SUSE-CU-2020:763-1: Security update of ses/7/rook/ceph

[sle-updates at lists.suse.com]

SUSE Container Update Advisory: ses/7/rook/ceph
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2020:763-1
Container Tags        : ses/7/rook/ceph:1.4.7 , ses/7/rook/ceph:1.4.7.6 , ses/7/rook/ceph:1.4.7.6.1.1397 , ses/7/rook/ceph:latest , ses/7/rook/ceph:sle15.2.octopus
Container Release     : 1.1397
Severity              : important
Type                  : security
References            : 1176262 1176262 1178168 1178376 1179036 1179193 1179341 1179431
                        1179515 CVE-2019-20916 CVE-2019-20916 CVE-2020-25659 
-----------------------------------------------------------------

The container ses/7/rook/ceph was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:3566-1
Released:    Mon Nov 30 16:56:52 2020
Summary:     Security update for python-setuptools
Type:        security
Severity:    important
References:  1176262,CVE-2019-20916
This update for python-setuptools fixes the following issues:

- Fixed a directory traversal in _download_http_url() (bsc#1176262 CVE-2019-20916)

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:3581-1
Released:    Tue Dec  1 14:40:22 2020
Summary:     Recommended update for libusb-1_0
Type:        recommended
Severity:    moderate
References:  1178376
This update for libusb-1_0 fixes the following issues:

- Fixes a build failure for libusb for the inclusion of 'sys/time.h' on PowerPC. (bsc#1178376)

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:3592-1
Released:    Wed Dec  2 10:31:34 2020
Summary:     Security update for python-cryptography
Type:        security
Severity:    moderate
References:  1178168,CVE-2020-25659
This update for python-cryptography fixes the following issues:

- CVE-2020-25659: Attempted to mitigate Bleichenbacher attacks on RSA decryption (bsc#1178168).
 
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:3593-1
Released:    Wed Dec  2 10:33:49 2020
Summary:     Security update for python3
Type:        security
Severity:    important
References:  1176262,1179193,CVE-2019-20916
This update for python3 fixes the following issues:

Update to 3.6.12 (bsc#1179193), including:

- Fixed a directory traversal in _download_http_url() (bsc#1176262 CVE-2019-20916)

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:3620-1
Released:    Thu Dec  3 17:03:55 2020
Summary:     Recommended update for pam
Type:        recommended
Severity:    moderate
References:  
This update for pam fixes the following issues:

- Check if the password is part of the username. (jsc#SLE-16719, jsc#SLE-16720)
  - Check whether the password contains a substring of of the user's name of at least `<N>` characters length in 
  some form. This is enabled by the new parameter `usersubstr=<N>`

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:3626-1
Released:    Fri Dec  4 13:51:46 2020
Summary:     Recommended update for audit
Type:        recommended
Severity:    moderate
References:  1179515
This update for audit fixes the following issues:

- Enable Aarch64 processor support. (bsc#1179515) 

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:3640-1
Released:    Mon Dec  7 13:24:41 2020
Summary:     Recommended update for binutils
Type:        recommended
Severity:    important
References:  1179036,1179341
This update for binutils fixes the following issues:

Update binutils 2.35 branch to commit 1c5243df:

* Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
  certain DWARF variable descriptions.
* Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
  PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
  PR26711
* The above includes fixes for dwo files produced by modern dwp,
  fixing several problems in the DWARF reader.

Update binutils to 2.35.1 and rebased branch diff:

* This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  '.nop'.  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled. This fixes an 
  incompatibility introduced in the latest update that broke the install
  scripts of the Oracle server. [bsc#1179341]

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:3703-1
Released:    Mon Dec  7 20:17:32 2020
Summary:     Recommended update for aaa_base
Type:        recommended
Severity:    moderate
References:  1179431
This update for aaa_base fixes the following issue:

- Avoid semicolon within (t)csh login script on S/390. (bsc#1179431)

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:3704-1
Released:    Tue Dec  8 08:31:07 2020
Summary:     Recommended update for rook
Type:        recommended
Severity:    moderate
References:  
This update for rook fixes the following issues:

- Derive CSI and sidecar image versions from code defaults rather than images found in the build service.