SUSE-CU-2024:4258-1: Security update of rancher/seedimage-builder
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Fri Sep 13 15:33:13 UTC 2024
SUSE Container Update Advisory: rancher/seedimage-builder
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2024:4258-1
Container Tags : rancher/seedimage-builder:1.6.4 , rancher/seedimage-builder:1.6.4-2.12 , rancher/seedimage-builder:latest
Container Release : 2.12
Severity : important
Type : security
References : 1188441 1199079 1220356 1220724 1221239 1221289 1221399 1221482
1221665 1221666 1221667 1221668 1221940 1222992 1223423 1223424
1223425 1224282 1227525 1227888 1228041 1228535 1229930 1229931
1229932 CVE-2024-2004 CVE-2024-2379 CVE-2024-2398 CVE-2024-2466
CVE-2024-28182 CVE-2024-28757 CVE-2024-2961 CVE-2024-33599 CVE-2024-33600
CVE-2024-33601 CVE-2024-33602 CVE-2024-34459 CVE-2024-45490 CVE-2024-45491
CVE-2024-45492 CVE-2024-6197 CVE-2024-7264
-----------------------------------------------------------------
The container rancher/seedimage-builder was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: 9
Released: Fri Aug 9 10:33:34 2024
Summary: Recommended update for bash, libcap-ng, libselinux, libselinux-bindings, libsemanage, zypper
Type: recommended
Severity: low
References:
This update fixes the following issues:
- No change rebuild due to dependency changes.
-----------------------------------------------------------------
Advisory ID: 18
Released: Tue Aug 20 13:47:06 2024
Summary: Security update for nghttp2
Type: security
Severity: important
References: 1221399,CVE-2024-28182
This update for nghttp2 fixes the following issues:
- CVE-2024-28182: Fixed denial of service via http/2 continuation frames (bsc#1221399)
-----------------------------------------------------------------
Advisory ID: 24
Released: Wed Aug 28 13:31:01 2024
Summary: Security update for ca-certificates-mozilla
Type: security
Severity: important
References: 1199079,1220356,1227525
This update for ca-certificates-mozilla fixes the following issues:
- Updated to 2.68 state of Mozilla SSL root CAs (bsc#1227525)
- Added: FIRMAPROFESIONAL CA ROOT-A WEB
- Distrust: GLOBALTRUST 2020
- Updated to 2.66 state of Mozilla SSL root CAs (bsc#1220356)
Added:
- CommScope Public Trust ECC Root-01
- CommScope Public Trust ECC Root-02
- CommScope Public Trust RSA Root-01
- CommScope Public Trust RSA Root-02
- D-Trust SBR Root CA 1 2022
- D-Trust SBR Root CA 2 2022
- Telekom Security SMIME ECC Root 2021
- Telekom Security SMIME RSA Root 2023
- Telekom Security TLS ECC Root 2020
- Telekom Security TLS RSA Root 2023
- TrustAsia Global Root CA G3
- TrustAsia Global Root CA G4
Removed:
- Autoridad de Certificacion Firmaprofesional CIF A62634068
- Chambers of Commerce Root - 2008
- Global Chambersign Root - 2008
- Security Communication Root CA
- Symantec Class 1 Public Primary Certification Authority - G6
- Symantec Class 2 Public Primary Certification Authority - G6
- TrustCor ECA-1
- TrustCor RootCert CA-1
- TrustCor RootCert CA-2
- VeriSign Class 1 Public Primary Certification Authority - G3
- VeriSign Class 2 Public Primary Certification Authority - G3
-----------------------------------------------------------------
Advisory ID: 29
Released: Wed Sep 4 12:41:35 2024
Summary: Recommended update for gcc13
Type: recommended
Severity: important
References: 1188441,1220724,1221239
This update for gcc13 fixes the following issues:
- Update to GCC 13.3 release
- Removed Fiji support from the GCN offload compiler as that is requiring
Code Object version 3 which is no longer supported by llvm18.
- Avoid combine spending too much compile-time and memory doing nothing
on s390x. [bsc#1188441]
- Make requirement to lld version specific to avoid requiring the
meta-package.
- Fix unwinding for JIT code. [bsc#1221239]
- Revert libgccjit dependency change. [bsc#1220724]
-----------------------------------------------------------------
Advisory ID: 30
Released: Wed Sep 4 16:07:40 2024
Summary: Security update for curl
Type: security
Severity: moderate
References: 1221665,1221666,1221667,1221668,1227888,1228535,CVE-2024-2004,CVE-2024-2379,CVE-2024-2398,CVE-2024-2466,CVE-2024-6197,CVE-2024-7264
This update for curl fixes the following issues:
Security issues fixed:
- CVE-2024-7264: ASN.1 date parser overread (bsc#1228535)
- CVE-2024-6197: Freeing stack buffer in utf8asn1str (bsc#1227888)
- CVE-2024-2379: QUIC certificate check bypass with wolfSSL (bsc#1221666)
- CVE-2024-2466: TLS certificate check bypass with mbedTLS (bsc#1221668)
- CVE-2024-2004: Usage of disabled protocol (bsc#1221665)
- CVE-2024-2398: HTTP/2 push headers memory-leak (bsc#1221667)
Non-security issue fixed:
- Fixed various TLS related issues including FTP over SSL transmission timeouts.
-----------------------------------------------------------------
Advisory ID: 32
Released: Thu Sep 5 12:12:35 2024
Summary: Security update for glibc
Type: security
Severity: important
References: 1221482,1221940,1222992,1223423,1223424,1223425,1228041,CVE-2024-2961,CVE-2024-33599,CVE-2024-33600,CVE-2024-33601,CVE-2024-33602
This update for glibc fixes the following issues:
Fixed security issues:
- CVE-2024-33602: Use time_t for return type of addgetnetgrentX (bsc#1223425)
- CVE-2024-33599: nscd: Stack-based buffer overflow in netgroup cache (bsc#1223423)
- CVE-2024-33600: nscd: Avoid null pointer crashes after notfound response (bsc#1223424)
- CVE-2024-33600: nscd: Do not send missing not-found response in addgetnetgrentX (bsc#1223424)
- CVE-2024-33601, CVE-2024-33602: netgroup: Use two buffers in addgetnetgrentX (bsc#1223425)
- CVE-2024-2961: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (bsc#1222992)
Fixed non-security issues:
- Add workaround for invalid use of libc_nonshared.a with non-SUSE libc (bsc#1221482)
- Fix segfault in wcsncmp (bsc#1228041)
- Also include stat64 in the 32-bit libc_nonshared.a workaround (bsc#1221482)
- Avoid creating ULP prologue for _start routine (bsc#1221940)
- Also add libc_nonshared.a workaround to 32-bit x86 compat package (bsc#1221482)
- malloc: Use __get_nprocs on arena_get2
- linux: Use rseq area unconditionally in sched_getcpu
-----------------------------------------------------------------
Advisory ID: 44
Released: Wed Sep 11 13:33:01 2024
Summary: Security update for expat
Type: security
Severity: important
References: 1221289,1229930,1229931,1229932,CVE-2024-28757,CVE-2024-45490,CVE-2024-45491,CVE-2024-45492
This update for expat fixes the following issues:
- CVE-2024-45492: detect integer overflow in function nextScaffoldPart (bsc#1229932)
- CVE-2024-45491: detect integer overflow in dtdCopy (bsc#1229931)
- CVE-2024-45490: reject negative len for XML_ParseBuffer (bsc#1229930)
- CVE-2024-28757: XML Entity Expansion attack when there is isolated use of external parsers (bsc#1221289)
-----------------------------------------------------------------
Advisory ID: 45
Released: Wed Sep 11 13:41:31 2024
Summary: Security update for libxml2
Type: security
Severity: moderate
References: 1224282,CVE-2024-34459
This update for libxml2 fixes the following issues:
- CVE-2024-34459: Fixed buffer over-read in (bsc#1224282)
The following package changes have been done:
- boost-license1_84_0-1.84.0-1.4 added
- compat-usrmerge-tools-84.87-2.195 added
- crypto-policies-20230920.570ea89-1.50 updated
- file-magic-5.44-4.151 added
- kbd-legacy-2.6.4-1.3 added
- libsemanage-conf-3.5-3.1 added
- libssh-config-0.10.6-1.12 updated
- pkgconf-m4-1.8.0-2.205 added
- system-user-root-20190513-2.208 updated
- filesystem-84.87-5.2 updated
- glibc-2.38-7.1 updated
- libzstd1-1.5.5-8.142 updated
- libz1-1.2.13-6.138 updated
- libverto1-0.3.2-12.5 updated
- libuuid1-2.39.3-2.7 added
- libunistring5-1.1-2.8 added
- libtasn1-6-4.19.0-2.7 updated
- libsmartcols1-2.39.3-2.7 added
- libsepol2-3.5-2.196 added
- libseccomp2-2.5.4-2.199 added
- libsasl2-3-2.1.28-5.7 updated
- libpopt0-1.19-2.184 added
- libpkgconf3-1.8.0-2.205 added
- libpcre2-8-0-10.42-2.179 added
- libnss_usrfiles2-2.27-2.185 added
- libnghttp2-14-1.52.0-5.1 updated
- liblzma5-5.4.3-4.166 updated
- liblz4-1-1.9.4-2.8 added
- liblua5_4-5-5.4.6-1.68 added
- libkeyutils1-1.6.3-2.8 updated
- libip4tc2-1.8.9-2.9 added
- libgpg-error0-1.47-4.136 added
- libgmp10-6.3.0-1.119 updated
- libgcc_s1-13.3.0+git8781-1.1 updated
- libffi8-3.4.4-2.182 added
- libexpat1-2.5.0-3.1 added
- libeconf0-0.6.1-1.13 added
- libcrypt1-4.4.36-1.134 added
- libcom_err2-1.47.0-2.3 updated
- libcap2-2.69-2.83 updated
- libcap-ng0-0.8.3-4.1 added
- libbz2-1-1.0.8-2.191 updated
- libbrotlicommon1-1.1.0-1.6 updated
- libblkid1-2.39.3-2.7 added
- libaudit1-3.0.9-3.143 added
- libattr1-2.5.1-2.193 updated
- libalternatives1-1.2+30.a5431e9-2.12 added
- libacl1-2.3.1-2.187 updated
- fillup-1.42-2.7 added
- diffutils-3.10-2.101 added
- libidn2-0-2.3.4-2.6 updated
- pkgconf-1.8.0-2.205 added
- libselinux1-3.5-3.1 updated
- netcfg-11.6-4.42 added
- libxml2-2-2.11.6-3.1 added
- libgcrypt20-1.10.3-1.37 added
- libstdc++6-13.3.0+git8781-1.1 updated
- libncurses6-6.4.20240224-10.2 updated
- terminfo-base-6.4.20240224-10.2 updated
- libp11-kit0-0.25.3-1.6 updated
- perl-base-5.38.2-1.52 added
- libudev1-254.9-1.9 added
- chkstat-1600_20240206-1.8 added
- libzio1-1.08-2.192 updated
- libmagic1-5.44-4.151 added
- libbrotlidec1-1.1.0-1.6 updated
- libfdisk1-2.39.3-2.7 added
- alts-1.2+30.a5431e9-2.12 added
- libpsl5-0.21.2-2.5 updated
- sed-4.9-2.9 added
- libsubid4-4.15.1-1.1 added
- libsemanage2-3.5-3.1 added
- libmount1-2.39.3-2.7 added
- findutils-4.9.0-2.181 updated
- libsystemd0-254.9-1.9 added
- libreadline8-8.2-2.180 added
- bash-5.2.15-3.1 updated
- p11-kit-0.25.3-1.6 updated
- p11-kit-tools-0.25.3-1.6 updated
- ncurses-utils-6.4.20240224-10.2 added
- libboost_thread1_84_0-1.84.0-1.4 added
- bash-sh-5.2.15-3.1 updated
- xz-5.4.3-4.166 added
- systemd-default-settings-branding-openSUSE-0.7-2.4 added
- systemd-default-settings-0.7-2.4 added
- pkgconf-pkg-config-1.8.0-2.205 added
- login_defs-4.15.1-1.1 added
- grep-3.11-4.8 added
- coreutils-9.4-4.8 updated
- systemd-presets-common-SUSE-15-5.1 added
- rpm-config-SUSE-20240214-1.1 added
- rpm-4.18.0-6.133 added
- permissions-config-1600_20240206-1.8 added
- glibc-locale-base-2.38-7.1 added
- ca-certificates-2+git20230406.2dae8b7-2.8 updated
- ca-certificates-mozilla-2.68-1.1 updated
- systemd-presets-branding-ALP-transactional-20230214-3.1 added
- permissions-1600_20240206-1.8 added
- libopenssl3-3.1.4-5.6 added
- pam-1.6.0-2.22 added
- libldap2-2.6.4-4.12 added
- libkmod2-30-10.56 added
- krb5-1.20.1-4.11 updated
- util-linux-2.39.3-2.7 added
- shadow-4.15.1-1.1 added
- pam-config-2.11-1.1 added
- kbd-2.6.4-1.3 added
- libssh4-0.10.6-1.12 updated
- libcurl4-8.6.0-2.1 updated
- curl-8.6.0-2.1 updated
- aaa_base-84.87+git20230815.cab7b44-1.8 added
- dbus-1-daemon-1.14.10-1.11 added
- dbus-1-tools-1.14.10-1.11 added
- systemd-254.9-1.9 added
- sysuser-shadow-3.1-2.197 added
- dbus-1-common-1.14.10-1.11 added
- libdbus-1-3-1.14.10-1.11 added
- dbus-1-1.14.10-1.11 added
- container:suse-toolbox-image-1.0.0-6.51 added
- container:suse-sle15-15.5-- removed
- info-6.5-4.17 removed
- libffi7-3.2.1.git259-10.8 removed
- libjitterentropy3-3.4.1-150000.1.12.1 removed
- libldap-2_4-2-2.4.46-150200.14.17.1 removed
- libldap-data-2.4.46-150200.14.17.1 removed
- libopenssl1_1-1.1.1l-150500.17.31.1 removed
- libopenssl1_1-hmac-1.1.1l-150500.17.31.1 removed
- libreadline7-7.0-150400.25.22 removed
- libtasn1-4.13-150000.4.8.1 removed
- libunistring2-0.9.10-1.1 removed
- openssl-1_1-1.1.1l-150500.17.31.1 removed
- patterns-base-fips-20200124-150400.20.4.1 removed
More information about the sle-container-updates
mailing list