SUSE Security Update: Security update for mariadb
______________________________________________________________________________

Announcement ID:    SUSE-SU-2020:3625-1
Rating:             important
References:         #1171550 #1175596 #1177472 #1178428 
Cross-References:   CVE-2020-13249 CVE-2020-14765 CVE-2020-14776
                    CVE-2020-14789 CVE-2020-14812 CVE-2020-15180
                    CVE-2020-2752 CVE-2020-2760 CVE-2020-2812
                    CVE-2020-2814
Affected Products:
                    SUSE OpenStack Cloud 7
______________________________________________________________________________

   An update that fixes 10 vulnerabilities is now available.

Description:

   This update for mariadb includes the following fixes:

   Security fixes included in this update:

   - CVE-2020-2752: Fixed an issue which could have resulted in unauthorized
     ability to cause denial of service.
   - CVE-2020-2812: Fixed an issue which could have resulted in unauthorized
     ability to cause denial of service.
   - CVE-2020-2814: Fixed an issue which could have resulted in unauthorized
     ability to cause denial of service.
   - CVE-2020-2760: Fixed an issue which could have resulted in unauthorized
     ability to cause denial of service.
   - CVE-2020-13249: Fixed an improper validation of the content of an OK
     packet received from a server.
   - CVE-2020-14812: Fixed an issue which could have resulted in unauthorized
     ability to cause denial of service.
   - CVE-2020-14765: Fixed an issue which could have resulted in unauthorized
     ability to cause denial of service.
   - CVE-2020-14776: Fixed an issue which could have resulted in unauthorized
     ability of accessing data.
   - CVE-2020-14789: Fixed an issue which could have resulted in unauthorized
     ability to cause denial of service.
   - CVE-2020-15180: Fixed an issue in Galera which could have led to remote
     code execution.


   Non Security fixes included in this update:

   - Update to 10.2.36 GA [bsc#1177472] and [bsc#1178428]
     * release notes and changelog:
       https://mariadb.com/kb/en/mariadb-10236-release-notes/
       https://mariadb.com/kb/en/mariadb-10236-changelog/
       https://mariadb.com/kb/en/mariadb-10235-release-notes/
       https://mariadb.com/kb/en/mariadb-10235-changelog/
       https://mariadb.com/kb/en/mariadb-10234-release-notes/
       https://mariadb.com/kb/en/mariadb-10234-changelog/
     * fixes for the following security vulnerabilities: 10.2.36: none
       10.2.35: CVE-2020-14812, CVE-2020-14765, CVE-2020-14776,
       CVE-2020-14789 10.2.34: CVE-2020-15180
   - update suse_skipped_tests.list

   - Update to 10.2.33 GA [bsc#1175596]
     * release notes and changelog:
       https://mariadb.com/kb/en/mariadb-10233-release-notes/
       https://mariadb.com/kb/en/mariadb-10233-changelog/
     * fixes for the following security vulnerabilities: none
   - refresh mariadb-10.2.4-fortify-and-O.patch
   - tune the testsuite to avoid randomly failing tests
   - update suse_skipped_tests.list

   - Update to 10.2.32 GA [bsc#1171550]
     * Fixes for the following security vulnerabilities: CVE-2020-2752,
       CVE-2020-2812, CVE-2020-2814, CVE-2020-2760, CVE-2020-13249
     * release notes and changelog:
       https://mariadb.com/kb/en/mariadb-10232-release-notes/
       https://mariadb.com/kb/en/mariadb-10232-changelog/
   - refresh mariadb-10.2.4-fortify-and-O.patch
   - drop specfile "hacks" as things work correctly in upstream now:
     * renaming tmpfiles.conf -> mariadb.conf
     * installing pam_user_map.so to /lib64/security for non 32bit
       architectures
     * sysusers.conf was renamed to mariadb.conf
   - update suse_skipped_tests.list


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE OpenStack Cloud 7:

      zypper in -t patch SUSE-OpenStack-Cloud-7-2020-3625=1



Package List:

   - SUSE OpenStack Cloud 7 (aarch64 s390x x86_64):

      mariadb-10.2.36-19.1
      mariadb-client-10.2.36-19.1
      mariadb-client-debuginfo-10.2.36-19.1
      mariadb-debuginfo-10.2.36-19.1
      mariadb-debugsource-10.2.36-19.1
      mariadb-tools-10.2.36-19.1
      mariadb-tools-debuginfo-10.2.36-19.1

   - SUSE OpenStack Cloud 7 (noarch):

      mariadb-errormessages-10.2.36-19.1

   - SUSE OpenStack Cloud 7 (x86_64):

      mariadb-galera-10.2.36-19.1


References:

   https://www.suse.com/security/cve/CVE-2020-13249.html
   https://www.suse.com/security/cve/CVE-2020-14765.html
   https://www.suse.com/security/cve/CVE-2020-14776.html
   https://www.suse.com/security/cve/CVE-2020-14789.html
   https://www.suse.com/security/cve/CVE-2020-14812.html
   https://www.suse.com/security/cve/CVE-2020-15180.html
   https://www.suse.com/security/cve/CVE-2020-2752.html
   https://www.suse.com/security/cve/CVE-2020-2760.html
   https://www.suse.com/security/cve/CVE-2020-2812.html
   https://www.suse.com/security/cve/CVE-2020-2814.html
   https://bugzilla.suse.com/1171550
   https://bugzilla.suse.com/1175596
   https://bugzilla.suse.com/1177472
   https://bugzilla.suse.com/1178428

SUSE: 2020:3625-1 important: mariadb

December 4, 2020
An update that fixes 10 vulnerabilities is now available

Summary

This update for mariadb includes the following fixes: Security fixes included in this update: - CVE-2020-2752: Fixed an issue which could have resulted in unauthorized ability to cause denial of service. - CVE-2020-2812: Fixed an issue which could have resulted in unauthorized ability to cause denial of service. - CVE-2020-2814: Fixed an issue which could have resulted in unauthorized ability to cause denial of service. - CVE-2020-2760: Fixed an issue which could have resulted in unauthorized ability to cause denial of service. - CVE-2020-13249: Fixed an improper validation of the content of an OK packet received from a server. - CVE-2020-14812: Fixed an issue which could have resulted in unauthorized ability to cause denial of service. - CVE-2020-14765: Fixed an issue which could have resulted in unauthorized ability to cause denial of service. - CVE-2020-14776: Fixed an issue which could have resulted in unauthorized ability of accessing data. - CVE-2020-14789: Fixed an issue which could have resulted in unauthorized ability to cause denial of service. - CVE-2020-15180: Fixed an issue in Galera which could have led to remote code execution. Non Security fixes included in this update: - Update to 10.2.36 GA [bsc#1177472] and [bsc#1178428] * release notes and changelog: https://mariadb.com/kb/en/mariadb-10236-release-notes/ https://mariadb.com/kb/en/mariadb-10236-changelog/ https://mariadb.com/kb/en/mariadb-10235-release-notes/ https://mariadb.com/kb/en/mariadb-10235-changelog/ https://mariadb.com/kb/en/mariadb-10234-release-notes/ https://mariadb.com/kb/en/mariadb-10234-changelog/ * fixes for the following security vulnerabilities: 10.2.36: none 10.2.35: CVE-2020-14812, CVE-2020-14765, CVE-2020-14776, CVE-2020-14789 10.2.34: CVE-2020-15180 - update suse_skipped_tests.list - Update to 10.2.33 GA [bsc#1175596] * release notes and changelog: https://mariadb.com/kb/en/mariadb-10233-release-notes/ https://mariadb.com/kb/en/mariadb-10233-changelog/ * fixes for the following security vulnerabilities: none - refresh mariadb-10.2.4-fortify-and-O.patch - tune the testsuite to avoid randomly failing tests - update suse_skipped_tests.list - Update to 10.2.32 GA [bsc#1171550] * Fixes for the following security vulnerabilities: CVE-2020-2752, CVE-2020-2812, CVE-2020-2814, CVE-2020-2760, CVE-2020-13249 * release notes and changelog: https://mariadb.com/kb/en/mariadb-10232-release-notes/ https://mariadb.com/kb/en/mariadb-10232-changelog/ - refresh mariadb-10.2.4-fortify-and-O.patch - drop specfile "hacks" as things work correctly in upstream now: * renaming tmpfiles.conf -> mariadb.conf * installing pam_user_map.so to /lib64/security for non 32bit architectures * sysusers.conf was renamed to mariadb.conf - update suse_skipped_tests.list Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 7: zypper in -t patch SUSE-OpenStack-Cloud-7-2020-3625=1 Package List: - SUSE OpenStack Cloud 7 (aarch64 s390x x86_64): mariadb-10.2.36-19.1 mariadb-client-10.2.36-19.1 mariadb-client-debuginfo-10.2.36-19.1 mariadb-debuginfo-10.2.36-19.1 mariadb-debugsource-10.2.36-19.1 mariadb-tools-10.2.36-19.1 mariadb-tools-debuginfo-10.2.36-19.1 - SUSE OpenStack Cloud 7 (noarch): mariadb-errormessages-10.2.36-19.1 - SUSE OpenStack Cloud 7 (x86_64): mariadb-galera-10.2.36-19.1

References

#1171550 #1175596 #1177472 #1178428

Cross- CVE-2020-13249 CVE-2020-14765 CVE-2020-14776

CVE-2020-14789 CVE-2020-14812 CVE-2020-15180

CVE-2020-2752 CVE-2020-2760 CVE-2020-2812

CVE-2020-2814

Affected Products:

SUSE OpenStack Cloud 7

https://www.suse.com/security/cve/CVE-2020-13249.html

https://www.suse.com/security/cve/CVE-2020-14765.html

https://www.suse.com/security/cve/CVE-2020-14776.html

https://www.suse.com/security/cve/CVE-2020-14789.html

https://www.suse.com/security/cve/CVE-2020-14812.html

https://www.suse.com/security/cve/CVE-2020-15180.html

https://www.suse.com/security/cve/CVE-2020-2752.html

https://www.suse.com/security/cve/CVE-2020-2760.html

https://www.suse.com/security/cve/CVE-2020-2812.html

https://www.suse.com/security/cve/CVE-2020-2814.html

https://bugzilla.suse.com/1171550

https://bugzilla.suse.com/1175596

https://bugzilla.suse.com/1177472

https://bugzilla.suse.com/1178428

Severity
Announcement ID: SUSE-SU-2020:3625-1
Rating: important

Related News

CISA Sounds Alarm on Newly Exploited Vulnerabilities: Is Your System at Risk?
3 - 5 min read
CISA regularly publishes updates regarding vulnerabilities that present severe threats to global cybersecurity. Recently, CISA added three
Navigating the Linux Kernel
2 - 4 min read
The Linux operating system, widely acclaimed for its robustness and security , recently received widespread media attention due to a significant
Defending Against Remote Code Execution in Google Chrome: A Critical Update
2 - 3 min read
Google Chrome, a widely used web browser, serves millions of internet users by connecting them to the online world. Unfortunately, severe
Staying a Step Ahead of Adversaries: Mitigating Chromium
2 - 4 min read
Google Chrome, one of the world's most widely used web browsers, has recently been scrutinized due to the discovery of multiple Chromium
Unmasking Cicada3301: Examining the Threat of the New Rust-Based Ransomware
2 - 4 min read
Ransomware has long been a severe threat to organizations and admins alike. Recently, cybersecurity researchers discovered a new variant called
Buffer Overflow Exploits in Linux: Origins, Impact, and Countermeasures
3 - 6 min read
Buffer overflow vulnerabilities have long been one of the biggest headaches in computer security, especially on Linux operating systems that power
8 Expert-Recommended Security Practices to Fortify Your Linux Systems
4 - 8 min read
As a Linux admin or an infosec professional, you understand how the security landscape changes due to evolving threats, newly discovered
Open Source Strategies for Enhancing Security in Digital Business Operations
5 - 9 min read
Digital transformation, powered by the principles of open-source security , is vital for businesses looking to excel in today's technology-driven

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved