SUSE-CU-2023:3163-1: Security update of suse/sle15

[sle-security-updates at lists.suse.com]

SUSE Container Update Advisory: suse/sle15
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2023:3163-1
Container Tags        : bci/bci-base:15.5 , bci/bci-base:15.5.36.5.37 , suse/sle15:15.5 , suse/sle15:15.5.36.5.37
Container Release     : 36.5.37
Severity              : important
Type                  : security
References            : 1211829 1212475 1212819 1212910 1215026 CVE-2023-38039 
-----------------------------------------------------------------

The container suse/sle15 was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:3814-1
Released:    Wed Sep 27 18:08:17 2023
Summary:     Recommended update for glibc
Type:        recommended
Severity:    moderate
References:  1211829,1212819,1212910
This update for glibc fixes the following issues:

- nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415)
- Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457)
- elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688)
- elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676)
- ld.so: Always use MAP_COPY to map the first segment (BZ #30452)
- add GB18030-2022 charmap (jsc#PED-4908, BZ #30243)


-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:3823-1
Released:    Wed Sep 27 18:42:38 2023
Summary:     Security update for curl
Type:        security
Severity:    important
References:  1215026,CVE-2023-38039
This update for curl fixes the following issues:

- CVE-2023-38039: Fixed possible DoS when receiving too large HTTP header. (bsc#1215026)

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:3834-1
Released:    Wed Sep 27 19:18:33 2023
Summary:     Security update for container-suseconnect
Type:        security
Severity:    important
References:  1212475

This update of container-suseconnect fixes the following issues:

- rebuild the package with the go 1.21 security release (bsc#1212475).

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:3843-1
Released:    Wed Sep 27 20:18:06 2023
Summary:     Recommended update for suse-build-key
Type:        recommended
Severity:    important
References:  
This update for suse-build-key fixes the following issues:

This update adds and runs a import-suse-build-key script.

It is run after installation with libzypp based installers. (jsc#PED-2777)

It imports the future SUSE Linux Enterprise 15 4096 bit RSA key primary and reserve keys.

To manually import them you can also run:

# rpm --import /usr/lib/rpm/gnupg/keys/gpg-pubkey-3fa1d6ce-63c9481c.asc
# rpm --import /usr/lib/rpm/gnupg/keys/gpg-pubkey-d588dc46-63c939db.asc


The following package changes have been done:

- container-suseconnect-2.4.0-150000.4.38.1 updated
- curl-8.0.1-150400.5.29.1 updated
- glibc-2.31-150300.58.1 updated
- libcurl4-8.0.1-150400.5.29.1 updated
- suse-build-key-12.0-150000.8.34.1 updated