SUSE-CU-2023:3640-1: Security update of suse/sle15

[sle-security-updates at lists.suse.com]

SUSE Container Update Advisory: suse/sle15
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2023:3640-1
Container Tags        : bci/bci-base:15.4 , bci/bci-base:15.4.27.14.116 , suse/sle15:15.4 , suse/sle15:15.4.27.14.116
Container Release     : 27.14.116
Severity              : important
Type                  : security
References            : 1196647 1212475 
-----------------------------------------------------------------

The container suse/sle15 was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:4309-1
Released:    Tue Oct 31 14:09:03 2023
Summary:     Security update for container-suseconnect
Type:        security
Severity:    important
References:  1212475

This update of container-suseconnect fixes the following issues:

- rebuild the package with the go 1.21 security release (bsc#1212475).

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:4310-1
Released:    Tue Oct 31 14:10:47 2023
Summary:     Recommended update for libtirpc
Type:        recommended
Severity:    moderate
References:  1196647
This Update for libtirpc to 1.3.4, fixing the following issues:
    
Update to 1.3.4 (bsc#1199467)

 * binddynport.c honor ip_local_reserved_ports
   - replaces: binddynport-honor-ip_local_reserved_ports.patch
 * gss-api: expose gss major/minor error in authgss_refresh()
 * rpcb_clnt.c: Eliminate double frees in delete_cache()
 * rpcb_clnt.c: memory leak in destroy_addr
 * portmapper: allow TCP-only portmapper
 * getnetconfigent: avoid potential DoS issue by removing unnecessary sleep
 * clnt_raw.c: fix a possible null pointer dereference
 * bindresvport.c: fix a potential resource leakage

Update to 1.3.3:

* Fix DoS vulnerability in libtirpc
  - replaces: 0001-Fix-DoS-vulnerability-in-libtirpc.patch
* _rpc_dtablesize: use portable system call
* libtirpc: Fix use-after-free accessing the error number
* Fix potential memory leak of parms.r_addr
  - replaces 0001-fix-parms.r_addr-memory-leak.patch
* rpcb_clnt.c add mechanism to try v2 protocol first
  - preplaces: 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch
* Eliminate deadlocks in connects with an MT environment
* clnt_dg_freeres() uncleared set active state may deadlock
* thread safe clnt destruction
* SUNRPC: mutexed access blacklist_read state variable
* SUNRPC: MT-safe overhaul of address cache management in rpcb_clnt.c

Update to 1.3.2:

* Replace the final SunRPC licenses with BSD licenses
* blacklist: Add a few more well known ports
* libtirpc: disallow calling auth_refresh from clnt_call with RPCSEC_GSS

Update to 1.3.1:

* Remove AUTH_DES interfaces from auth_des.h
  The unsupported  AUTH_DES authentication has be
  compiled out since commit d918e41d889 (Wed Oct 9 2019)
  replaced by API routines that return errors.
* svc_dg: Free xp_netid during destroy
* Fix memory management issues of fd locks
* libtirpc: replace array with list for per-fd locks
* __svc_vc_dodestroy: fix double free of xp_ltaddr.buf
* __rpc_dtbsize: rlim_cur instead of rlim_max
* pkg-config: use the correct replacements for libdir/includedir


The following package changes have been done:

- container-suseconnect-2.4.0-150000.4.42.1 updated
- libtirpc-netconfig-1.3.4-150300.3.20.1 updated
- libtirpc3-1.3.4-150300.3.20.1 updated