SUSE-CU-2023:727-1: Recommended update of suse/sle15

Sat Mar 18 08:07:34 UTC 2023

SUSE Container Update Advisory: suse/sle15
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2023:727-1
Container Tags        : bci/bci-base:15.4 , bci/bci-base:15.4.27.14.41 , suse/sle15:15.4 , suse/sle15:15.4.27.14.41
Container Release     : 27.14.41
Severity              : important
Type                  : recommended
References            : 1178233 1203248 1203249 1203715 1204548 1204956 1205570 1205636
                        1206949 1208924 1208925 1208926 1208998 
-----------------------------------------------------------------

The container suse/sle15 was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:776-1
Released:    Thu Mar 16 17:29:23 2023
Summary:     Recommended update for gcc12
Type:        recommended
Severity:    moderate
References:  
This update for gcc12 fixes the following issues:

This update ships gcc12 also to the SUSE Linux Enterprise 15 SP1 LTSS and 15 SP2 LTSS products.

SUSE Linux Enterprise 15 SP3 and SP4 get only refreshed builds without changes

This update ship the GCC 12 compiler suite and its base libraries.

The compiler baselibraries are provided for all SUSE Linux Enterprise 15
versions and replace the same named GCC 11 ones.

The new compilers for C, C++, and Fortran are provided in the SUSE Linux
Enterprise Module for Development Tools.

To use gcc12 compilers use:

- install 'gcc12' or 'gcc12-c++' or one of the other 'gcc12-COMPILER' frontend packages.
- override your makefile to use CC=gcc12, CXX=g++12 and similar overrides for the other languages.

For a full changelog with all new GCC12 features, check out

	https://gcc.gnu.org/gcc-12/changes.html

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:782-1
Released:    Thu Mar 16 19:08:34 2023
Summary:     Recommended update for libgcrypt
Type:        recommended
Severity:    moderate
References:  1208924,1208925,1208926
This update for libgcrypt fixes the following issues:

- FIPS: ECC: Transition to error-state if PCT fail [bsc#1208925]
- FIPS: ECDSA: Avoid no-keytest in ECDSA keygen [bsc#1208924]
- FIPS: PBKDF2: Added additional checks for the minimum key length,
  salt length, iteration count and passphrase length to the kdf
  FIPS indicator in _gcry_fips_indicator_kdf() [bsc#1208926]

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:783-1
Released:    Thu Mar 16 19:09:03 2023
Summary:     Recommended update for openssl-1_1
Type:        recommended
Severity:    moderate
References:  1208998
This update for openssl-1_1 fixes the following issues:

FIPS: Service-level indicator changes [bsc#1208998]

* Add additional checks required by FIPS 140-3. Minimum values for
  PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for
  iteration count and 20 characters for password.

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:788-1
Released:    Thu Mar 16 19:37:59 2023
Summary:     Recommended update for libsolv, libzypp, zypper
Type:        recommended
Severity:    important
References:  1178233,1203248,1203249,1203715,1204548,1204956,1205570,1205636,1206949
This update for libsolv, libzypp, zypper fixes the following issues:

libsolv:

- Do not autouninstall SUSE PTF packages
- Ensure 'duplinvolvedmap_all' is reset when a solver is reused
- Fix 'keep installed' jobs not disabling 'best update' rules
- New '-P' and '-W' options for `testsolv`
- New introspection interface for weak dependencies similar to ruleinfos
- Ensure special case file dependencies are written correctly in the testcase writer
- Support better info about alternatives
- Support decision reason queries
- Support merging of related decisions
- Support stringification of multiple solvables
- Support stringification of ruleinfo, decisioninfo and decision reasons

libzypp:

- Avoid calling getsockopt when we know the info already.
  This patch should fix logging on WSL, getsockopt seems to not be fully supported but the code required it when
  accepting new socket connections (bsc#1178233)
- Avoid redirecting 'history.logfile=/dev/null' into the target
- Create '.no_auto_prune' in the package cache dir to prevent auto cleanup of orphaned repositories (bsc#1204956)
- Enhance yaml-cpp detection
- Improve download of optional files
- MultiCurl: Make sure to reset the progress function when falling back.
- Properly reset range requests (bsc#1204548)
- Removing a PTF without enabled repos should always fail (bsc#1203248)
  Without enabled repos, the dependent PTF-packages would be removed (not replaced!) as well. 
  To remove a PTF `zypper install -- -PTF` or a dedicated `zypper removeptf PTF` should be used. This will update the
  installed PTF packages to theit latest version.
- Skip media.1/media download for http repo status calc.
  This patch allows zypp to skip a extra media.1/media download to calculate if a repository needs to be refreshed.
  This optimisation only takes place if the repo does specify only downloading base urls.
- Use a dynamic fallback for BLKSIZE in downloads.
  When not receiving a blocklist via metalink file from the server MediaMultiCurl used to fallback to a fixed,
  relatively small BLKSIZE. This patch changes the fallback into a dynamic value based on the filesize using a similar
  metric as the MirrorCache implementation on the server side.
- ProgressData: enforce reporting the INIT||END state (bsc#1206949)
- ps: fix service detection on newer Tumbleweed systems (bsc#1205636)

zypper:

- Allow to (re)add a service with the same URL (bsc#1203715)
- Bump dependency requirement to libzypp-devel 17.31.7 or greater
- Explain outdatedness of repositories
- patterns: Avoid dispylaing superfluous @System entries (bsc#1205570)
- Provide `removeptf` command (bsc#1203249)
  A remove command which prefers replacing dependant packages to removing them as well.
  A PTF is typically removed as soon as the fix it provides is applied to the latest official update of the dependant
  packages. However it is not desired for the dependant packages to be removed together with the PTF, which is what the
  remove command would do. The `removeptf` command however will aim to replace the dependant packages by their official
  update versions.
- Update man page and explain '.no_auto_prune' (bsc#1204956)

The following package changes have been done:

- libgcc_s1-12.2.1+git416-150000.1.7.1 updated
- libgcrypt20-hmac-1.9.4-150400.6.8.1 updated
- libgcrypt20-1.9.4-150400.6.8.1 updated
- libopenssl1_1-hmac-1.1.1l-150400.7.28.1 updated
- libopenssl1_1-1.1.1l-150400.7.28.1 updated
- libsolv-tools-0.7.23-150400.3.3.1 updated
- libstdc++6-12.2.1+git416-150000.1.7.1 updated
- libzypp-17.31.8-150400.3.14.1 updated
- openssl-1_1-1.1.1l-150400.7.28.1 updated
- zypper-1.14.59-150400.3.12.2 updated