SUSE-CU-2023:2343-1: Security update of rancher/elemental-teal-iso/5.3

sle-updates at lists.suse.com sle-updates at lists.suse.com
Thu Jul 20 07:02:30 UTC 2023


SUSE Container Update Advisory: rancher/elemental-teal-iso/5.3
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2023:2343-1
Container Tags        : rancher/elemental-teal-iso/5.3:1.1.5 , rancher/elemental-teal-iso/5.3:1.1.5-3.5.21 , rancher/elemental-teal-iso/5.3:latest
Container Release     : 3.5.21
Severity              : important
Type                  : security
References            : 1201627 1203141 1206513 1207410 1207534 1209713 1209714 1209918
                        1210135 1210164 1210411 1210412 1210434 1210507 1210593 1211230
                        1211231 1211232 1211233 1211430 1211795 1212260 1212623 CVE-2022-4304
                        CVE-2023-24593 CVE-2023-25180 CVE-2023-2650 CVE-2023-28319 CVE-2023-28320
                        CVE-2023-28321 CVE-2023-28322 CVE-2023-28484 CVE-2023-29383 CVE-2023-29469
                        CVE-2023-29491 CVE-2023-2953 
-----------------------------------------------------------------

The container rancher/elemental-teal-iso/5.3 was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:2053-1
Released:    Thu Apr 27 11:31:08 2023
Summary:     Security update for libxml2
Type:        security
Severity:    moderate
References:  1209918,1210411,1210412,CVE-2023-28484,CVE-2023-29469
This update for libxml2 fixes the following issues:

- CVE-2023-29469: Fixed inconsistent result when hashing empty strings (bsc#1210412).
- CVE-2023-28484: Fixed NULL pointer dereference in xmlSchemaFixupComplexType (bsc#1210411).

The following non-security bug was fixed:

- Remove unneeded dependency (bsc#1209918). 

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:2060-1
Released:    Thu Apr 27 17:04:25 2023
Summary:     Security update for glib2
Type:        security
Severity:    moderate
References:  1209713,1209714,1210135,CVE-2023-24593,CVE-2023-25180
This update for glib2 fixes the following issues:

- CVE-2023-24593: Fixed a denial of service caused by handling a malicious text-form variant (bsc#1209714).
- CVE-2023-25180: Fixed a denial of service caused by malicious serialised variant (bsc#1209713).

The following non-security bug was fixed:

- Fixed regression on s390x (bsc#1210135, glgo#GNOME/glib!2978).

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:2066-1
Released:    Fri Apr 28 13:54:17 2023
Summary:     Security update for shadow
Type:        security
Severity:    moderate
References:  1210507,CVE-2023-29383
This update for shadow fixes the following issues:

- CVE-2023-29383: Fixed apparent /etc/shadow manipulation via chfn (bsc#1210507).

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:2111-1
Released:    Fri May  5 14:34:00 2023
Summary:     Security update for ncurses
Type:        security
Severity:    moderate
References:  1210434,CVE-2023-29491
This update for ncurses fixes the following issues:

- CVE-2023-29491: Fixed memory corruption issues when processing malformed terminfo data (bsc#1210434).

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:2133-1
Released:    Tue May  9 13:37:10 2023
Summary:     Recommended update for zlib
Type:        recommended
Severity:    moderate
References:  1206513
This update for zlib fixes the following issues:

- Add DFLTCC support for using inflate() with a small window (bsc#1206513)

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:2224-1
Released:    Wed May 17 09:53:54 2023
Summary:     Security update for curl
Type:        security
Severity:    important
References:  1211230,1211231,1211232,1211233,CVE-2023-28319,CVE-2023-28320,CVE-2023-28321,CVE-2023-28322
This update for curl adds the following feature:

Update to version 8.0.1 (jsc#PED-2580)

- CVE-2023-28319: use-after-free in SSH sha256 fingerprint check (bsc#1211230).
- CVE-2023-28320: siglongjmp race condition (bsc#1211231).
- CVE-2023-28321: IDN wildcard matching (bsc#1211232).
- CVE-2023-28322: POST-after-PUT confusion (bsc#1211233).

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:2240-1
Released:    Wed May 17 19:56:54 2023
Summary:     Recommended update for systemd
Type:        recommended
Severity:    moderate
References:  1203141,1207410
This update for systemd fixes the following issues:

- udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410)
- Optimize when hundred workers claim the same symlink with the same priority (bsc#1203141)
- Add nss-resolve and systemd-network to Packagehub-Subpackages (MSC-626)

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:2317-1
Released:    Tue May 30 14:01:22 2023
Summary:     Recommended update for util-linux
Type:        recommended
Severity:    moderate
References:  1210164
This update for util-linux fixes the following issue:

- Add upstream patch to prevent possible performance degradation of libuuid (bsc#1210164)

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:2333-1
Released:    Wed May 31 09:01:28 2023
Summary:     Recommended update for zlib
Type:        recommended
Severity:    moderate
References:  1210593
This update for zlib fixes the following issue:

- Fix function calling order to avoid crashes (bsc#1210593)

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:2342-1
Released:    Thu Jun  1 11:34:20 2023
Summary:     Security update for openssl-1_1
Type:        security
Severity:    important
References:  1211430,CVE-2023-2650
This update for openssl-1_1 fixes the following issues:

- CVE-2023-2650: Fixed possible denial of service translating ASN.1 object identifiers (bsc#1211430).

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:2484-1
Released:    Mon Jun 12 08:49:58 2023
Summary:     Security update for openldap2
Type:        security
Severity:    moderate
References:  1211795,CVE-2023-2953
This update for openldap2 fixes the following issues:

- CVE-2023-2953: Fixed null pointer deref in ber_memalloc_x (bsc#1211795).

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:2625-1
Released:    Fri Jun 23 17:16:11 2023
Summary:     Recommended update for gcc12
Type:        recommended
Severity:    moderate
References:  
This update for gcc12 fixes the following issues:

- Update to GCC 12.3 release, 0c61aa720e62f1baf0bfd178e283, git1204

  * includes regression and other bug fixes

- Speed up builds with --enable-link-serialization.

- Update embedded newlib to version 4.2.0

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:2648-1
Released:    Tue Jun 27 09:52:35 2023
Summary:     Security update for openssl-1_1
Type:        security
Severity:    moderate
References:  1201627,1207534,CVE-2022-4304
This update for openssl-1_1 fixes the following issues:

- CVE-2022-4304: Reworked the fix for the Timing-Oracle in RSA decryption.
  The previous fix for this timing side channel turned out to cause a
  severe 2-3x performance regression in the typical use case (bsc#1207534).

- Update further expiring certificates that affect the testsuite (bsc#1201627).

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:2800-1
Released:    Mon Jul 10 07:35:22 2023
Summary:     Recommended update for openssl-1_1
Type:        recommended
Severity:    moderate
References:  1212623
This update for openssl-1_1 fixes the following issues:

- Check the OCSP RESPONSE in openssl s_client command and terminate
  connection if a revoked certificate is found. [bsc#1212623]

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:2827-1
Released:    Fri Jul 14 11:27:47 2023
Summary:     Recommended update for libxml2
Type:        recommended
Severity:    moderate
References:  
This update for libxml2 fixes the following issues:

- Build also for modern python version (jsc#PED-68)

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:2855-1
Released:    Mon Jul 17 16:35:21 2023
Summary:     Recommended update for openldap2
Type:        recommended
Severity:    moderate
References:  1212260
This update for openldap2 fixes the following issues:

- libldap2 crashes on ldap_sasl_bind_s (bsc#1212260)


The following package changes have been done:

- libldap-data-2.4.46-150200.14.17.1 updated
- libuuid1-2.37.2-150400.8.17.1 updated
- libudev1-249.16-150400.8.28.3 updated
- libsmartcols1-2.37.2-150400.8.17.1 updated
- libcap2-2.63-150400.3.3.1 updated
- libblkid1-2.37.2-150400.8.17.1 updated
- libaudit1-3.0.6-150400.4.10.1 updated
- libfdisk1-2.37.2-150400.8.17.1 updated
- libz1-1.2.11-150000.3.45.1 updated
- libgcc_s1-12.3.0+git1204-150000.1.10.1 updated
- libstdc++6-12.3.0+git1204-150000.1.10.1 updated
- libncurses6-6.1-150000.5.15.1 updated
- terminfo-base-6.1-150000.5.15.1 updated
- ncurses-utils-6.1-150000.5.15.1 updated
- libglib-2_0-0-2.70.5-150400.3.8.1 updated
- libxml2-2-2.9.14-150400.5.19.1 updated
- libsystemd0-249.16-150400.8.28.3 updated
- libopenssl1_1-1.1.1l-150400.7.45.1 updated
- libopenssl1_1-hmac-1.1.1l-150400.7.45.1 updated
- libldap-2_4-2-2.4.46-150200.14.17.1 updated
- libmount1-2.37.2-150400.8.17.1 updated
- login_defs-4.8.1-150400.10.6.1 updated
- libcurl4-8.0.1-150400.5.23.1 updated
- shadow-4.8.1-150400.10.6.1 updated
- util-linux-2.37.2-150400.8.17.1 updated
- systemd-rpm-macros-11-7.27.1 updated
- container:rancher-elemental-teal-5.3-latest-- updated
- container:rancher-elemental-builder-image-5.3-latest-- updated
- container:bci-bci-busybox-latest-- added


More information about the sle-updates mailing list