Alerts This Week
Warning Icon 1 537
Alerts This Week
Warning Icon 1 537

openSUSE: 2022:0016-1 Important: Watchman Local Escalation Fix

opensuse
Calendar Grey January 17, 2022
Dist Opensuse Esm H88
A vital Fedora patch for auditd tackles significant vulnerabilities, notably remote code execution threats.
An update that solves one vulnerability and has one errata is now available

Description

This update for watchman fixes the following issues:

- ship README.suse that explains how to use the template systemd units

- add user writable bit for systemd service and socket files

- properly handle state directory creation in /run/watchman/$USER-state.

The former approach was susceptible to a local privilege escalation

using symlinks (CVE-2022-21944, boo#1194470).

- Added hardening to systemd service(s) (boo#1181400). Modified:

* watchman@.service

- removed python2 bindings

- enabled python3 bindings as python3-watchman

- Changes in 4.8.0:

* New command `flush-subscriptions` to synchronize subscriptions

associated with the current session.

* Enforce socket Unix groups more strongly ??? Watchman will now

refuse to start if it couldn't gain the right group memberships, as

can happen for sites that are experiencing intermittent LDAP

connectivity problems.

* pywatchman now officially...

Read the Full Advisory

Patch

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods

like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Backports SLE-15-SP3:

zypper in -t patch openSUSE-2022-16=1

Package List

- openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64):

python3-watchman-1.4.0-bp153.2.3.1

watchman-4.9.0-bp153.2.3.1

References

https://www.suse.com/security/cve/CVE-2022-21944.html

https://bugzilla.suse.com/1181400

https://bugzilla.suse.com/1194470

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: openSUSE-SU-2022:0016-1
Rating: important
Affected Products: openSUSE Backports SLE-15-SP3 ble.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here