SUSE-CU-2020:663-1: Security update of ses/6/ceph/ceph
sle-security-updates at lists.suse.com
sle-security-updates at lists.suse.com
Tue Nov 10 00:12:16 MST 2020
SUSE Container Update Advisory: ses/6/ceph/ceph
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2020:663-1
Container Tags : ses/6/ceph/ceph:14.2.13.398 , ses/6/ceph/ceph:14.2.13.398.1.5.297 , ses/6/ceph/ceph:latest
Container Release : 1.5.297
Severity : important
Type : security
References : 1002895 1010996 1011548 1071152 1071390 1082318 1087982 1088358
1100369 1104902 1107105 1109160 1118367 1118368 1126826 1126829
1126831 1128220 1130873 1130873 1132798 1133297 1138666 1138793
1140126 1142152 1142649 1142733 1143609 1145231 1146991 1149911
1149955 1149995 1150021 1151612 1151708 1152100 1152590 1152692
1153768 1153770 1153943 1153946 1154661 1154803 1154803 1154871
1154935 1155045 1155262 1155271 1155327 1156087 1156159 1156205
1156300 1156409 1156913 1157051 1157315 1157755 1158257 1158336
1158358 1158817 1158830 1159314 1159689 1159819 1159928 1160254
1160590 1160626 1160933 1160979 1161168 1161239 1161335 1161517
1161521 1161718 1162553 1162698 1162930 1163119 1163333 1163526
1163744 1164126 1164260 1164538 1164543 1164543 1164571 1164718
1165011 1165424 1165439 1165476 1165476 1165502 1165539 1165573
1165573 1165580 1165713 1165835 1165840 1165894 1166139 1166260
1166297 1166393 1166531 1166610 1166610 1166624 1166670 1166678
1166881 1166932 1167122 1167122 1167471 1167477 1167732 1167898
1168076 1168235 1168345 1168364 1168389 1168403 1168669 1168669
1168699 1168756 1168835 1168990 1168990 1169134 1169356 1169357
1169488 1169512 1169569 1169582 1169604 1169746 1169872 1169944
1169947 1169947 1169992 1170175 1170247 1170487 1170527 1170571
1170572 1170667 1170713 1170771 1170801 1170801 1170908 1170938
1170964 1171145 1171173 1171224 1171224 1171313 1171367 1171422
1171510 1171561 1171656 1171740 1171762 1171863 1171864 1171866
1171872 1171878 1171883 1171921 1171956 1171978 1172021 1172055
1172072 1172085 1172135 1172135 1172142 1172195 1172295 1172348
1172461 1172506 1172597 1172698 1172704 1172798 1172824 1172846
1172925 1172925 1172958 1173027 1173032 1173104 1173106 1173227
1173229 1173273 1173274 1173307 1173311 1173339 1173422 1173422
1173529 1173539 1173972 1173983 1174011 1174079 1174091 1174154
1174230 1174240 1174260 1174551 1174561 1174591 1174673 1174697
1174736 1174753 1174817 1174918 1175061 1175109 1175168 1175240
1175342 1175443 1175568 1175592 1175781 1175811 1175830 1175831
1176086 1176092 1176123 1176173 1176173 1176179 1176181 1176263
1176384 1176410 1176513 1176625 1176671 1176674 1176756 1176800
1176899 1177143 1177460 1177460 1177864 1177977 1178346 1178350
1178353 906079 937216 973042 CVE-2017-3136 CVE-2018-5741 CVE-2019-12972
CVE-2019-14250 CVE-2019-14444 CVE-2019-16056 CVE-2019-17006 CVE-2019-17450
CVE-2019-17451 CVE-2019-18218 CVE-2019-19956 CVE-2019-19956 CVE-2019-20388
CVE-2019-20907 CVE-2019-6477 CVE-2019-9074 CVE-2019-9075 CVE-2019-9077
CVE-2020-10543 CVE-2020-10753 CVE-2020-10878 CVE-2020-11501 CVE-2020-12243
CVE-2020-12399 CVE-2020-12402 CVE-2020-12723 CVE-2020-13777 CVE-2020-13844
CVE-2020-14422 CVE-2020-15673 CVE-2020-15676 CVE-2020-15677 CVE-2020-15678
CVE-2020-15683 CVE-2020-15719 CVE-2020-15969 CVE-2020-1730 CVE-2020-1747
CVE-2020-24659 CVE-2020-24977 CVE-2020-25219 CVE-2020-26154 CVE-2020-7595
CVE-2020-8023 CVE-2020-8027 CVE-2020-8177 CVE-2020-8231 CVE-2020-8616
CVE-2020-8617 CVE-2020-8618 CVE-2020-8619 CVE-2020-8620 CVE-2020-8621
CVE-2020-8622 CVE-2020-8623 CVE-2020-8624
-----------------------------------------------------------------
The container ses/6/ceph/ceph was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:948-1
Released: Wed Apr 8 07:44:21 2020
Summary: Security update for gmp, gnutls, libnettle
Type: security
Severity: moderate
References: 1152692,1155327,1166881,1168345,CVE-2020-11501
This update for gmp, gnutls, libnettle fixes the following issues:
Security issue fixed:
- CVE-2020-11501: Fixed zero random value in DTLS client hello (bsc#1168345)
FIPS related bugfixes:
- FIPS: Install checksums for binary integrity verification which are
required when running in FIPS mode (bsc#1152692, jsc#SLE-9518)
- FIPS: Fixed a cfb8 decryption issue, no longer truncate output IV if
input is shorter than block size. (bsc#1166881)
- FIPS: Added Diffie Hellman public key verification test. (bsc#1155327)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:949-1
Released: Wed Apr 8 07:45:48 2020
Summary: Recommended update for mozilla-nss
Type: recommended
Severity: moderate
References: 1168669
This update for mozilla-nss fixes the following issues:
- Use secure_getenv() to avoid PR_GetEnvSecure() being called when NSPR
is unavailable, resulting in an abort (bsc#1168669).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:959-1
Released: Wed Apr 8 12:59:50 2020
Summary: Security update for python-PyYAML
Type: security
Severity: important
References: 1165439,CVE-2020-1747
This update for python-PyYAML fixes the following issues:
- CVE-2020-1747: Fixed an arbitrary code execution when YAML files are parsed by FullLoader (bsc#1165439).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:961-1
Released: Wed Apr 8 13:34:06 2020
Summary: Recommended update for e2fsprogs
Type: recommended
Severity: moderate
References: 1160979
This update for e2fsprogs fixes the following issues:
- e2fsck: clarify overflow link count error message (bsc#1160979)
- ext2fs: update allocation info earlier in ext2fs_mkdir() (bsc#1160979)
- ext2fs: implement dir entry creation in htree directories (bsc#1160979)
- tests: add test to excercise indexed directories with metadata_csum (bsc#1160979)
- tune2fs: update dir checksums when clearing dir_index feature (bsc#1160979)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:967-1
Released: Thu Apr 9 11:41:53 2020
Summary: Security update for libssh
Type: security
Severity: moderate
References: 1168699,CVE-2020-1730
This update for libssh fixes the following issues:
- CVE-2020-1730: Fixed a possible denial of service when using AES-CTR (bsc#1168699).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:969-1
Released: Thu Apr 9 11:43:17 2020
Summary: Security update for permissions
Type: security
Severity: moderate
References: 1168364
This update for permissions fixes the following issues:
- Fixed spelling of icinga group (bsc#1168364)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:979-1
Released: Mon Apr 13 15:42:59 2020
Summary: Recommended update for parted
Type: recommended
Severity: moderate
References: 1168756
This update for parted fixes the following issue:
- fix null pointer dereference. (bsc#1168756)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:981-1
Released: Mon Apr 13 15:43:44 2020
Summary: Recommended update for rpm
Type: recommended
Severity: moderate
References: 1156300
This update for rpm fixes the following issues:
- Fix for language package macros to avoid wrong requirement on shared library. (bsc#1156300)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1026-1
Released: Fri Apr 17 16:14:43 2020
Summary: Recommended update for libsolv
Type: recommended
Severity: moderate
References: 1159314
This update for libsolv fixes the following issues:
libsolv was updated to version 0.7.11:
- fix solv_zchunk decoding error if large chunks are used (bsc#1159314)
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1037-1
Released: Mon Apr 20 10:49:39 2020
Summary: Recommended update for python-pytest
Type: recommended
Severity: low
References: 1002895,1107105,1138666,1167732
This update fixes the following issues:
New python-pytest versions are provided.
In Basesystem:
- python3-pexpect: updated to 4.8.0
- python3-py: updated to 1.8.1
- python3-zipp: shipped as dependency in version 0.6.0
In Python2:
- python2-pexpect: updated to 4.8.0
- python2-py: updated to 1.8.1
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1047-1
Released: Tue Apr 21 10:33:06 2020
Summary: Recommended update for gnutls
Type: recommended
Severity: moderate
References: 1168835
This update for gnutls fixes the following issues:
- Backport AES XTS support (bsc#1168835)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1061-1
Released: Wed Apr 22 10:45:41 2020
Summary: Recommended update for mozilla-nss
Type: recommended
Severity: moderate
References: 1169872
This update for mozilla-nss fixes the following issues:
- This implements API mechanisms for performing DSA and ECDSA hash-and-sign in a single call, which will be required in future FIPS cycles (bsc#1169872).
- Always perform nssdbm checksumming on softoken load, even if nssdbm itself is not loaded.
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1063-1
Released: Wed Apr 22 10:46:50 2020
Summary: Recommended update for libgcrypt
Type: recommended
Severity: moderate
References: 1165539,1169569
This update for libgcrypt fixes the following issues:
This update for libgcrypt fixes the following issues:
- FIPS: Switch the PCT to use the new signature operation (bsc#1165539)
- FIPS: Verify that the generated signature and the original input differ in test_keys function for RSA, DSA and ECC (bsc#1165539)
- Add zero-padding when qx and qy have different lengths when assembling the Q point from affine coordinates.
- Ship the FIPS checksum file in the shared library package and create a separate trigger file for the FIPS selftests (bsc#1169569)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1069-1
Released: Wed Apr 22 16:48:00 2020
Summary: Recommended update for python-six
Type: recommended
Severity: moderate
References: 1166139
This update for python-six fixes the following issues:
- Use setuptools for building to support pip 10.x and avoid packages to be unistalled. (bsc#1166139)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1094-1
Released: Thu Apr 23 16:34:21 2020
Summary: Recommended update for python-google-api-python-client
Type: recommended
Severity: moderate
References: 1088358,1160933
This update for python-google-api-python-client fixes the following issues:
- Fix dependencies to use google-auth instead of deprecated
oauth2client (bsc#1160933, jsc#ECO-1148)
python-cachetools 2.0.1 is shipped to the Public Cloud Module.
python-google-auth 1.5.1 is shipped to the Public Cloud Module.
python-google-api-python-client was updated to:
- Upgrade to 1.7.4: just series of minor bugfixes
- Fix check for error text on Python 3.7. (#278)
- Use new Auth URIs. (#281)
- Add code-of-conduct document. (#270)
- Fix some typos in test_urllib3.py (#268)
- Warn when using user credentials from the Cloud SDK (#266)
- Add compute engine-based IDTokenCredentials (#236)
- Corrected some typos (#265)
Update to 1.4.2:
- Raise a helpful exception when trying to refresh credentials without
a refresh token. (#262)
- Fix links to README and CONTRIBUTING in docs/index.rst. (#260)
- Fix a typo in credentials.py. (#256)
- Use pytest instead of py.test per upstream recommendation,
#dropthedot. (#255)
- Fix typo on exemple of jwt usage (#245)
New upstream release 1.4.1 (bsc#1088358)
- Added a check for the cryptography version before attempting to use it.
+ From version 1.4.0
- Added `cryptography`-based RSA signer and verifier.
- Added `google.oauth2.service_account.IDTokenCredentials`.
- Improved documentation around ID Tokens
+ From version 1.3.0
- Added ``google.oauth2.credentials.Credentials.from_authorized_user_file``.
- Dropped direct pyasn1 dependency in favor of letting ``pyasn1-modules``
specify the right version.
- ``default()`` now checks for the project ID environment var before
warning about missing project ID.
- Fixed the docstrings for ``has_scopes()`` and ``with_scopes()``.
- Fixed example in docstring for ``ReadOnlyScoped``.
- Made ``transport.requests`` use timeouts and retries
to improve reliability.
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1108-1
Released: Fri Apr 24 16:31:01 2020
Summary: Recommended update for gnutls
Type: recommended
Severity: moderate
References: 1169992
This update for gnutls fixes the following issues:
- FIPS: Do not check for /etc/system-fips which we don't have (bsc#1169992)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1131-1
Released: Tue Apr 28 11:59:17 2020
Summary: Recommended update for mozilla-nss
Type: recommended
Severity: moderate
References: 1170571,1170572
This update for mozilla-nss fixes the following issues:
- FIPS: Add Softoken POSTs for new DSA and ECDSA hash-and-sign update functions. (bsc#1170571)
- FIPS: Add pairwise consistency check for CKM_SHA224_RSA_PKCS. Remove ditto checks
for CKM_RSA_PKCS, CKM_DSA and CKM_ECDSA, since these are served
by the new CKM_SHA224_RSA_PKCS, CKM_DSA_SHA224, CKM_ECDSA_SHA224
checks.
- FIPS: Replace bad attempt at unconditional nssdbm checksumming with
a dlopen(), so it can be located consistently and perform its own
self-tests.
- FIPS: This fixes an instance of inverted logic due to a boolean being mistaken for
a SECStatus, which caused key derivation to fail when the caller
provided a valid subprime.
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1175-1
Released: Tue May 5 08:33:43 2020
Summary: Recommended update for systemd
Type: recommended
Severity: moderate
References: 1165011,1168076
This update for systemd fixes the following issues:
- Fix check for address to keep interface names stable. (bsc#1168076)
- Fix for checking non-normalized WHAT for network FS. (bsc#1165011)
- Allow to specify an arbitrary string for when vfs is used. (bsc#1165011)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1214-1
Released: Thu May 7 11:20:34 2020
Summary: Recommended update for libgcrypt
Type: recommended
Severity: moderate
References: 1169944
This update for libgcrypt fixes the following issues:
- FIPS: libgcrypt: Fixed a double free in test_keys() on failed signature verification (bsc#1169944)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:1219-1
Released: Thu May 7 17:10:42 2020
Summary: Security update for openldap2
Type: security
Severity: important
References: 1170771,CVE-2020-12243
This update for openldap2 fixes the following issues:
- CVE-2020-12243: Fixed a denial of service related to recursive filters (bsc#1170771).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1226-1
Released: Fri May 8 10:51:05 2020
Summary: Recommended update for gcc9
Type: recommended
Severity: moderate
References: 1149995,1152590,1167898
This update for gcc9 fixes the following issues:
This update ships the GCC 9.3 release.
- Includes a fix for Internal compiler error when building HepMC (bsc#1167898)
- Includes fix for binutils version parsing
- Add libstdc++6-pp provides and conflicts to avoid file conflicts
with same minor version of libstdc++6-pp from gcc10.
- Add gcc9 autodetect -g at lto link (bsc#1149995)
- Install go tool buildid for bootstrapping go
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1271-1
Released: Wed May 13 13:17:59 2020
Summary: Recommended update for permissions
Type: recommended
Severity: important
References: 1171173
This update for permissions fixes the following issues:
- Remove setuid bit for newgidmap and newuidmap in paranoid profile. (bsc#1171173)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1290-1
Released: Fri May 15 16:39:59 2020
Summary: Recommended update for gnutls
Type: recommended
Severity: moderate
References: 1171422
This update for gnutls fixes the following issues:
- Add RSA 4096 key generation support in FIPS mode (bsc#1171422)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:1294-1
Released: Mon May 18 07:38:36 2020
Summary: Security update for file
Type: security
Severity: moderate
References: 1154661,1169512,CVE-2019-18218
This update for file fixes the following issues:
Security issues fixed:
- CVE-2019-18218: Fixed a heap-based buffer overflow in cdf_read_property_info() (bsc#1154661).
Non-security issue fixed:
- Fixed broken '--help' output (bsc#1169512).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:1299-1
Released: Mon May 18 07:43:21 2020
Summary: Security update for libxml2
Type: security
Severity: moderate
References: 1159928,1161517,1161521,CVE-2019-19956,CVE-2019-20388,CVE-2020-7595
This update for libxml2 fixes the following issues:
- CVE-2019-20388: Fixed a memory leak in xmlSchemaPreRun (bsc#1161521).
- CVE-2019-19956: Fixed a memory leak (bsc#1159928).
- CVE-2020-7595: Fixed an infinite loop in an EOF situation (bsc#1161517).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1303-1
Released: Mon May 18 09:40:36 2020
Summary: Recommended update for timezone
Type: recommended
Severity: moderate
References: 1169582
This update for timezone fixes the following issues:
- timezone update 2020a. (bsc#1169582)
* Morocco springs forward on 2020-05-31, not 2020-05-24.
* Canada's Yukon advanced to -07 year-round on 2020-03-08.
* America/Nuuk renamed from America/Godthab.
* zic now supports expiration dates for leap second lists.
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1308-1
Released: Mon May 18 10:05:46 2020
Summary: Recommended update for psmisc
Type: recommended
Severity: moderate
References: 1170247
This update for psmisc fixes the following issues:
- Allow not unique mounts as well as not unique mountpoint. (bsc#1170247)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1328-1
Released: Mon May 18 17:16:04 2020
Summary: Recommended update for grep
Type: recommended
Severity: moderate
References: 1155271
This update for grep fixes the following issues:
- Update testsuite expectations, no functional changes (bsc#1155271)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1342-1
Released: Tue May 19 13:27:31 2020
Summary: Recommended update for python3
Type: recommended
Severity: moderate
References: 1149955,1165894,CVE-2019-16056
This update for python3 fixes the following issues:
- Changed the name of idle3 icons to idle3.png to avoid collision with Python 2 version (bsc#1165894).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1348-1
Released: Wed May 20 11:37:41 2020
Summary: Recommended update for mozilla-nss
Type: recommended
Severity: moderate
References: 1170908
This update for mozilla-nss fixes the following issues:
The following issues are fixed:
- Add AES Keywrap POST.
- Accept EACCES in lieu of ENOENT when trying to access /proc/sys/crypto/fips_enabled (bsc#1170908).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1361-1
Released: Thu May 21 09:31:18 2020
Summary: Recommended update for libgcrypt
Type: recommended
Severity: moderate
References: 1171872
This update for libgcrypt fixes the following issues:
- FIPS: RSA/DSA/ECC test_keys() print out debug messages only in debug mode (bsc#1171872)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1370-1
Released: Thu May 21 19:06:00 2020
Summary: Recommended update for systemd-presets-branding-SLE
Type: recommended
Severity: moderate
References: 1171656
This update for systemd-presets-branding-SLE fixes the following issues:
Cleanup of outdated autostart services (bsc#1171656):
- Remove acpid.service. acpid is only available on SLE via openSUSE
backports. In openSUSE acpid.service is *not* autostarted. I see no
reason why it should be on SLE.
- Remove spamassassin.timer. This timer never seems to have existed.
Instead spamassassin ships a 'sa-update.timer'. But it is not
default-enabled and nobody ever complained about this.
- Remove snapd.apparmor.service: This service was proactively added a year
ago, but snapd didn't even make it into openSUSE yet. There's no reason
to keep this entry unless snapd actually enters SLE which is not
foreseeable.
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1400-1
Released: Mon May 25 14:09:02 2020
Summary: Recommended update for glibc
Type: recommended
Severity: moderate
References: 1162930
This update for glibc fixes the following issues:
- nptl: wait for pending setxid request also in detached thread. (bsc#1162930)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1404-1
Released: Mon May 25 15:32:34 2020
Summary: Recommended update for zlib
Type: recommended
Severity: moderate
References: 1138793,1166260
This update for zlib fixes the following issues:
- Including the latest fixes from IBM (bsc#1166260)
IBM Z mainframes starting from version z15 provide DFLTCC instruction, which implements
deflate algorithm in hardware with estimated compression and decompression performance
orders of magnitude faster than the current zlib and ratio comparable with that of level 1.
- Add SUSE specific fix to solve bsc#1138793.
The fix will avoid to test if the app was linked with exactly same version of zlib
like the one that is present on the runtime.
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1411-1
Released: Mon May 25 19:09:51 2020
Summary: Recommended update for python-cheroot
Type: recommended
Severity: moderate
References: 1169604
This update for python-cheroot fixes the following issues:
- Fix to avoid possible race condition on persistent HTTP connections via SSH tunnel over proxy. (bsc#1169604)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1492-1
Released: Wed May 27 18:32:41 2020
Summary: Recommended update for python-rpm-macros
Type: recommended
Severity: moderate
References: 1171561
This update for python-rpm-macros fixes the following issue:
- Update to version 20200207.5feb6c1 (bsc#1171561)
* Do not write .pyc files for tests
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1496-1
Released: Wed May 27 20:30:31 2020
Summary: Recommended update for python-requests
Type: recommended
Severity: low
References: 1170175
This update for python-requests fixes the following issues:
- Fix for warnings 'test fails to build' for python http. (bsc#1170175)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1506-1
Released: Fri May 29 17:22:11 2020
Summary: Recommended update for aaa_base
Type: recommended
Severity: moderate
References: 1087982,1170527
This update for aaa_base fixes the following issues:
- Not all XTerm based emulators do have a terminfo entry. (bsc#1087982)
- Better support of Midnight Commander. (bsc#1170527)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:1532-1
Released: Thu Jun 4 10:16:12 2020
Summary: Security update for libxml2
Type: security
Severity: moderate
References: 1172021,CVE-2019-19956
This update for libxml2 fixes the following issues:
- CVE-2019-19956: Reverted the upstream fix for this memory leak because it introduced other, more severe vulnerabilities (bsc#1172021).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1542-1
Released: Thu Jun 4 13:24:37 2020
Summary: Recommended update for timezone
Type: recommended
Severity: moderate
References: 1172055
This update for timezone fixes the following issue:
- zdump --version reported 'unknown' (bsc#1172055)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1562-1
Released: Mon Jun 8 12:39:15 2020
Summary: Recommended update for lvm2
Type: recommended
Severity: moderate
References: 1145231,1150021,1158358,1163526,1164126,1164718
This update for lvm2 fixes the following issues:
- Fix heap memory leak in lvmetad. (bsc#1164126)
- lvmetad uses devices/global_filter but not devices/filter after lvm2 update. (bsc#1163526)
This config item global_filter_compat is a SUSE special.
The default value is 1, which means the devices/global_filter behaviour is same as before.
When the value is 0, user should use global_filter to control system-wide software,
e.g. udev and lvmetad global_filter_compat are not opened by LVM.
- Avoid creation of mixed-blocksize 'PV' on 'LVM' volume groups (LVM2). (bsc#1149408)
- Fix for LVM metadata when an error occurs writing device. (bsc#1150021)
- Fix for boot when it takes extremely long time with 400 LUN's. (bsc#1158358)
- Fix for LVM metadata to avoid faulty LVM detection. (bsc#1145231)
- Enhance block cache code to fix issues with 'lvmtad' and 'lvmcache'. (bsc#1164718)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1579-1
Released: Tue Jun 9 17:05:23 2020
Summary: Recommended update for audit
Type: recommended
Severity: important
References: 1156159,1172295
This update for audit fixes the following issues:
- Fix hang on startup. (bsc#1156159)
- Fix specfile to require libauparse0 and libaudit1 after splitting audit-libs. (bsc#1172295)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:1584-1
Released: Tue Jun 9 18:39:15 2020
Summary: Security update for gnutls
Type: security
Severity: important
References: 1172461,1172506,CVE-2020-13777
This update for gnutls fixes the following issues:
- CVE-2020-13777: Fixed an insecure session ticket key construction which could
have made the TLS server to not bind the session ticket encryption key with a
value supplied by the application until the initial key rotation, allowing
an attacker to bypass authentication in TLS 1.3 and recover previous
conversations in TLS 1.2 (bsc#1172506).
- Fixed an improper handling of certificate chain with cross-signed intermediate
CA certificates (bsc#1172461).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1611-1
Released: Fri Jun 12 09:38:03 2020
Summary: Recommended update for libsolv, libzypp, zypper
Type: recommended
Severity: moderate
References: 1130873,1154803,1164543,1165476,1165573,1166610,1167122,1168990
This update for libsolv, libzypp, zypper fixes the following issues:
libsolv was updated to 0.7.13 to fix:
- Fix solvable swapping messing up idarrays
- fix ruleinfo of complex dependencies returning the wrong origin
libzypp was updated to 17.23.4 to fix:
- Get retracted patch status from updateinfo data (jsc#SLE-8770)
libsolv injects the indicator provides into packages only.
- remove 'using namespace std;' (bsc#1166610, fixes #218)
- Online doc: add 'Hardware (modalias) dependencies' page
(fixes #216)
- Add HistoryLogReader actionFilter to parse only specific
HistoryActionIDs.
- RepoVariables: Add safe guard in case the caller does not own a
zypp instance.
- Enable c++17. Define libyzpp CXX_STANDARD in ZyppCommon.cmake.
- Fix package status computation regarding unneeded, orphaned, recommended
and suggested packages (broken in 17.23.0) (bsc#1165476)
- Log patch status changes to history (jsc#SLE-5116)
- Allow to disable all WebServer dependent tests when building. OBS
wants to be able to get rid of the nginx/FastCGI-devel build
requirement. Use 'rpmbuild --without mediabackend_tests' or
'cmake -DDISABLE_MEDIABACKEND_TESTS=1'.
- update translations
- boost: Fix deprecated auto_unit_test.hpp includes.
- Disable zchunk on Leap-15.0 and SLE15-* while there is no libzck.
- Fix decision whether to download ZCHUNK files.
libzypp and libsolv must both be able to read the format.
- yum::Downloader: Prefer zchunk compressed metadata if libvsolv
supports it.
- Selectable: Fix highestAvailableVersionObj if only retracted
packages are available. Avoid using retracted items as candidate
(jsc#SLE-8770)
- RpmDb: Become rpmdb backend independent (jsc#SLE-7272)
- RpmDb: Close API offering a custom rpmdb path
It's actually not needed and for this to work also libsolv needs
to support it. You can sill use a librpmDb::db_const_iterator to
access a database at a custom location (ro).
- Remove legacy rpmV3database conversion code.
- Reformat manpages to workaround asciidoctor shortcomings
(bsc#1154803, bsc#1167122, bsc#1168990)
- Remove undocumented rug legacy stuff.
- Remove 'using namespace std;' (bsc#1166610)
- patch table: Add 'Since' column if history data are available
(jsc#SLE-5116)
zypper was updated to version 1.14.36:
- Tag 'retracted' patch status in info and list-patches (jsc#SLE-8770)
- Tag 'R'etracted items in search tabes status columns (jsc#SLE-8770)
- Relax 'Do not allow the abbreviation of cli arguments' in
legacy distibutions (bsc#1164543)
- Correctly detect ambigous switch abbreviations (bsc#1165573)
- zypper-aptitude: don't supplement zypper.
supplementing zypper means zypper-aptitude gets installed by
default and pulls in perl. Neither is desired on small systems.
- Do not allow the abbreviation of cli arguments (bsc#1164543)
- accoring to according in all translation files.
- Always show exception history if available.
- Use default package cache location for temporary repos (bsc#1130873)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1637-1
Released: Wed Jun 17 15:07:58 2020
Summary: Recommended update for zypper
Type: recommended
Severity: important
References: 1169947,1172925
This update for zypper fixes the following issues:
- Print switch abbrev warning to stderr (bsc#1172925)
- Fix typo in man page (bsc#1169947)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:1677-1
Released: Thu Jun 18 18:16:39 2020
Summary: Security update for mozilla-nspr, mozilla-nss
Type: security
Severity: important
References: 1159819,1169746,1171978,CVE-2019-17006,CVE-2020-12399
This update for mozilla-nspr, mozilla-nss fixes the following issues:
mozilla-nss was updated to version 3.53
- CVE-2020-12399: Fixed a timing attack on DSA signature generation (bsc#1171978).
- CVE-2019-17006: Added length checks for cryptographic primitives (bsc#1159819).
Release notes: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.53_release_notes
mozilla-nspr to version 4.25
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:1682-1
Released: Fri Jun 19 09:44:54 2020
Summary: Security update for perl
Type: security
Severity: important
References: 1171863,1171864,1171866,1172348,CVE-2020-10543,CVE-2020-10878,CVE-2020-12723
This update for perl fixes the following issues:
- CVE-2020-10543: Fixed a heap buffer overflow in regular expression compiler which could have
allowed overwriting of allocated memory with attacker's data (bsc#1171863).
- CVE-2020-10878: Fixed multiple integer overflows which could have allowed the insertion of
instructions into the compiled form of Perl regular expression (bsc#1171864).
- CVE-2020-12723: Fixed an attacker's corruption of the intermediate language state of a
compiled regular expression (bsc#1171866).
- Fixed a bad warning in features.ph (bsc#1172348).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1745-1
Released: Thu Jun 25 10:02:41 2020
Summary: Recommended update for suse-module-tools
Type: recommended
Severity: moderate
References: 1132798,1142152,1158817,1166531,937216
This update for suse-module-tools fixes the following issues:
- Fixes a dependency issue on ppc64le with papr_scm (bsc#1142152, fate#327775)
- Fixes an issue where KVM virtualized machines with libvirt don't come up with an active
ethernet connection when the host's bridge device is being used (openSUSE Leap only) (bsc#1158817)
- Added new configuration file for s390x: modprobe.conf.s390x (bsc#1132798)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1759-1
Released: Thu Jun 25 18:44:37 2020
Summary: Recommended update for krb5
Type: recommended
Severity: moderate
References: 1169357
This update for krb5 fixes the following issue:
- Call systemd to reload the services instead of init-scripts. (bsc#1169357)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1760-1
Released: Thu Jun 25 18:46:13 2020
Summary: Recommended update for systemd
Type: recommended
Severity: moderate
References: 1157315,1162698,1164538,1169488,1171145,1172072
This update for systemd fixes the following issues:
- Merge branch 'SUSE/v234' into SLE15
units: starting suspend.target should not fail when suspend is successful (bsc#1172072)
core/mount: do not add Before=local-fs.target or remote-fs.target if nofail mount option is set
mount: let mount_add_extras() take care of remote-fs.target deps (bsc#1169488)
mount: set up local-fs.target/remote-fs.target deps in mount_add_default_dependencies() too
udev: rename the persistent link for ATA devices (bsc#1164538)
shared/install: try harder to find enablement symlinks when disabling a unit (bsc#1157315)
tmpfiles: remove unnecessary assert (bsc#1171145)
test-engine: manager_free() was called too early
pid1: by default make user units inherit their umask from the user manager (bsc#1162698)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:1773-1
Released: Fri Jun 26 08:05:59 2020
Summary: Security update for curl
Type: security
Severity: important
References: 1173027,CVE-2020-8177
This update for curl fixes the following issues:
- CVE-2020-8177: Fixed an issue where curl could have been tricked by a malicious
server to overwrite a local file when using the -J option (bsc#1173027).
-----------------------------------------------------------------
Advisory ID: SUSE-OU-2020:1787-1
Released: Fri Jun 26 09:28:58 2020
Summary: Recommended update for python-scipy
Type: optional
Severity: low
References: 1171510
This update for python-scipy doesn't fix any user visible issues, but improves the
package building process.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:1822-1
Released: Thu Jul 2 11:30:42 2020
Summary: Security update for python3
Type: security
Severity: important
References: 1173274,CVE-2020-14422
This update for python3 fixes the following issues:
- CVE-2020-14422: Fixed an improper computation of hash values in the IPv4Interface and IPv6Interface
could have led to denial of service (bsc#1173274).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:1396-1
Released: Fri Jul 3 12:33:05 2020
Summary: Security update for zstd
Type: security
Severity: moderate
References: 1082318,1133297
This update for zstd fixes the following issues:
- Fix for build error caused by wrong static libraries. (bsc#1133297)
- Correction in spec file marking the license as documentation. (bsc#1082318)
- Add new package for SLE-15. (jsc#ECO-1886)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:1850-1
Released: Mon Jul 6 14:44:39 2020
Summary: Security update for mozilla-nss
Type: security
Severity: moderate
References: 1168669,1173032,CVE-2020-12402
This update for mozilla-nss fixes the following issues:
mozilla-nss was updated to version 3.53.1
- CVE-2020-12402: Fixed a potential side channel attack during RSA key generation (bsc#1173032)
- Fixed various FIPS issues in libfreebl3 which were causing segfaults in the test suite of chrony (bsc#1168669).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:1856-1
Released: Mon Jul 6 17:05:51 2020
Summary: Security update for openldap2
Type: security
Severity: important
References: 1172698,1172704,CVE-2020-8023
This update for openldap2 fixes the following issues:
- CVE-2020-8023: Fixed a potential local privilege escalation from ldap to root when OPENLDAP_CONFIG_BACKEND='ldap' was used (bsc#1172698).
- Changed DB_CONFIG to root:ldap permissions (bsc#1172704).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:1860-1
Released: Mon Jul 6 17:09:44 2020
Summary: Security update for permissions
Type: security
Severity: moderate
References: 1171883
This update for permissions fixes the following issues:
- Removed conflicting entries which might expose pcp to security issues (bsc#1171883)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1869-1
Released: Tue Jul 7 15:08:12 2020
Summary: Recommended update for libsolv, libzypp, zypper
Type: recommended
Severity: moderate
References: 1130873,1154803,1164543,1165476,1165573,1166610,1167122,1168990,1169947,1170801,1171224,1172135,1172925
This update for libsolv, libzypp, zypper fixes the following issues:
libsolv was updated to 0.7.14:
- Enable zstd compression support
- Support blacklisted packages in solver_findproblemrule()
(bnc#1172135)
- Support rules with multiple negative literals in choice rule
generation
- Fix solvable swapping messing up idarrays
- fix ruleinfo of complex dependencies returning the wrong origin
libzypp was updated to 17.23.7:
- Enable zchunk metadata download if libsolv supports it.
- Older kernel-devel packages are not properly purged (bsc#1171224)
- doc: enhance service plugin example.
- Get retracted patch status from updateinfo data (jsc#SLE-8770)
libsolv injects the indicator provides into packages only.
- remove 'using namespace std;' (bsc#1166610, fixes #218)
- Online doc: add 'Hardware (modalias) dependencies' page
(fixes #216)
- Add HistoryLogReader actionFilter to parse only specific
HistoryActionIDs.
- RepoVariables: Add safe guard in case the caller does not own a
zypp instance.
- Enable c++17. Define libyzpp CXX_STANDARD in ZyppCommon.cmake.
- Fix package status computation regarding unneeded, orphaned, recommended
and suggested packages (broken in 17.23.0) (bsc#1165476)
- Log patch status changes to history (jsc#SLE-5116)
- Allow to disable all WebServer dependent tests when building. OBS
wants to be able to get rid of the nginx/FastCGI-devel build
requirement. Use 'rpmbuild --without mediabackend_tests' or
'cmake -DDISABLE_MEDIABACKEND_TESTS=1'.
- boost: Fix deprecated auto_unit_test.hpp includes.
- Disable zchunk on Leap-15.0 and SLE15-* while there is no libzck.
- Fix decision whether to download ZCHUNK files.
libzypp and libsolv must both be able to read the format.
- yum::Downloader: Prefer zchunk compressed metadata if libvsolv
supports it.
- Selectable: Fix highestAvailableVersionObj if only retracted
packages are available. Avoid using retracted items as candidate
(jsc#SLE-8770)
- RpmDb: Become rpmdb backend independent (jsc#SLE-7272)
- RpmDb: Close API offering a custom rpmdb path
It's actually not needed and for this to work also libsolv needs
to support it. You can sill use a librpmDb::db_const_iterator to
access a database at a custom location (ro).
- Remove legacy rpmV3database conversion code.
- Fix core dump with corrupted history file (bsc#1170801)
zypper was updated to 1.14.37:
- Reformat manpages to workaround asciidoctor shortcomings
(bsc#1154803, bsc#1167122, bsc#1168990)
- Remove undocumented rug legacy stuff.
- Remove 'using namespace std;' (bsc#1166610)
- patch table: Add 'Since' column if history data are available
(jsc#SLE-5116)
- Tag 'retracted' patch status in info and list-patches (jsc#SLE-8770)
- Tag 'R'etracted items in search tabes status columns (jsc#SLE-8770)
- Relax 'Do not allow the abbreviation of cli arguments' in
legacy distibutions (bsc#1164543)
- Correctly detect ambigous switch abbreviations (bsc#1165573)
- zypper-aptitude: don't supplement zypper.
supplementing zypper means zypper-aptitude gets installed by
default and pulls in perl. Neither is desired on small systems.
- Do not allow the abbreviation of cli arguments (bsc#1164543)
- accoring to according in all translation files.
- Always show exception history if available.
- Use default package cache location for temporary repos (bsc#1130873)
- Print switch abbrev warning to stderr (bsc#1172925)
- Fix typo in man page (bsc#1169947)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1929-1
Released: Wed Jul 15 14:59:50 2020
Summary: Recommended update for python-numpy
Type: recommended
Severity: low
References: 1166678
This update for python-numpy fixes the following issues:
- Fixes a file conflict with /usr/bin/f2py (bsc#1166678)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:1953-1
Released: Sat Jul 18 03:06:11 2020
Summary: Recommended update for parted
Type: recommended
Severity: important
References: 1164260
This update for parted fixes the following issue:
- fix support of NVDIMM (pmemXs) devices (bsc#1164260)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:2040-1
Released: Fri Jul 24 13:58:53 2020
Summary: Recommended update for libsolv, libzypp
Type: recommended
Severity: moderate
References: 1170801,1171224,1172135,1173106,1174011
This update for libsolv, libzypp fixes the following issues:
libsolv was updated to version 0.7.14:
- Enable zstd compression support for sle15
- Support blacklisted packages in solver_findproblemrule() (bsc#1172135)
- Support rules with multiple negative literals in choice rule
generation
libzypp was updated to version 17.24.0:
- Enable zchunk metadata download if libsolv supports it.
- Older kernel-devel packages are not properly purged (bsc#1171224)
- doc: enhance service plugin example.
- Fix core dump with corrupted history file (bsc#1170801)
- Better handling of the purge-kernels algorithm. (bsc#1173106)
- Proactively send credentials if the URL specifes '?auth=basic' and a username.
(bsc#1174011)
- ZYPP_MEDIA_CURL_DEBUG: Strip credentials in header log. (bsc#1174011)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:2083-1
Released: Thu Jul 30 10:27:59 2020
Summary: Recommended update for diffutils
Type: recommended
Severity: moderate
References: 1156913
This update for diffutils fixes the following issue:
- Disable a sporadically failing test for ppc64 and ppc64le builds. (bsc#1156913)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:2099-1
Released: Fri Jul 31 08:06:40 2020
Summary: Recommended update for systemd
Type: recommended
Severity: moderate
References: 1173227,1173229,1173422
This update for systemd fixes the following issues:
- migrate-sysconfig-i18n.sh: fixed marker handling (bsc#1173229)
The marker is used to make sure the script is run only once. Instead
of storing it in /usr, use /var which is more appropriate for such
file.
Also make it owned by systemd package.
- Fix inconsistent file modes for some ghost files (bsc#1173227)
Ghost files are assumed by rpm to have mode 000 by default which is
not consistent with file permissions set at runtime.
Also /var/lib/systemd/random-seed was tracked wrongly as a
directory.
Also don't track (ghost) /etc/systemd/system/runlevel*.target
aliases since we're not supposed to track units or aliases user
might define/override.
- Fix build of systemd on openSUSE Leap 15.2 (bsc#1173422)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:2124-1
Released: Wed Aug 5 09:24:47 2020
Summary: Recommended update for lvm2
Type: recommended
Severity: moderate
References: 1172597
This update for lvm2 fixes the following issues:
- Fixed an issue where the system hangs for 90 seconds before it actually shuts down (bsc#1172597)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:2224-1
Released: Thu Aug 13 09:15:47 2020
Summary: Recommended update for glibc
Type: recommended
Severity: moderate
References: 1171878,1172085
This update for glibc fixes the following issues:
- Fix concurrent changes on nscd aware files appeared by 'getent' when the NSCD cache was enabled. (bsc#1171878, BZ #23178)
- Implement correct locking and cancellation cleanup in syslog functions. (bsc#1172085, BZ #26100)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:2277-1
Released: Wed Aug 19 13:24:03 2020
Summary: Security update for python3
Type: security
Severity: moderate
References: 1174091,CVE-2019-20907
This update for python3 fixes the following issues:
- bsc#1174091, CVE-2019-20907: avoiding possible infinite loop in specifically crafted tarball.
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:2278-1
Released: Wed Aug 19 21:26:08 2020
Summary: Recommended update for util-linux
Type: recommended
Severity: moderate
References: 1149911,1151708,1168235,1168389
This update for util-linux fixes the following issues:
- blockdev: Do not fail --report on kpartx-style partitions on multipath. (bsc#1168235)
- nologin: Add support for -c to prevent error from su -c. (bsc#1151708)
- Avoid triggering autofs in lookup_umount_fs_by_statfs. (bsc#1168389)
- mount: Fall back to device node name if /dev/mapper link not found. (bsc#1149911)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:2284-1
Released: Thu Aug 20 16:04:17 2020
Summary: Recommended update for ca-certificates-mozilla
Type: recommended
Severity: important
References: 1010996,1071152,1071390,1154871,1174673,973042
This update for ca-certificates-mozilla fixes the following issues:
update to 2.42 state of the Mozilla NSS Certificate store (bsc#1174673)
Removed CAs:
* AddTrust External CA Root
* AddTrust Class 1 CA Root
* LuxTrust Global Root 2
* Staat der Nederlanden Root CA - G2
* Symantec Class 1 Public Primary Certification Authority - G4
* Symantec Class 2 Public Primary Certification Authority - G4
* VeriSign Class 3 Public Primary Certification Authority - G3
Added CAs:
* certSIGN Root CA G2
* e-Szigno Root CA 2017
* Microsoft ECC Root Certificate Authority 2017
* Microsoft RSA Root Certificate Authority 2017
- reverted p11-kit nss trust integration as it breaks in fresh installations (bsc#1154871)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:2384-1
Released: Sat Aug 29 00:57:13 2020
Summary: Recommended update for e2fsprogs
Type: recommended
Severity: low
References: 1170964
This update for e2fsprogs fixes the following issues:
- Fix for an issue when system message with placeholders are not properly replaced. (bsc#1170964)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:2411-1
Released: Tue Sep 1 13:28:47 2020
Summary: Recommended update for systemd
Type: recommended
Severity: moderate
References: 1142733,1146991,1158336,1172195,1172824,1173539
This update for systemd fixes the following issues:
- Improve logging when PID1 fails at setting a namespace up when spawning a command specified by
'Exec*='. (bsc#1172824, bsc#1142733)
pid1: improve message when setting up namespace fails.
execute: let's close glibc syslog channels too.
execute: normalize logging in *execute.c*.
execute: fix typo in error message.
execute: drop explicit *log_open()*/*log_close()* now that it is unnecessary.
execute: make use of the new logging mode in *execute.c*
log: add a mode where we open the log fds for every single log message.
log: let's make use of the fact that our functions return the negative error code for *log_oom()* too.
execute: downgrade a log message ERR → WARNING, since we proceed ignoring its result.
execute: rework logging in *setup_keyring()* to include unit info.
execute: improve and augment execution log messages.
- vconsole-setup: downgrade log message when setting font fails on dummy console. (bsc#1172195 bsc#1173539)
- fix infinite timeout. (bsc#1158336)
- bpf: mount bpffs by default on boot. (bsc#1146991)
- man: explain precedence for options which take a list.
- man: unify titling, fix description of precedence in sysusers.d(5)
- udev-event: fix timeout log messages.
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:2420-1
Released: Tue Sep 1 13:48:35 2020
Summary: Recommended update for zlib
Type: recommended
Severity: moderate
References: 1174551,1174736
This update for zlib provides the following fixes:
- Permit a deflateParams() parameter change as soon as possible. (bsc#1174736)
- Fix DFLTCC not flushing EOBS when creating raw streams. (bsc#1174551)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:2425-1
Released: Tue Sep 1 13:54:05 2020
Summary: Recommended update for nfs-utils
Type: recommended
Severity: moderate
References: 1174260
This update for nfs-utils fixes the following issues:
- Fix a bug when concurrent 'gssd' requests arrive from kernel, causing hanging NFS mounts. (bsc#1174260)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:2446-1
Released: Wed Sep 2 09:33:22 2020
Summary: Security update for curl
Type: security
Severity: moderate
References: 1175109,CVE-2020-8231
This update for curl fixes the following issues:
- An application that performs multiple requests with libcurl's
multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
rare circumstances experience that when subsequently using the
setup connect-only transfer, libcurl will pick and use the wrong
connection and instead pick another one the application has
created since then. [bsc#1175109, CVE-2020-8231]
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:2581-1
Released: Wed Sep 9 13:07:07 2020
Summary: Security update for openldap2
Type: security
Severity: moderate
References: 1174154,CVE-2020-15719
This update for openldap2 fixes the following issues:
- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
SAN's falling back to CN validation in violation of rfc6125.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:2612-1
Released: Fri Sep 11 11:18:01 2020
Summary: Security update for libxml2
Type: security
Severity: moderate
References: 1176179,CVE-2020-24977
This update for libxml2 fixes the following issues:
- CVE-2020-24977: Fixed a global-buffer-overflow in xmlEncodeEntitiesInternal (bsc#1176179).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:2638-1
Released: Tue Sep 15 15:41:32 2020
Summary: Recommended update for cryptsetup
Type: recommended
Severity: moderate
References: 1165580
This update for cryptsetup fixes the following issues:
Update from version 2.0.5 to version 2.0.6. (jsc#SLE-5911, bsc#1165580)
- Fix support of larger metadata areas in *LUKS2* header.
This release properly supports all specified metadata areas, as documented
in *LUKS2* format description.
Currently, only default metadata area size is used (in format or convert).
Later cryptsetup versions will allow increasing this metadata area size.
- If *AEAD* (authenticated encryption) is used, cryptsetup now tries to check
if the requested *AEAD* algorithm with specified key size is available in kernel crypto API.
This change avoids formatting a device that cannot be later activated.
For this function, the kernel must be compiled with the *CONFIG_CRYPTO_USER_API_AEAD* option enabled.
Note that kernel user crypto API options (*CONFIG_CRYPTO_USER_API* and *CONFIG_CRYPTO_USER_API_SKCIPHER*)
are already mandatory for LUKS2.
- Fix setting of integrity no-journal flag. Now you can store this flag to metadata using *\--persistent* option.
- Fix cryptsetup-reencrypt to not keep temporary reencryption headers if interrupted during initial password prompt.
- Adds early check to plain and LUKS2 formats to disallow device format if device size is not aligned to requested
sector size. Previously it was possible, and the device was rejected to activate by kernel later.
- Fix checking of hash algorithms availability for *PBKDF* early. Previously *LUKS2* format allowed non-existent hash
algorithm with invalid keyslot preventing the device from activation.
- Allow Adiantum cipher construction (a non-authenticated length-preserving fast encryption scheme), so it can be used
both for data encryption and keyslot encryption in *LUKS1/2* devices.
For benchmark, use:
# cryptsetup benchmark -c xchacha12,aes-adiantum
# cryptsetup benchmark -c xchacha20,aes-adiantum
For LUKS format:
# cryptsetup luksFormat -c xchacha20,aes-adiantum-plain64 -s 256 <device>
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:2651-1
Released: Wed Sep 16 14:42:55 2020
Summary: Recommended update for zlib
Type: recommended
Severity: moderate
References: 1175811,1175830,1175831
This update for zlib fixes the following issues:
- Fix compression level switching (bsc#1175811, bsc#1175830, bsc#1175831)
- Enable hardware compression on s390/s390x (jsc#SLE-13776)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:2704-1
Released: Tue Sep 22 15:06:36 2020
Summary: Recommended update for krb5
Type: recommended
Severity: moderate
References: 1174079
This update for krb5 fixes the following issue:
- Fix prefix reported by krb5-config, libraries and headers are not installed under /usr/lib/mit prefix. (bsc#1174079)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:2712-1
Released: Tue Sep 22 17:08:03 2020
Summary: Security update for openldap2
Type: security
Severity: moderate
References: 1175568,CVE-2020-8027
This update for openldap2 fixes the following issues:
- CVE-2020-8027: openldap_update_modules_path.sh starts daemons unconditionally and uses fixed paths in /tmp (bsc#1175568).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:2757-1
Released: Fri Sep 25 19:45:40 2020
Summary: Recommended update for nfs-utils
Type: recommended
Severity: moderate
References: 1173104
This update for nfs-utils fixes the following issue:
- Some scripts are requiring Python2 while it is not installed by default and they can work with Python3. (bsc#1173104)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:2818-1
Released: Thu Oct 1 10:38:55 2020
Summary: Recommended update for libzypp, zypper
Type: recommended
Severity: moderate
References: 1165424,1173273,1173529,1174240,1174561,1174918,1175342,1175592
This update for libzypp, zypper provides the following fixes:
Changes in libzypp:
- VendorAttr: Const-correct API and let Target provide its settings. (bsc#1174918)
- Support buildnr with commit hash in purge-kernels. This adds special behaviour for when
a kernel version has the rebuild counter before the kernel commit hash. (bsc#1175342)
- Improve Italian translation of the 'breaking dependencies' message. (bsc#1173529)
- Make sure reading from lsof does not block forever. (bsc#1174240)
- Just collect details for the signatures found.
Changes in zypper:
- man: Enhance description of the global package cache. (bsc#1175592)
- man: Point out that plain rpm packages are not downloaded to the global package cache.
(bsc#1173273)
- Directly list subcommands in 'zypper help'. (bsc#1165424)
- Remove extern C block wrapping augeas.h as it breaks the build on Arch Linux.
- Point out that plaindir repos do not follow symlinks. (bsc#1174561)
- Fix help command for list-patches.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:2830-1
Released: Fri Oct 2 10:34:26 2020
Summary: Security update for permissions
Type: security
Severity: moderate
References: 1161335,1176625
This update for permissions fixes the following issues:
- whitelist WMP (bsc#1161335, bsc#1176625)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:2855-1
Released: Mon Oct 5 08:26:53 2020
Summary: Recommended update for nfs-ganesha
Type: recommended
Severity: moderate
References: 1176263
This update for nfs-ganesha fixes the following issues:
- Version upgrade to version 2.8.4+git0.28562219d includes a lot of bug fixes.
Please refer to this package's changelog to get a full list of all bug fixes.
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:2869-1
Released: Tue Oct 6 16:13:20 2020
Summary: Recommended update for aaa_base
Type: recommended
Severity: moderate
References: 1011548,1153943,1153946,1161239,1171762
This update for aaa_base fixes the following issues:
- DIR_COLORS (bug#1006973):
- add screen.xterm-256color
- add TERM rxvt-unicode-256color
- sort and merge TERM entries in etc/DIR_COLORS
- check for Packages.db and use this instead of Packages. (bsc#1171762)
- Rename path() to _path() to avoid using a general name.
- refresh_initrd call modprobe as /sbin/modprobe (bsc#1011548)
- etc/profile add some missing ;; in case esac statements
- profile and csh.login: on s390x set TERM to dumb on dumb terminal (bsc#1153946)
- backup-rpmdb: exit if zypper is running (bsc#1161239)
- Add color alias for ip command (jsc#sle-9880, jsc#SLE-7679, bsc#1153943)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:2901-1
Released: Tue Oct 13 14:22:43 2020
Summary: Security update for libproxy
Type: security
Severity: important
References: 1176410,1177143,CVE-2020-25219,CVE-2020-26154
This update for libproxy fixes the following issues:
- CVE-2020-25219: Rewrote url::recvline to be nonrecursive (bsc#1176410).
- CVE-2020-26154: Fixed a buffer overflow when PAC is enabled (bsc#1177143).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:2914-1
Released: Tue Oct 13 17:25:20 2020
Summary: Security update for bind
Type: security
Severity: moderate
References: 1100369,1109160,1118367,1118368,1128220,1156205,1157051,1161168,1170667,1170713,1171313,1171740,1172958,1173307,1173311,1173983,1175443,1176092,1176674,906079,CVE-2017-3136,CVE-2018-5741,CVE-2019-6477,CVE-2020-8616,CVE-2020-8617,CVE-2020-8618,CVE-2020-8619,CVE-2020-8620,CVE-2020-8621,CVE-2020-8622,CVE-2020-8623,CVE-2020-8624
This update for bind fixes the following issues:
BIND was upgraded to version 9.16.6:
Note:
- bind is now more strict in regards to DNSSEC. If queries are not working,
check for DNSSEC issues. For instance, if bind is used in a namserver
forwarder chain, the forwarding DNS servers must support DNSSEC.
Fixing security issues:
- CVE-2020-8616: Further limit the number of queries that can be triggered from
a request. Root and TLD servers are no longer exempt
from max-recursion-queries. Fetches for missing name server. (bsc#1171740)
Address records are limited to 4 for any domain.
- CVE-2020-8617: Replaying a TSIG BADTIME response as a request could trigger an
assertion failure. (bsc#1171740)
- CVE-2019-6477: Fixed an issue where TCP-pipelined queries could bypass
the tcp-clients limit (bsc#1157051).
- CVE-2018-5741: Fixed the documentation (bsc#1109160).
- CVE-2020-8618: It was possible to trigger an INSIST when determining
whether a record would fit into a TCP message buffer (bsc#1172958).
- CVE-2020-8619: It was possible to trigger an INSIST in
lib/dns/rbtdb.c:new_reference() with a particular zone content
and query patterns (bsc#1172958).
- CVE-2020-8624: 'update-policy' rules of type 'subdomain' were
incorrectly treated as 'zonesub' rules, which allowed
keys used in 'subdomain' rules to update names outside
of the specified subdomains. The problem was fixed by
making sure 'subdomain' rules are again processed as
described in the ARM (bsc#1175443).
- CVE-2020-8623: When BIND 9 was compiled with native PKCS#11 support, it
was possible to trigger an assertion failure in code
determining the number of bits in the PKCS#11 RSA public
key with a specially crafted packet (bsc#1175443).
- CVE-2020-8621: named could crash in certain query resolution scenarios
where QNAME minimization and forwarding were both
enabled (bsc#1175443).
- CVE-2020-8620: It was possible to trigger an assertion failure by
sending a specially crafted large TCP DNS message (bsc#1175443).
- CVE-2020-8622: It was possible to trigger an assertion failure when
verifying the response to a TSIG-signed request (bsc#1175443).
Other issues fixed:
- Add engine support to OpenSSL EdDSA implementation.
- Add engine support to OpenSSL ECDSA implementation.
- Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
- Warn about AXFR streams with inconsistent message IDs.
- Make ISC rwlock implementation the default again.
- Fixed issues when using cookie-secrets for AES and SHA2 (bsc#1161168)
- Installed the default files in /var/lib/named and created
chroot environment on systems using transactional-updates (bsc#1100369, fate#325524)
- Fixed an issue where bind was not working in FIPS mode (bsc#906079).
- Fixed dependency issues (bsc#1118367 and bsc#1118368).
- GeoIP support is now discontinued, now GeoIP2 is used(bsc#1156205).
- Fixed an issue with FIPS (bsc#1128220).
- The liblwres library is discontinued upstream and is no longer included.
- Added service dependency on NTP to make sure the clock is accurate when bind is starts (bsc#1170667, bsc#1170713).
- Reject DS records at the zone apex when loading master files. Log but otherwise ignore attempts to add DS records at the zone apex via UPDATE.
- The default value of 'max-stale-ttl' has been changed from 1 week to 12 hours.
- Zone timers are now exported via statistics channel.
- The 'primary' and 'secondary' keywords, when used as parameters for 'check-names', were not processed correctly and were being ignored.
- 'rndc dnstap -roll <value>' did not limit the number of saved files to <value>.
- Add 'rndc dnssec -status' command.
- Addressed a couple of situations where named could crash.
- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
so that named, being a/the only member of the 'named' group
has full r/w access yet cannot change directories owned by root
in the case of a compromized named.
[bsc#1173307, bind-chrootenv.conf]
- Added '/etc/bind.keys' to NAMED_CONF_INCLUDE_FILES in /etc/sysconfig/named to suppress warning message re missing file (bsc#1173983).
- Removed '-r /dev/urandom' from all invocations of rndc-confgen
(init/named system/lwresd.init system/named.init in vendor-files)
as this option is deprecated and causes rndc-confgen to fail.
(bsc#1173311, bsc#1176674, bsc#1170713)
- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
of /usr/sbin/dnssec-keygen as BIND now uses the random number
functions provided by the crypto library (i.e., OpenSSL or a
PKCS#11 provider) as a source of randomness rather than /dev/random.
Therefore the -r command line option no longer has any effect on
dnssec-keygen. Leaving the option in genDDNSkey as to not break
compatibility. Patch provided by Stefan Eisenwiener.
[bsc#1171313]
- Put libns into a separate subpackage to avoid file conflicts
in the libisc subpackage due to different sonums (bsc#1176092).
- Require /sbin/start_daemon: both init scripts, the one used in
systemd context as well as legacy sysv, make use of start_daemon.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:2947-1
Released: Fri Oct 16 15:23:07 2020
Summary: Security update for gcc10, nvptx-tools
Type: security
Severity: moderate
References: 1172798,1172846,1173972,1174753,1174817,1175168,CVE-2020-13844
This update for gcc10, nvptx-tools fixes the following issues:
This update provides the GCC10 compiler suite and runtime libraries.
The base SUSE Linux Enterprise libraries libgcc_s1, libstdc++6 are replaced by
the gcc10 variants.
The new compiler variants are available with '-10' suffix, you can specify them
via:
CC=gcc-10
CXX=g++-10
or similar commands.
For a detailed changelog check out https://gcc.gnu.org/gcc-10/changes.html
Changes in nvptx-tools:
- Enable build on aarch64
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:2958-1
Released: Tue Oct 20 12:24:55 2020
Summary: Recommended update for procps
Type: recommended
Severity: moderate
References: 1158830
This update for procps fixes the following issues:
- Fixes an issue when command 'ps -C' does not allow anymore an argument longer than 15 characters. (bsc#1158830)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:2979-1
Released: Wed Oct 21 11:37:14 2020
Summary: Recommended update for mozilla-nss
Type: recommended
Severity: moderate
References: 1176173
This update for mozilla-nss fixes the following issue:
- FIPS: Adjust the Diffie-Hellman and Elliptic Curve Diffie-Hellman algorithms to be
NIST SP800-56Arev3 compliant (bsc#1176173).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:2983-1
Released: Wed Oct 21 15:03:03 2020
Summary: Recommended update for file
Type: recommended
Severity: moderate
References: 1176123
This update for file fixes the following issues:
- Fixes an issue when file displays broken 'ELF' interpreter. (bsc#1176123)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:2988-1
Released: Wed Oct 21 17:35:34 2020
Summary: Security update for gnutls
Type: security
Severity: moderate
References: 1176086,1176181,1176671,CVE-2020-24659
This update for gnutls fixes the following issues:
- Fix heap buffer overflow in handshake with no_renegotiation alert sent (CVE-2020-24659 bsc#1176181)
- FIPS: Implement (EC)DH requirements from SP800-56Arev3 (bsc#1176086)
- FIPS: Use 2048 bit prime in DH selftest (bsc#1176086)
- FIPS: Add TLS KDF selftest (bsc#1176671)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:3060-1
Released: Wed Oct 28 08:09:21 2020
Summary: Security update for binutils
Type: security
Severity: moderate
References: 1126826,1126829,1126831,1140126,1142649,1143609,1153768,1153770,1157755,1160254,1160590,1163333,1163744,CVE-2019-12972,CVE-2019-14250,CVE-2019-14444,CVE-2019-17450,CVE-2019-17451,CVE-2019-9074,CVE-2019-9075,CVE-2019-9077
This update for binutils fixes the following issues:
binutils was updated to version 2.35. (jsc#ECO-2373)
Update to binutils 2.35:
* The assembler can now produce DWARF-5 format line number tables.
* Readelf now has a 'lint' mode to enable extra checks of the files it is processing.
* Readelf will now display '[...]' when it has to truncate a symbol name.
The old behaviour - of displaying as many characters as possible, up to
the 80 column limit - can be restored by the use of the --silent-truncation
option.
* The linker can now produce a dependency file listing the inputs that it
has processed, much like the -M -MP option supported by the compiler.
- fix DT_NEEDED order with -flto [bsc#1163744]
Update to binutils 2.34:
* The disassembler (objdump --disassemble) now has an option to
generate ascii art thats show the arcs between that start and end
points of control flow instructions.
* The binutils tools now have support for debuginfod. Debuginfod is a
HTTP service for distributing ELF/DWARF debugging information as
well as source code. The tools can now connect to debuginfod
servers in order to download debug information about the files that
they are processing.
* The assembler and linker now support the generation of ELF format
files for the Z80 architecture.
- Add new subpackages for libctf and libctf-nobfd.
- Disable LTO due to bsc#1163333.
- Includes fixes for these CVEs:
bsc#1153768 aka CVE-2019-17451 aka PR25070
bsc#1153770 aka CVE-2019-17450 aka PR25078
- fix various build fails on aarch64 (PR25210, bsc#1157755).
Update to binutils 2.33.1:
* Adds support for the Arm Scalable Vector Extension version 2
(SVE2) instructions, the Arm Transactional Memory Extension (TME)
instructions and the Armv8.1-M Mainline and M-profile Vector
Extension (MVE) instructions.
* Adds support for the Arm Cortex-A76AE, Cortex-A77 and Cortex-M35P
processors and the AArch64 Cortex-A34, Cortex-A65, Cortex-A65AE,
Cortex-A76AE, and Cortex-A77 processors.
* Adds a .float16 directive for both Arm and AArch64 to allow
encoding of 16-bit floating point literals.
* For MIPS, Add -m[no-]fix-loongson3-llsc option to fix (or not)
Loongson3 LLSC Errata. Add a --enable-mips-fix-loongson3-llsc=[yes|no]
configure time option to set the default behavior. Set the default
if the configure option is not used to 'no'.
* The Cortex-A53 Erratum 843419 workaround now supports a choice of
which workaround to use. The option --fix-cortex-a53-843419 now
takes an optional argument --fix-cortex-a53-843419[=full|adr|adrp]
which can be used to force a particular workaround to be used.
See --help for AArch64 for more details.
* Add support for GNU_PROPERTY_AARCH64_FEATURE_1_BTI and
GNU_PROPERTY_AARCH64_FEATURE_1_PAC in ELF GNU program properties
in the AArch64 ELF linker.
* Add -z force-bti for AArch64 to enable GNU_PROPERTY_AARCH64_FEATURE_1_BTI
on output while warning about missing GNU_PROPERTY_AARCH64_FEATURE_1_BTI
on inputs and use PLTs protected with BTI.
* Add -z pac-plt for AArch64 to pick PAC enabled PLTs.
* Add --source-comment[=<txt>] option to objdump which if present,
provides a prefix to source code lines displayed in a disassembly.
* Add --set-section-alignment <section-name>=<power-of-2-align>
option to objcopy to allow the changing of section alignments.
* Add --verilog-data-width option to objcopy for verilog targets to
control width of data elements in verilog hex format.
* The separate debug info file options of readelf (--debug-dump=links
and --debug-dump=follow) and objdump (--dwarf=links and
--dwarf=follow-links) will now display and/or follow multiple
links if more than one are present in a file. (This usually
happens when gcc's -gsplit-dwarf option is used).
In addition objdump's --dwarf=follow-links now also affects its
other display options, so that for example, when combined with
--syms it will cause the symbol tables in any linked debug info
files to also be displayed. In addition when combined with
--disassemble the --dwarf= follow-links option will ensure that
any symbol tables in the linked files are read and used when
disassembling code in the main file.
* Add support for dumping types encoded in the Compact Type Format
to objdump and readelf.
- Includes fixes for these CVEs:
bsc#1126826 aka CVE-2019-9077 aka PR1126826
bsc#1126829 aka CVE-2019-9075 aka PR1126829
bsc#1126831 aka CVE-2019-9074 aka PR24235
bsc#1140126 aka CVE-2019-12972 aka PR23405
bsc#1143609 aka CVE-2019-14444 aka PR24829
bsc#1142649 aka CVE-2019-14250 aka PR90924
* Add xBPF target
* Fix various problems with DWARF 5 support in gas
* fix nm -B for objects compiled with -flto and -fcommon.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:3091-1
Released: Thu Oct 29 16:35:37 2020
Summary: Security update for MozillaThunderbird and mozilla-nspr
Type: security
Severity: important
References: 1174230,1176384,1176756,1176899,1177977,CVE-2020-15673,CVE-2020-15676,CVE-2020-15677,CVE-2020-15678,CVE-2020-15683,CVE-2020-15969
This update for MozillaThunderbird and mozilla-nspr fixes the following issues:
- Mozilla Thunderbird 78.4
* new: MailExtensions: browser.tabs.sendMessage API added
* new: MailExtensions: messageDisplayScripts API added
* changed: Yahoo and AOL mail users using password authentication will be migrated to OAuth2
* changed: MailExtensions: messageDisplay APIs extended to support multiple selected messages
* changed: MailExtensions: compose.begin functions now support creating a message with attachments
* fixed: Thunderbird could freeze when updating global search index
* fixed: Multiple issues with handling of self-signed SSL certificates addressed
* fixed: Recipient address fields in compose window could expand to fill all available space
* fixed: Inserting emoji characters in message compose window caused unexpected behavior
* fixed: Button to restore default folder icon color was not keyboard accessible
* fixed: Various keyboard navigation fixes
* fixed: Various color-related theme fixes
* fixed: MailExtensions: Updating attachments with onBeforeSend.addListener() did not work
MFSA 2020-47 (bsc#1177977)
* CVE-2020-15969 Use-after-free in usersctp
* CVE-2020-15683 Memory safety bugs fixed in Thunderbird 78.4
- Mozilla Thunderbird 78.3.3
* OpenPGP: Improved support for encrypting with subkeys
* OpenPGP message status icons were not visible in message header pane
* Creating a new calendar event did not require an event title
- Mozilla Thunderbird 78.3.2 (bsc#1176899)
* OpenPGP: Improved support for encrypting with subkeys
* OpenPGP: Encrypted messages with international characters were sometimes displayed incorrectly
* Single-click deletion of recipient pills with middle mouse button restored
* Searching an address book list did not display results
* Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
* fix crash in nsImapProtocol::CreateNewLineFromSocket
- Mozilla Thunderbird 78.3.0
MFSA 2020-44 (bsc#1176756)
* CVE-2020-15677 Download origin spoofing via redirect
* CVE-2020-15676 XSS when pasting attacker-controlled data into a contenteditable element
* CVE-2020-15678 When recursing through layers while scrolling, an iterator may have become invalid, resulting in a potential use-after- free scenario
* CVE-2020-15673 Memory safety bugs fixed in Thunderbird 78.3
- update mozilla-nspr to version 4.25.1
* The macOS platform code for shared library loading was
changed to support macOS 11.
* Dependency needed for the MozillaThunderbird udpate
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:3099-1
Released: Thu Oct 29 19:33:41 2020
Summary: Recommended update for timezone
Type: recommended
Severity: moderate
References: 1177460
This update for timezone fixes the following issues:
- timezone update 2020b (bsc#1177460)
* Revised predictions for Morocco's changes starting in 2023.
* Canada's Yukon changes to -07 on 2020-11-01, not 2020-03-08.
* Macquarie Island has stayed in sync with Tasmania since 2011.
* Casey, Antarctica is at +08 in winter and +11 in summer.
* zic no longer supports -y, nor the TYPE field of Rules.
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:3123-1
Released: Tue Nov 3 09:48:13 2020
Summary: Recommended update for timezone
Type: recommended
Severity: important
References: 1177460,1178346,1178350,1178353
This update for timezone fixes the following issues:
- Generate 'fat' timezone files (was default before 2020b). (bsc#1178346, bsc#1178350, bsc#1178353)
- Palestine ends DST earlier than predicted, on 2020-10-24. (bsc#1177460)
- Fiji starts DST later than usual, on 2020-12-20. (bsc#1177460)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:3138-1
Released: Tue Nov 3 12:14:03 2020
Summary: Recommended update for systemd
Type: recommended
Severity: moderate
References: 1104902,1154935,1165502,1167471,1173422,1176513,1176800
This update for systemd fixes the following issues:
- seccomp: shm{get,at,dt} now have their own numbers everywhere (bsc#1173422)
- test-seccomp: log function names
- test-seccomp: add log messages when skipping tests
- basic/virt: Detect PowerVM hypervisor (bsc#1176800)
- fs-util: suppress world-writable warnings if we read /dev/null
- udevadm: rename option '--log-priority' into '--log-level'
- udev: rename kernel option 'log_priority' into 'log_level'
- fstab-generator: add 'nofail' when NFS 'bg' option is used (bsc#1176513)
- Fix memory protection default (bsc#1167471)
- cgroup: Support 0-value for memory protection directives and accepts MemorySwapMax=0 (bsc#1154935)
- Improve latency and reliability when users log in/out (bsc#1104902, bsc#1165502)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:3234-1
Released: Fri Nov 6 16:01:36 2020
Summary: Recommended update for ca-certificates-mozilla
Type: recommended
Severity: moderate
References: 1177864
This update for ca-certificates-mozilla fixes the following issues:
The SSL Root CA store was updated to the 2.44 state of the Mozilla NSS Certificate store (bsc#1177864)
- Removed CAs:
- EE Certification Centre Root CA
- Taiwan GRCA
- Added CAs:
- Trustwave Global Certification Authority
- Trustwave Global ECC P256 Certification Authority
- Trustwave Global ECC P384 Certification Authority
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:3253-1
Released: Mon Nov 9 07:45:04 2020
Summary: Recommended update for mozilla-nss
Type: recommended
Severity: moderate
References: 1174697,1176173
This update for mozilla-nss fixes the following issues:
- Fixes an issue for Mozilla Firefox which has failed in fips mode (bsc#1174697)
- FIPS: Adjust the Diffie-Hellman and Elliptic Curve Diffie-Hellman algorithms to be
NIST SP800-56Arev3 compliant (bsc#1176173).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:3257-1
Released: Mon Nov 9 11:12:55 2020
Summary: Security update for ceph, deepsea
Type: security
Severity: moderate
References: 1151612,1152100,1155045,1155262,1156087,1156409,1158257,1159689,1160626,1161718,1162553,1163119,1164571,1165713,1165835,1165840,1166297,1166393,1166624,1166670,1166932,1167477,1168403,1169134,1169356,1170487,1170938,1171367,1171921,1171956,1172142,1173339,1174591,1175061,1175240,1175781,CVE-2020-10753
This update for ceph, deepsea fixes the following issues:
- Update to 14.2.13-398-gb6c514eec7:
+ Upstream 14.2.13 release
see https://ceph.io/releases/v14-2-13-nautilus-released/
* (bsc#1151612, bsc#1158257) ceph-volume: major batch refactor
- Update to 14.2.12-436-g6feab505b7:
+ Upstream 14.2.12 release
see https://ceph.io/releases/v14-2-12-nautilus-released/
* (bsc#1169134) mgr/dashboard: document Prometheus' security model
* (bsc#1170487) monclient: schedule first tick using mon_client_hunt_interval
* (bsc#1174591) mgr/dashboard: Unable to edit iSCSI logged-in client
* (bsc#1174591) mgr/dashboard: Allow editing iSCSI targets with initiators logged-in
* (bsc#1175061) os/bluestore: dump onode that has too many spanning blobs
* (bsc#1175240) pybind/mgr/restful: use dict.items() for py3 compatible
+ (bsc#1175781) ceph-volume: lvmcache: print help correctly
+ spec: move python-enum34 into rhel 7 conditional
- Update to 14.2.11-394-g9cbbc473c0:
+ Upstream 14.2.11 release
see https://ceph.io/releases/v14-2-11-nautilus-released/
* mgr/progress: Skip pg_summary update if _events dict is empty
(bsc#1167477) (bsc#1172142) (bsc#1171956)
* mgr/dashboard: Allow to edit iSCSI target with active session
(bsc#1173339)
- Update to 14.2.10-392-gb3a13b81cb:
+ Upstream 14.2.10 release
see https://ceph.io/releases/v14-2-10-nautilus-released/
* mgr: Improve internal python to c++ interface (bsc#1167477)
- Update to 14.2.9-970-ged84cae0c9:
+ rgw: sanitize newlines in s3 CORSConfiguration's ExposeHeader
(bsc#1171921, CVE-2020-10753)
- Update to 14.2.9-969-g9917342dc8d:
* rebase on top of upstream nautilus, SHA1 ccd9c04f88e53aef7e4f1068ce1221fa3b97450d
* cmake: Improve test for 16-byte atomic support on IBM Z
* (jsc#SES-680) monitoring: add details to Prometheus alerts
* (bsc#1155045) mgr/dashboard: add debug mode, and accept expected exception when SSL handshaking
* (bsc#1152100) monitoring: alert for prediction of disk and pool fill up broken
* (bsc#1155262) mgr/dashboard: iSCSI targets not available if any gateway is down
* (bsc#1159689) os/bluestore: more flexible DB volume space usage
* (bsc#1156087) ceph-volume: make get_devices fs location independent
* (bsc#1156409) monitoring: wait before firing osd full alert
* (bsc#1160626) mgr/dashboard: Unable to remove an iSCSI gateway that is already in use
* (bsc#1161718) mount.ceph: remove arbitrary limit on size of name= option
* (bsc#1162553) ceph-volume: strip _dmcrypt suffix in simple scan json output
* (bsc#1163119) mgr/dashboard: Not able to restrict bucket creation for new user
* (bsc#1164571) mgr/dashboard: Prevent iSCSI target recreation when editing controls
* (bsc#1165713) mgr/dashboard: Repair broken grafana panels
* (bsc#1165835) rgw: get barbican secret key request maybe return error code
* (bsc#1165840) rgw: making implicit_tenants backwards compatible
* (bsc#1166297) mgr/dashboard: Repair broken grafana panels
* (bsc#1166393) mgr/dashboard: KeyError on dashboard reload
* (bsc#1166624) mgr/dashboard: Fix iSCSI's username and password validation
* (bsc#1166670) monitoring: root volume full alert fires false positives
* (bsc#1166932) mgr: synchronize ClusterState's health and mon_status
* (bsc#1168403) mgr/dashboard: Add more debug information to Dashboard RGW backend
* (bsc#1169356) rgw: reshard: skip stale bucket id entries from reshard queue
* (bsc#1170938) mon/OSDMonitor: allow trimming maps even if osds are down
* (bsc#1171367) Set OSD's bluefs-buffered-io param to false by default
- Update to 14.2.13-398-gb6c514eec7:
+ Upstream 14.2.13 release
see https://ceph.io/releases/v14-2-13-nautilus-released/
* (bsc#1151612, bsc#1158257) ceph-volume: major batch refactor
- Update to 14.2.12-436-g6feab505b7:
+ Upstream 14.2.12 release
see https://ceph.io/releases/v14-2-12-nautilus-released/
* (bsc#1169134) mgr/dashboard: document Prometheus' security model
* (bsc#1170487) monclient: schedule first tick using mon_client_hunt_interval
* (bsc#1174591) mgr/dashboard: Unable to edit iSCSI logged-in client
* (bsc#1174591) mgr/dashboard: Allow editing iSCSI targets with initiators logged-in
* (bsc#1175061) os/bluestore: dump onode that has too many spanning blobs
* (bsc#1175240) pybind/mgr/restful: use dict.items() for py3 compatible
+ (bsc#1175781) ceph-volume: lvmcache: print help correctly
+ spec: move python-enum34 into rhel 7 conditional
- Update to 14.2.11-394-g9cbbc473c0:
+ Upstream 14.2.11 release
see https://ceph.io/releases/v14-2-11-nautilus-released/
* mgr/progress: Skip pg_summary update if _events dict is empty
(bsc#1167477) (bsc#1172142) (bsc#1171956)
* mgr/dashboard: Allow to edit iSCSI target with active session
(bsc#1173339)
- Update to 14.2.10-392-gb3a13b81cb:
+ Upstream 14.2.10 release
see https://ceph.io/releases/v14-2-10-nautilus-released/
* mgr: Improve internal python to c++ interface (bsc#1167477)
- Update to 14.2.9-970-ged84cae0c9:
+ rgw: sanitize newlines in s3 CORSConfiguration's ExposeHeader
(bsc#1171921, CVE-2020-10753)
- Update to 14.2.9-969-g9917342dc8d:
* rebase on top of upstream nautilus, SHA1 ccd9c04f88e53aef7e4f1068ce1221fa3b97450d
* cmake: Improve test for 16-byte atomic support on IBM Z
* (jsc#SES-680) monitoring: add details to Prometheus alerts
* (bsc#1155045) mgr/dashboard: add debug mode, and accept expected exception when SSL handshaking
* (bsc#1152100) monitoring: alert for prediction of disk and pool fill up broken
* (bsc#1155262) mgr/dashboard: iSCSI targets not available if any gateway is down
* (bsc#1159689) os/bluestore: more flexible DB volume space usage
* (bsc#1156087) ceph-volume: make get_devices fs location independent
* (bsc#1156409) monitoring: wait before firing osd full alert
* (bsc#1160626) mgr/dashboard: Unable to remove an iSCSI gateway that is already in use
* (bsc#1161718) mount.ceph: remove arbitrary limit on size of name= option
* (bsc#1162553) ceph-volume: strip _dmcrypt suffix in simple scan json output
* (bsc#1163119) mgr/dashboard: Not able to restrict bucket creation for new user
* (bsc#1164571) mgr/dashboard: Prevent iSCSI target recreation when editing controls
* (bsc#1165713) mgr/dashboard: Repair broken grafana panels
* (bsc#1165835) rgw: get barbican secret key request maybe return error code
* (bsc#1165840) rgw: making implicit_tenants backwards compatible
* (bsc#1166297) mgr/dashboard: Repair broken grafana panels
* (bsc#1166393) mgr/dashboard: KeyError on dashboard reload
* (bsc#1166624) mgr/dashboard: Fix iSCSI's username and password validation
* (bsc#1166670) monitoring: root volume full alert fires false positives
* (bsc#1166932) mgr: synchronize ClusterState's health and mon_status
* (bsc#1168403) mgr/dashboard: Add more debug information to Dashboard RGW backend
* (bsc#1169356) rgw: reshard: skip stale bucket id entries from reshard queue
* (bsc#1170938) mon/OSDMonitor: allow trimming maps even if osds are down
* (bsc#1171367) Set OSD's bluefs-buffered-io param to false by default
- Version: 0.9.33
- drop workarounds for old ceph-volume lvm batch command
- runners/upgrade: Add SES6->7 pre-upgrade checks
More information about the sle-security-updates
mailing list