Alerts This Week
Warning Icon 1 700
Alerts This Week
Warning Icon 1 700

openSUSE 15.2: 2021:0410-1 Important Fix for Crmsh DoS Issues

opensuse
Calendar Grey March 14, 2021
Dist Opensuse Esm H88
The latest release of crmsh addresses a pair of security flaws and incorporates seven critical patches designed to improve system integrity.
An update that solves two vulnerabilities and has 7 fixes is now available

Description

This update for crmsh fixes the following issues:

- Update to version 4.3.0+20210305.9db5c9a8:

* Fix: bootstrap: Adjust qdevice configure/remove process to avoid race

condition due to quorum lost(bsc#1181415)

* Dev: cibconfig: remove related code about detecting crm_diff support

--no-verion

* Fix: ui_configure: raise error when params not exist(bsc#1180126)

* Dev: doc: remove doc for crm node status

* Dev: ui_node: remove status subcommand

- Update to version 4.3.0+20210219.5d1bf034:

* Fix: hb_report: walk through hb_report process under

hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)

* Fix: bootstrap: setup authorized ssh access for

hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)

* Dev: analyze: Add analyze sublevel and put preflight_check in

it(jsc#ECO-1658)

* Dev: utils: change default file mod as 644 for str2file function

* Dev: hb_report: Detect...

Read the Full Advisory

Patch

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods

like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.2:

zypper in -t patch openSUSE-2021-410=1

Package List

- openSUSE Leap 15.2 (noarch):

crmsh-4.3.0+20210305.9db5c9a8-lp152.4.47.1

crmsh-scripts-4.3.0+20210305.9db5c9a8-lp152.4.47.1

crmsh-test-4.3.0+20210305.9db5c9a8-lp152.4.47.1

References

https://www.suse.com/security/cve/CVE-2020-35459.html

https://www.suse.com/security/cve/CVE-2021-3020.html

https://bugzilla.suse.com/1154927

https://bugzilla.suse.com/1178454

https://bugzilla.suse.com/1178869

https://bugzilla.suse.com/1179999

https://bugzilla.suse.com/1180126

https://bugzilla.suse.com/1180137

https://bugzilla.suse.com/1180571

https://bugzilla.suse.com/1180688

https://bugzilla.suse.com/1181415

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: openSUSE-SU-2021:0410-1
Rating: important
Affected Products: openSUSE Leap 15.2 ble.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here