active grab to deliver touch events if
any
* Revert "present/scmd: Check that the flip and screen pixmap
pitches match"
* glamor: Make pixmap exportable from `gbm_bo_from_pixmap()`
- Drop patches fixed upstream:
* U_xwayland-Separate-DamagePtr-into-separate-window-data.patch
* 0001-xsync-Add-resource-inside-of-SyncCreate-export-SyncC.patch
* 0002-GLX-Add-a-per-client-vendor-mapping.patch
* 0003-GLX-Use-the-sending-client-for-looking-up-XID-s.patch
* 0004-GLX-Add-a-function-to-change-a-clients-vendor-list.patch
* 0005-GLX-Set-GlxServerExports-major-minor-Version.patch
- Switch to gitcheckout via source service, use the stable released
branch but set explicit commit used in _service.
==== yast2-schema ====
Version update (4.2.4 -> 4.2.5)
- Added extra_services to security.rnc file (bsc#1153623).
- 4.2.5
==== zlib ====
Subpackages: libminizip1 libz1 libz1-32bit zlib-devel
- Add SUSE specific patch to fix bsc#1138793, we simply don't want
to test if the app was linked with exactly same version of zlib
like the one that is present on the runtime:
* zlib-no-version-check.patch
--
To unsubscribe, e-mail: opensuse-factory+unsubscribe@opensuse.org
To contact the owner, e-mail: opensuse-factory+owner@opensuse.org