SUSE-CU-2024:3405-1: Security update of suse/rmt-server

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: suse/rmt-server
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2024:3405-1
Container Tags        : suse/rmt-server:2.18 , suse/rmt-server:2.18-39.1 , suse/rmt-server:latest
Container Release     : 39.1
Severity              : important
Type                  : security
References            : 1222899 1223336 1226463 1227138 916845 CVE-2013-4235 CVE-2024-5535
-----------------------------------------------------------------

The container suse/rmt-server was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2024:2630-1
Released:    Tue Jul 30 09:12:44 2024
Summary:     Security update for shadow
Type:        security
Severity:    important
References:  916845,CVE-2013-4235
This update for shadow fixes the following issues:

- CVE-2013-4235: Fixed a race condition when copying and removing directory trees (bsc#916845).

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2024:2635-1
Released:    Tue Jul 30 09:14:09 2024
Summary:     Security update for openssl-3
Type:        security
Severity:    important
References:  1222899,1223336,1226463,1227138,CVE-2024-5535
This update for openssl-3 fixes the following issues:

Security fixes:

- CVE-2024-5535: Fixed SSL_select_next_proto buffer overread (bsc#1227138)

Other fixes:

- Build with no-afalgeng (bsc#1226463)
- Build with enabled sm2 and sm4 support (bsc#1222899)
- Fix non-reproducibility issue (bsc#1223336)

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2024:2641-1
Released:    Tue Jul 30 09:29:36 2024
Summary:     Recommended update for systemd
Type:        recommended
Severity:    moderate
References:  
This update for systemd fixes the following issues:

systemd was updated from version 254.13 to version 254.15:
    
- Changes in version 254.15:

  * boot: cover for hardware keys on phones/tablets
  * Conditional PSI check to reflect changes done in 5.13
  * core/dbus-manager: refuse SoftReboot() for user managers
  * core/exec-invoke: reopen OpenFile= fds with O_NOCTTY
  * core/exec-invoke: use sched_setattr instead of sched_setscheduler
  * core/unit: follow merged units before updating SourcePath= timestamp too
  * coredump: correctly take tmpfs size into account for compression
  * cryptsetup: improve TPM2 blob display
  * docs: Add section to HACKING.md on distribution packages
  * docs: fixed dead link to GNOME documentation
  * docs/CODING_STYLE: document that we nowadays prefer (const char*) for func ret type
  * Fixed typo in CAP_BPF description
  * LICENSES/README: expand text to summarize state for binaries and libs
  * man: fully adopt ~/.local/state/
  * man/systemd.exec: list inaccessible files for ProtectKernelTunables
  * man/tmpfiles: remove outdated behavior regarding symlink ownership
  * meson: bpf: propagate 'sysroot' for cross compilation
  * meson: Define __TARGET_ARCH macros required by bpf
  * mkfs-util: Set sector size for btrfs as well
  * mkosi: drop CentOS 8 from CI
  * mkosi: Enable hyperscale-packages-experimental for CentOS
  * mountpoint-util: do not assume symlinks are not mountpoints
  * os-util: avoid matching on the wrong extension-release file
  * README: add missing CONFIG_MEMCG kernel config option for oomd
  * README: update requirements for signed dm-verity
  * resolved: allow the full TTL to be used by OPT records
  * resolved: correct parsing of OPT extended RCODEs
  * sysusers: handle NSS errors gracefully
  * TEST-58-REPART: reverse order of diff args
  * TEST-64-UDEV-STORAGE: Make nvme_subsystem expected pci symlinks more generic
  * test: fixed TEST-24-CRYPTSETUP on SUSE
  * test: install /etc/hosts
  * Use consistent spelling of systemd.condition_first_boot argument
  * util: make file_read() 64bit offset safe
  * vmm: make sure we can handle smbios objects without variable part
    
- Changes in version 254.14:

  * analyze: show pcrs also in sha384 bank
  * chase: Tighten '.' and './' check
  * core/service: fixed accept-socket deserialization
  * efi-api: check /sys/class/tpm/tpm0/tpm_version_major, too
  * executor: check for all permission related errnos when setting up IPC namespace
  * install: allow removing symlinks even for units that are gone
  * json: use secure un{base64,hex}mem for sensitive variants
  * man,units: drop 'temporary' from description of systemd-tmpfiles
  * missing_loop.h: fixed LOOP_SET_STATUS_SETTABLE_FLAGS
  * repart: fixed memory leak
  * repart: Use CRYPT_ACTIVATE_PRIVATE
  * resolved: permit dnssec rrtype questions when we aren't validating
  * rules: Limit the number of device units generated for serial ttys
  * run: do not pass the pty slave fd to transient service in a machine
  * sd-dhcp-server: clear buffer before receive
  * strbuf: use GREEDY_REALLOC to grow the buffer

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2024:2649-1
Released:    Tue Jul 30 13:53:03 2024
Summary:     Recommended update for rmt-server
Type:        recommended
Severity:    moderate
References:  
This update for rmt-server fixes the following issues:

- Version 2.18
  * Move temporary storage of downloaded files to the repo directory to avoid filling up /tmp partition
  * Fixes for RES7-LTSS and OL7-LTSS clients
  * Instance Verification: re-setting the repository and registry cache path to the right value; update the cache scrubber paths


The following package changes have been done:

- libopenssl3-3.1.4-150600.5.10.1 updated
- libudev1-254.15-150600.4.8.1 updated
- libopenssl-3-fips-provider-3.1.4-150600.5.10.1 updated
- login_defs-4.8.1-150600.17.3.1 updated
- shadow-4.8.1-150600.17.3.1 updated
- rmt-server-config-2.18-150500.3.19.1 updated
- rmt-server-2.18-150500.3.19.1 updated
- container:sles15-image-15.6.0-47.11.2 updated