Sehr geehrte Damen und Herren, wegen eines Auslandsaufenthaltes kann ich die Nachricht vermutlich bis zum 4.4. nicht lesen. In dringenden Fällen stehe ich Ihnen unter +49 177 7902970 telefonisch zur Verfügung. Mit freundlichen Grüßen W. Lisiewicz ------------- Szanowni Państwo, z powodu pobytu za granicą nie będę prawdopodobnie mógł przeczytać Państwa wiadomości do dnia 4.4. W pilnych przypadkach jestem dostępny pod numerem telefonu +49 177 7902970. Pozdrawiam serdecznie W. Lisiewicz Am 03.04.2013 um 23:07 schrieb opensuse-security@opensuse.org:
SUSE Security Update: Security update for puppet ______________________________________________________________________________
Announcement ID: SUSE-SU-2013:0618-1 Rating: important References: #809839 Cross-References: CVE-2013-1640 CVE-2013-1652 CVE-2013-1653 CVE-2013-1654 CVE-2013-1655 CVE-2013-2274 CVE-2013-2275 Affected Products: SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Desktop 11 SP2 ______________________________________________________________________________
An update that fixes 7 vulnerabilities is now available. It includes one version update.
Description:
puppet has been updated to fix 2.6.18 multiple vulnerabilities and bugs.
* (#19391) Find the catalog for the specified node name * Don't assume master supports SSLv2 * Don't require openssl client to return 0 on failure * Display SSL messages so we can match our regex * Don't assume puppetbindir is defined * Remove unnecessary rubygems require * Run openssl from windows when trying to downgrade master * Separate tests for same CVEs into separate files * Fix order-dependent test failure in rest_authconfig_spec * Always read request body when using Rack * (#19392) (CVE-2013-1653) Fix acceptance test to catch unvalidated model on 2.6 * (#19392) (CVE-2013-1653) Validate indirection model in save handler * Acceptance tests for CVEs 2013 (1640, 1652, 1653, 1654, 2274, 2275) * (#19531) (CVE-2013-2275) Only allow report save from the node matching the certname * (#19391) Backport Request#remote? method * (#8858) Explicitly set SSL peer verification mode. * (#8858) Refactor tests to use real HTTP objects * (#19392) (CVE-2013-1653) Validate instances passed to indirector * (#19391) (CVE-2013-1652) Disallow use_node compiler parameter for remote requests * (#19151) Reject SSLv2 SSL handshakes and ciphers * (#14093) Restore access to the filename in the template * (#14093) Remove unsafe attributes from TemplateWrapper
Security Issue references:
* CVE-2013-2275 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2275
* CVE-2013-2274 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2274
* CVE-2013-1655 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1655
* CVE-2013-1654 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1654
* CVE-2013-1653 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1653
* CVE-2013-1652 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1652
* CVE-2013-1640 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1640
Patch Instructions:
To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Server 11 SP2 for VMware:
zypper in -t patch slessp2-puppet-7526
- SUSE Linux Enterprise Server 11 SP2:
zypper in -t patch slessp2-puppet-7526
- SUSE Linux Enterprise Desktop 11 SP2:
zypper in -t patch sledsp2-puppet-7526
To bring your system up-to-date, use "zypper patch".
Package List:
- SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64) [New Version: 2.6.18]:
puppet-2.6.18-0.4.2 puppet-server-2.6.18-0.4.2
- SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 2.6.18]:
puppet-2.6.18-0.4.2 puppet-server-2.6.18-0.4.2
- SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 2.6.18]:
puppet-2.6.18-0.4.2
References:
http://support.novell.com/security/cve/CVE-2013-1640.html http://support.novell.com/security/cve/CVE-2013-1652.html http://support.novell.com/security/cve/CVE-2013-1653.html http://support.novell.com/security/cve/CVE-2013-1654.html http://support.novell.com/security/cve/CVE-2013-1655.html http://support.novell.com/security/cve/CVE-2013-2274.html http://support.novell.com/security/cve/CVE-2013-2275.html https://bugzilla.novell.com/809839 http://download.novell.com/patch/finder/?keywords=bc7ffedd9ace9c95117aaf0acb...
-- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-security-announce+help@opensuse.org