openSUSE Security Update: Security update for otrs______________________________________________________________________________

Announcement ID:    openSUSE-SU-2017:3054-1
Rating:             important
References:         #1068677 #1069391 
Cross-References:   CVE-2017-15864 CVE-2017-16664
Affected Products:
                    openSUSE Leap 42.3
                    openSUSE Leap 42.2
______________________________________________________________________________

   An update that fixes two vulnerabilities is now available.

Description:

   This update for otrs fixes the following security issues:

   - CVE-2017-15864: Remote authenticated attackers could have caused otrs to
     disclose configuration information, including database credentials
     (boo#1068677, OSA-2017-06)
   - CVE-2017-16664: Remote authenticated attackers could have caused the
     execution of shell commands with the permission of the web server user
     (boo#1069391, OSA-2017-07)


Patch Instructions:

   To install this openSUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - openSUSE Leap 42.3:

      zypper in -t patch openSUSE-2017-1291=1

   - openSUSE Leap 42.2:

      zypper in -t patch openSUSE-2017-1291=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - openSUSE Leap 42.3 (noarch):

      otrs-3.3.20-14.1
      otrs-doc-3.3.20-14.1
      otrs-itsm-3.3.14-14.1

   - openSUSE Leap 42.2 (noarch):

      otrs-3.3.20-5.11.1
      otrs-doc-3.3.20-5.11.1
      otrs-itsm-3.3.14-5.11.1


References:

   https://www.suse.com/security/cve/CVE-2017-15864.html
   https://www.suse.com/security/cve/CVE-2017-16664.html
   https://bugzilla.suse.com/1068677
   https://bugzilla.suse.com/1069391