SUSE-SU-2020:0087-1: moderate: Security update for libsolv, libzypp, zypper

[sle-updates at lists.suse.com]

   SUSE Security Update: Security update for libsolv, libzypp, zypper
______________________________________________________________________________

Announcement ID:    SUSE-SU-2020:0087-1
Rating:             moderate
References:         #1135114 #1154804 #1154805 #1155198 #1155205 
                    #1155298 #1155678 #1155819 #1156158 #1157377 
                    #1158763 
Cross-References:   CVE-2019-18900
Affected Products:
                    SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1
                    SUSE Linux Enterprise Module for Open Buildservice Development Tools 15
                    SUSE Linux Enterprise Module for Development Tools 15
                    SUSE Linux Enterprise Module for Basesystem 15
                    SUSE Linux Enterprise Installer 15
______________________________________________________________________________

   An update that solves one vulnerability and has 10 fixes is
   now available.

Description:

   This update for libsolv, libzypp, zypper fixes the following issues:

   Security issue fixed:

   - CVE-2019-18900: Fixed assert cookie file that was world readable
     (bsc#1158763).

   Bug fixes

   - Fixed removing orphaned packages dropped by to-be-installed products
     (bsc#1155819).
   - Adds libzypp API to mark all obsolete kernels according to the existing
     purge-kernel script rules (bsc#1155198).
   - Do not enforce 'en' being in RequestedLocales If the user decides to
     have a system without explicit language support he may do so
     (bsc#1155678).
   - Load only target resolvables for zypper rm (bsc#1157377).
   - Fix broken search by filelist (bsc#1135114).
   - Replace python by a bash script in zypper-log (fixes#304, fixes#306,
     bsc#1156158).
   - Do not sort out requested locales which are not available (bsc#1155678).
   - Prevent listing duplicate matches in tables. XML result is provided
     within the new list-patches-byissue element (bsc#1154805).
   - XML add patch issue-date and issue-list (bsc#1154805).
   - Fix zypper lp --cve/bugzilla/issue options (bsc#1155298).
   - Always execute commit when adding/removing locales (fixes bsc#1155205).
   - Fix description of --table-style,-s in man page (bsc#1154804).


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1:

      zypper in -t patch SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2020-87=1

   - SUSE Linux Enterprise Module for Open Buildservice Development Tools 15:

      zypper in -t patch SUSE-SLE-Module-Development-Tools-OBS-15-2020-87=1

   - SUSE Linux Enterprise Module for Development Tools 15:

      zypper in -t patch SUSE-SLE-Module-Development-Tools-15-2020-87=1

   - SUSE Linux Enterprise Module for Basesystem 15:

      zypper in -t patch SUSE-SLE-Module-Basesystem-15-2020-87=1

   - SUSE Linux Enterprise Installer 15:

      zypper in -t patch SUSE-SLE-INSTALLER-15-2020-87=1



Package List:

   - SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (aarch64 ppc64le s390x x86_64):

      python-solv-0.7.10-3.22.1
      python-solv-debuginfo-0.7.10-3.22.1

   - SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (aarch64 ppc64le s390x x86_64):

      libsolv-debuginfo-0.7.10-3.22.1
      libsolv-debugsource-0.7.10-3.22.1
      libsolv-demo-0.7.10-3.22.1
      libsolv-demo-debuginfo-0.7.10-3.22.1
      libzypp-debuginfo-17.19.0-3.34.1
      libzypp-debugsource-17.19.0-3.34.1
      libzypp-devel-doc-17.19.0-3.34.1

   - SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (noarch):

      zypper-aptitude-1.14.33-3.29.1

   - SUSE Linux Enterprise Module for Development Tools 15 (aarch64 ppc64le s390x x86_64):

      libsolv-debuginfo-0.7.10-3.22.1
      libsolv-debugsource-0.7.10-3.22.1
      perl-solv-0.7.10-3.22.1
      perl-solv-debuginfo-0.7.10-3.22.1
      python3-solv-0.7.10-3.22.1
      python3-solv-debuginfo-0.7.10-3.22.1
      ruby-solv-0.7.10-3.22.1
      ruby-solv-debuginfo-0.7.10-3.22.1

   - SUSE Linux Enterprise Module for Basesystem 15 (aarch64 ppc64le s390x x86_64):

      libsolv-debuginfo-0.7.10-3.22.1
      libsolv-debugsource-0.7.10-3.22.1
      libsolv-devel-0.7.10-3.22.1
      libsolv-devel-debuginfo-0.7.10-3.22.1
      libsolv-tools-0.7.10-3.22.1
      libsolv-tools-debuginfo-0.7.10-3.22.1
      libzypp-17.19.0-3.34.1
      libzypp-debuginfo-17.19.0-3.34.1
      libzypp-debugsource-17.19.0-3.34.1
      libzypp-devel-17.19.0-3.34.1
      python-solv-0.7.10-3.22.1
      python-solv-debuginfo-0.7.10-3.22.1
      zypper-1.14.33-3.29.1
      zypper-debuginfo-1.14.33-3.29.1
      zypper-debugsource-1.14.33-3.29.1

   - SUSE Linux Enterprise Module for Basesystem 15 (noarch):

      zypper-log-1.14.33-3.29.1

   - SUSE Linux Enterprise Installer 15 (aarch64 ppc64le s390x x86_64):

      libsolv-tools-0.7.10-3.22.1
      libzypp-17.19.0-3.34.1
      zypper-1.14.33-3.29.1


References:

   https://www.suse.com/security/cve/CVE-2019-18900.html
   https://bugzilla.suse.com/1135114
   https://bugzilla.suse.com/1154804
   https://bugzilla.suse.com/1154805
   https://bugzilla.suse.com/1155198
   https://bugzilla.suse.com/1155205
   https://bugzilla.suse.com/1155298
   https://bugzilla.suse.com/1155678
   https://bugzilla.suse.com/1155819
   https://bugzilla.suse.com/1156158
   https://bugzilla.suse.com/1157377
   https://bugzilla.suse.com/1158763