SUSE-CU-2024:5713-1: Security update of suse/manager/5.0/x86_64/proxy-salt-broker
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Mon Nov 18 16:16:45 UTC 2024
SUSE Container Update Advisory: suse/manager/5.0/x86_64/proxy-salt-broker
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2024:5713-1
Container Tags : suse/manager/5.0/x86_64/proxy-salt-broker:5.0.2 , suse/manager/5.0/x86_64/proxy-salt-broker:5.0.2.7.8.1 , suse/manager/5.0/x86_64/proxy-salt-broker:latest
Container Release : 7.8.1
Severity : important
Type : security
References : 1148184 1199282 1220262 1224258 1224260 1224264 1224265 1224266
1224267 1224268 1224269 1224270 1224271 1224272 1224273 1224275
1227233 1227378 1227999 1228618 1228619 1228623 1228780 1229596
1230227 1230906 1232241 CVE-2023-50782 CVE-2024-5642 CVE-2024-6232
CVE-2024-6923 CVE-2024-7592 CVE-2024-9287
-----------------------------------------------------------------
The container suse/manager/5.0/x86_64/proxy-salt-broker was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2024:3470-1
Released: Fri Sep 27 14:34:46 2024
Summary: Security update for python3
Type: security
Severity: important
References: 1227233,1227378,1227999,1228780,1229596,1230227,CVE-2024-5642,CVE-2024-6232,CVE-2024-6923,CVE-2024-7592
This update for python3 fixes the following issues:
- CVE-2024-6923: Fixed uncontrolled CPU resource consumption when in http.cookies module (bsc#1228780).
- CVE-2024-5642: Fixed buffer overread when NPN is used and invalid values are sent to the OpenSSL API (bsc#1227233).
- CVE-2024-7592: Fixed Email header injection due to unquoted newlines (bsc#1229596).
- CVE-2024-6232: excessive backtracking when parsing tarfile headers leads to ReDoS. (bsc#1230227)
Bug fixes:
- %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999).
- Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378).
- Remove %suse_update_desktop_file macro as it is not useful any more.
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2024:3472-1
Released: Fri Sep 27 14:51:53 2024
Summary: Recommended update for libsodium
Type: recommended
Severity: important
References: 1148184,1199282
This update for libsodium fixes the following issues:
libsodium:
- Version update from 1.0.16 to 1.0.18 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)
* Emscripten: print and printErr functions are overridden to send errors to the console, if there is one
* Emscripten: UTF8ToString() is now exported since Pointer_stringify() has been deprecated
* Libsodium version detection has been fixed in the CMake recipe
* Generic hashing got a 10% speedup on AVX2.
* New target: WebAssembly/WASI (compile with dist-builds/wasm32-wasi.sh)
* New functions to map a hash to an edwards25519 point or get a random point: core_ed25519_from_hash() and core_ed25519_random()
* crypto_core_ed25519_scalar_mul() has been implemented for scalar*scalar (mod L) multiplication
* Support for the Ristretto group has been implemented for interoperability with wasm-crypto
* Improvements have been made to the test suite
* Portability improvements have been made
* 'randombytes_salsa20' has been 'renamed to randombytes_internal'
* Support for NativeClient has been removed
* Most ((nonnull)) attributes have been relaxed to allow 0-length inputs to be NULL.
* The -ftree-vectorize and -ftree-slp-vectorize compiler switches are now used, if available, for optimized builds
* For the full list of changes please consult the packaged ChangeLog
- Disable LTO to bypass build failures on Power PC architecture (bsc#1148184)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2024:3879-1
Released: Fri Nov 1 17:04:25 2024
Summary: Security update for python3
Type: security
Severity: moderate
References: 1230906,1232241,CVE-2024-9287
This update for python3 fixes the following issues:
Security fixes:
- CVE-2024-9287: properly quote path names provided when creating a virtual environment (bsc#1232241)
Other fixes:
- Drop .pyc files from docdir for reproducible builds (bsc#1230906)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2024:3905-1
Released: Mon Nov 4 13:39:01 2024
Summary: Security update for openssl-1_1
Type: security
Severity: moderate
References: 1220262,1224258,1224260,1224264,1224265,1224266,1224267,1224268,1224269,1224270,1224271,1224272,1224273,1224275,1228618,1228619,1228623,CVE-2023-50782
This update for openssl-1_1 fixes the following issues:
Security fixes:
- CVE-2023-50782: Implicit rejection in PKCS#1 v1.5 (bsc#1220262)
Other fixes:
- FIPS: AES GCM external IV implementation (bsc#1228618)
- FIPS: Mark PBKDF2 and HKDF HMAC input keys with size >= 112 bits as approved in the SLI. (bsc#1228623)
- FIPS: Enforce KDF in FIPS style (bsc#1224270)
- FIPS: Mark HKDF and TLSv1.3 KDF as approved in the SLI (bsc#1228619)
- FIPS: The X9.31 scheme is not approved for RSA signature operations in FIPS 186-5. (bsc#1224269)
- FIPS: Differentiate the PSS length requirements (bsc#1224275)
- FIPS: Mark sigGen and sigVer primitives as non-approved (bsc#1224272)
- FIPS: Disable PKCSv1.5 and shake in FIPS mode (bsc#1224271)
- FIPS: Mark SHA1 as non-approved in the SLI (bsc#1224266)
- FIPS: DH FIPS selftest and safe prime group (bsc#1224264)
- FIPS: Remove not needed FIPS DRBG files (bsc#1224268)
- FIPS: Add Pair-wise Consistency Test when generating DH key (bsc#1224265)
- FIPS: Disallow non-approved KDF types (bsc#1224267)
- FIPS: Disallow RSA sigVer with 1024 and ECDSA sigVer/keyVer P-192 (bsc#1224273)
- FIPS: DRBG component chaining (bsc#1224258)
- FIPS: Align CRNGT_BUFSIZ with Jitter RNG output size (bsc#1224260)
The following package changes have been done:
- libsodium23-1.0.18-150000.4.8.1 updated
- libopenssl1_1-1.1.1w-150600.5.9.1 updated
- libpython3_6m1_0-3.6.15-150300.10.75.1 updated
- python3-base-3.6.15-150300.10.75.1 updated
- python3-3.6.15-150300.10.75.1 updated
More information about the sle-container-updates
mailing list