SUSE-CU-2022:2727-1: Security update of suse/manager/4.3/proxy-httpd
sle-updates at lists.suse.com
sle-updates at lists.suse.com
Wed Oct 26 11:15:04 UTC 2022
SUSE Container Update Advisory: suse/manager/4.3/proxy-httpd
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2022:2727-1
Container Tags : suse/manager/4.3/proxy-httpd:4.3.2 , suse/manager/4.3/proxy-httpd:4.3.2.9.10.1 , suse/manager/4.3/proxy-httpd:latest
Container Release : 9.10.1
Severity : critical
Type : security
References : 1047178 1121365 1180995 1182983 1189282 1189802 1190651 1190653
1190700 1190888 1191020 1191857 1193859 1195624 1195773 1196729
1197027 1198168 1198471 1198472 1198523 1198752 1198903 1199140
1199492 1199726 1199895 1200480 1200573 1200629 1200800 1200993
1201092 1201210 1201220 1201260 1201293 1201576 1201589 1201626
1201638 1201680 1201753 1201783 1201788 1201913 1201918 1201942
1201972 1202117 1202148 1202271 1202272 1202367 1202455 1202464
1202602 1202624 1202728 1202729 1202805 1202870 1202899 1203018
1203026 1203046 1203049 1203056 1203069 1203169 1203287 1203288
1203385 1203406 1203422 1203438 1203449 1203478 1203484 1203564
1203585 1203611 1203649 1204244 1204357 1204366 1204367 CVE-2017-6512
CVE-2021-28861 CVE-2021-36690 CVE-2021-41411 CVE-2021-42740 CVE-2021-43138
CVE-2021-46828 CVE-2022-0860 CVE-2022-31129 CVE-2022-31252 CVE-2022-3515
CVE-2022-35737 CVE-2022-40303 CVE-2022-40304 CVE-2022-40674
-----------------------------------------------------------------
The container suse/manager/4.3/proxy-httpd was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:2796-1
Released: Fri Aug 12 14:34:31 2022
Summary: Recommended update for jitterentropy
Type: recommended
Severity: moderate
References:
This update for jitterentropy fixes the following issues:
jitterentropy is included in version 3.4.0 (jsc#SLE-24941):
This is a FIPS 140-3 / NIST 800-90b compliant userspace jitter entropy generator library,
used by other FIPS libraries.
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:3127-1
Released: Wed Sep 7 04:36:10 2022
Summary: Recommended update for libtirpc
Type: recommended
Severity: moderate
References: 1198752,1200800
This update for libtirpc fixes the following issues:
- Exclude ipv6 addresses in client protocol version 2 code (bsc#1200800)
- Fix memory leak in params.r_addr assignement (bsc#1198752)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:3215-1
Released: Thu Sep 8 15:58:27 2022
Summary: Recommended update for rpm
Type: recommended
Severity: moderate
References:
This update for rpm fixes the following issues:
- Support Ed25519 RPM signatures [jsc#SLE-24714]
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:3220-1
Released: Fri Sep 9 04:30:52 2022
Summary: Recommended update for libzypp, zypper
Type: recommended
Severity: moderate
References: 1199895,1200993,1201092,1201576,1201638
This update for libzypp, zypper fixes the following issues:
libzypp:
- Improve handling of package locks, allowing to reset the status of its initial state (bsc#1199895)
- Fix issues when receiving exceptions from curl_easy_cleanup (bsc#1201092)
- Don't auto-flag kernel-firmware as 'reboot-needed' (bsc#1200993)
- Remove Medianetwork and its dependent code. First reason for this is that MediaNetwork was just meant as a way to test
the new CURL based downloaded. Second the Provide API is going to completely replace the current media backend.
zypper:
- Truncate the 'Name' column when using `zypper lr`, if the table is wider than the terminal (bsc#1201638)
- Reject install/remove modifier without argument (bsc#1201576)
- zypper-download: Handle unresolvable arguments as errors
- Put signing key supplying repository name in quotes
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:3262-1
Released: Tue Sep 13 15:34:29 2022
Summary: Recommended update for gcc11
Type: recommended
Severity: moderate
References: 1199140
This update for gcc11 ships some missing 32bit libraries for s390x. (bsc#1199140)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:3271-1
Released: Wed Sep 14 06:45:39 2022
Summary: Security update for perl
Type: security
Severity: moderate
References: 1047178,CVE-2017-6512
This update for perl fixes the following issues:
- CVE-2017-6512: Fixed File::Path rmtree/remove_tree race condition (bsc#1047178).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:3304-1
Released: Mon Sep 19 11:43:25 2022
Summary: Recommended update for libassuan
Type: recommended
Severity: moderate
References:
This update for libassuan fixes the following issues:
- Add a timeout for writing to a SOCKS5 proxy
- Add workaround for a problem with LD_LIBRARY_PATH on newer systems
- Fix issue in the logging code
- Fix some build trivialities
- Upgrade autoconf
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:3305-1
Released: Mon Sep 19 11:45:57 2022
Summary: Security update for libtirpc
Type: security
Severity: important
References: 1201680,CVE-2021-46828
This update for libtirpc fixes the following issues:
- CVE-2021-46828: Fixed denial of service vulnerability with lots of connections (bsc#1201680).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:3307-1
Released: Mon Sep 19 13:26:51 2022
Summary: Security update for sqlite3
Type: security
Severity: moderate
References: 1189802,1195773,1201783,CVE-2021-36690,CVE-2022-35737
This update for sqlite3 fixes the following issues:
- CVE-2022-35737: Fixed an array-bounds overflow if billions of bytes are used in a string argument to a C API (bnc#1201783).
- CVE-2021-36690: Fixed an issue with the SQLite Expert extension when a column has no collating sequence (bsc#1189802).
- Package the Tcl bindings here again so that we only ship one copy of SQLite (bsc#1195773).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:3328-1
Released: Wed Sep 21 12:48:56 2022
Summary: Recommended update for jitterentropy
Type: recommended
Severity: moderate
References: 1202870
This update for jitterentropy fixes the following issues:
- Hide the non-GNUC constructs that are library internal from the
exported header, to make it usable in builds with strict C99
compliance. (bsc#1202870)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:3353-1
Released: Fri Sep 23 15:23:40 2022
Summary: Security update for permissions
Type: security
Severity: moderate
References: 1203018,CVE-2022-31252
This update for permissions fixes the following issues:
- CVE-2022-31252: Fixed chkstat group controlled paths (bsc#1203018).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:3452-1
Released: Wed Sep 28 12:13:43 2022
Summary: Recommended update for glibc
Type: recommended
Severity: moderate
References: 1201942
This update for glibc fixes the following issues:
- Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942)
- powerpc: Optimized memcmp for power10 (jsc#PED-987)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:3489-1
Released: Sat Oct 1 13:35:24 2022
Summary: Security update for expat
Type: security
Severity: important
References: 1203438,CVE-2022-40674
This update for expat fixes the following issues:
- CVE-2022-40674: Fixed use-after-free in the doContent function in xmlparse.c (bsc#1203438).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:3521-1
Released: Tue Oct 4 14:18:56 2022
Summary: Recommended update for lvm2
Type: recommended
Severity: critical
References: 1198523
This update for lvm2 fixes the following issues:
- Add additional check in the package to prevent removal of device-mapper library files during install (bsc#1198523)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:3544-1
Released: Thu Oct 6 13:48:42 2022
Summary: Security update for python3
Type: security
Severity: important
References: 1202624,CVE-2021-28861
This update for python3 fixes the following issues:
- CVE-2021-28861: Fixed an open redirection vulnerability in the HTTP server when an URI path starts with // (bsc#1202624).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:3551-1
Released: Fri Oct 7 17:03:55 2022
Summary: Recommended update for libgcrypt
Type: recommended
Severity: moderate
References: 1182983,1190700,1191020,1202117
This update for libgcrypt fixes the following issues:
- FIPS: Fixed gpg/gpg2 gets out of core handler in FIPS mode while
typing Tab key to Auto-Completion. [bsc#1182983]
- FIPS: Ported libgcrypt to use jitterentropy [bsc#1202117, jsc#SLE-24941]
* Enable the jitter based entropy generator by default in random.conf
* Update the internal jitterentropy to version 3.4.0
- FIPS: Get most of the entropy from rndjent_poll [bsc#1202117]
- FIPS: Check keylength in gcry_fips_indicator_kdf() [bsc#1190700]
* Consider approved keylength greater or equal to 112 bits.
- FIPS: Zeroize buffer and digest in check_binary_integrity() [bsc#1191020]
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:3555-1
Released: Mon Oct 10 14:05:12 2022
Summary: Recommended update for aaa_base
Type: recommended
Severity: important
References: 1199492
This update for aaa_base fixes the following issues:
- The wrapper rootsh is not a restricted shell. (bsc#1199492)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:3564-1
Released: Tue Oct 11 16:15:57 2022
Summary: Recommended update for libzypp, zypper
Type: recommended
Severity: critical
References: 1189282,1201972,1203649
This update for libzypp, zypper fixes the following issues:
libzypp:
- Enable 'zck' support for SUSE Linux Enterprise 15 Service Pack 4 and newer (bsc#1189282)
- Fix regression leading to `-allow-vendor-change` and `no-allow-vendor-change` options being ignored (bsc#1201972)
- Remove migration code that is no longer needed (bsc#1203649)
- Store logrotate files in vendor specif directory '/usr/etc/logrotate.d' if so defined
zypper:
- Fix contradiction in the man page: `--download-in-advance` option is the default behavior
- Fix regression leading to `-allow-vendor-change` and `no-allow-vendor-change` options being ignored (bsc#1201972)
- Fix tests to use locale 'C.UTF-8' rather than 'en_US'
- Make sure 'up' respects solver related CLI options (bsc#1201972)
- Remove unneeded code to compute the PPP status because it is now auto established
- Store logrotate files in vendor specif directory '/usr/etc/logrotate.d' if so defined
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:3663-1
Released: Wed Oct 19 19:05:21 2022
Summary: Recommended update for openssl-1_1
Type: recommended
Severity: moderate
References: 1121365,1180995,1190651,1190653,1190888,1193859,1198471,1198472,1201293,1202148,1203046,1203069
This update for openssl-1_1 fixes the following issues:
- FIPS: Default to RFC-7919 groups for genparam and dhparam
- FIPS: list only FIPS approved digest and public key algorithms
[bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
* The FIPS_drbg implementation is not FIPS validated anymore. To
provide backwards compatibility for applications that need FIPS
compliant RNG number generation and use FIPS_drbg_generate,
this function was re-wired to call the FIPS validated DRBG
instance instead through the RAND_bytes() call.
- FIPS: Fix minor memory leaks by FIPS patch [bsc#1203046]
- FIPS: OpenSSL: Port openssl to use jitterentropy [bsc#1202148, jsc#SLE-24941]
libcrypto.so now requires libjitterentropy3 library.
- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
- FIPS: Add zeroization of temporary variables to the hmac integrity
function FIPSCHECK_verify(). [bsc#1190653]
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:3670-1
Released: Thu Oct 20 10:44:13 2022
Summary: Recommended update for zchunk
Type: recommended
Severity: moderate
References: 1204244
This update for zchunk fixes the following issues:
- Make sure to ship libzck1 to Micro 5.3 (bsc#1204244)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:3683-1
Released: Fri Oct 21 11:48:39 2022
Summary: Security update for libksba
Type: security
Severity: critical
References: 1204357,CVE-2022-3515
This update for libksba fixes the following issues:
- CVE-2022-3515: Fixed a possible overflow in the TLV parser (bsc#1204357).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:3692-1
Released: Fri Oct 21 16:15:07 2022
Summary: Security update for libxml2
Type: security
Severity: important
References: 1204366,1204367,CVE-2022-40303,CVE-2022-40304
This update for libxml2 fixes the following issues:
- CVE-2022-40303: Fixed integer overflows with XML_PARSE_HUGE (bsc#1204366).
- CVE-2022-40304: Fixed dict corruption caused by entity reference cycles (bsc#1204367).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:3750-1
Released: Wed Oct 26 10:45:25 2022
Summary: Maintenance update for SUSE Manager 4.3: Server and Proxy
Type: security
Severity: moderate
References: 1191857,1195624,1196729,1197027,1198168,1198903,1199726,1200480,1200573,1200629,1201210,1201220,1201260,1201589,1201626,1201753,1201788,1201913,1201918,1202271,1202272,1202367,1202455,1202464,1202602,1202728,1202729,1202805,1202899,1203026,1203049,1203056,1203169,1203287,1203288,1203385,1203406,1203422,1203449,1203478,1203484,1203564,1203585,1203611,CVE-2021-41411,CVE-2021-42740,CVE-2021-43138,CVE-2022-0860,CVE-2022-31129
Maintenance update for SUSE Manager 4.3: Server and Proxy
The following package changes have been done:
- libtirpc-netconfig-1.2.6-150300.3.14.1 updated
- glibc-2.31-150300.41.1 updated
- perl-base-5.26.1-150300.17.11.1 updated
- libgcrypt20-1.9.4-150400.6.5.1 updated
- libgcrypt20-hmac-1.9.4-150400.6.5.1 updated
- libsqlite3-0-3.39.3-150000.3.17.1 updated
- libjitterentropy3-3.4.0-150000.1.6.1 added
- libgcc_s1-11.3.0+git1637-150000.1.11.2 updated
- libksba8-1.3.5-150000.4.3.1 updated
- libassuan0-2.5.5-150000.4.3.1 updated
- libstdc++6-11.3.0+git1637-150000.1.11.2 updated
- libxml2-2-2.9.14-150400.5.10.1 updated
- libopenssl1_1-1.1.1l-150400.7.10.5 updated
- libopenssl1_1-hmac-1.1.1l-150400.7.10.5 updated
- libzck1-1.1.16-150400.3.2.1 added
- libtirpc3-1.2.6-150300.3.14.1 updated
- permissions-20201225-150400.5.11.1 updated
- libzypp-17.31.2-150400.3.9.1 updated
- zypper-1.14.57-150400.3.9.1 updated
- aaa_base-84.87+git20180409.04c9dae-150300.10.3.1 updated
- libdevmapper1_03-1.02.163-150400.178.1 updated
- libexpat1-2.4.4-150400.3.9.1 updated
- libpython3_6m1_0-3.6.15-150300.10.30.1 updated
- python3-base-3.6.15-150300.10.30.1 updated
- python3-3.6.15-150300.10.30.1 updated
- python3-uyuni-common-libs-4.3.6-150400.3.6.4 updated
- python3-rpm-4.14.3-150300.49.1 updated
- spacewalk-backend-4.3.16-150400.3.6.8 updated
- python3-libxml2-2.9.14-150400.5.10.1 updated
- python3-spacewalk-client-tools-4.3.12-150400.3.6.6 updated
- spacewalk-client-tools-4.3.12-150400.3.6.6 updated
- susemanager-tftpsync-recv-4.3.7-150400.3.3.3 updated
More information about the sle-updates
mailing list