SUSE-CU-2021:277-1: Security update of suse/sles12sp4
sle-updates at lists.suse.com
sle-updates at lists.suse.com
Sat Aug 7 06:48:13 UTC 2021
SUSE Container Update Advisory: suse/sles12sp4
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2021:277-1
Container Tags : suse/sles12sp4:26.325 , suse/sles12sp4:latest
Container Release : 26.325
Severity : important
Type : security
References : 1027496 1131330 1161510 1178561 1181443 1184761 1184967 1185046
1185331 1185562 1185807 1186015 1186229 1187212 1187784 1187911
1188063 1188217 1188218 1188219 1188220 CVE-2016-10228 CVE-2019-20387
CVE-2021-22922 CVE-2021-22923 CVE-2021-22924 CVE-2021-22925 CVE-2021-3200
CVE-2021-33560 CVE-2021-33910 CVE-2021-3541 CVE-2021-35942
-----------------------------------------------------------------
The container suse/sles12sp4 was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:2016-1
Released: Fri Jun 18 09:39:25 2021
Summary: Security update for libxml2
Type: security
Severity: moderate
References: 1186015,CVE-2021-3541
This update for libxml2 fixes the following issues:
- CVE-2021-3541: Fixed exponential entity expansion attack that could bypass all existing protection mechanisms (bsc#1186015).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:2086-1
Released: Fri Jun 18 17:28:57 2021
Summary: Recommended update for pam
Type: recommended
Severity: important
References: 1181443,1185562
This update for pam fixes the following issues:
- Fixed a bug, where the 'unlimited'/'-1' value was not interpreted correctly (bsc#1181443)
- In the 32-bit compatibility package for 64-bit architectures, require 'systemd-32bit' to be also installed as it contains pam_systemd.so for 32 bit applications. (bsc#1185562)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:2156-1
Released: Thu Jun 24 15:39:39 2021
Summary: Security update for libgcrypt
Type: security
Severity: important
References: 1187212,CVE-2021-33560
This update for libgcrypt fixes the following issues:
- CVE-2021-33560: Fixed a side-channel against ElGamal encryption, caused by missing exponent blinding (bsc#1187212).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:2180-1
Released: Mon Jun 28 17:40:39 2021
Summary: Security update for libsolv
Type: security
Severity: important
References: 1161510,1186229,CVE-2019-20387,CVE-2021-3200
This update for libsolv fixes the following issues:
Security issues fixed:
- CVE-2019-20387: Fixed heap-buffer-overflow in repodata_schema2id (bsc#1161510)
- CVE-2021-3200: testcase_read: error out if repos are added or the system is changed too late (bsc#1186229)
Other issues fixed:
- backport support for blacklisted packages to support ptf packages and retracted patches
- fix ruleinfo of complex dependencies returning the wrong origin
- fix SOLVER_FLAG_FOCUS_BEST updateing packages without reason
- fix add_complex_recommends() selecting conflicted packages in rare cases
- fix potential segfault in resolve_jobrules
- fix solv_zchunk decoding error if large chunks are used
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:2423-1
Released: Wed Jul 21 11:03:43 2021
Summary: Security update for systemd
Type: security
Severity: important
References: 1178561,1184761,1184967,1185046,1185331,1185807,1188063,CVE-2021-33910
This update for systemd fixes the following issues:
Security issues fixed:
- CVE-2021-33910: Fixed a denial of service (stack exhaustion) in systemd (PID 1) (bsc#1188063)
Other fixes:
- mount-util: shorten the loop a bit (#7545)
- mount-util: do not use the official MAX_HANDLE_SZ (#7523)
- mount-util: tape over name_to_handle_at() flakiness (#7517) (bsc#1184761)
- mount-util: fix bad indenting
- mount-util: EOVERFLOW might have other causes than buffer size issues
- mount-util: fix error propagation in fd_fdinfo_mnt_id()
- mount-util: drop exponential buffer growing in name_to_handle_at_loop()
- udev: port udev_has_devtmpfs() to use path_get_mnt_id()
- mount-util: add new path_get_mnt_id() call that queries the mnt ID of a path
- mount-util: add name_to_handle_at_loop() wrapper around name_to_handle_at()
- mount-util: accept that name_to_handle_at() might fail with EPERM (#5499)
- basic: fallback to the fstat if we don't have access to the /proc/self/fdinfo
- sysusers: use the usual comment style
- test/TEST-21-SYSUSERS: add tests for new functionality
- sysusers: allow admin/runtime overrides to command-line config
- basic/strv: add function to insert items at position
- sysusers: allow the shell to be specified
- sysusers: move various user credential validity checks to src/basic/
- man: reformat table in sysusers.d(5)
- sysusers: take configuration as positional arguments
- sysusers: emit a bit more info at debug level when locking fails
- sysusers: allow force reusing existing user/group IDs (#8037)
- sysusers: ensure GID in uid:gid syntax exists
- sysusers: make ADD_GROUP always create a group
- test: add TEST-21-SYSUSERS test
- sysuser: use OrderedHashmap
- sysusers: allow uid:gid in sysusers.conf files
- sysusers: fix memleak (#4430)
- These commits implement the option '--replace' for systemd-sysusers
so %sysusers_create_package can be introduced in SLE and packages
can rely on this rpm macro without wondering whether the macro is
available on the different target the package is submitted to.
- Expect 644 permissions for /usr/lib/udev/compat-symlink-generation (bsc#1185807)
- systemctl: add --value option
- execute: make sure to call into PAM after initializing resource limits (bsc#1184967)
- rlimit-util: introduce setrlimit_closest_all()
- system-conf: drop reference to ShutdownWatchdogUsec=
- core: rename ShutdownWatchdogSec to RebootWatchdogSec (bsc#1185331)
- Return -EAGAIN instead of -EALREADY from unit_reload (bsc#1185046)
- rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
- write_net_rules: set execute bits (bsc#1178561)
- udev: rework network device renaming
- Revert 'Revert 'udev: network device renaming - immediately give up if the target name isn't available''
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:2425-1
Released: Wed Jul 21 11:26:08 2021
Summary: Security update for curl
Type: security
Severity: moderate
References: 1188217,1188218,1188219,1188220,CVE-2021-22922,CVE-2021-22923,CVE-2021-22924,CVE-2021-22925
This update for curl fixes the following issues:
- CVE-2021-22925: TELNET stack contents disclosure again. (bsc#1188220)
- CVE-2021-22924: Bad connection reuse due to flawed path name checks. (bsc#1188219)
- CVE-2021-22923: Insufficiently Protected Credentials. (bsc#1188218)
- CVE-2021-22922: Wrong content via metalink not discarded. (bsc#1188217)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:2480-1
Released: Tue Jul 27 13:47:22 2021
Summary: Security update for glibc
Type: security
Severity: moderate
References: 1027496,1131330,1187911,CVE-2016-10228,CVE-2021-35942
This update for glibc fixes the following issues:
Security issues fixed:
- CVE-2021-35942: wordexp: Fixed handle overflow in positional parameter number (bsc#1187911)
- CVE-2016-10228: Rewrite iconv option parsing (bsc#1027496)
Other fixes:
- Fixed race in pthread_mutex_lock while promoting to PTHREAD_MUTEX_ELISION_NP (bsc#1131330)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:2578-1
Released: Sun Aug 1 15:54:42 2021
Summary: Recommended update for openldap2
Type: recommended
Severity: moderate
References: 1187784
This update for openldap2 rebuilds openldap2 against a symbol
versioned enabled openssl 1.0 library.
This is an enablemend for migrations to openssl 1.1.1 which will enable TLS 1.3 support.
More information about the sle-updates
mailing list