SUSE-CU-2021:570-1: Security update of bci/init
sle-security-updates at lists.suse.com
sle-security-updates at lists.suse.com
Tue Dec 7 08:15:31 UTC 2021
SUSE Container Update Advisory: bci/init
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2021:570-1
Container Tags : bci/init:15.3 , bci/init:15.3.3.66 , bci/init:latest
Container Release : 3.66
Severity : important
Type : security
References : 1029961 1113013 1162581 1172973 1172974 1174504 1177127 1178236
1185016 1185524 1186071 1186503 1186602 1186910 1187153 1187224
1187270 1187273 1187425 1187466 1187512 1187654 1187738 1187760
1188156 1188344 1188435 1188623 1188921 1189031 1190052 1190059
1190199 1190356 1190440 1190465 1190645 1190712 1190739 1190793
1190815 1190850 1190915 1190933 1190984 1191200 1191260 1191286
1191324 1191370 1191480 1191563 1191609 1191690 1191736 1191804
1191804 1191922 1191987 1192104 1192160 1192161 1192248 1192337
1192436 CVE-2019-20838 CVE-2020-14155 CVE-2021-37600 CVE-2021-39537
-----------------------------------------------------------------
The container bci/init was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: SUSE-OU-2020:3026-1
Released: Fri Oct 23 15:35:49 2020
Summary: Optional update for the Public Cloud Module
Type: optional
Severity: moderate
References:
This update adds the Google Cloud Storage packages to the Public Cloud module (jsc#ECO-2398).
The following packages were included:
- python3-grpcio
- python3-protobuf
- python3-google-api-core
- python3-google-cloud-core
- python3-google-cloud-storage
- python3-google-resumable-media
- python3-googleapis-common-protos
- python3-grpcio-gcp
- python3-mock (updated to version 3.0.5)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:294-1
Released: Wed Feb 3 12:54:28 2021
Summary: Recommended update for libprotobuf
Type: recommended
Severity: moderate
References:
libprotobuf was updated to fix:
- ship the libprotobuf-lite15 on the basesystem module and the INSTALLER channel. (jsc#ECO-2911)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:656-1
Released: Mon Mar 1 09:34:21 2021
Summary: Recommended update for protobuf
Type: recommended
Severity: moderate
References: 1177127
This update for protobuf fixes the following issues:
- Add missing dependency of python subpackages on python-six. (bsc#1177127)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:3474-1
Released: Wed Oct 20 08:41:31 2021
Summary: Security update for util-linux
Type: security
Severity: moderate
References: 1178236,1188921,CVE-2021-37600
This update for util-linux fixes the following issues:
- CVE-2021-37600: Fixed an integer overflow which could lead to a buffer overflow in get_sem_elements() in sys-utils/ipcutils.c. (bsc#1188921)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3480-1
Released: Wed Oct 20 11:24:10 2021
Summary: Recommended update for yast2-network
Type: recommended
Severity: moderate
References: 1185016,1185524,1186910,1187270,1187512,1188344,1190645,1190739,1190915,1190933
This update for yast2-network fixes the following issues:
- Don't crash when the interfaces table contains a not configured one (bnc#1190645, bsc#1190915).
- Fix the shown description using the interface friendly name when it is empty (bsc#1190933).
- Consider aliases sections as case insensitive (bsc#1190739).
- Display user defined device name in the devices overview (bnc#1190645).
- Don't crash when defined aliases in AutoYaST profile are not defined as a map (bsc#1188344).
- Support 'boot' and 'on' as aliases for the 'auto' startmode (bsc#1186910).
- Fix desktop file so the control center tooltip is translated (bsc#1187270).
- Use the linuxrc proxy settings for the HTTPS and FTP proxies (bsc#1185016).
- Don't crash at the end of installation when storing wifi configuration for NetworkManager (bsc#1185524, bsc#1187512).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:3490-1
Released: Wed Oct 20 16:31:55 2021
Summary: Security update for ncurses
Type: security
Severity: moderate
References: 1190793,CVE-2021-39537
This update for ncurses fixes the following issues:
- CVE-2021-39537: Fixed an heap-based buffer overflow in _nc_captoinfo. (bsc#1190793)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3494-1
Released: Wed Oct 20 16:48:46 2021
Summary: Recommended update for pam
Type: recommended
Severity: moderate
References: 1190052
This update for pam fixes the following issues:
- Added pam_faillock to the set of available PAM modules. (jsc#SLE-20638)
- Added new file macros.pam on request of systemd. (bsc#1190052)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3501-1
Released: Fri Oct 22 10:42:46 2021
Summary: Recommended update for libzypp, zypper, libsolv, protobuf
Type: recommended
Severity: moderate
References: 1186503,1186602,1187224,1187425,1187466,1187738,1187760,1188156,1188435,1189031,1190059,1190199,1190465,1190712,1190815
This update for libzypp, zypper, libsolv and protobuf fixes the following issues:
- Choice rules: treat orphaned packages as newest (bsc#1190465)
- Avoid calling 'su' to detect a too restrictive sudo user umask (bsc#1186602)
- Do not check of signatures and keys two times(redundant) (bsc#1190059)
- Rephrase vendor conflict message in case 2 packages are involved (bsc#1187760)
- Show key fpr from signature when signature check fails (bsc#1187224)
- Fix solver jobs for PTFs (bsc#1186503)
- Fix purge-kernels fails (bsc#1187738)
- Fix obs:// platform guessing for Leap (bsc#1187425)
- Make sure to keep states alives while transitioning. (bsc#1190199)
- Manpage: Improve description about patch updates(bsc#1187466)
- Manpage: Recommend the needs-rebooting command to test whether a system reboot is suggested.
- Fix kernel-*-livepatch removal in purge-kernels. (bsc#1190815)
- Fix crashes in logging code when shutting down (bsc#1189031)
- Do not download full files even if the checkExistsOnly flag is set. (bsc#1190712)
- Add need reboot/restart hint to XML install summary (bsc#1188435)
- Prompt: choose exact match if prompt options are not prefix free (bsc#1188156)
- Include libprotobuf-lite20 in products to enable parallel downloads. (jsc#ECO-2911, jsc#SLE-16862)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3509-1
Released: Tue Oct 26 09:47:40 2021
Summary: Recommended update for suse-module-tools
Type: recommended
Severity: important
References: 1191200,1191260,1191480,1191804,1191922
This update for suse-module-tools fixes the following issues:
Update to version 15.3.13:
- Fix bad exit status in openQA. (bsc#1191922)
- Ignore kernel keyring for kernel certificates. (bsc#1191480)
- Deal with existing certificates that should be de-enrolled. (bsc#1191804)
- Don't pass existing files to weak-modules2. (bsc#1191200)
- Skip certificate scriptlet on non-UEFI systems. (bsc#1191260)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3510-1
Released: Tue Oct 26 11:22:15 2021
Summary: Recommended update for pam
Type: recommended
Severity: important
References: 1191987
This update for pam fixes the following issues:
- Fixed a bad directive file which resulted in
the 'securetty' file to be installed as 'macros.pam'.
(bsc#1191987)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:3529-1
Released: Wed Oct 27 09:23:32 2021
Summary: Security update for pcre
Type: security
Severity: moderate
References: 1172973,1172974,CVE-2019-20838,CVE-2020-14155
This update for pcre fixes the following issues:
Update pcre to version 8.45:
- CVE-2020-14155: Fixed integer overflow via a large number after a '(?C' substring (bsc#1172974).
- CVE-2019-20838: Fixed buffer over-read in JIT compiler (bsc#1172973)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3564-1
Released: Wed Oct 27 16:12:08 2021
Summary: Recommended update for rpm-config-SUSE
Type: recommended
Severity: moderate
References: 1190850
This update for rpm-config-SUSE fixes the following issues:
- Support ZSTD compressed kernel modules. (bsc#1190850)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3589-1
Released: Mon Nov 1 19:27:52 2021
Summary: Recommended update for apparmor
Type: recommended
Severity: moderate
References: 1191690
This update for apparmor fixes the following issues:
- Fixed an issue when apparmor provides python2 and python3 libraries with the same name. (bsc#1191690)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3663-1
Released: Mon Nov 15 19:14:32 2021
Summary: Recommended update for suse-module-tools
Type: recommended
Severity: moderate
References: 1191804
This update for suse-module-tools fixes the following issues:
- Update to version 15.3.14:
* more fixes for updates under secure boot
* cert-script: Deal with existing $cert.delete file (bsc#1191804).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3786-1
Released: Wed Nov 24 05:59:13 2021
Summary: Recommended update for rpm-config-SUSE
Type: recommended
Severity: important
References: 1192160
This update for rpm-config-SUSE fixes the following issues:
- Add support for the kernel xz-compressed firmware files (bsc#1192160)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3792-1
Released: Wed Nov 24 06:12:09 2021
Summary: Recommended update for kmod
Type: recommended
Severity: moderate
References: 1192104
This update for kmod fixes the following issues:
- Enable ZSTD compression (bsc#1192104)(jsc#SLE-21256)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3799-1
Released: Wed Nov 24 18:07:54 2021
Summary: Recommended update for gcc11
Type: recommended
Severity: moderate
References: 1187153,1187273,1188623
This update for gcc11 fixes the following issues:
The additional GNU compiler collection GCC 11 is provided:
To select these compilers install the packages:
- gcc11
- gcc-c++11
- and others with 11 prefix.
to select them for building:
- CC='gcc-11'
- CXX='g++-11'
The compiler baselibraries (libgcc_s1, libstdc++6 and others) are being replaced by the GCC 11 variants.
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3808-1
Released: Fri Nov 26 00:30:54 2021
Summary: Recommended update for systemd
Type: recommended
Severity: moderate
References: 1186071,1190440,1190984,1192161
This update for systemd fixes the following issues:
- Add timestamp to D-Bus events to improve traceability (jsc#SLE-17798)
- Fix fd_is_mount_point() when both the parent and directory are network file systems (bsc#1190984)
- Support detection for ARM64 Hyper-V guests (bsc#1186071)
- Fix systemd-detect-virt not detecting Amazon EC2 Nitro instance (bsc#1190440)
- Enable support for Portable Services in openSUSE Leap only (jsc#SLE-21694)
- Fix IO scheduler udev rules to address performance issues (jsc#SLE-21032, bsc#1192161)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3870-1
Released: Thu Dec 2 07:11:50 2021
Summary: Recommended update for libzypp, zypper
Type: recommended
Severity: moderate
References: 1190356,1191286,1191324,1191370,1191609,1192337,1192436
This update for libzypp, zypper fixes the following issues:
libzypp:
- Check log writer before accessing it (bsc#1192337)
- Zypper should keep cached files if transaction is aborted (bsc#1190356)
- Require a minimum number of mirrors for multicurl (bsc#1191609)
- Fixed slowdowns when rlimit is too high by using procfs to detect niumber of
open file descriptors (bsc#1191324)
- Fixed zypper incomplete messages when using non English localization (bsc#1191370)
- RepoManager: Don't probe for plaindir repository if the URL schema is a plugin (bsc#1191286)
- Disable logger in the child process after fork (bsc#1192436)
zypper:
- Fixed Zypper removing a kernel explicitely pinned that uses uname -r output format as name (openSUSE/zypper#418)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3872-1
Released: Thu Dec 2 07:25:55 2021
Summary: Recommended update for cracklib
Type: recommended
Severity: moderate
References: 1191736
This update for cracklib fixes the following issues:
- Enable build time tests (bsc#1191736)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3891-1
Released: Fri Dec 3 10:21:49 2021
Summary: Recommended update for keyutils
Type: recommended
Severity: moderate
References: 1029961,1113013,1187654
This update for keyutils fixes the following issues:
- Add /etc/keys/ and /usr/etc/keys/ directory (bsc#1187654)
keyutils was updated to 1.6.3 (jsc#SLE-20016):
* Revert the change notifications that were using /dev/watch_queue.
* Apply the change notifications that use pipe2(O_NOTIFICATION_PIPE).
* Allow 'keyctl supports' to retrieve raw capability data.
* Allow 'keyctl id' to turn a symbolic key ID into a numeric ID.
* Allow 'keyctl new_session' to name the keyring.
* Allow 'keyctl add/padd/etc.' to take hex-encoded data.
* Add 'keyctl watch*' to expose kernel change notifications on keys.
* Add caps for namespacing and notifications.
* Set a default TTL on keys that upcall for name resolution.
* Explicitly clear memory after it's held sensitive information.
* Various manual page fixes.
* Fix C++-related errors.
* Add support for keyctl_move().
* Add support for keyctl_capabilities().
* Make key=val list optional for various public-key ops.
* Fix system call signature for KEYCTL_PKEY_QUERY.
* Fix 'keyctl pkey_query' argument passing.
* Use keyctl_read_alloc() in dump_key_tree_aux().
* Various manual page fixes.
Updated to 1.6:
* Apply various specfile cleanups from Fedora.
* request-key: Provide a command line option to suppress helper execution.
* request-key: Find least-wildcard match rather than first match.
* Remove the dependency on MIT Kerberos.
* Fix some error messages
* keyctl_dh_compute.3: Suggest /proc/crypto for list of available hashes.
* Fix doc and comment typos.
* Add public key ops for encrypt, decrypt, sign and verify (needs linux-4.20).
* Add pkg-config support for finding libkeyutils.
* upstream isn't offering PGP signatures for the source tarballs anymore
Updated to 1.5.11 (bsc#1113013)
* Add keyring restriction support.
* Add KDF support to the Diffie-Helman function.
* DNS: Add support for AFS config files and SRV records
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:3899-1
Released: Fri Dec 3 11:27:41 2021
Summary: Security update for aaa_base
Type: security
Severity: moderate
References: 1162581,1174504,1191563,1192248
This update for aaa_base fixes the following issues:
- Allowed ping and ICMP commands without CAP_NET_RAW (bsc#1174504).
- Add $HOME/.local/bin to PATH, if it exists (bsc#1192248).
- Fixed get_kernel_version.c to work also for recent kernels on the s390/X platform (bsc#1191563).
- Support xz compressed kernel (bsc#1162581)
The following package changes have been done:
- aaa_base-84.87+git20180409.04c9dae-3.52.1 updated
- cracklib-dict-small-2.9.7-11.6.1 updated
- cracklib-2.9.7-11.6.1 updated
- kmod-29-4.12.1 updated
- libapparmor1-2.13.6-3.3.1 updated
- libaugeas0-1.10.1-3.3.1 updated
- libblkid1-2.36.2-4.5.1 updated
- libcrack2-2.9.7-11.6.1 updated
- libfdisk1-2.36.2-4.5.1 updated
- libgcc_s1-11.2.1+git610-1.3.9 updated
- libkeyutils1-1.6.3-5.6.1 updated
- libkmod2-29-4.12.1 updated
- libmount1-2.36.2-4.5.1 updated
- libncurses6-6.1-5.9.1 updated
- libpcre1-8.45-20.10.1 updated
- libprotobuf-lite20-3.9.2-4.9.1 added
- libsmartcols1-2.36.2-4.5.1 updated
- libsolv-tools-0.7.20-9.2 updated
- libstdc++6-11.2.1+git610-1.3.9 updated
- libsystemd0-246.16-7.21.1 updated
- libudev1-246.16-7.21.1 updated
- libuuid1-2.36.2-4.5.1 updated
- libzypp-17.28.8-20.1 updated
- ncurses-utils-6.1-5.9.1 updated
- pam-1.3.0-6.50.1 updated
- rpm-config-SUSE-1-5.6.1 updated
- suse-module-tools-15.3.14-3.14.1 updated
- systemd-246.16-7.21.1 updated
- terminfo-base-6.1-5.9.1 updated
- udev-246.16-7.21.1 updated
- util-linux-2.36.2-4.5.1 updated
- zypper-1.14.50-21.1 updated
- container:sles15-image-15.0.0-17.8.39 updated
More information about the sle-security-updates
mailing list