SUSE-SU-2020:3625-1: important: Security update for mariadb

[sle-updates at lists.suse.com]

   SUSE Security Update: Security update for mariadb
______________________________________________________________________________

Announcement ID:    SUSE-SU-2020:3625-1
Rating:             important
References:         #1171550 #1175596 #1177472 #1178428 
Cross-References:   CVE-2020-13249 CVE-2020-14765 CVE-2020-14776
                    CVE-2020-14789 CVE-2020-14812 CVE-2020-15180
                    CVE-2020-2752 CVE-2020-2760 CVE-2020-2812
                    CVE-2020-2814
Affected Products:
                    SUSE OpenStack Cloud 7
______________________________________________________________________________

   An update that fixes 10 vulnerabilities is now available.

Description:

   This update for mariadb includes the following fixes:

   Security fixes included in this update:

   - CVE-2020-2752: Fixed an issue which could have resulted in unauthorized
     ability to cause denial of service.
   - CVE-2020-2812: Fixed an issue which could have resulted in unauthorized
     ability to cause denial of service.
   - CVE-2020-2814: Fixed an issue which could have resulted in unauthorized
     ability to cause denial of service.
   - CVE-2020-2760: Fixed an issue which could have resulted in unauthorized
     ability to cause denial of service.
   - CVE-2020-13249: Fixed an improper validation of the content of an OK
     packet received from a server.
   - CVE-2020-14812: Fixed an issue which could have resulted in unauthorized
     ability to cause denial of service.
   - CVE-2020-14765: Fixed an issue which could have resulted in unauthorized
     ability to cause denial of service.
   - CVE-2020-14776: Fixed an issue which could have resulted in unauthorized
     ability of accessing data.
   - CVE-2020-14789: Fixed an issue which could have resulted in unauthorized
     ability to cause denial of service.
   - CVE-2020-15180: Fixed an issue in Galera which could have led to remote
     code execution.


   Non Security fixes included in this update:

   - Update to 10.2.36 GA [bsc#1177472] and [bsc#1178428]
     * release notes and changelog:
       https://mariadb.com/kb/en/library/mariadb-10236-release-notes
       https://mariadb.com/kb/en/library/mariadb-10236-changelog
       https://mariadb.com/kb/en/library/mariadb-10235-release-notes
       https://mariadb.com/kb/en/library/mariadb-10235-changelog
       https://mariadb.com/kb/en/library/mariadb-10234-release-notes
       https://mariadb.com/kb/en/library/mariadb-10234-changelog
     * fixes for the following security vulnerabilities: 10.2.36: none
       10.2.35: CVE-2020-14812, CVE-2020-14765, CVE-2020-14776,
       CVE-2020-14789 10.2.34: CVE-2020-15180
   - update suse_skipped_tests.list

   - Update to 10.2.33 GA [bsc#1175596]
     * release notes and changelog:
       https://mariadb.com/kb/en/library/mariadb-10233-release-notes
       https://mariadb.com/kb/en/library/mariadb-10233-changelog
     * fixes for the following security vulnerabilities: none
   - refresh mariadb-10.2.4-fortify-and-O.patch
   - tune the testsuite to avoid randomly failing tests
   - update suse_skipped_tests.list

   - Update to 10.2.32 GA [bsc#1171550]
     * Fixes for the following security vulnerabilities: CVE-2020-2752,
       CVE-2020-2812, CVE-2020-2814, CVE-2020-2760, CVE-2020-13249
     * release notes and changelog:
       https://mariadb.com/kb/en/library/mariadb-10232-release-notes
       https://mariadb.com/kb/en/library/mariadb-10232-changelog
   - refresh mariadb-10.2.4-fortify-and-O.patch
   - drop specfile "hacks" as things work correctly in upstream now:
     * renaming tmpfiles.conf -> mariadb.conf
     * installing pam_user_map.so to /lib64/security for non 32bit
       architectures
     * sysusers.conf was renamed to mariadb.conf
   - update suse_skipped_tests.list


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE OpenStack Cloud 7:

      zypper in -t patch SUSE-OpenStack-Cloud-7-2020-3625=1



Package List:

   - SUSE OpenStack Cloud 7 (aarch64 s390x x86_64):

      mariadb-10.2.36-19.1
      mariadb-client-10.2.36-19.1
      mariadb-client-debuginfo-10.2.36-19.1
      mariadb-debuginfo-10.2.36-19.1
      mariadb-debugsource-10.2.36-19.1
      mariadb-tools-10.2.36-19.1
      mariadb-tools-debuginfo-10.2.36-19.1

   - SUSE OpenStack Cloud 7 (noarch):

      mariadb-errormessages-10.2.36-19.1

   - SUSE OpenStack Cloud 7 (x86_64):

      mariadb-galera-10.2.36-19.1


References:

   https://www.suse.com/security/cve/CVE-2020-13249.html
   https://www.suse.com/security/cve/CVE-2020-14765.html
   https://www.suse.com/security/cve/CVE-2020-14776.html
   https://www.suse.com/security/cve/CVE-2020-14789.html
   https://www.suse.com/security/cve/CVE-2020-14812.html
   https://www.suse.com/security/cve/CVE-2020-15180.html
   https://www.suse.com/security/cve/CVE-2020-2752.html
   https://www.suse.com/security/cve/CVE-2020-2760.html
   https://www.suse.com/security/cve/CVE-2020-2812.html
   https://www.suse.com/security/cve/CVE-2020-2814.html
   https://bugzilla.suse.com/1171550
   https://bugzilla.suse.com/1175596
   https://bugzilla.suse.com/1177472
   https://bugzilla.suse.com/1178428