SUSE-CU-2022:2361-1: Security update of suse/389-ds

[sle-security-updates at lists.suse.com]

SUSE Container Update Advisory: suse/389-ds
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2022:2361-1
Container Tags        : suse/389-ds:2.0 , suse/389-ds:2.0-16.28 , suse/389-ds:latest
Container Release     : 16.28
Severity              : important
Type                  : security
References            : 1047178 1189802 1195773 1197998 1201680 1201783 1202470 1203018
                        CVE-2017-6512 CVE-2021-36690 CVE-2021-46828 CVE-2022-2850 CVE-2022-31252
                        CVE-2022-35737 
-----------------------------------------------------------------

The container suse/389-ds was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:3271-1
Released:    Wed Sep 14 06:45:39 2022
Summary:     Security update for perl
Type:        security
Severity:    moderate
References:  1047178,CVE-2017-6512
This update for perl fixes the following issues:

- CVE-2017-6512: Fixed File::Path rmtree/remove_tree race condition (bsc#1047178).

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:3286-1
Released:    Fri Sep 16 09:08:48 2022
Summary:     Security update for 389-ds
Type:        security
Severity:    moderate
References:  1197998,1202470,CVE-2022-2850
This update for 389-ds fixes the following issues:

- CVE-2022-2850: Fixed an application crash when running a sync_repl client that could be triggered via a malformed cookie (bsc#1202470).

Non-security fixes:

- Update to version 2.0.16~git20.219f047ae:
  * Fix missing 'not' in description
  * CI - makes replication/acceptance_test.py::test_modify_entry more robust
  * fix repl keep alive event interval
  * Sync_repl may crash while managing invalid cookie
  * Hostname when set to localhost causing failures in other tests
  * lib389 - do not set backend name to lowercase
  * keep alive update event starts too soon
  * Fix various memory leaks
  * UI - LDAP Editor is not updated when we switch instances
  * Supplier should do periodic updates
- Update sudoers schema to support UTF-8 (bsc#1197998)
- Update to version 2.0.16~git9.e2a858a86:
  * UI - Various fixes and RFE's for UI
  * Remove problematic language from source code
  * CI - disable TLS hostname checking
  * Update npm and cargo packages
  * Support ECDSA private keys for TLS

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:3305-1
Released:    Mon Sep 19 11:45:57 2022
Summary:     Security update for libtirpc
Type:        security
Severity:    important
References:  1201680,CVE-2021-46828
This update for libtirpc fixes the following issues:

- CVE-2021-46828: Fixed denial of service vulnerability with lots of connections (bsc#1201680).

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:3307-1
Released:    Mon Sep 19 13:26:51 2022
Summary:     Security update for sqlite3
Type:        security
Severity:    moderate
References:  1189802,1195773,1201783,CVE-2021-36690,CVE-2022-35737
This update for sqlite3 fixes the following issues:

- CVE-2022-35737: Fixed an array-bounds overflow if billions of bytes are used in a string argument to a C API (bnc#1201783).
- CVE-2021-36690: Fixed an issue with the SQLite Expert extension when a column has no collating sequence (bsc#1189802).
  
- Package the Tcl bindings here again so that we only ship one copy of SQLite (bsc#1195773).

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:3353-1
Released:    Fri Sep 23 15:23:40 2022
Summary:     Security update for permissions
Type:        security
Severity:    moderate
References:  1203018,CVE-2022-31252
This update for permissions fixes the following issues:

- CVE-2022-31252: Fixed chkstat group controlled paths (bsc#1203018).


The following package changes have been done:

- libtirpc-netconfig-1.2.6-150300.3.14.1 updated
- perl-base-5.26.1-150300.17.11.1 updated
- libsqlite3-0-3.39.3-150000.3.17.1 updated
- libtirpc3-1.2.6-150300.3.14.1 updated
- permissions-20201225-150400.5.11.1 updated
- libsvrcore0-2.0.16~git20.219f047ae-150400.3.10.1 updated
- lib389-2.0.16~git20.219f047ae-150400.3.10.1 updated
- 389-ds-2.0.16~git20.219f047ae-150400.3.10.1 updated
- container:sles15-image-15.0.0-27.11.27 updated