SUSE-FU-2022:2794-1: moderate: Feature update for ongres-scram, ongres-stringprep, postgresql-jdbc

[sle-updates at lists.suse.com]

   SUSE Feature Update: Feature update for ongres-scram, ongres-stringprep, postgresql-jdbc
______________________________________________________________________________

Announcement ID:    SUSE-FU-2022:2794-1
Rating:             moderate
References:         #1196693 #1197356 SLE-23994 
Affected Products:
                    SUSE Linux Enterprise High Performance Computing 15-SP3
                    SUSE Linux Enterprise Module for SUSE Manager Server 4.2
                    SUSE Linux Enterprise Module for Server Applications 15-SP3
                    SUSE Linux Enterprise Server 15-SP3
                    SUSE Linux Enterprise Server for SAP Applications 15-SP3
                    SUSE Linux Enterprise Storage 7.1
                    SUSE Manager Proxy 4.2
                    SUSE Manager Retail Branch Server 4.2
                    SUSE Manager Server 4.2
                    openSUSE Leap 15.3
______________________________________________________________________________

   An update that solves one vulnerability, contains one
   feature and has one errata is now available.

Description:

   This feature update for ongres-scram, ongres-stringprep, postgresql-jdbc
   provides:


   ongres-scram:

   - Upgrade from version 1.0.0-beta.2 to version 2.1. (jsc#SLE-23994)
     * Add standard `SASLPrep` (bsc#1196693, jsc#SLE-23994)
     * Failover to bouncy castle implementation of `PBKDF2WithHmacSHA256` to
       support Oracle JDK 7
     * Updated `saslprep` to version 1.1 to remove a build dependency coming
       from the `stringprep` module

   ongres-stringprep:

   - Introduce `ongres-stringprep` 1.1 as dependency of `ongres-scram`.
     (bsc#1196693, jsc#SLE-23994)

   postgresql-jdbc:

   - CVE-2022-26520: Fixed arbitrary File Write Vulnerability (bsc#1197356)
   - Upgrade postgresql-jdbc from version 42.2.16 to version 42.2.25
     (jsc#SLE-23994)
     * Use `SASLprep` normalization for SCRAM authentication and fixes issues
       with spaces in passwords. (bsc#1196693)


Patch Instructions:

   To install this SUSE Feature Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Leap 15.3:

      zypper in -t patch openSUSE-SLE-15.3-2022-2794=1

   - SUSE Linux Enterprise Module for Server Applications 15-SP3:

      zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP3-2022-2794=1

   - SUSE Linux Enterprise Module for SUSE Manager Server 4.2:

      zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Server-4.2-2022-2794=1



Package List:

   - openSUSE Leap 15.3 (noarch):

      ongres-scram-2.1-150300.3.3.4
      ongres-scram-client-2.1-150300.3.3.4
      ongres-scram-javadoc-2.1-150300.3.3.4
      ongres-scram-parent-2.1-150300.3.3.4
      ongres-stringprep-1.1-150300.7.3.4
      ongres-stringprep-codegenerator-1.1-150300.7.3.4
      ongres-stringprep-javadoc-1.1-150300.7.3.4
      ongres-stringprep-parent-1.1-150300.7.3.4
      ongres-stringprep-saslprep-1.1-150300.7.3.4
      postgresql-jdbc-42.2.25-150300.3.5.2
      postgresql-jdbc-javadoc-42.2.25-150300.3.5.2

   - SUSE Linux Enterprise Module for Server Applications 15-SP3 (noarch):

      ongres-scram-2.1-150300.3.3.4
      ongres-scram-client-2.1-150300.3.3.4
      ongres-stringprep-1.1-150300.7.3.4
      ongres-stringprep-saslprep-1.1-150300.7.3.4
      postgresql-jdbc-42.2.25-150300.3.5.2

   - SUSE Linux Enterprise Module for SUSE Manager Server 4.2 (noarch):

      ongres-scram-2.1-150300.3.3.4
      ongres-scram-client-2.1-150300.3.3.4
      ongres-stringprep-1.1-150300.7.3.4
      ongres-stringprep-saslprep-1.1-150300.7.3.4
      postgresql-jdbc-42.2.25-150300.3.5.2


References:

   https://www.suse.com/security/cve/CVE-2022-26520.html
   https://bugzilla.suse.com/1196693
   https://bugzilla.suse.com/1197356