SUSE-CU-2020:54-1: Security update of caasp/v4/prometheus-pushgateway
sle-updates at lists.suse.com
sle-updates at lists.suse.com
Mon Feb 17 04:26:04 MST 2020
SUSE Container Update Advisory: caasp/v4/prometheus-pushgateway
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2020:54-1
Container Tags : caasp/v4/prometheus-pushgateway:0.6.0 , caasp/v4/prometheus-pushgateway:0.6.0-rev1 , caasp/v4/prometheus-pushgateway:0.6.0-rev1-build1.7.1
Container Release : 1.7.1
Severity : important
Type : security
References : 1005023 1007715 1009532 1013125 1033084 1033085 1033086 1033087
1033088 1033089 1033090 1036463 1038194 1039099 1044840 1045723
1047002 1049825 1051143 1063675 1065270 1071321 1072183 1073313
1076696 1080919 1081947 1081947 1082293 1082318 1082318 1082956
1083158 1084671 1084812 1084842 1084934 1085196 1086367 1086367
1087550 1088052 1088279 1088524 1089640 1089761 1090944 1091265
1091677 1092100 1092877 1092920 1093414 1093753 1093753 1093851
1094150 1094154 1094161 1094222 1094735 1095096 1095148 1095661
1095670 1095973 1096191 1096718 1096745 1096974 1096984 1097073
1097158 1097370 1098569 1099793 1100396 1100415 1100488 1100779
1101040 1101470 1101470 1101591 1102046 1102310 1102526 1102564
1102908 1103320 1103320 1104531 1104780 1105031 1105166 1105435
1105437 1105459 1105460 1106019 1106214 1106383 1106390 1107066
1107067 1107617 1107640 1107941 1109197 1109252 1110304 1110445
1110700 1110797 1111019 1111342 1111345 1111345 1111388 1111498
1111973 1112024 1112570 1112723 1112726 1112758 1112928 1113083
1113100 1113632 1113660 1113665 1114135 1114407 1114592 1114674
1114675 1114681 1114686 1114845 1114933 1114984 1114993 1115640
1115929 1116995 1117025 1117063 1117354 1117993 1118086 1118087
1118087 1118364 1118629 1119414 1119687 1119937 1119971 1120279
1120323 1120346 1120472 1120629 1120630 1120631 1120689 1121051
1121197 1121446 1121563 1121563 1121753 1122000 1122361 1122417
1122666 1122729 1123043 1123333 1123371 1123377 1123378 1123685
1123710 1123727 1123820 1123892 1123919 1124122 1124153 1124223
1124847 1125007 1125352 1125352 1125410 1125439 1125604 1125886
1126056 1126096 1126117 1126118 1126119 1126327 1126377 1126590
1127073 1127155 1127223 1127308 1127557 1127608 1127701 1128246
1128383 1128598 1128828 1129576 1129598 1129753 1130045 1130230
1130306 1130325 1130326 1130681 1130682 1131060 1131113 1131330
1131686 1131823 1132348 1132400 1132721 1133495 1133506 1133509
1133773 1133808 1134193 1134217 1134226 1134524 1134856 1135123
1135170 1135254 1135534 1135708 1135709 1135749 1135751 1135984
1136717 1137053 1137296 1137337 1137624 1137832 1137977 1138869
1138939 1139083 1139083 1139459 1139795 1139937 1140039 1140631
1140647 1141059 1141093 1141113 1141883 1141897 1142614 1142649
1142654 1143055 1143194 1143273 1144047 1144169 1145023 1145231
1145521 1145554 1145716 1146027 1146415 1146415 1146866 1146947
1148517 1148987 1149145 1149332 1149429 1149495 1149496 1149511
1150003 1150021 1150137 1150250 1150595 1150734 1151023 1151377
1151582 1152101 1152335 1152755 1153351 1153557 1153936 1154019
1154036 1154037 1154256 1154295 1154871 1154884 1154887 1155199
1155207 1155323 1155338 1155339 1155346 1155574 1155593 1155668
1155810 1156213 1156482 1157198 1157278 1157292 1157775 1157794
1157802 1157893 1158095 1158095 1158101 1158485 1158809 1158830
1158921 1158996 1159074 1159452 1159814 1160443 1160571 1160600
1160970 1161056 1161179 1161436 1161975 1162108 353876 859480
915402 918346 943457 953659 960273 985657 991901 CVE-2009-5155
CVE-2015-0247 CVE-2015-1572 CVE-2016-10739 CVE-2016-3189 CVE-2017-10790
CVE-2017-17740 CVE-2017-18269 CVE-2017-7500 CVE-2017-7607 CVE-2017-7608
CVE-2017-7609 CVE-2017-7610 CVE-2017-7611 CVE-2017-7612 CVE-2017-7613
CVE-2018-0500 CVE-2018-0732 CVE-2018-1000654 CVE-2018-1000858
CVE-2018-10360 CVE-2018-10844 CVE-2018-10845 CVE-2018-10846 CVE-2018-1122
CVE-2018-1123 CVE-2018-11236 CVE-2018-11237 CVE-2018-1124 CVE-2018-1125
CVE-2018-1126 CVE-2018-12015 CVE-2018-12020 CVE-2018-14404 CVE-2018-14567
CVE-2018-14618 CVE-2018-15686 CVE-2018-15688 CVE-2018-16062 CVE-2018-16402
CVE-2018-16403 CVE-2018-16839 CVE-2018-16840 CVE-2018-16842 CVE-2018-16864
CVE-2018-16865 CVE-2018-16866 CVE-2018-16868 CVE-2018-16868 CVE-2018-16869
CVE-2018-16890 CVE-2018-17953 CVE-2018-18310 CVE-2018-18311 CVE-2018-18312
CVE-2018-18313 CVE-2018-18314 CVE-2018-18520 CVE-2018-18521 CVE-2018-19211
CVE-2018-20346 CVE-2018-20532 CVE-2018-20533 CVE-2018-20534 CVE-2018-20843
CVE-2018-6954 CVE-2018-9251 CVE-2019-12290 CVE-2019-12749 CVE-2019-12900
CVE-2019-12900 CVE-2019-12904 CVE-2019-13050 CVE-2019-13057 CVE-2019-13565
CVE-2019-13627 CVE-2019-14250 CVE-2019-14866 CVE-2019-14889 CVE-2019-14889
CVE-2019-1547 CVE-2019-1551 CVE-2019-1563 CVE-2019-15847 CVE-2019-15903
CVE-2019-16168 CVE-2019-17543 CVE-2019-17594 CVE-2019-17595 CVE-2019-18224
CVE-2019-19126 CVE-2019-20386 CVE-2019-3688 CVE-2019-3690 CVE-2019-3822
CVE-2019-3823 CVE-2019-3829 CVE-2019-3836 CVE-2019-3842 CVE-2019-3843
CVE-2019-3844 CVE-2019-3880 CVE-2019-5021 CVE-2019-5094 CVE-2019-5188
CVE-2019-5436 CVE-2019-5481 CVE-2019-5482 CVE-2019-6454 CVE-2019-6454
CVE-2019-6706 CVE-2019-7150 CVE-2019-7665 CVE-2019-8905 CVE-2019-8906
CVE-2019-8907 CVE-2019-9169 CVE-2019-9893 CVE-2019-9936 CVE-2019-9937
CVE-2020-1712 SLE-3853 SLE-4117 SLE-5807 SLE-5933 SLE-6533 SLE-6536
SLE-7687 SLE-8789 SLE-9132 SLE-9171
-----------------------------------------------------------------
The container caasp/v4/prometheus-pushgateway was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2018:1223-1
Released: Tue Jun 26 11:41:00 2018
Summary: Security update for gpg2
Type: security
Severity: important
References: 1096745,CVE-2018-12020
Description:
This update for gpg2 fixes the following security issue:
- CVE-2018-12020: GnuPG mishandled the original filename during decryption and
verification actions, which allowed remote attackers to spoof the output that
GnuPG sends on file descriptor 2 to other programs that use the '--status-fd 2'
option (bsc#1096745).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2018:1264-1
Released: Tue Jul 3 10:56:12 2018
Summary: Recommended update for curl
Type: recommended
Severity: moderate
References: 1086367
Description:
This update for curl provides the following fix:
- Use OPENSSL_config() instead of CONF_modules_load_file() to avoid crashes due to conflicting
openssl engines. (bsc#1086367)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2018:1327-1
Released: Tue Jul 17 08:07:24 2018
Summary: Security update for perl
Type: security
Severity: moderate
References: 1096718,CVE-2018-12015
Description:
This update for perl fixes the following issues:
- CVE-2018-12015: The Archive::Tar module allowed remote attackers to bypass a
directory-traversal protection mechanism and overwrite arbitrary files
(bsc#1096718)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2018:1346-1
Released: Thu Jul 19 09:25:08 2018
Summary: Security update for glibc
Type: security
Severity: moderate
References: 1082318,1092877,1094150,1094154,1094161,CVE-2017-18269,CVE-2018-11236,CVE-2018-11237
Description:
This update for glibc fixes the following security issues:
- CVE-2017-18269: An SSE2-optimized memmove implementation for i386 did not
correctly perform the overlapping memory check if the source memory range
spaned the middle of the address space, resulting in corrupt data being
produced by the copy operation. This may have disclosed information to
context-dependent attackers, resulted in a denial of service or code execution
(bsc#1094150).
- CVE-2018-11236: Prevent integer overflow on 32-bit architectures when
processing very long pathname arguments to the realpath function, leading to a
stack-based buffer overflow (bsc#1094161).
- CVE-2018-11237: An AVX-512-optimized implementation of the mempcpy function
may have writen data beyond the target buffer, leading to a buffer overflow in
__mempcpy_avx512_no_vzeroupper (bsc#1092877, bsc#1094154).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2018:1353-1
Released: Thu Jul 19 09:50:32 2018
Summary: Security update for e2fsprogs
Type: security
Severity: moderate
References: 1009532,1038194,915402,918346,960273,CVE-2015-0247,CVE-2015-1572
Description:
This update for e2fsprogs fixes the following issues:
Security issues fixed:
- CVE-2015-0247: Fixed couple of heap overflows in e2fsprogs (fsck, dumpe2fs, e2image...) (bsc#915402).
- CVE-2015-1572: Fixed potential buffer overflow in closefs() (bsc#918346).
Bug fixes:
- bsc#1038194: generic/405 test fails with /dev/mapper/thin-vol is inconsistent on ext4 file system.
- bsc#1009532: resize2fs hangs when trying to resize a large ext4 file system.
- bsc#960273: xfsprogs does not call %{?regenerate_initrd_post}.
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2018:1362-1
Released: Thu Jul 19 12:47:33 2018
Summary: Recommended update for ca-certificates-mozilla
Type: recommended
Severity: moderate
References: 1100415
Description:
ca-certificates-mozilla was updated to the 2.24 state of the Mozilla NSS Certificate store. (bsc#1100415)
Following CAs were removed:
* S-TRUST_Universal_Root_CA
* TC_TrustCenter_Class_3_CA_II
* TUeRKTRUST_Elektronik_Sertifika_Hizmet_Saglayicisi_H5
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2018:1396-1
Released: Thu Jul 26 16:23:09 2018
Summary: Security update for rpm
Type: security
Severity: moderate
References: 1094735,1095148,943457,CVE-2017-7500
Description:
This update for rpm fixes the following issues:
This security vulnerability was fixed:
- CVE-2017-7500: Fixed symlink attacks during RPM installation (bsc#943457)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2018:1409-1
Released: Fri Jul 27 06:45:10 2018
Summary: Recommended update for systemd
Type: recommended
Severity: moderate
References: 1039099,1083158,1088052,1091265,1093851,1095096,1095973,1098569
Description:
This update for systemd provides the following fixes:
- systemctl: Mask always reports the same unit names when different unknown units are passed. (bsc#1095973)
- systemctl: Check the existence of all units, not just the first one.
- scsi_id: Fix the prefix for pre-SPC inquiry reply. (bsc#1039099)
- device: Make sure to always retroactively start device dependencies. (bsc#1088052)
- locale-util: On overlayfs FTW_MOUNT causes nftw(3) to not list *any* files.
- Fix pattern to detect distribution.
- install: The 'user' and 'global' scopes are equivalent for user presets. (bsc#1093851)
- install: Search for preset files in /run (#7715)
- install: Consider globally enabled units as 'enabled' for the user. (bsc#1093851)
- install: Consider non-Alias=/non-DefaultInstance= symlinks as 'indirect' enablement.
- install: Only consider names in Alias= as 'enabling'.
- udev: Whitelist mlx4_core locally-administered MAC addresses in the persistent rule
generator. (bsc#1083158)
- man: Updated systemd-analyze blame description for service-units with Type=simple.
(bsc#1091265)
- fileio: Support writing atomic files with timestamp.
- fileio.c: Fix incorrect mtime
- Drop runtime dependency on dracut, otherwise systemd pulls in tools to generate the
initrd even in container/chroot installations that don't have a kernel. For environments
where initrd matters, dracut should be pulled via a pattern. (bsc#1098569)
- An update broke booting with encrypted partitions on NVMe (bsc#1095096)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2018:1685-1
Released: Fri Aug 17 18:20:58 2018
Summary: Security update for curl
Type: security
Severity: moderate
References: 1099793,CVE-2018-0500
Description:
This update for curl fixes the following issues:
Security issue fixed:
- CVE-2018-0500: Fix a SMTP send heap buffer overflow (bsc#1099793).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2018:1754-1
Released: Fri Aug 24 16:40:21 2018
Summary: Recommended update for ca-certificates-mozilla
Type: recommended
Severity: moderate
References: 1104780
Description:
This update for ca-certificates-mozilla fixes the following issues:
Updated to the 2.26 state of the Mozilla NSS Certificate store. (bsc#1104780)
- removed server auth rights from following CAs:
- Certplus Root CA G1
- Certplus Root CA G2
- OpenTrust Root CA G1
- OpenTrust Root CA G2
- OpenTrust Root CA G3
- removed CA
- ComSign CA
- new CA added:
- GlobalSign
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2018:1760-1
Released: Fri Aug 24 17:14:53 2018
Summary: Recommended update for libtirpc
Type: recommended
Severity: moderate
References: 1072183
Description:
This update for libtirpc fixes the following issues:
- rpcinfo: send RPC getport call as specified via parameter (bsc#1072183)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2018:1904-1
Released: Fri Sep 14 12:46:39 2018
Summary: Security update for curl
Type: security
Severity: moderate
References: 1086367,1106019,CVE-2018-14618
Description:
This update for curl fixes the following issues:
This security issue was fixed:
- CVE-2018-14618: Prevent integer overflow in the NTLM authentication code
(bsc#1106019)
This non-security issue was fixed:
- Use OPENSSL_config instead of CONF_modules_load_file() to avoid crashes due
to openssl engines conflicts (bsc#1086367)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2018:1999-1
Released: Tue Sep 25 08:20:35 2018
Summary: Recommended update for zlib
Type: recommended
Severity: moderate
References: 1071321
Description:
This update for zlib provides the following fixes:
- Speedup zlib on power8. (fate#325307)
- Add safeguard against negative values in uInt. (bsc#1071321)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2018:2055-1
Released: Thu Sep 27 14:30:14 2018
Summary: Recommended update for openldap2
Type: recommended
Severity: moderate
References: 1089640
Description:
This update for openldap2 provides the following fix:
- Fix slapd segfaults in mdb_env_reader_dest. (bsc#1089640)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2018:2070-1
Released: Fri Sep 28 08:02:02 2018
Summary: Security update for gnutls
Type: security
Severity: moderate
References: 1047002,1105437,1105459,1105460,CVE-2017-10790,CVE-2018-10844,CVE-2018-10845,CVE-2018-10846
Description:
This update for gnutls fixes the following security issues:
- Improved mitigations against Lucky 13 class of attacks
- CVE-2018-10846: 'Just in Time' PRIME + PROBE cache-based side channel attack
can lead to plaintext recovery (bsc#1105460)
- CVE-2018-10845: HMAC-SHA-384 vulnerable to Lucky thirteen attack due to use
of wrong constant (bsc#1105459)
- CVE-2018-10844: HMAC-SHA-256 vulnerable to Lucky thirteen attack due to not
enough dummy function calls (bsc#1105437)
- CVE-2017-10790: The _asn1_check_identifier function in Libtasn1 caused a NULL
pointer dereference and crash (bsc#1047002)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2018:2083-1
Released: Sun Sep 30 14:06:33 2018
Summary: Security update for openssl-1_1
Type: security
Severity: moderate
References: 1097158,1101470,CVE-2018-0732
Description:
This update for openssl-1_1 to 1.1.0i fixes the following issues:
These security issues were fixed:
- CVE-2018-0732: During key agreement in a TLS handshake using a DH(E) based
ciphersuite a malicious server could have sent a very large prime value to the
client. This caused the client to spend an unreasonably long period of time
generating a key for this prime resulting in a hang until the client has
finished. This could be exploited in a Denial Of Service attack (bsc#1097158)
- Make problematic ECDSA sign addition length-invariant
- Add blinding to ECDSA and DSA signatures to protect against side channel attacks
These non-security issues were fixed:
- When unlocking a pass phrase protected PEM file or PKCS#8 container, we now
allow empty (zero character) pass phrases.
- Certificate time validation (X509_cmp_time) enforces stricter compliance with
RFC 5280. Fractional seconds and timezone offsets are no longer allowed.
- Fixed a text canonicalisation bug in CMS
- Add openssl(cli) Provide so the packages that require the openssl binary can
require this instead of the new openssl meta package (bsc#1101470)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2018:2155-1
Released: Fri Oct 5 14:41:17 2018
Summary: Recommended update for ca-certificates
Type: recommended
Severity: moderate
References: 1101470
Description:
This update for ca-certificates fixes the following issues:
- Changed 'openssl' requirement to 'openssl(cli)' (bsc#1101470)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2018:2177-1
Released: Tue Oct 9 09:00:13 2018
Summary: Recommended update for bash
Type: recommended
Severity: moderate
References: 1095661,1095670,1100488
Description:
This update for bash provides the following fixes:
- Bugfix: Parse settings in inputrc for all screen TERM variables
starting with 'screen.' (bsc#1095661)
- Make the generation of bash.html reproducible. (bsc#1100488)
- Use initgroups(3) instead of setgroups(2) to fix the usage of suid programs. (bsc#1095670)
- Fix a problem that could cause hash table bash uses to store exit statuses from
asynchronous processes to develop loops in circumstances involving long-running scripts
that create and reap many processes.
- Fix a problem that could cause the shell to loop if a SIGINT is received inside of a
SIGINT trap handler.
- Fix cases where a failing readline command (e.g., delete-char at the end of a line) can
cause a multi-character key sequence to 'back up' and attempt to re-read some of the
characters in the sequence.
- Fix a problem when sourcing a file from an interactive shell, that setting the SIGINT
handler to the default and typing ^C would cause the shell to exit.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2018:2182-1
Released: Tue Oct 9 11:08:36 2018
Summary: Security update for libxml2
Type: security
Severity: moderate
References: 1088279,1102046,1105166,CVE-2018-14404,CVE-2018-14567,CVE-2018-9251
Description:
This update for libxml2 fixes the following security issues:
- CVE-2018-9251: The xz_decomp function allowed remote attackers to cause a
denial of service (infinite loop) via a crafted XML file that triggers
LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint (bsc#1088279)
- CVE-2018-14567: Prevent denial of service (infinite loop) via a crafted XML
file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint
(bsc#1105166)
- CVE-2018-14404: Prevent NULL pointer dereference in the xmlXPathCompOpEval()
function when parsing an invalid XPath expression in the XPATH_OP_AND or
XPATH_OP_OR case leading to a denial of service attack (bsc#1102046)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2018:2370-1
Released: Mon Oct 22 14:02:01 2018
Summary: Recommended update for aaa_base
Type: recommended
Severity: moderate
References: 1102310,1104531
Description:
This update for aaa_base provides the following fixes:
- Let bash.bashrc work even for (m)ksh. (bsc#1104531)
- Fix an error at login if java system directory is empty. (bsc#1102310)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2018:2485-1
Released: Fri Oct 26 12:38:01 2018
Summary: Recommended update for kmod
Type: recommended
Severity: moderate
References: 1112928
Description:
This update for kmod provides the following fixes:
- Allow 'modprobe -c' print the status of 'allow_unsupported_modules' option. (bsc#1112928)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2018:2487-1
Released: Fri Oct 26 12:39:07 2018
Summary: Recommended update for glibc
Type: recommended
Severity: moderate
References: 1102526
Description:
This update for glibc fixes the following issues:
- Fix build on aarch64 with binutils newer than 2.30.
- Fix year 2039 bug for localtime with 64-bit time_t (bsc#1102526)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2018:2539-1
Released: Tue Oct 30 16:17:23 2018
Summary: Recommended update for rpm
Type: recommended
Severity: moderate
References: 1113100
Description:
This update for rpm fixes the following issues:
- On PowerPC64 fix the superfluous TOC. dependency (bsc#1113100)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2018:2569-1
Released: Fri Nov 2 19:00:18 2018
Summary: Recommended update for pam
Type: recommended
Severity: moderate
References: 1110700
Description:
This update for pam fixes the following issues:
- Remove limits for nproc from /etc/security/limits.conf (bsc#1110700)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2018:2578-1
Released: Mon Nov 5 17:55:35 2018
Summary: Security update for curl
Type: security
Severity: moderate
References: 1112758,1113660,CVE-2018-16839,CVE-2018-16840,CVE-2018-16842
Description:
This update for curl fixes the following issues:
- CVE-2018-16839: A SASL password overflow via integer overflow was fixed which could lead to crashes (bsc#1112758)
- CVE-2018-16840: A use-after-free in SASL handle close was fixed which could lead to crashes (bsc#1112758)
- CVE-2018-16842: A Out-of-bounds Read in tool_msgs.c was fixed which could lead to crashes (bsc#1113660)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2018:2595-1
Released: Wed Nov 7 11:14:42 2018
Summary: Security update for systemd
Type: security
Severity: important
References: 1089761,1090944,1091677,1093753,1101040,1102908,1105031,1107640,1107941,1109197,1109252,1110445,1112024,1113083,1113632,1113665,1114135,991901,CVE-2018-15686,CVE-2018-15688
Description:
This update for systemd fixes the following issues:
Security issues fixed:
- CVE-2018-15688: A buffer overflow vulnerability in the dhcp6 client of systemd allowed a malicious dhcp6 server to overwrite heap memory in systemd-networkd. (bsc#1113632)
- CVE-2018-15686: A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. (bsc#1113665)
Non security issues fixed:
- dhcp6: split assert_return() to be more debuggable when hit
- core: skip unit deserialization and move to the next one when unit_deserialize() fails
- core: properly handle deserialization of unknown unit types (#6476)
- core: don't create Requires for workdir if 'missing ok' (bsc#1113083)
- logind: use manager_get_user_by_pid() where appropriate
- logind: rework manager_get_{user|session}_by_pid() a bit
- login: fix user at .service case, so we don't allow nested sessions (#8051) (bsc#1112024)
- core: be more defensive if we can't determine per-connection socket peer (#7329)
- core: introduce systemd.early_core_pattern= kernel cmdline option
- core: add missing 'continue' statement
- core/mount: fstype may be NULL
- journald: don't ship systemd-journald-audit.socket (bsc#1109252)
- core: make 'tmpfs' dependencies on swapfs a 'default' dep, not an 'implicit' (bsc#1110445)
- mount: make sure we unmount tmpfs mounts before we deactivate swaps (#7076)
- detect-virt: do not try to read all of /proc/cpuinfo (bsc#1109197)
- emergency: make sure console password agents don't interfere with the emergency shell
- man: document that 'nofail' also has an effect on ordering
- journald: take leading spaces into account in syslog_parse_identifier
- journal: do not remove multiple spaces after identifier in syslog message
- syslog: fix segfault in syslog_parse_priority()
- journal: fix syslog_parse_identifier()
- install: drop left-over debug message (#6913)
- Ship systemd-sysv-install helper via the main package
This script was part of systemd-sysvinit sub-package but it was
wrong since systemd-sysv-install is a script used to redirect
enable/disable operations to chkconfig when the unit targets are
sysv init scripts. Therefore it's never been a SySV init tool.
- Add udev.no-partlabel-links kernel command-line option. This option can be used to disable
the generation of the by-partlabel symlinks regardless of the name used. (bsc#1089761)
- man: SystemMaxUse= clarification in journald.conf(5). (bsc#1101040)
- systemctl: load unit if needed in 'systemctl is-active' (bsc#1102908)
- core: don't freeze OnCalendar= timer units when the clock goes back a lot (bsc#1090944)
- Enable or disable machines.target according to the presets (bsc#1107941)
- cryptsetup: add support for sector-size= option (fate#325697)
- nspawn: always use permission mode 555 for /sys (bsc#1107640)
- Bugfix for a race condition between daemon-reload and other commands (bsc#1105031)
- Fixes an issue where login with root credentials was not possible in init level 5 (bsc#1091677)
- Fix an issue where services of type 'notify' harmless DENIED log entries. (bsc#991901)
- Does no longer adjust qgroups on existing subvolumes (bsc#1093753)
- cryptsetup: add support for sector-size= option (#9936) (fate#325697 bsc#1114135)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2018:2607-1
Released: Wed Nov 7 15:42:48 2018
Summary: Optional update for gcc8
Type: recommended
Severity: low
References: 1084812,1084842,1087550,1094222,1102564
Description:
The GNU Compiler GCC 8 is being added to the Development Tools Module by this
update.
The update also supplies gcc8 compatible libstdc++, libgcc_s1 and other
gcc derived libraries for the Basesystem module of SUSE Linux Enterprise 15.
Various optimizers have been improved in GCC 8, several of bugs fixed,
quite some new warnings added and the error pin-pointing and
fix-suggestions have been greatly improved.
The GNU Compiler page for GCC 8 contains a summary of all the changes that
have happened:
https://gcc.gnu.org/gcc-8/changes.html
Also changes needed or common pitfalls when porting software are described on:
https://gcc.gnu.org/gcc-8/porting_to.html
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2018:2744-1
Released: Thu Nov 22 14:30:38 2018
Summary: Recommended update for apparmor
Type: recommended
Severity: moderate
References: 1111345
Description:
This update for apparmor fixes the following issues:
- allow dnsmasq to open logfiles (bsc#1111345)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2018:2825-1
Released: Mon Dec 3 15:35:02 2018
Summary: Security update for pam
Type: security
Severity: important
References: 1115640,CVE-2018-17953
Description:
This update for pam fixes the following issue:
Security issue fixed:
- CVE-2018-17953: Fixed IP address and subnet handling of pam_access.so that was not honoured correctly when a single host was specified (bsc#1115640).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2018:2861-1
Released: Thu Dec 6 14:32:01 2018
Summary: Security update for ncurses
Type: security
Severity: important
References: 1103320,1115929,CVE-2018-19211
Description:
This update for ncurses fixes the following issues:
Security issue fixed:
- CVE-2018-19211: Fixed denial of service issue that was triggered by a NULL pointer dereference at function _nc_parse_entry (bsc#1115929).
Non-security issue fixed:
- Remove scree.xterm from terminfo data base as with this screen uses fallback TERM=screen (bsc#1103320).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2018:2984-1
Released: Wed Dec 19 11:32:39 2018
Summary: Security update for perl
Type: security
Severity: moderate
References: 1114674,1114675,1114681,1114686,CVE-2018-18311,CVE-2018-18312,CVE-2018-18313,CVE-2018-18314
Description:
This update for perl fixes the following issues:
Secuirty issues fixed:
- CVE-2018-18311: Fixed integer overflow with oversize environment (bsc#1114674).
- CVE-2018-18312: Fixed heap-buffer-overflow write / reg_node overrun (bsc#1114675).
- CVE-2018-18313: Fixed heap-buffer-overflow read if regex contains \0 chars (bsc#1114681).
- CVE-2018-18314: Fixed heap-buffer-overflow in regex (bsc#1114686).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2018:2986-1
Released: Wed Dec 19 13:53:22 2018
Summary: Security update for libnettle
Type: security
Severity: moderate
References: 1118086,CVE-2018-16869
Description:
This update for libnettle fixes the following issues:
Security issues fixed:
- CVE-2018-16869: Fixed a leaky data conversion exposing a manager oracle (bsc#1118086)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:23-1
Released: Mon Jan 7 16:30:33 2019
Summary: Security update for gpg2
Type: security
Severity: moderate
References: 1120346,CVE-2018-1000858
Description:
This update for gpg2 fixes the following issue:
Security issue fixed:
- CVE-2018-1000858: Fixed a Cross Site Request Forgery(CSRF) vulnerability in dirmngr
that can result in Attacker controlled CSRF (bsc#1120346).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:44-1
Released: Tue Jan 8 13:07:32 2019
Summary: Recommended update for acl
Type: recommended
Severity: low
References: 953659
Description:
This update for acl fixes the following issues:
- test: Add helper library to fake passwd/group files.
- quote: Escape literal backslashes. (bsc#953659)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:56-1
Released: Thu Jan 10 15:04:46 2019
Summary: Recommended update for apparmor
Type: recommended
Severity: moderate
References: 1111345
Description:
This update for apparmor fixes the following issues:
- Update the last dnsmasq fix for logfiles when running under apparmor (bsc#1111345)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:137-1
Released: Mon Jan 21 15:52:45 2019
Summary: Security update for systemd
Type: security
Severity: important
References: 1005023,1045723,1076696,1080919,1093753,1101591,1111498,1114933,1117063,1119971,1120323,CVE-2018-16864,CVE-2018-16865,CVE-2018-16866,CVE-2018-6954
Description:
This update for systemd provides the following fixes:
Security issues fixed:
- CVE-2018-16864, CVE-2018-16865: Fixed two memory corruptions through attacker-controlled alloca()s (bsc#1120323)
- CVE-2018-16866: Fixed an information leak in journald (bsc#1120323)
- CVE-2018-6954: Fix mishandling of symlinks present in non-terminal path components (bsc#1080919)
- Fixed an issue during system startup in relation to encrypted swap disks (bsc#1119971)
Non-security issues fixed:
- pam_systemd: Fix 'Cannot create session: Already running in a session' (bsc#1111498)
- systemd-vconsole-setup: vconsole setup fails, fonts will not be copied to tty (bsc#1114933)
- systemd-tmpfiles-setup: symlinked /tmp to /var/tmp breaking multiple units (bsc#1045723)
- Fixed installation issue with /etc/machine-id during update (bsc#1117063)
- btrfs: qgroups are assigned to parent qgroups after reboot (bsc#1093753)
- logind: Stop managing VT switches if no sessions are registered on that VT. (bsc#1101591)
- udev: Downgrade message when settting inotify watch up fails. (bsc#1005023)
- udev: Ignore the exit code of systemd-detect-virt for memory hot-add. In SLE-12-SP3,
80-hotplug-cpu-mem.rules has a memory hot-add rule that uses systemd-detect-virt to
detect non-zvm environment. The systemd-detect-virt returns exit failure code when it
detected _none_ state. The exit failure code causes that the hot-add memory block can
not be set to online. (bsc#1076696)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:147-1
Released: Wed Jan 23 17:57:31 2019
Summary: Recommended update for ca-certificates-mozilla
Type: recommended
Severity: moderate
References: 1121446
Description:
This update for ca-certificates-mozilla fixes the following issues:
The package was updated to the 2.30 version of the Mozilla NSS Certificate store. (bsc#1121446)
Removed Root CAs:
- AC Raiz Certicamara S.A.
- Certplus Root CA G1
- Certplus Root CA G2
- OpenTrust Root CA G1
- OpenTrust Root CA G2
- OpenTrust Root CA G3
- Visa eCommerce Root
Added Root CAs:
- Certigna Root CA (email and server auth)
- GTS Root R1 (server auth)
- GTS Root R2 (server auth)
- GTS Root R3 (server auth)
- GTS Root R4 (server auth)
- OISTE WISeKey Global Root GC CA (email and server auth)
- UCA Extended Validation Root (server auth)
- UCA Global G2 Root (email and server auth)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:151-1
Released: Wed Jan 23 17:58:59 2019
Summary: Recommended update for apparmor
Type: recommended
Severity: moderate
References: 1082956,1097370,1100779,1111342,1117354,1119937,1120472
Description:
This update for apparmor fixes the following issues:
- Change of path of rpm in lessopen.sh (bsc#1082956, bsc#1117354)
- allow network access in lessopen.sh for reading files on NFS (workaround
for bsc#1119937 / lp#1784499)
- dropped check that lets aa-logprof error out in a corner-case (log
event for a non-existing profile while a profile file with the default
filename for that non-existing profile exists) (bsc#1120472)
- netconfig: write resolv.conf to /run with link to /etc (fate#325872,
bsc#1097370) [patch apparmor-nameservice-resolv-conf-link.patch]
Update to AppArmor 2.12.2:
- add profile names to most profiles
- update dnsmasq profile (pid file and logfile path) (bsc#1111342)
- add vulkan abstraction
- add letsencrypt certificate path to abstractions/ssl_*
- ignore *.orig and *.rej files when loading profiles
- fix aa-complain etc. to handle named profiles
- several bugfixes and small profile improvements
- see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.12.2
for the detailed upstream changelog
Update to AppArmor 2.12.1:
- add qt5 and qt5-compose-cache-write abstractions
- add @{uid} and @{uids} kernel var placeholders
- several profile and abstraction updates
- add support for conditional includes ('include if exists')
- ignore 'abi' rules in parser and tools (instead of erroring out)
- utils: fix overwriting of child profile flags if they differ from
the main profile
- several bugfixes (including bsc#1100779)
- see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.12.1
for detailed upstream release notes
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:170-1
Released: Fri Jan 25 13:43:29 2019
Summary: Recommended update for kmod
Type: recommended
Severity: moderate
References: 1118629
Description:
This update for kmod fixes the following issues:
- Fixes module dependency file corruption on parallel invocation (bsc#1118629).
- Allows 'modprobe -c' to print the status of 'allow_unsupported_modules' option.
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:189-1
Released: Mon Jan 28 14:14:46 2019
Summary: Recommended update for rpm
Type: recommended
Severity: moderate
References:
Description:
This update for rpm fixes the following issues:
- Add kmod(module) provides to kernel and KMPs (fate#326579).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:247-1
Released: Wed Feb 6 07:18:45 2019
Summary: Security update for lua53
Type: security
Severity: moderate
References: 1123043,CVE-2019-6706
Description:
This update for lua53 fixes the following issues:
Security issue fixed:
- CVE-2019-6706: Fixed a use-after-free bug in the lua_upvaluejoin function of lapi.c (bsc#1123043)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:248-1
Released: Wed Feb 6 08:35:20 2019
Summary: Security update for curl
Type: security
Severity: important
References: 1123371,1123377,1123378,CVE-2018-16890,CVE-2019-3822,CVE-2019-3823
Description:
This update for curl fixes the following issues:
Security issues fixed:
- CVE-2019-3823: Fixed a heap out-of-bounds read in the code handling the end-of-response for SMTP (bsc#1123378).
- CVE-2019-3822: Fixed a stack based buffer overflow in the function creating an outgoing NTLM type-3 message (bsc#1123377).
- CVE-2018-16890: Fixed a heap buffer out-of-bounds read in the function handling incoming NTLM type-2 messages (bsc#1123371).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:369-1
Released: Wed Feb 13 14:01:42 2019
Summary: Recommended update for itstool
Type: recommended
Severity: moderate
References: 1065270,1111019
Description:
This update for itstool and python-libxml2-python fixes the following issues:
Package: itstool
- Updated version to support Python3. (bnc#1111019)
Package: python-libxml2-python
- Fix segfault when parsing invalid data. (bsc#1065270)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:426-1
Released: Mon Feb 18 17:46:55 2019
Summary: Security update for systemd
Type: security
Severity: important
References: 1117025,1121563,1122000,1123333,1123727,1123892,1124153,1125352,CVE-2019-6454
Description:
This update for systemd fixes the following issues:
- CVE-2019-6454: Overlong DBUS messages could be used to crash systemd (bsc#1125352)
- units: make sure initrd-cleanup.service terminates before switching to rootfs (bsc#1123333)
- logind: fix bad error propagation
- login: log session state 'closing' (as well as New/Removed)
- logind: fix borked r check
- login: don't remove all devices from PID1 when only one was removed
- login: we only allow opening character devices
- login: correct comment in session_device_free()
- login: remember that fds received from PID1 need to be removed eventually
- login: fix FDNAME in call to sd_pid_notify_with_fds()
- logind: fd 0 is a valid fd
- logind: rework sd_eviocrevoke()
- logind: check file is device node before using .st_rdev
- logind: use the new FDSTOREREMOVE=1 sd_notify() message (bsc#1124153)
- core: add a new sd_notify() message for removing fds from the FD store again
- logind: make sure we don't trip up on half-initialized session devices (bsc#1123727)
- fd-util: accept that kcmp might fail with EPERM/EACCES
- core: Fix use after free case in load_from_path() (bsc#1121563)
- core: include Found state in device dumps
- device: fix serialization and deserialization of DeviceFound
- fix path in btrfs rule (#6844)
- assemble multidevice btrfs volumes without external tools (#6607) (bsc#1117025)
- Update systemd-system.conf.xml (bsc#1122000)
- units: inform user that the default target is started after exiting from rescue or emergency mode
- core: free lines after reading them (bsc#1123892)
- sd-bus: if we receive an invalid dbus message, ignore and proceeed
- automount: don't pass non-blocking pipe to kernel.
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:532-1
Released: Fri Mar 1 13:47:29 2019
Summary: Recommended update for console-setup, kbd
Type: recommended
Severity: moderate
References: 1122361
Description:
This update for console-setup and kbd provides the following fix:
- Fix Shift-Tab mapping. (bsc#1122361)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:571-1
Released: Thu Mar 7 18:13:46 2019
Summary: Security update for file
Type: security
Severity: moderate
References: 1096974,1096984,1126117,1126118,1126119,CVE-2018-10360,CVE-2019-8905,CVE-2019-8906,CVE-2019-8907
Description:
This update for file fixes the following issues:
The following security vulnerabilities were addressed:
- CVE-2018-10360: Fixed an out-of-bounds read in the function do_core_note in
readelf.c, which allowed remote attackers to cause a denial of service
(application crash) via a crafted ELF file (bsc#1096974)
- CVE-2019-8905: Fixed a stack-based buffer over-read in do_core_note in readelf.c
(bsc#1126118)
- CVE-2019-8906: Fixed an out-of-bounds read in do_core_note in readelf. c
(bsc#1126119)
- CVE-2019-8907: Fixed a stack corruption in do_core_note in readelf.c
(bsc#1126117)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:577-1
Released: Mon Mar 11 12:03:49 2019
Summary: Recommended update for apparmor
Type: recommended
Severity: important
References: 1123820,1127073
Description:
This update for apparmor fixes the following issues:
- apparmor prevents libvirtd from starting (bsc#1127073)
- Start apparmor after filesystem remount (bsc#1123820)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:641-1
Released: Tue Mar 19 13:17:28 2019
Summary: Recommended update for glibc
Type: recommended
Severity: moderate
References: 1112570,1114984,1114993
Description:
This update for glibc provides the following fixes:
- Fix Haswell CPU string flags. (bsc#1114984)
- Fix waiters-after-spinning case. (bsc#1114993)
- Do not relocate absolute symbols. (bsc#1112570)
- Add glibc-locale-base subpackage containing only C, C.UTF-8 and en_US.UTF-8 locales.
(fate#326551)
- Add HWCAP_ATOMICS to HWCAP_IMPORTANT (fate#325962)
- Remove slow paths from math routines. (fate#325815, fate#325879, fate#325880,
fate#325881, fate#325882)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:664-1
Released: Wed Mar 20 14:54:12 2019
Summary: Recommended update for gpgme
Type: recommended
Severity: low
References: 1121051
Description:
This update for gpgme provides the following fix:
- Re-generate keys in Qt tests to not expire. (bsc#1121051)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:700-1
Released: Thu Mar 21 19:54:00 2019
Summary: Recommended update for cyrus-sasl
Type: recommended
Severity: moderate
References: 1044840
Description:
This update for cyrus-sasl provides the following fix:
- Fix a problem that was causing syslog to be polluted with messages 'GSSAPI client step 1'.
By server context the connection will be sent to the log function but the client content
does not have log level information, so there is no way to stop DEBUG level logs.
(bsc#1044840)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:713-1
Released: Fri Mar 22 15:55:05 2019
Summary: Recommended update for glibc
Type: recommended
Severity: moderate
References: 1063675,1126590
Description:
This update for glibc fixes the following issues:
- Add MAP_SYNC from Linux 4.15 (bsc#1126590)
- Add MAP_SHARED_VALIDATE from Linux 4.15 (bsc#1126590)
- nptl: Preserve error in setxid thread broadcast in coredumps (bsc#1063675, BZ #22153)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:732-1
Released: Mon Mar 25 14:10:04 2019
Summary: Recommended update for aaa_base
Type: recommended
Severity: moderate
References: 1088524,1118364,1128246
Description:
This update for aaa_base fixes the following issues:
- Restore old position of ssh/sudo source of profile (bsc#1118364).
- Update logic for JRE_HOME env variable (bsc#1128246)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:788-1
Released: Thu Mar 28 11:55:06 2019
Summary: Security update for sqlite3
Type: security
Severity: moderate
References: 1119687,CVE-2018-20346
Description:
This update for sqlite3 to version 3.27.2 fixes the following issue:
Security issue fixed:
- CVE-2018-20346: Fixed a remote code execution vulnerability in FTS3 (Magellan) (bsc#1119687).
Release notes: https://www.sqlite.org/releaselog/3_27_2.html
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:791-1
Released: Thu Mar 28 12:06:50 2019
Summary: Security update for libnettle
Type: recommended
Severity: moderate
References: 1129598
Description:
This update for libnettle to version 3.4.1 fixes the following issues:
Issues addressed and new features:
- Updated to 3.4.1 (fate#327114 and bsc#1129598)
- Fixed a missing break statements in the parsing of PEM input files in pkcs1-conv.
- Fixed a link error on the pss-mgf1-test which was affecting builds without public key support.
- All functions using RSA private keys are now side-channel silent. This applies both to the
bignum calculations, which now use GMP's mpn_sec_* family of functions, and the processing of
PKCS#1 padding needed for RSA decryption.
- Changes in behavior:
The functions rsa_decrypt and rsa_decrypt_tr may now clobber all of the provided message
buffer, independent of the actual message length. They are side-channel silent, in that
branches and memory accesses don't depend on the validity or length of the message.
Side-channel leakage from the caller's use of length and return value may still provide
an oracle useable for a Bleichenbacher-style chosen ciphertext attack.
Which is why the new function rsa_sec_decrypt is recommended.
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:858-1
Released: Wed Apr 3 15:50:37 2019
Summary: Recommended update for libtirpc
Type: recommended
Severity: moderate
References: 1120689,1126096
Description:
This update for libtirpc fixes the following issues:
- Fix a yp_bind_client_create_v3: RPC: Unknown host error (bsc#1126096).
- add an option to enforce connection via protocol version 2 first (bsc#1120689).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:866-1
Released: Thu Apr 4 11:24:48 2019
Summary: Recommended update for apparmor
Type: recommended
Severity: moderate
References: 1120279,1125439
Description:
This update for apparmor fixes the following issues:
- Add /proc/pid/tcp and /proc/pid/tcp6 entries to the apparmor profile. (bsc#1125439)
- allow network access and notify file creation/access (bsc#1120279)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:894-1
Released: Fri Apr 5 17:16:23 2019
Summary: Recommended update for rpm
Type: recommended
Severity: moderate
References: 1119414,1126327,1129753,SLE-3853,SLE-4117
Description:
This update for rpm fixes the following issues:
- This update shortens RPM changelog to after a certain cut off date (bsc#1129753)
- Translate dashes to underscores in kmod provides (FATE#326579, jsc#SLE-4117, jsc#SLE-3853, bsc#1119414).
- Re-add symset-table from SLE 12 (bsc#1126327).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:903-1
Released: Mon Apr 8 15:41:44 2019
Summary: Security update for glibc
Type: security
Severity: moderate
References: 1100396,1122729,1130045,CVE-2016-10739
Description:
This update for glibc fixes the following issues:
Security issue fixed:
- CVE-2016-10739: Fixed an improper implementation of getaddrinfo function which could allow
applications to incorrectly assume that had parsed a valid string, without the possibility of
embedded HTTP headers or other potentially dangerous substrings (bsc#1122729).
Other issue fixed:
- Fixed an issue where pthread_mutex_trylock did not use a correct order of instructions
while maintained the robust mutex list due to missing compiler barriers (bsc#1130045).
- Added new Japanese Era name support (bsc#1100396).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:1002-1
Released: Wed Apr 24 10:13:34 2019
Summary: Recommended update for zlib
Type: recommended
Severity: moderate
References: 1110304,1129576
Description:
This update for zlib fixes the following issues:
- Fixes a segmentation fault error (bsc#1110304, bsc#1129576)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:1040-1
Released: Thu Apr 25 17:09:21 2019
Summary: Security update for samba
Type: security
Severity: important
References: 1114407,1124223,1125410,1126377,1131060,1131686,CVE-2019-3880
Description:
This update for samba fixes the following issues:
Security issue fixed:
- CVE-2019-3880: Fixed a path/symlink traversal vulnerability, which allowed an unprivileged user to save registry files outside a share (bsc#1131060).
ldb was updated to version 1.2.4 (bsc#1125410 bsc#1131686):
- Out of bound read in ldb_wildcard_compare
- Hold at most 10 outstanding paged result cookies
- Put 'results_store' into a doubly linked list
- Refuse to build Samba against a newer minor version of ldb
Non-security issues fixed:
- Fixed update-apparmor-samba-profile script after apparmor switched to using named profiles (bsc#1126377).
- Abide to the load_printers parameter in smb.conf (bsc#1124223).
- Provide the 32bit samba winbind PAM module and its dependend 32bit libraries.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:1121-1
Released: Tue Apr 30 18:02:43 2019
Summary: Security update for gnutls
Type: security
Severity: important
References: 1118087,1130681,1130682,CVE-2018-16868,CVE-2019-3829,CVE-2019-3836
Description:
This update for gnutls fixes to version 3.6.7 the following issues:
Security issued fixed:
- CVE-2019-3836: Fixed an invalid pointer access via malformed TLS1.3 async messages (bsc#1130682).
- CVE-2019-3829: Fixed a double free vulnerability in the certificate verification API (bsc#1130681).
- CVE-2018-16868: Fixed Bleichenbacher-like side channel leakage in PKCS#1 v1.5 verification and padding oracle verification (bsc#1118087)
Non-security issue fixed:
- Update gnutls to support TLS 1.3 (fate#327114)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:1127-1
Released: Thu May 2 09:39:24 2019
Summary: Security update for sqlite3
Type: security
Severity: moderate
References: 1130325,1130326,CVE-2019-9936,CVE-2019-9937
Description:
This update for sqlite3 to version 3.28.0 fixes the following issues:
Security issues fixed:
- CVE-2019-9936: Fixed a heap-based buffer over-read, when running fts5 prefix
queries inside transaction (bsc#1130326).
- CVE-2019-9937: Fixed a denial of service related to interleaving reads and writes in
a single transaction with an fts5 virtual table (bsc#1130325).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:1206-1
Released: Fri May 10 14:01:55 2019
Summary: Security update for bzip2
Type: security
Severity: low
References: 985657,CVE-2016-3189
Description:
This update for bzip2 fixes the following issues:
Security issue fixed:
- CVE-2016-3189: Fixed a use-after-free in bzip2recover (bsc#985657).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:1312-1
Released: Wed May 22 12:19:12 2019
Summary: Recommended update for aaa_base
Type: recommended
Severity: moderate
References: 1096191
Description:
This update for aaa_base fixes the following issue:
* Shell detection in /etc/profile and /etc/bash.bashrc was broken within AppArmor-confined containers
(bsc#1096191)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:1351-1
Released: Fri May 24 14:41:10 2019
Summary: Security update for gnutls
Type: security
Severity: important
References: 1118087,1134856,CVE-2018-16868
Description:
This update for gnutls fixes the following issues:
Security issue fixed:
- CVE-2018-16868: Fixed Bleichenbacher-like side channel leakage in PKCS#1 v1.5 verification (bsc#1118087).
Non-security issue fixed:
- Explicitly require libnettle 3.4.1 to prevent missing symbol errors (bsc#1134856).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:1357-1
Released: Mon May 27 13:29:15 2019
Summary: Security update for curl
Type: security
Severity: important
References: 1135170,CVE-2019-5436
Description:
This update for curl fixes the following issues:
Security issue fixed:
- CVE-2019-5436: Fixed a heap buffer overflow exists in tftp_receive_packet that receives data from a TFTP server (bsc#1135170).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:1364-1
Released: Tue May 28 10:51:38 2019
Summary: Security update for systemd
Type: security
Severity: moderate
References: 1036463,1121563,1124122,1125352,1125604,1126056,1127557,1130230,1132348,1132400,1132721,1133506,1133509,CVE-2019-3842,CVE-2019-3843,CVE-2019-3844,CVE-2019-6454,SLE-5933
Description:
This update for systemd fixes the following issues:
Security issues fixed:
- CVE-2019-3842: Fixed a privilege escalation in pam_systemd which could be exploited by a local user (bsc#1132348).
- CVE-2019-6454: Fixed a denial of service via crafted D-Bus message (bsc#1125352).
- CVE-2019-3843, CVE-2019-3844: Fixed a privilege escalation where services with DynamicUser could gain new privileges or create SUID/SGID binaries (bsc#1133506, bsc#1133509).
Non-security issued fixed:
- logind: fix killing of scopes (bsc#1125604)
- namespace: make MountFlags=shared work again (bsc#1124122)
- rules: load drivers only on 'add' events (bsc#1126056)
- sysctl: Don't pass null directive argument to '%s' (bsc#1121563)
- systemd-coredump: generate a stack trace of all core dumps and log into the journal (jsc#SLE-5933)
- udevd: notify when max number value of children is reached only once per batch of events (bsc#1132400)
- sd-bus: bump message queue size again (bsc#1132721)
- Do not automatically online memory on s390x (bsc#1127557)
- Removed sg.conf (bsc#1036463)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:1368-1
Released: Tue May 28 13:15:38 2019
Summary: Recommended update for sles12sp3-docker-image, sles12sp4-image, system-user-root
Type: security
Severity: important
References: 1134524,CVE-2019-5021
Description:
This update for sles12sp3-docker-image, sles12sp4-image, system-user-root fixes the following issues:
- CVE-2019-5021: Include an invalidated root password by default, not an empty one (bsc#1134524)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:1372-1
Released: Tue May 28 16:53:28 2019
Summary: Security update for libtasn1
Type: security
Severity: moderate
References: 1105435,CVE-2018-1000654
Description:
This update for libtasn1 fixes the following issues:
Security issue fixed:
- CVE-2018-1000654: Fixed a denial of service in the asn1 parser (bsc#1105435).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:1484-1
Released: Thu Jun 13 07:46:46 2019
Summary: Recommended update for e2fsprogs
Type: recommended
Severity: moderate
References: 1128383
Description:
This update for e2fsprogs fixes the following issues:
- Check and fix tails of all bitmap blocks (bsc#1128383)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:1486-1
Released: Thu Jun 13 09:40:24 2019
Summary: Security update for elfutils
Type: security
Severity: moderate
References: 1033084,1033085,1033086,1033087,1033088,1033089,1033090,1106390,1107066,1107067,1111973,1112723,1112726,1123685,1125007,CVE-2017-7607,CVE-2017-7608,CVE-2017-7609,CVE-2017-7610,CVE-2017-7611,CVE-2017-7612,CVE-2017-7613,CVE-2018-16062,CVE-2018-16402,CVE-2018-16403,CVE-2018-18310,CVE-2018-18520,CVE-2018-18521,CVE-2019-7150,CVE-2019-7665
Description:
This update for elfutils fixes the following issues:
Security issues fixed:
- CVE-2017-7607: Fixed a heap-based buffer overflow in handle_gnu_hash (bsc#1033084)
- CVE-2017-7608: Fixed a heap-based buffer overflow in ebl_object_note_type_name() (bsc#1033085)
- CVE-2017-7609: Fixed a memory allocation failure in __libelf_decompress (bsc#1033086)
- CVE-2017-7610: Fixed a heap-based buffer overflow in check_group (bsc#1033087)
- CVE-2017-7611: Fixed a denial of service via a crafted ELF file (bsc#1033088)
- CVE-2017-7612: Fixed a denial of service in check_sysv_hash() via a crafted ELF file (bsc#1033089)
- CVE-2017-7613: Fixed denial of service caused by the missing validation of the number of sections and the number of segments in a crafted ELF file (bsc#1033090)
- CVE-2018-16062: Fixed a heap-buffer overflow in /elfutils/libdw/dwarf_getaranges.c:156 (bsc#1106390)
- CVE-2018-16402: Fixed a denial of service/double free on an attempt to decompress the same section twice (bsc#1107066)
- CVE-2018-16403: Fixed a heap buffer overflow in readelf (bsc#1107067)
- CVE-2018-18310: Fixed an invalid address read problem in dwfl_segment_report_module.c (bsc#1111973)
- CVE-2018-18520: Fixed bad handling of ar files inside are files (bsc#1112726)
- CVE-2018-18521: Fixed a denial of service vulnerabilities in the function arlib_add_symbols() used by eu-ranlib (bsc#1112723)
- CVE-2019-7150: dwfl_segment_report_module doesn't check whether the dyn data read from core file is truncated (bsc#1123685)
- CVE-2019-7665: NT_PLATFORM core file note should be a zero terminated string (bsc#1125007)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:1590-1
Released: Thu Jun 20 19:49:57 2019
Summary: Recommended update for permissions
Type: recommended
Severity: moderate
References: 1128598
Description:
This update for permissions fixes the following issues:
- Added whitelisting for /usr/lib/singularity/bin/starter-suid in the new singularity 3.1 version. (bsc#1128598)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:1595-1
Released: Fri Jun 21 10:17:44 2019
Summary: Security update for dbus-1
Type: security
Severity: important
References: 1137832,CVE-2019-12749
Description:
This update for dbus-1 fixes the following issues:
Security issue fixed:
- CVE-2019-12749: Fixed an implementation flaw in DBUS_COOKIE_SHA1 which
could have allowed local attackers to bypass authentication (bsc#1137832).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:1631-1
Released: Fri Jun 21 11:17:21 2019
Summary: Recommended update for xz
Type: recommended
Severity: low
References: 1135709
Description:
This update for xz fixes the following issues:
Add SUSE-Public-Domain licence as some parts of xz utils (liblzma,
xz, xzdec, lzmadec, documentation, translated messages, tests,
debug, extra directory) are in public domain licence [bsc#1135709]
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:1635-1
Released: Fri Jun 21 12:45:53 2019
Summary: Recommended update for krb5
Type: recommended
Severity: moderate
References: 1134217
Description:
This update for krb5 provides the following fix:
- Move LDAP schema files from /usr/share/doc/packages/krb5 to /usr/share/kerberos/ldap.
(bsc#1134217)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:1700-1
Released: Tue Jun 25 13:19:21 2019
Summary: Security update for libssh
Type: recommended
Severity: moderate
References: 1134193
Description:
This update for libssh fixes the following issue:
Issue addressed:
- Added support for new AES-GCM encryption types (bsc#1134193).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:1808-1
Released: Wed Jul 10 13:16:29 2019
Summary: Recommended update for libgcrypt
Type: recommended
Severity: moderate
References: 1133808
Description:
This update for libgcrypt fixes the following issues:
- Fixed redundant fips tests in some situations causing sudo to stop
working when pam-kwallet is installed. bsc#1133808
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:1835-1
Released: Fri Jul 12 18:06:31 2019
Summary: Security update for expat
Type: security
Severity: moderate
References: 1139937,CVE-2018-20843
Description:
This update for expat fixes the following issues:
Security issue fixed:
- CVE-2018-20843: Fixed a denial of service triggered by high resource consumption
in the XML parser when XML names contain a large amount of colons (bsc#1139937).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:1846-1
Released: Mon Jul 15 11:36:33 2019
Summary: Security update for bzip2
Type: security
Severity: important
References: 1139083,CVE-2019-12900
Description:
This update for bzip2 fixes the following issues:
Security issue fixed:
- CVE-2019-12900: Fixed an out-of-bounds write in decompress.c with many selectors (bsc#1139083).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:1853-1
Released: Mon Jul 15 16:03:36 2019
Summary: Recommended update for systemd
Type: recommended
Severity: moderate
References: 1107617,1137053
Description:
This update for systemd fixes the following issues:
- conf-parse: remove 4K line length limit (bsc#1137053)
- udevd: change the default value of udev.children-max (again) (bsc#1107617)
- meson: stop creating enablement symlinks in /etc during installation (sequel)
- Fixed build for openSUSE Leap 15+
- Make sure we don't ship any static enablement symlinks in /etc
Those symlinks must only be created by the presets. There are no
changes in practice since systemd/udev doesn't ship such symlinks in
/etc but let's make sure no future changes will introduce new ones
by mistake.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:1877-1
Released: Thu Jul 18 11:31:46 2019
Summary: Security update for glibc
Type: security
Severity: moderate
References: 1117993,1123710,1127223,1127308,1131330,CVE-2009-5155,CVE-2019-9169
Description:
This update for glibc fixes the following issues:
Security issues fixed:
- CVE-2019-9169: Fixed a heap-based buffer over-read via an attempted case-insensitive regular-expression match (bsc#1127308).
- CVE-2009-5155: Fixed a denial of service in parse_reg_exp() (bsc#1127223).
Non-security issues fixed:
- Does no longer compress debug sections in crt*.o files (bsc#1123710)
- Fixes a concurrency problem in ldconfig (bsc#1117993)
- Fixes a race condition in pthread_mutex_lock while promoting to PTHREAD_MUTEX_ELISION_NP (bsc#1131330)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:1971-1
Released: Thu Jul 25 14:58:52 2019
Summary: Security update for libgcrypt
Type: security
Severity: moderate
References: 1138939,CVE-2019-12904
Description:
This update for libgcrypt fixes the following issues:
Security issue fixed:
- CVE-2019-12904: Fixed a flush-and-reload side-channel attack in the AES implementation (bsc#1138939).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:1994-1
Released: Fri Jul 26 16:12:05 2019
Summary: Recommended update for libxml2
Type: recommended
Severity: moderate
References: 1135123
Description:
This update for libxml2 fixes the following issues:
- Added a new configurable variable XPATH_DEFAULT_MAX_NODESET_LENGTH to avoid nodeset limit when processing large XML files. (bsc#1135123)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:2004-1
Released: Mon Jul 29 13:01:59 2019
Summary: Security update for bzip2
Type: security
Severity: important
References: 1139083,CVE-2019-12900
Description:
This update for bzip2 fixes the following issues:
- Fixed a regression with the fix for CVE-2019-12900, which caused incompatibilities
with files that used many selectors (bsc#1139083).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:2006-1
Released: Mon Jul 29 13:02:49 2019
Summary: Security update for gpg2
Type: security
Severity: important
References: 1124847,1141093,CVE-2019-13050
Description:
This update for gpg2 fixes the following issues:
Security issue fixed:
- CVE-2019-13050: Fixed a denial of service attacks via big keys (bsc#1141093).
Non-security issue fixed:
- Allow coredumps in X11 desktop sessions (bsc#1124847)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:2085-1
Released: Wed Aug 7 13:58:43 2019
Summary: Recommended update for apparmor
Type: recommended
Severity: moderate
References: 1135751
Description:
This update for apparmor fixes the following issues:
- Profile updates for dnsmasq, dovecot, identd, syslog-ng
- Parser: fix 'Px -> foo-bar' (the '-' was rejected before)
- Add certbot paths to abstractions/ssl_certs and abstractions/ssl_keys.
- Fix build with swig 4.0. (bsc#1135751)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:2097-1
Released: Fri Aug 9 09:31:17 2019
Summary: Recommended update for libgcrypt
Type: recommended
Severity: important
References: 1097073
Description:
This update for libgcrypt fixes the following issues:
- Fixed a regression where system were unable to boot in fips mode, caused by an
incomplete implementation of previous change (bsc#1097073).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:2134-1
Released: Wed Aug 14 11:54:56 2019
Summary: Recommended update for zlib
Type: recommended
Severity: moderate
References: 1136717,1137624,1141059,SLE-5807
Description:
This update for zlib fixes the following issues:
- Update the s390 patchset. (bsc#1137624)
- Tweak zlib-power8 to have type of crc32_vpmsum conform to usage. (bsc#1141059)
- Use FAT LTO objects in order to provide proper static library.
- Do not enable the previous patchset on s390 but just s390x. (bsc#1137624)
- Add patchset for s390 improvements. (jsc#SLE-5807, bsc#1136717)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:2188-1
Released: Wed Aug 21 10:10:29 2019
Summary: Recommended update for aaa_base
Type: recommended
Severity: moderate
References: 1140647
Description:
This update for aaa_base fixes the following issues:
- Make systemd detection cgroup oblivious. (bsc#1140647)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:2218-1
Released: Mon Aug 26 11:29:57 2019
Summary: Recommended update for pinentry
Type: recommended
Severity: moderate
References: 1141883
Description:
This update for pinentry fixes the following issues:
- Fix a dangling pointer in qt/main.cpp that caused crashes. (bsc#1141883)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:2241-1
Released: Wed Aug 28 14:58:49 2019
Summary: Recommended update for ca-certificates-mozilla
Type: recommended
Severity: moderate
References: 1144169
Description:
This update for ca-certificates-mozilla fixes the following issues:
ca-certificates-mozillawas updated to 2.34 state of the Mozilla NSS Certificate store (bsc#1144169)
Removed CAs:
- Certinomis - Root CA
Includes new root CAs from the 2.32 version:
- emSign ECC Root CA - C3 (email and server auth)
- emSign ECC Root CA - G3 (email and server auth)
- emSign Root CA - C1 (email and server auth)
- emSign Root CA - G1 (email and server auth)
- Hongkong Post Root CA 3 (server auth)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:2307-1
Released: Thu Sep 5 14:45:08 2019
Summary: Security update for util-linux and shadow
Type: security
Severity: moderate
References: 1081947,1082293,1085196,1106214,1121197,1122417,1125886,1127701,1135534,1135708,1141113,353876
Description:
This update for util-linux and shadow fixes the following issues:
util-linux:
- Fixed an issue where PATH settings in /etc/default/su being ignored (bsc#1121197)
- Prevent outdated pam files (bsc#1082293).
- De-duplicate fstrim -A properly (bsc#1127701).
- Do not trim read-only volumes (bsc#1106214).
- Integrate pam_keyinit pam module to login (bsc#1081947).
- Perform one-time reset of /etc/default/su (bsc#1121197).
- Fix problems in reading of login.defs values (bsc#1121197)
- libmount: To prevent incorrect behavior, recognize more pseudofs and netfs (bsc#1122417).
- raw.service: Add RemainAfterExit=yes (bsc#1135534).
- agetty: Return previous response of agetty for special characters (bsc#1085196, bsc#1125886)
- libmount: print a blacklist hint for 'unknown filesystem type' (jsc#SUSE-4085, fate#326832)
- Fix /etc/default/su comments and create /etc/default/runuser (bsc#1121197).
shadow:
- Fixed an issue where PATH settings in /etc/default/su being ignored (bsc#1121197)
- Fix segfault in useradd during setting password inactivity period. (bsc#1141113)
- Hardening for su wrappers (bsc#353876)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:2361-1
Released: Thu Sep 12 07:54:54 2019
Summary: Recommended update for krb5
Type: recommended
Severity: moderate
References: 1081947,1144047
Description:
This update for krb5 contains the following fixes:
- Integrate pam_keyinit PAM module, ksu-pam.d. (bsc#1081947)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:2367-1
Released: Thu Sep 12 12:59:37 2019
Summary: Recommended update for lvm2
Type: recommended
Severity: moderate
References: 1122666,1135984,1137296
Description:
This update for lvm2 fixes the following issues:
- Fix unknown feature in status message (bsc#1135984)
- Fix using device aliases with lvmetad (bsc#1137296)
- Fix devices drop open error message (bsc#1122666)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:2373-1
Released: Thu Sep 12 14:18:53 2019
Summary: Security update for curl
Type: security
Severity: important
References: 1149495,1149496,CVE-2019-5481,CVE-2019-5482
Description:
This update for curl fixes the following issues:
Security issues fixed:
- CVE-2019-5481: Fixed FTP-KRB double-free during kerberos FTP data transfer (bsc#1149495).
- CVE-2019-5482: Fixed TFTP small blocksize heap buffer overflow (bsc#1149496).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:2395-1
Released: Wed Sep 18 08:31:38 2019
Summary: Security update for openldap2
Type: security
Severity: moderate
References: 1073313,1111388,1114845,1143194,1143273,CVE-2017-17740,CVE-2019-13057,CVE-2019-13565
Description:
This update for openldap2 fixes the following issues:
Security issue fixed:
- CVE-2019-13565: Fixed an authentication bypass when using SASL authentication and session encryption (bsc#1143194).
- CVE-2019-13057: Fixed an issue with delegated database admin privileges (bsc#1143273).
- CVE-2017-17740: When both the nops module and the member of overlay
are enabled, attempts to free a buffer that was allocated on the stack,
which allows remote attackers to cause a denial of service (slapd crash)
via a member MODDN operation. (bsc#1073313)
Non-security issues fixed:
- Fixed broken shebang line in openldap_update_modules_path.sh (bsc#1114845).
- Create files in /var/lib/ldap/ during initial start to allow for transactional updates (bsc#1111388)
- Fixed incorrect post script call causing tmpfiles creation not to be run (bsc#1111388).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:2403-1
Released: Wed Sep 18 16:14:29 2019
Summary: Security update for openssl-1_1
Type: security
Severity: moderate
References: 1150003,1150250,CVE-2019-1547,CVE-2019-1563
Description:
This update for openssl-1_1 fixes the following issues:
OpenSSL Security Advisory [10 September 2019]
* CVE-2019-1547: Added EC_GROUP_set_generator side channel attack avoidance. (bsc#1150003)
* CVE-2019-1563: Fixed Bleichenbacher attack against cms/pkcs7 encryption transported key (bsc#1150250)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:2423-1
Released: Fri Sep 20 16:41:45 2019
Summary: Recommended update for aaa_base
Type: recommended
Severity: moderate
References: 1146866,SLE-9132
Description:
This update for aaa_base fixes the following issues:
Added sysctl.d/51-network.conf to tighten network security (bsc#1146866) (jira#SLE-9132)
Following settings have been tightened (and set to 0):
- net.ipv4.conf.all.accept_redirects
- net.ipv4.conf.default.accept_redirects
- net.ipv4.conf.default.accept_source_route
- net.ipv6.conf.all.accept_redirects
- net.ipv6.conf.default.accept_redirects
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:2429-1
Released: Mon Sep 23 09:28:40 2019
Summary: Security update for expat
Type: security
Severity: moderate
References: 1149429,CVE-2019-15903
Description:
This update for expat fixes the following issues:
Security issues fixed:
- CVE-2019-15903: Fixed heap-based buffer over-read caused by crafted XML input. (bsc#1149429)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:2517-1
Released: Wed Oct 2 10:49:20 2019
Summary: Security update for libseccomp
Type: security
Severity: moderate
References: 1082318,1128828,1142614,CVE-2019-9893
Description:
This update for libseccomp fixes the following issues:
Security issues fixed:
- CVE-2019-9893: An incorrect generation of syscall filters in libseccomp was fixed (bsc#1128828)
libseccomp was updated to new upstream release 2.4.1:
- Fix a BPF generation bug where the optimizer mistakenly
identified duplicate BPF code blocks.
libseccomp was updated to 2.4.0 (bsc#1128828 CVE-2019-9893):
- Update the syscall table for Linux v5.0-rc5
- Added support for the SCMP_ACT_KILL_PROCESS action
- Added support for the SCMP_ACT_LOG action and SCMP_FLTATR_CTL_LOG attribute
- Added explicit 32-bit (SCMP_AX_32(...)) and 64-bit (SCMP_AX_64(...)) argument comparison macros to help protect against unexpected sign extension
- Added support for the parisc and parisc64 architectures
- Added the ability to query and set the libseccomp API level via seccomp_api_get(3) and seccomp_api_set(3)
- Return -EDOM on an endian mismatch when adding an architecture to a filter
- Renumber the pseudo syscall number for subpage_prot() so it no longer conflicts with spu_run()
- Fix PFC generation when a syscall is prioritized, but no rule exists
- Numerous fixes to the seccomp-bpf filter generation code
- Switch our internal hashing function to jhash/Lookup3 to MurmurHash3
- Numerous tests added to the included test suite, coverage now at ~92%
- Update our Travis CI configuration to use Ubuntu 16.04
- Numerous documentation fixes and updates
libseccomp was updated to release 2.3.3:
- Updated the syscall table for Linux v4.15-rc7
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:2533-1
Released: Thu Oct 3 15:02:50 2019
Summary: Security update for sqlite3
Type: security
Severity: moderate
References: 1150137,CVE-2019-16168
Description:
This update for sqlite3 fixes the following issues:
Security issue fixed:
- CVE-2019-16168: Fixed improper validation of sqlite_stat1 field that could lead to denial of service (bsc#1150137).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:2626-1
Released: Thu Oct 10 17:22:35 2019
Summary: Recommended update for permissions
Type: recommended
Severity: moderate
References: 1110797
Description:
This update for permissions fixes the following issues:
- Updated permissons for amanda. (bsc#1110797)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:2676-1
Released: Tue Oct 15 21:06:54 2019
Summary: Recommended update for e2fsprogs
Type: recommended
Severity: moderate
References: 1145716,1152101,CVE-2019-5094
Description:
This update for e2fsprogs fixes the following issues:
Security issue fixed:
- CVE-2019-5094: Fixed an arbitrary code execution via specially crafted ext4 file systems. (bsc#1152101)
Non-security issue fixed:
- libext2fs: Call fsync(2) to clear stale errors for a new a unix I/O channel. (bsc#1145716)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:2730-1
Released: Mon Oct 21 16:04:57 2019
Summary: Security update for procps
Type: security
Severity: important
References: 1092100,1121753,CVE-2018-1122,CVE-2018-1123,CVE-2018-1124,CVE-2018-1125,CVE-2018-1126
Description:
This update for procps fixes the following issues:
procps was updated to 3.3.15. (bsc#1092100)
Following security issues were fixed:
- CVE-2018-1122: Prevent local privilege escalation in top. If a user ran top
with HOME unset in an attacker-controlled directory, the attacker could have
achieved privilege escalation by exploiting one of several vulnerabilities in
the config_file() function (bsc#1092100).
- CVE-2018-1123: Prevent denial of service in ps via mmap buffer overflow.
Inbuilt protection in ps maped a guard page at the end of the overflowed
buffer, ensuring that the impact of this flaw is limited to a crash (temporary
denial of service) (bsc#1092100).
- CVE-2018-1124: Prevent multiple integer overflows leading to a heap
corruption in file2strvec function. This allowed a privilege escalation for a
local attacker who can create entries in procfs by starting processes, which
could result in crashes or arbitrary code execution in proc utilities run by
other users (bsc#1092100).
- CVE-2018-1125: Prevent stack buffer overflow in pgrep. This vulnerability was
mitigated by FORTIFY limiting the impact to a crash (bsc#1092100).
- CVE-2018-1126: Ensure correct integer size in proc/alloc.* to prevent
truncation/integer overflow issues (bsc#1092100).
Also this non-security issue was fixed:
- Fix CPU summary showing old data. (bsc#1121753)
The update to 3.3.15 contains the following fixes:
* library: Increment to 8:0:1
No removals, no new functions
Changes: slab and pid structures
* library: Just check for SIGLOST and don't delete it
* library: Fix integer overflow and LPE in file2strvec CVE-2018-1124
* library: Use size_t for alloc functions CVE-2018-1126
* library: Increase comm size to 64
* pgrep: Fix stack-based buffer overflow CVE-2018-1125
* pgrep: Remove >15 warning as comm can be longer
* ps: Fix buffer overflow in output buffer, causing DOS CVE-2018-1123
* ps: Increase command name selection field to 64
* top: Don't use cwd for location of config CVE-2018-1122
* update translations
* library: build on non-glibc systems
* free: fix scaling on 32-bit systems
* Revert 'Support running with child namespaces'
* library: Increment to 7:0:1
No changes, no removals
New fuctions: numa_init, numa_max_node, numa_node_of_cpu, numa_uninit, xalloc_err_handler
* doc: Document I idle state in ps.1 and top.1
* free: fix some of the SI multiples
* kill: -l space between name parses correctly
* library: dont use vm_min_free on non Linux
* library: don't strip off wchan prefixes (ps & top)
* pgrep: warn about 15+ char name only if -f not used
* pgrep/pkill: only match in same namespace by default
* pidof: specify separator between pids
* pkill: Return 0 only if we can kill process
* pmap: fix duplicate output line under '-x' option
* ps: avoid eip/esp address truncations
* ps: recognizes SCHED_DEADLINE as valid CPU scheduler
* ps: display NUMA node under which a thread ran
* ps: Add seconds display for cputime and time
* ps: Add LUID field
* sysctl: Permit empty string for value
* sysctl: Don't segv when file not available
* sysctl: Read and write large buffers
* top: add config file support for XDG specification
* top: eliminated minor libnuma memory leak
* top: show fewer memory decimal places (configurable)
* top: provide command line switch for memory scaling
* top: provide command line switch for CPU States
* top: provides more accurate cpu usage at startup
* top: display NUMA node under which a thread ran
* top: fix argument parsing quirk resulting in SEGV
* top: delay interval accepts non-locale radix point
* top: address a wishlist man page NLS suggestion
* top: fix potential distortion in 'Mem' graph display
* top: provide proper multi-byte string handling
* top: startup defaults are fully customizable
* watch: define HOST_NAME_MAX where not defined
* vmstat: Fix alignment for disk partition format
* watch: Support ANSI 39,49 reset sequences
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:2742-1
Released: Tue Oct 22 15:40:16 2019
Summary: Recommended update for libzypp, zypper, libsolv and PackageKit
Type: recommended
Severity: important
References: 1049825,1116995,1120629,1120630,1120631,1127155,1127608,1130306,1131113,1131823,1134226,1135749,1137977,1139795,1140039,1145521,1146027,1146415,1146947,1153557,859480,CVE-2018-20532,CVE-2018-20533,CVE-2018-20534
Description:
This update for libzypp, zypper, libsolv and PackageKit fixes the following issues:
Security issues fixed in libsolv:
- CVE-2018-20532: Fixed NULL pointer dereference at ext/testcase.c (function testcase_read) (bsc#1120629).
- CVE-2018-20533: Fixed NULL pointer dereference at ext/testcase.c (function testcase_str2dep_complex) in libsolvext.a (bsc#1120630).
- CVE-2018-20534: Fixed illegal address access at src/pool.h (function pool_whatprovides) in libsolv.a (bsc#1120631).
Other issues addressed in libsolv:
- Fixed an issue where libsolv failed to build against swig 4.0 by updating the version to 0.7.5 (bsc#1135749).
- Fixed an issue with the package name (bsc#1131823).
- repo_add_rpmdb: do not copy bad solvables from the old solv file
- Fixed an issue with cleandeps updates in which all packages were not updated
- Experimental DISTTYPE_CONDA and REL_CONDA support
- Fixed cleandeps jobs when using patterns (bsc#1137977)
- Fixed favorq leaking between solver runs if the solver is reused
- Fixed SOLVER_FLAG_FOCUS_BEST updateing packages without reason
- Be more correct with multiversion packages that obsolete their own name (bnc#1127155)
- Fix repository priority handling for multiversion packages
- Make code compatible with swig 4.0, remove obj0 instances
- repo2solv: support zchunk compressed data
- Remove NO_BRP_STRIP_DEBUG=true as brp-15-strip-debug will
not strip debug info for archives
Issues fixed in libzypp:
- Fix empty metalink downloads if filesize is unknown (bsc#1153557)
- Recognize riscv64 as architecture
- Fix installation of new header file (fixes #185)
- zypp.conf: Introduce `solver.focus` to define the resolvers general
attitude when resolving jobs. (bsc#1146415)
- New container detection algorithm for zypper ps (bsc#1146947)
- Fix leaking filedescriptors in MediaCurl. (bsc#1116995)
- Run file conflict check on dry-run. (bsc#1140039)
- Do not remove orphan products if the .prod file is owned by
a package. (bsc#1139795)
- Rephrase file conflict check summary. (bsc#1140039)
- Fix bash completions option detection. (bsc#1049825)
- Fixes a bug where zypper exited on SIGPIPE when downloading packages (bsc#1145521)
- Fixes an issue where zypper exited with a segmentation fault when updating via YaST2 (bsc#1146027)
- PublicKey::algoName: supply key algorithm and length
Issues fixed in zypper:
- Update to version 1.14.30
- Ignore SIGPIPE while STDOUT/STDERR are OK (bsc#1145521)
- Dump stacktrace on SIGPIPE (bsc#1145521)
- info: The requested info must be shown in QUIET mode (fixes #287)
- Fix local/remote url classification.
- Rephrase file conflict check summary (bsc#1140039)
- Fix bash completions option detection (bsc#1049825)
- man: split '--with[out]' like options to ease searching.
- Unhided 'ps' command in help
- Added option to show more conflict information
- Rephrased `zypper ps` hint (bsc#859480)
- Fixed repo refresh not returning 106-ZYPPER_EXIT_INF_REPOS_SKIPPED
if --root is used (bsc#1134226)
- Fixed unknown package handling in zypper install (bsc#1127608)
- Re-show progress bar after pressing retry upon install error (bsc#1131113)
Issues fixed in PackageKit:
- Port the cron configuration variables to the systemd timer script, and add -sendwait
parameter to mail in the script(bsc#1130306).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:2757-1
Released: Wed Oct 23 17:21:17 2019
Summary: Security update for lz4
Type: security
Severity: moderate
References: 1153936,CVE-2019-17543
Description:
This update for lz4 fixes the following issues:
- CVE-2019-17543: Fixed a heap-based buffer overflow in LZ4_write32 (bsc#1153936).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:2812-1
Released: Tue Oct 29 14:57:55 2019
Summary: Recommended update for systemd
Type: recommended
Severity: moderate
References: 1139459,1140631,1145023,1150595,SLE-7687
Description:
This update for systemd provides the following fixes:
- Fix a problem that would cause invoking try-restart to an inactive service to hang when
a daemon-reload is invoked before the try-restart returned. (bsc#1139459)
- man: Add a note about _netdev usage.
- units: Replace remote-cryptsetup-pre.target with remote-fs-pre.target.
- units: Add [Install] section to remote-cryptsetup.target.
- cryptsetup: Ignore _netdev, since it is used in generator.
- cryptsetup-generator: Use remote-cryptsetup.target when _netdev is present. (jsc#SLE-7687)
- cryptsetup-generator: Add a helper utility to create symlinks.
- units: Add remote-cryptsetup.target and remote-cryptsetup-pre.target.
- man: Add an explicit description of _netdev to systemd.mount(5).
- man: Order fields alphabetically in crypttab(5).
- man: Make crypttab(5) a bit easier to read.
- units: Order cryptsetup-pre.target before cryptsetup.target.
- Fix reporting of enabled-runtime units.
- sd-bus: Deal with cookie overruns. (bsc#1150595)
- rules: Add by-id symlinks for persistent memory. (bsc#1140631)
- Buildrequire polkit so /usr/share/polkit-1/rules.d subdir can be only owned by polkit.
(bsc#1145023)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:2870-1
Released: Thu Oct 31 08:09:14 2019
Summary: Recommended update for aaa_base
Type: recommended
Severity: moderate
References: 1051143,1138869,1151023
Description:
This update for aaa_base provides the following fixes:
- Check if variables can be set before modifying them to avoid warnings on login with a
restricted shell. (bsc#1138869)
- Add s390x compressed kernel support. (bsc#1151023)
- service: Check if there is a second argument before using it. (bsc#1051143)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:2418-1
Released: Thu Nov 14 11:53:03 2019
Summary: Recommended update for bash
Type: recommended
Severity: moderate
References: 1133773,1143055
Description:
This update for bash fixes the following issues:
- Rework patch readline-7.0-screen (bsc#1143055):
map all 'screen(-xxx)?.yyy(-zzz)?' to 'screen' as well as
map 'konsole(-xxx)?' and 'gnome(-xxx)?' to 'xterm'
- Add a backport from bash 5.0 to perform better with large numbers of sub processes. (bsc#1133773)
-----------------------------------------------------------------
Advisory ID: SUSE-OU-2019:2980-1
Released: Thu Nov 14 22:45:33 2019
Summary: Optional update for curl
Type: optional
Severity: low
References: 1154019
Description:
This update for curl doesn't address any user visible issues.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:2997-1
Released: Mon Nov 18 15:16:38 2019
Summary: Security update for ncurses
Type: security
Severity: moderate
References: 1103320,1154036,1154037,CVE-2019-17594,CVE-2019-17595
Description:
This update for ncurses fixes the following issues:
Security issues fixed:
- CVE-2019-17594: Fixed a heap-based buffer over-read in the _nc_find_entry function (bsc#1154036).
- CVE-2019-17595: Fixed a heap-based buffer over-read in the fmt_entry function (bsc#1154037).
Non-security issue fixed:
- Removed screen.xterm from terminfo database (bsc#1103320).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:3010-1
Released: Tue Nov 19 18:10:58 2019
Summary: Recommended update for zypper and libsolv
Type: recommended
Severity: moderate
References: 1145554,1146415,1149511,1153351,SLE-9171
Description:
This update for zypper and libsolv fixes the following issues:
Package: zypper
- Improved the documentation of $releasever and --releasever usescases (bsc#1149511)
- zypper will now ask only once when multiple packages share the same license text (bsc#1145554)
- Added a new 'solver.focus' option for /etc/zypp/zypp.conf to define systemwide focus
mode when resolving jobs (bsc#1146415)
- Fixes an issue where 'zypper lu' didn't list all available package updates (bsc#1153351)
- Added a new --repo option to the 'download' command to allow to specify a repository (jsc#SLE-9171)
Package: libsolv
- Fixes issues when updating too many packages in focusbest mode
- Fixes the handling of disabled and installed packages in distupgrade
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:3040-1
Released: Fri Nov 22 11:59:52 2019
Summary: Recommended update for lvm2
Type: recommended
Severity: moderate
References: 1145231
Description:
This update for lvm2 fixes the following issues:
- Adds a fix to detect MD devices by LVM2 with metadata=1.0/0.9 (bsc#1145231)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:3059-1
Released: Mon Nov 25 17:33:07 2019
Summary: Security update for cpio
Type: security
Severity: moderate
References: 1155199,CVE-2019-14866
Description:
This update for cpio fixes the following issues:
- CVE-2019-14866: Fixed an improper validation of the values written
in the header of a TAR file through the to_oct() function which could
have led to unexpected TAR generation (bsc#1155199).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:3061-1
Released: Mon Nov 25 17:34:22 2019
Summary: Security update for gcc9
Type: security
Severity: moderate
References: 1114592,1135254,1141897,1142649,1142654,1148517,1149145,CVE-2019-14250,CVE-2019-15847,SLE-6533,SLE-6536
Description:
This update includes the GNU Compiler Collection 9.
A full changelog is provided by the GCC team on:
https://www.gnu.org/software/gcc/gcc-9/changes.html
The base system compiler libraries libgcc_s1, libstdc++6 and others are
now built by the gcc 9 packages.
To use it, install 'gcc9' or 'gcc9-c++' or other compiler brands and use CC=gcc-9 /
CXX=g++-9 during configuration for using it.
Security issues fixed:
- CVE-2019-15847: Fixed a miscompilation in the POWER9 back end, that optimized multiple calls of the __builtin_darn intrinsic into a single call. (bsc#1149145)
- CVE-2019-14250: Fixed a heap overflow in the LTO linker. (bsc#1142649)
Non-security issues fixed:
- Split out libstdc++ pretty-printers into a separate package supplementing gdb and the installed runtime. (bsc#1135254)
- Fixed miscompilation for vector shift on s390. (bsc#1141897)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:3070-1
Released: Tue Nov 26 12:39:29 2019
Summary: Recommended update for gpg2
Type: recommended
Severity: low
References: 1152755
Description:
This update for gpg2 provides the following fix:
- Remove a build requirement on self. This is causing Leap 15.2 bootstrap to fail. (bsc#1152755)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:3086-1
Released: Thu Nov 28 10:02:24 2019
Summary: Security update for libidn2
Type: security
Severity: moderate
References: 1154884,1154887,CVE-2019-12290,CVE-2019-18224
Description:
This update for libidn2 to version 2.2.0 fixes the following issues:
- CVE-2019-12290: Fixed an improper round-trip check when converting A-labels to U-labels (bsc#1154884).
- CVE-2019-18224: Fixed a heap-based buffer overflow that was caused by long domain strings (bsc#1154887).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:3087-1
Released: Thu Nov 28 10:03:00 2019
Summary: Security update for libxml2
Type: security
Severity: low
References: 1123919
Description:
This update for libxml2 doesn't fix any additional security issues, but correct its rpm changelog to reflect
all CVEs that have been fixed over the past.
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:3118-1
Released: Fri Nov 29 14:41:35 2019
Summary: Recommended update for e2fsprogs
Type: recommended
Severity: moderate
References: 1154295
Description:
This update for e2fsprogs fixes the following issues:
- Make minimum size estimates more reliable for mounted filesystem. (bsc#1154295)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:3166-1
Released: Wed Dec 4 11:24:42 2019
Summary: Recommended update for aaa_base
Type: recommended
Severity: moderate
References: 1007715,1084934,1157278
Description:
This update for aaa_base fixes the following issues:
- Use official key binding functions in inputrc that is replace up-history with previous-history, down-history with next-history and backward-delete-word with backward-kill-word. (bsc#1084934)
- Add some missed key escape sequences for urxvt-unicode terminal as well. (bsc#1007715)
- Clear broken ghost entry in patch which breaks 'readline'. (bsc#1157278)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:3181-1
Released: Thu Dec 5 11:43:07 2019
Summary: Security update for permissions
Type: security
Severity: moderate
References: 1093414,1150734,1157198,CVE-2019-3688,CVE-2019-3690
Description:
This update for permissions fixes the following issues:
- CVE-2019-3688: Changed wrong ownership in /usr/sbin/pinger to root:squid
which could have allowed a squid user to gain persistence by changing the
binary (bsc#1093414).
- CVE-2019-3690: Fixed a privilege escalation through untrusted symbolic
links (bsc#1150734).
- Fixed a regression which caused sagmentation fault (bsc#1157198).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:3240-1
Released: Tue Dec 10 10:40:19 2019
Summary: Recommended update for ca-certificates-mozilla, p11-kit
Type: recommended
Severity: moderate
References: 1154871
Description:
This update for ca-certificates-mozilla, p11-kit fixes the following issues:
Changes in ca-certificates-mozilla:
- export correct p11kit trust attributes so Firefox detects built in
certificates (bsc#1154871).
Changes in p11-kit:
- support loading NSS attribute CKA_NSS_MOZILLA_CA_POLICY so Firefox
detects built in certificates (bsc#1154871)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:3267-1
Released: Wed Dec 11 11:19:53 2019
Summary: Security update for libssh
Type: security
Severity: important
References: 1158095,CVE-2019-14889
Description:
This update for libssh fixes the following issues:
- CVE-2019-14889: Fixed an arbitrary command execution (bsc#1158095).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:3343-1
Released: Thu Dec 19 11:05:27 2019
Summary: Recommended update for lvm2
Type: recommended
Severity: moderate
References: 1155668
Description:
This update for lvm2 fixes the following issues:
- Fix seeing a 90 Second delay during shutdown and reboot. (bsc#1155668)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:3392-1
Released: Fri Dec 27 13:33:29 2019
Summary: Security update for libgcrypt
Type: security
Severity: moderate
References: 1148987,1155338,1155339,CVE-2019-13627
Description:
This update for libgcrypt fixes the following issues:
Security issues fixed:
- CVE-2019-13627: Mitigation against an ECDSA timing attack (bsc#1148987).
Bug fixes:
- Added CMAC AES self test (bsc#1155339).
- Added CMAC TDES self test missing (bsc#1155338).
- Fix test dsa-rfc6979 in FIPS mode.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:69-1
Released: Fri Jan 10 12:33:59 2020
Summary: Security update for openssl-1_1
Type: security
Severity: moderate
References: 1155346,1157775,1158101,1158809,CVE-2019-1551,SLE-8789
Description:
This update for openssl-1_1 fixes the following issues:
Security issue fixed:
- CVE-2019-1551: Fixed an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli (bsc#1158809).
Various FIPS related improvements were done:
- FIPS: Backport SSH KDF to openssl (jsc#SLE-8789, bsc#1157775).
- Port FIPS patches from SLE-12 (bsc#1158101).
- Use SHA-2 in the RSA pairwise consistency check (bsc#1155346).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:129-1
Released: Mon Jan 20 09:21:13 2020
Summary: Security update for libssh
Type: security
Severity: important
References: 1158095,CVE-2019-14889
Description:
This update for libssh fixes the following issues:
- CVE-2019-14889: Fixed an unwanted command execution in scp caused by unsanitized location (bsc#1158095).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:225-1
Released: Fri Jan 24 06:49:07 2020
Summary: Recommended update for procps
Type: recommended
Severity: moderate
References: 1158830
Description:
This update for procps fixes the following issues:
- Fix for 'ps -C' allowing to accept any arguments longer than 15 characters anymore. (bsc#1158830)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:256-1
Released: Wed Jan 29 09:39:17 2020
Summary: Recommended update for aaa_base
Type: recommended
Severity: moderate
References: 1157794,1160970
Description:
This update for aaa_base fixes the following issues:
- Improves the way how the Java path is created to fix an issue with sapjvm. (bsc#1157794)
- Drop 'dev.cdrom.autoclose' = 0 from sysctl config. (bsc#1160970)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:262-1
Released: Thu Jan 30 11:02:42 2020
Summary: Security update for glibc
Type: security
Severity: moderate
References: 1149332,1151582,1157292,1157893,1158996,CVE-2019-19126
Description:
This update for glibc fixes the following issues:
Security issue fixed:
- CVE-2019-19126: Fixed to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition (bsc#1157292).
Bug fixes:
- Fixed z15 (s390x) strstr implementation that can return incorrect results if search string cross page boundary (bsc#1157893).
- Fixed Hardware support in toolchain (bsc#1151582).
- Fixed syscalls during early process initialization (SLE-8348).
- Fixed an array overflow in backtrace for PowerPC (bsc#1158996).
- Moved to posix_spawn on popen (bsc#1149332).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:265-1
Released: Thu Jan 30 14:05:34 2020
Summary: Security update for e2fsprogs
Type: security
Severity: moderate
References: 1160571,CVE-2019-5188
Description:
This update for e2fsprogs fixes the following issues:
- CVE-2019-5188: Fixed a code execution vulnerability in the directory rehashing functionality (bsc#1160571).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:279-1
Released: Fri Jan 31 12:01:39 2020
Summary: Recommended update for p11-kit
Type: recommended
Severity: moderate
References: 1013125
Description:
This update for p11-kit fixes the following issues:
- Also build documentation (bsc#1013125)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:335-1
Released: Thu Feb 6 11:37:24 2020
Summary: Security update for systemd
Type: security
Severity: important
References: 1084671,1092920,1106383,1133495,1151377,1154256,1155207,1155574,1156213,1156482,1158485,1159814,1161436,1162108,CVE-2019-20386,CVE-2020-1712
Description:
This update for systemd fixes the following issues:
- CVE-2020-1712 (bsc#bsc#1162108)
Fix a heap use-after-free vulnerability, when asynchronous
Polkit queries were performed while handling Dbus messages. A local
unprivileged attacker could have abused this flaw to crash systemd services or
potentially execute code and elevate their privileges, by sending specially
crafted Dbus messages.
- Use suse.pool.ntp.org server pool on SLE distros (jsc#SLE-7683)
- libblkid: open device in nonblock mode. (bsc#1084671)
- udev/cdrom_id: Do not open CD-rom in exclusive mode. (bsc#1154256)
- bus_open leak sd_event_source when udevadm trigger。 (bsc#1161436 CVE-2019-20386)
- fileio: introduce read_full_virtual_file() for reading virtual files in sysfs, procfs (bsc#1133495 bsc#1159814)
- fileio: initialize errno to zero before we do fread()
- fileio: try to read one byte too much in read_full_stream()
- logind: consider 'greeter' sessions suitable as 'display' sessions of a user (bsc#1158485)
- logind: never elect a session that is stopping as display
- journal: include kmsg lines from the systemd process which exec()d us (#8078)
- udevd: don't use monitor after manager_exit()
- udevd: capitalize log messages in on_sigchld()
- udevd: merge conditions to decrease indentation
- Revert 'udevd: fix crash when workers time out after exit is signal caught'
- core: fragments of masked units ought not be considered for NeedDaemonReload (#7060) (bsc#1156482)
- udevd: fix crash when workers time out after exit is signal caught
- udevd: wait for workers to finish when exiting (bsc#1106383)
- Improve bash completion support (bsc#1155207)
* shell-completion: systemctl: do not list template units in {re,}start
* shell-completion: systemctl: pass current word to all list_unit*
* bash-completion: systemctl: pass current partial unit to list-unit* (bsc#1155207)
* bash-completion: systemctl: use systemctl --no-pager
* bash-completion: also suggest template unit files
* bash-completion: systemctl: add missing options and verbs
* bash-completion: use the first argument instead of the global variable (#6457)
- networkd: VXLan Make group and remote variable separate (bsc#1156213)
- networkd: vxlan require Remote= to be a non multicast address (#8117) (bsc#1156213)
- fs-util: let's avoid unnecessary strerror()
- fs-util: introduce inotify_add_watch_and_warn() helper
- ask-password: improve log message when inotify limit is reached (bsc#1155574)
- shared/install: failing with -ELOOP can be due to the use of an alias in install_error() (bsc#1151377)
- man: alias names can't be used with enable command (bsc#1151377)
- Add boot option to not use swap at system start (jsc#SLE-7689)
- Allow YaST to select Iranian (Persian, Farsi) keyboard layout
(bsc#1092920)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:339-1
Released: Thu Feb 6 13:03:22 2020
Summary: Recommended update for openldap2
Type: recommended
Severity: low
References: 1158921
Description:
This update for openldap2 provides the following fix:
- Add libldap-data to the product (as it contains ldap.conf). (bsc#1158921)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:368-1
Released: Fri Feb 7 13:49:41 2020
Summary: Recommended update for lvm2
Type: recommended
Severity: moderate
References: 1150021
Description:
This update for lvm2 fixes the following issues:
- Fix for LVM in KVM: The scsi presistent reservation scenario can trigger and error during LVM actions. (bsc#1150021)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:386-1
Released: Mon Feb 17 11:41:23 2020
Summary: Skuba bug fix, supportconfig update, cri-o and kubernetes fixes, and prometheus fixes
Type: recommended
Severity: important
References: 1137337,1152335,1155323,1155593,1155810,1157802,1159074,1159452,1160443,1160600,1161056,1161179,1161975
Description:
= Required Actions
Update skuba, kubernetes-client and kubernetes-kubeadm packages on your management workstation as you would do with any other package.
Refer to: https://documentation.suse.com/sles/15-SP1/single-html/SLES-admin/#sec-zypper-softup-update
Packages on your cluster nodes (cri-o, kubernetes, supportutils-plugin-suse-caasp) will be updated automatically by skuba-update link:https://documentation.suse.com/suse-caasp/4.1/html/caasp-admin/_cluster_updates.html#_base_os_updates
Use `helm upgrade` command to fix prometheus kube-state-metrics image.
Finally, to apply the prometheus pushgateway fix, enable it in your helm chart https://github.com/SUSE/kubernetes-charts-suse-com/blob/master/stable/prometheus/values.yaml#L848 and use helm ugrade command link:https://helm.sh/docs/intro/using_helm/#helm-upgrade-and-helm-rollback-upgrading-a-release-and-recovering-on-failure.
More information about the sle-updates
mailing list