SUSE Security Update: Security update for mariadb
______________________________________________________________________________

Announcement ID:    SUSE-SU-2020:3625-1
Rating:             important
References:         #1171550 #1175596 #1177472 #1178428 
Cross-References:   CVE-2020-13249 CVE-2020-14765 CVE-2020-14776
                    CVE-2020-14789 CVE-2020-14812 CVE-2020-15180
                    CVE-2020-2752 CVE-2020-2760 CVE-2020-2812
                    CVE-2020-2814
Affected Products:
                    SUSE OpenStack Cloud 7
______________________________________________________________________________

   An update that fixes 10 vulnerabilities is now available.

Description:

   This update for mariadb includes the following fixes:

   Security fixes included in this update:

   - CVE-2020-2752: Fixed an issue which could have resulted in unauthorized
     ability to cause denial of service.
   - CVE-2020-2812: Fixed an issue which could have resulted in unauthorized
     ability to cause denial of service.
   - CVE-2020-2814: Fixed an issue which could have resulted in unauthorized
     ability to cause denial of service.
   - CVE-2020-2760: Fixed an issue which could have resulted in unauthorized
     ability to cause denial of service.
   - CVE-2020-13249: Fixed an improper validation of the content of an OK
     packet received from a server.
   - CVE-2020-14812: Fixed an issue which could have resulted in unauthorized
     ability to cause denial of service.
   - CVE-2020-14765: Fixed an issue which could have resulted in unauthorized
     ability to cause denial of service.
   - CVE-2020-14776: Fixed an issue which could have resulted in unauthorized
     ability of accessing data.
   - CVE-2020-14789: Fixed an issue which could have resulted in unauthorized
     ability to cause denial of service.
   - CVE-2020-15180: Fixed an issue in Galera which could have led to remote
     code execution.


   Non Security fixes included in this update:

   - Update to 10.2.36 GA [bsc#1177472] and [bsc#1178428]
     * release notes and changelog:
       https://mariadb.com/kb/en/mariadb-10236-release-notes/
       https://mariadb.com/kb/en/mariadb-10236-changelog/
       https://mariadb.com/kb/en/mariadb-10235-release-notes/
       https://mariadb.com/kb/en/mariadb-10235-changelog/
       https://mariadb.com/kb/en/mariadb-10234-release-notes/
       https://mariadb.com/kb/en/mariadb-10234-changelog/
     * fixes for the following security vulnerabilities: 10.2.36: none
       10.2.35: CVE-2020-14812, CVE-2020-14765, CVE-2020-14776,
       CVE-2020-14789 10.2.34: CVE-2020-15180
   - update suse_skipped_tests.list

   - Update to 10.2.33 GA [bsc#1175596]
     * release notes and changelog:
       https://mariadb.com/kb/en/mariadb-10233-release-notes/
       https://mariadb.com/kb/en/mariadb-10233-changelog/
     * fixes for the following security vulnerabilities: none
   - refresh mariadb-10.2.4-fortify-and-O.patch
   - tune the testsuite to avoid randomly failing tests
   - update suse_skipped_tests.list

   - Update to 10.2.32 GA [bsc#1171550]
     * Fixes for the following security vulnerabilities: CVE-2020-2752,
       CVE-2020-2812, CVE-2020-2814, CVE-2020-2760, CVE-2020-13249
     * release notes and changelog:
       https://mariadb.com/kb/en/mariadb-10232-release-notes/
       https://mariadb.com/kb/en/mariadb-10232-changelog/
   - refresh mariadb-10.2.4-fortify-and-O.patch
   - drop specfile "hacks" as things work correctly in upstream now:
     * renaming tmpfiles.conf -> mariadb.conf
     * installing pam_user_map.so to /lib64/security for non 32bit
       architectures
     * sysusers.conf was renamed to mariadb.conf
   - update suse_skipped_tests.list


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE OpenStack Cloud 7:

      zypper in -t patch SUSE-OpenStack-Cloud-7-2020-3625=1



Package List:

   - SUSE OpenStack Cloud 7 (aarch64 s390x x86_64):

      mariadb-10.2.36-19.1
      mariadb-client-10.2.36-19.1
      mariadb-client-debuginfo-10.2.36-19.1
      mariadb-debuginfo-10.2.36-19.1
      mariadb-debugsource-10.2.36-19.1
      mariadb-tools-10.2.36-19.1
      mariadb-tools-debuginfo-10.2.36-19.1

   - SUSE OpenStack Cloud 7 (noarch):

      mariadb-errormessages-10.2.36-19.1

   - SUSE OpenStack Cloud 7 (x86_64):

      mariadb-galera-10.2.36-19.1


References:

   https://www.suse.com/security/cve/CVE-2020-13249.html
   https://www.suse.com/security/cve/CVE-2020-14765.html
   https://www.suse.com/security/cve/CVE-2020-14776.html
   https://www.suse.com/security/cve/CVE-2020-14789.html
   https://www.suse.com/security/cve/CVE-2020-14812.html
   https://www.suse.com/security/cve/CVE-2020-15180.html
   https://www.suse.com/security/cve/CVE-2020-2752.html
   https://www.suse.com/security/cve/CVE-2020-2760.html
   https://www.suse.com/security/cve/CVE-2020-2812.html
   https://www.suse.com/security/cve/CVE-2020-2814.html
   https://bugzilla.suse.com/1171550
   https://bugzilla.suse.com/1175596
   https://bugzilla.suse.com/1177472
   https://bugzilla.suse.com/1178428

SUSE: 2020:3625-1 important: mariadb

December 4, 2020
An update that fixes 10 vulnerabilities is now available

Summary

This update for mariadb includes the following fixes: Security fixes included in this update: - CVE-2020-2752: Fixed an issue which could have resulted in unauthorized ability to cause denial of service. - CVE-2020-2812: Fixed an issue which could have resulted in unauthorized ability to cause denial of service. - CVE-2020-2814: Fixed an issue which could have resulted in unauthorized ability to cause denial of service. - CVE-2020-2760: Fixed an issue which could have resulted in unauthorized ability to cause denial of service. - CVE-2020-13249: Fixed an improper validation of the content of an OK packet received from a server. - CVE-2020-14812: Fixed an issue which could have resulted in unauthorized ability to cause denial of service. - CVE-2020-14765: Fixed an issue which could have resulted in unauthorized ability to cause denial of service. - CVE-2020-14776: Fixed an issue which could have resulted in unauthorized ability of accessing data. - CVE-2020-14789: Fixed an issue which could have resulted in unauthorized ability to cause denial of service. - CVE-2020-15180: Fixed an issue in Galera which could have led to remote code execution. Non Security fixes included in this update: - Update to 10.2.36 GA [bsc#1177472] and [bsc#1178428] * release notes and changelog: https://mariadb.com/kb/en/mariadb-10236-release-notes/ https://mariadb.com/kb/en/mariadb-10236-changelog/ https://mariadb.com/kb/en/mariadb-10235-release-notes/ https://mariadb.com/kb/en/mariadb-10235-changelog/ https://mariadb.com/kb/en/mariadb-10234-release-notes/ https://mariadb.com/kb/en/mariadb-10234-changelog/ * fixes for the following security vulnerabilities: 10.2.36: none 10.2.35: CVE-2020-14812, CVE-2020-14765, CVE-2020-14776, CVE-2020-14789 10.2.34: CVE-2020-15180 - update suse_skipped_tests.list - Update to 10.2.33 GA [bsc#1175596] * release notes and changelog: https://mariadb.com/kb/en/mariadb-10233-release-notes/ https://mariadb.com/kb/en/mariadb-10233-changelog/ * fixes for the following security vulnerabilities: none - refresh mariadb-10.2.4-fortify-and-O.patch - tune the testsuite to avoid randomly failing tests - update suse_skipped_tests.list - Update to 10.2.32 GA [bsc#1171550] * Fixes for the following security vulnerabilities: CVE-2020-2752, CVE-2020-2812, CVE-2020-2814, CVE-2020-2760, CVE-2020-13249 * release notes and changelog: https://mariadb.com/kb/en/mariadb-10232-release-notes/ https://mariadb.com/kb/en/mariadb-10232-changelog/ - refresh mariadb-10.2.4-fortify-and-O.patch - drop specfile "hacks" as things work correctly in upstream now: * renaming tmpfiles.conf -> mariadb.conf * installing pam_user_map.so to /lib64/security for non 32bit architectures * sysusers.conf was renamed to mariadb.conf - update suse_skipped_tests.list Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 7: zypper in -t patch SUSE-OpenStack-Cloud-7-2020-3625=1 Package List: - SUSE OpenStack Cloud 7 (aarch64 s390x x86_64): mariadb-10.2.36-19.1 mariadb-client-10.2.36-19.1 mariadb-client-debuginfo-10.2.36-19.1 mariadb-debuginfo-10.2.36-19.1 mariadb-debugsource-10.2.36-19.1 mariadb-tools-10.2.36-19.1 mariadb-tools-debuginfo-10.2.36-19.1 - SUSE OpenStack Cloud 7 (noarch): mariadb-errormessages-10.2.36-19.1 - SUSE OpenStack Cloud 7 (x86_64): mariadb-galera-10.2.36-19.1

References

#1171550 #1175596 #1177472 #1178428

Cross- CVE-2020-13249 CVE-2020-14765 CVE-2020-14776

CVE-2020-14789 CVE-2020-14812 CVE-2020-15180

CVE-2020-2752 CVE-2020-2760 CVE-2020-2812

CVE-2020-2814

Affected Products:

SUSE OpenStack Cloud 7

https://www.suse.com/security/cve/CVE-2020-13249.html

https://www.suse.com/security/cve/CVE-2020-14765.html

https://www.suse.com/security/cve/CVE-2020-14776.html

https://www.suse.com/security/cve/CVE-2020-14789.html

https://www.suse.com/security/cve/CVE-2020-14812.html

https://www.suse.com/security/cve/CVE-2020-15180.html

https://www.suse.com/security/cve/CVE-2020-2752.html

https://www.suse.com/security/cve/CVE-2020-2760.html

https://www.suse.com/security/cve/CVE-2020-2812.html

https://www.suse.com/security/cve/CVE-2020-2814.html

https://bugzilla.suse.com/1171550

https://bugzilla.suse.com/1175596

https://bugzilla.suse.com/1177472

https://bugzilla.suse.com/1178428

Severity
Announcement ID: SUSE-SU-2020:3625-1
Rating: important

Related News

19.Laptop Bed Esm H320
2 - 3 min read
AlmaLinux 9.4 beta has been released and provides compelling reasons to consider it for desktop usage. While AlmaLinux is primarily known as a
32.Lock Code Circular Esm H320
2 - 3 min read
Linux admins and security practitioners face significant challenges in keeping their Linux systems secure amidst the constant threat of kernel bugs.
1.Penguin Landscape Esm H320
2 - 3 min read
A significant security threat, known as the Spectre v2 exploit, has been observed targeting Linux systems running on modern Intel processors. Let's
10.FingerPrint Locks Esm H320
2 - 3 min read
The recent release of I2P 2.5.0 , an anonymous P2P network that protects against online censorship, surveillance, and monitoring, has brought a slew
24.Key Code Esm H320
2 - 3 min read
The Akira ransomware group has extorted approximately $42 million from over 250 victims since January 1, 2024. The group initially focused on
5.ShakingHands Esm H320
2 - 3 min read
At The Linux Foundation's Open Source Summit North America , Linus Torvalds, the creator of Linux, discussed various topics related to Linux
30.Lock Globe Motherboard Esm H320
1 - 2 min read
The SPDX 3.0 release marks a significant milestone in software management, particularly for Linux admins, infosec professionals, internet security
11.Locks IsometricPattern Esm H320
2 - 3 min read
Open Source maintainers and developers have been warned about the continued wave of attacks aimed at project maintainers similar to those recently
Sign Up

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved