SUSE-CU-2024:223-1: Security update of suse/ltss/sle15.3/sle15

Thu Jan 18 08:01:57 UTC 2024

SUSE Container Update Advisory: suse/ltss/sle15.3/sle15
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2024:223-1
Container Tags        : suse/ltss/sle15.3/bci-base:15.3 , suse/ltss/sle15.3/bci-base:15.3.3.40 , suse/ltss/sle15.3/sle15:15.3 , suse/ltss/sle15.3/sle15:15.3.3.40
Container Release     : 3.40
Severity              : important
Type                  : security
References            : 1029961 1158830 1201384 1206798 1209122 1212475 1215496 1216862
                        1216987 1217212 1217573 1218014 CVE-2023-46218 CVE-2023-50495
-----------------------------------------------------------------

The container suse/ltss/sle15.3/sle15 was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:4699-1
Released:    Mon Dec 11 07:02:10 2023
Summary:     Recommended update for gpg2
Type:        recommended
Severity:    moderate
References:  1217212
This update for gpg2 fixes the following issues:

- `dirmngr-client --validate` is broken for DER-encoded files (bsc#1217212)

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:4713-1
Released:    Mon Dec 11 13:23:12 2023
Summary:     Security update for curl
Type:        security
Severity:    moderate
References:  1217573,CVE-2023-46218
This update for curl fixes the following issues:

- CVE-2023-46218: Fixed cookie mixed case PSL bypass (bsc#1217573).

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:4723-1
Released:    Tue Dec 12 09:57:51 2023
Summary:     Recommended update for libtirpc
Type:        recommended
Severity:    moderate
References:  1216862
This update for libtirpc fixes the following issue:

- fix sed parsing in specfile (bsc#1216862)

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:4807-1
Released:    Wed Dec 13 18:07:37 2023
Summary:     Security update for container-suseconnect
Type:        security
Severity:    important
References:  1212475

This update of container-suseconnect fixes the following issues:

- rebuild the package with the go 1.21 security release (bsc#1212475).

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:4891-1
Released:    Mon Dec 18 16:31:49 2023
Summary:     Security update for ncurses
Type:        security
Severity:    moderate
References:  1201384,1218014,CVE-2023-50495
This update for ncurses fixes the following issues:

- CVE-2023-50495: Fixed a segmentation fault via _nc_wrap_entry() (bsc#1218014)
- Modify reset command to avoid altering clocal if the terminal uses a modem (bsc#1201384)

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:4963-1
Released:    Fri Dec 22 14:37:08 2023
Summary:     Recommended update for curl
Type:        recommended
Severity:    important
References:  1216987
This update for curl fixes the following issues:

- libssh: Implement SFTP packet size limit (bsc#1216987)

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2024:11-1
Released:    Tue Jan  2 13:24:52 2024
Summary:     Recommended update for procps
Type:        recommended
Severity:    moderate
References:  1029961,1158830,1206798,1209122
This update for procps fixes the following issues:

- Update procps to 3.3.17 (jsc#PED-3244 jsc#PED-6369)

- For support up to 2048 CPU as well (bsc#1185417)
- Allow `-´ as leading character to ignore possible errors on systctl entries (bsc#1209122)
- Get the first CPU summary correct (bsc#1121753)
- Enable pidof for SLE-15 as this is provided by sysvinit-tools
- Use a check on syscall __NR_pidfd_open to decide if
  the pwait tool and its manual page will be build
- Do not truncate output of w with option -n
- Prefer logind over utmp (jsc#PED-3144)
- Don't install translated man pages for non-installed binaries
  (uptime, kill).
- Fix directory for Ukrainian man pages translations.
- Move localized man pages to lang package.

- Update to procps-ng-3.3.17

  * library: Incremented to 8:3:0
    (no removals or additions, internal changes only)
  * all: properly handle utf8 cmdline translations
  * kill: Pass int to signalled process
  * pgrep: Pass int to signalled process
  * pgrep: Check sanity of SG_ARG_MAX
  * pgrep: Add older than selection
  * pidof: Quiet mode
  * pidof: show worker threads
  * ps.1: Mention stime alias
  * ps: check also match on truncated 16 char comm names
  * ps: Add exe output option
  * ps: A lot more sorting available
  * pwait: New command waits for a process
  * sysctl: Match systemd directory order
  * sysctl: Document directory order
  * top: ensure config file backward compatibility
  * top: add command line 'e' for symmetry with 'E'
  * top: add '4' toggle for two abreast cpu display
  * top: add '!' toggle for combining multiple cpus
  * top: fix potential SEGV involving -p switch
  * vmstat: Wide mode gives wider proc columns
  * watch: Add environment variable for interval
  * watch: Add no linewrap option
  * watch: Support more colors
  * free,uptime,slabtop: complain about extra ops

- Package translations in procps-lang.

- Fix pgrep: cannot allocate 4611686018427387903 bytes when ulimit -s is unlimited.

- Enable pidof by default

- Update to procps-ng-3.3.16

  * library: Increment to 8:2:0

    No removals or functions
    Internal changes only, so revision is incremented.
    Previous version should have been 8:1:0 not 8:0:1

  * docs: Use correct symbols for -h option in free.1
  * docs: ps.1 now warns about command name length
  * docs: install translated man pages
  * pgrep: Match on runstate
  * snice: Fix matching on pid
  * top: can now exploit 256-color terminals
  * top: preserves 'other filters' in configuration file
  * top: can now collapse/expand forest view children
  * top: parent %CPU time includes collapsed children
  * top: improve xterm support for vim navigation keys
  * top: avoid segmentation fault at program termination
  * 'ps -C' does not allow anymore an argument longer than 15 characters (bsc#1158830)

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2024:62-1
Released:    Mon Jan  8 11:44:47 2024
Summary:     Recommended update for libxcrypt
Type:        recommended
Severity:    moderate
References:  1215496
This update for libxcrypt fixes the following issues:

- fix variable name for datamember [bsc#1215496]
- added patches fix https://github.com/besser82/libxcrypt/commit/b212d601549a0fc84cbbcaf21b931f903787d7e2

The following package changes have been done:

- container-suseconnect-2.4.0-150000.4.46.1 updated
- curl-7.66.0-150200.4.66.1 updated
- gpg2-2.2.27-150300.3.8.1 updated
- libcrypt1-4.4.15-150300.4.7.1 updated
- libcurl4-7.66.0-150200.4.66.1 updated
- libncurses6-6.1-150000.5.20.1 updated
- libprocps8-3.3.17-150000.7.37.1 added
- libsolv-tools-0.7.27-150200.23.2 updated
- libtirpc-netconfig-1.3.4-150300.3.23.1 updated
- libtirpc3-1.3.4-150300.3.23.1 updated
- libzypp-17.31.27-150200.84.1 updated
- ncurses-utils-6.1-150000.5.20.1 updated
- procps-3.3.17-150000.7.37.1 updated
- terminfo-base-6.1-150000.5.20.1 updated
- zypper-1.14.68-150200.70.2 updated
- libprocps7-3.3.15-150000.7.34.1 removed