openSUSE Security Update: Security update for froxlor

Announcement ID:    openSUSE-SU-2021:0450-1
Rating:             moderate
References:         #1025193 #1082318 #846355 #958100 
Cross-References:   CVE-2016-5100
CVSS scores:
                    CVE-2016-5100 (NVD) : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products:
                    openSUSE Backports SLE-15-SP2

   An update that solves one vulnerability and has three fixes
   is now available.


   This update for froxlor fixes the following issues:

   - Upstream upgrade to version 0.10.23 (boo#846355)
   - Upstream upgrade to version 0.10.22 (boo#846355)

   - BuildRequire cron as this contains now the cron directories
   - Use %license for COPYING file instead of %doc [boo#1082318]

   Upstream upgrade to version (boo#846355)

   new features besides API that found their way in:

   - 2FA / TwoFactor Authentication for accounts
   - MySQL8 compatibility
   - new implementation of Let's Encrypt (
   - customizable error/access log handling for webserver (format, level,
     pipe-to-script, etc.)
   - lots and lots of bugfixes and small enhancements

   Upstream upgrade to version (boo#846355)

   - PHP rand function for random number generation fixed in previous version
     (boo#1025193) CVE-2016-5100
   - upstream upgrade to version 0.9.39 (boo#846355)
   - Add and change of froxlor config files and manual
   - Change Requires to enable use with php7 This update was imported from
     the openSUSE:Leap:15.2:Update update project.

Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Backports SLE-15-SP2:

      zypper in -t patch openSUSE-2021-450=1

Package List:

   - openSUSE Backports SLE-15-SP2 (noarch):