SUSE Container Update Advisory: suse/sles12sp4
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2021:277-1
Container Tags        : suse/sles12sp4:26.325 , suse/sles12sp4:latest
Container Release     : 26.325
Severity              : important
Type                  : security
References            : 1027496 1131330 1161510 1178561 1181443 1184761 1184967 1185046
                        1185331 1185562 1185807 1186015 1186229 1187212 1187784 1187911
                        1188063 1188217 1188218 1188219 1188220 CVE-2016-10228 CVE-2019-20387
                        CVE-2021-22922 CVE-2021-22923 CVE-2021-22924 CVE-2021-22925 CVE-2021-3200
                        CVE-2021-33560 CVE-2021-33910 CVE-2021-3541 CVE-2021-35942 
-----------------------------------------------------------------

The container suse/sles12sp4 was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:2016-1
Released:    Fri Jun 18 09:39:25 2021
Summary:     Security update for libxml2
Type:        security
Severity:    moderate
References:  1186015,CVE-2021-3541
This update for libxml2 fixes the following issues:

- CVE-2021-3541: Fixed exponential entity expansion attack that could bypass all existing protection mechanisms (bsc#1186015).

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:2086-1
Released:    Fri Jun 18 17:28:57 2021
Summary:     Recommended update for pam
Type:        recommended
Severity:    important
References:  1181443,1185562
This update for pam fixes the following issues:

- Fixed a bug, where the 'unlimited'/'-1' value was not interpreted correctly (bsc#1181443)
- In the 32-bit compatibility package for 64-bit architectures, require 'systemd-32bit' to be also installed as it contains pam_systemd.so for 32 bit applications. (bsc#1185562)
  
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:2156-1
Released:    Thu Jun 24 15:39:39 2021
Summary:     Security update for libgcrypt
Type:        security
Severity:    important
References:  1187212,CVE-2021-33560
This update for libgcrypt fixes the following issues:

- CVE-2021-33560: Fixed a side-channel against ElGamal encryption, caused by missing exponent blinding (bsc#1187212).

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:2180-1
Released:    Mon Jun 28 17:40:39 2021
Summary:     Security update for libsolv
Type:        security
Severity:    important
References:  1161510,1186229,CVE-2019-20387,CVE-2021-3200
This update for libsolv fixes the following issues:

Security issues fixed:

- CVE-2019-20387: Fixed heap-buffer-overflow in repodata_schema2id (bsc#1161510)
- CVE-2021-3200: testcase_read: error out if repos are added or the system is changed too late (bsc#1186229)

Other issues fixed:

- backport support for blacklisted packages to support ptf packages and retracted patches
- fix ruleinfo of complex dependencies returning the wrong origin
- fix SOLVER_FLAG_FOCUS_BEST updateing packages without reason
- fix add_complex_recommends() selecting conflicted packages in rare cases
- fix potential segfault in resolve_jobrules
- fix solv_zchunk decoding error if large chunks are used

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:2423-1
Released:    Wed Jul 21 11:03:43 2021
Summary:     Security update for systemd
Type:        security
Severity:    important
References:  1178561,1184761,1184967,1185046,1185331,1185807,1188063,CVE-2021-33910
This update for systemd fixes the following issues:

Security issues fixed:

- CVE-2021-33910: Fixed a denial of service (stack exhaustion) in systemd (PID 1) (bsc#1188063)

Other fixes:

- mount-util: shorten the loop a bit (#7545)
- mount-util: do not use the official MAX_HANDLE_SZ (#7523)
- mount-util: tape over name_to_handle_at() flakiness (#7517) (bsc#1184761)
- mount-util: fix bad indenting
- mount-util: EOVERFLOW might have other causes than buffer size issues
- mount-util: fix error propagation in fd_fdinfo_mnt_id()
- mount-util: drop exponential buffer growing in name_to_handle_at_loop()
- udev: port udev_has_devtmpfs() to use path_get_mnt_id()
- mount-util: add new path_get_mnt_id() call that queries the mnt ID of a path
- mount-util: add name_to_handle_at_loop() wrapper around name_to_handle_at()
- mount-util: accept that name_to_handle_at() might fail with EPERM (#5499)
- basic: fallback to the fstat if we don't have access to the /proc/self/fdinfo
- sysusers: use the usual comment style
- test/TEST-21-SYSUSERS: add tests for new functionality
- sysusers: allow admin/runtime overrides to command-line config
- basic/strv: add function to insert items at position
- sysusers: allow the shell to be specified
- sysusers: move various user credential validity checks to src/basic/
- man: reformat table in sysusers.d(5)
- sysusers: take configuration as positional arguments
- sysusers: emit a bit more info at debug level when locking fails
- sysusers: allow force reusing existing user/group IDs (#8037)
- sysusers: ensure GID in uid:gid syntax exists
- sysusers: make ADD_GROUP always create a group
- test: add TEST-21-SYSUSERS test
- sysuser: use OrderedHashmap
- sysusers: allow uid:gid in sysusers.conf files
- sysusers: fix memleak (#4430)
- These commits implement the option '--replace' for systemd-sysusers  so %sysusers_create_package can be introduced in SLE and packages
  can rely on this rpm macro without wondering whether the macro is
  available on the different target the package is submitted to.
- Expect 644 permissions for /usr/lib/udev/compat-symlink-generation (bsc#1185807)
- systemctl: add --value option
- execute: make sure to call into PAM after initializing resource limits (bsc#1184967)
- rlimit-util: introduce setrlimit_closest_all()
- system-conf: drop reference to ShutdownWatchdogUsec- core: rename ShutdownWatchdogSec to RebootWatchdogSec (bsc#1185331)
- Return -EAGAIN instead of -EALREADY from unit_reload (bsc#1185046)
- rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
- write_net_rules: set execute bits (bsc#1178561)
- udev: rework network device renaming
- Revert 'Revert 'udev: network device renaming - immediately give up if the target name isn't available''

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:2425-1
Released:    Wed Jul 21 11:26:08 2021
Summary:     Security update for curl
Type:        security
Severity:    moderate
References:  1188217,1188218,1188219,1188220,CVE-2021-22922,CVE-2021-22923,CVE-2021-22924,CVE-2021-22925
This update for curl fixes the following issues:

- CVE-2021-22925: TELNET stack contents disclosure again. (bsc#1188220)
- CVE-2021-22924: Bad connection reuse due to flawed path name checks. (bsc#1188219)
- CVE-2021-22923: Insufficiently Protected Credentials. (bsc#1188218)
- CVE-2021-22922: Wrong content via metalink not discarded. (bsc#1188217)

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:2480-1
Released:    Tue Jul 27 13:47:22 2021
Summary:     Security update for glibc
Type:        security
Severity:    moderate
References:  1027496,1131330,1187911,CVE-2016-10228,CVE-2021-35942
This update for glibc fixes the following issues:

Security issues fixed:

- CVE-2021-35942: wordexp: Fixed handle overflow in positional parameter number (bsc#1187911)
- CVE-2016-10228: Rewrite iconv option parsing (bsc#1027496)

Other fixes:

- Fixed race in pthread_mutex_lock while promoting to PTHREAD_MUTEX_ELISION_NP (bsc#1131330)

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:2578-1
Released:    Sun Aug  1 15:54:42 2021
Summary:     Recommended update for openldap2
Type:        recommended
Severity:    moderate
References:  1187784

This update for openldap2 rebuilds openldap2 against a symbol
versioned enabled openssl 1.0 library.

This is an enablemend for migrations to openssl 1.1.1 which will enable TLS 1.3 support.

SUSE: 2021:277-1 suse/sles12sp4 Security Update

August 7, 2021
The container suse/sles12sp4 was updated

Summary

Advisory ID: SUSE-SU-2021:2016-1 Released: Fri Jun 18 09:39:25 2021 Summary: Security update for libxml2 Type: security Severity: moderate Advisory ID: SUSE-RU-2021:2086-1 Released: Fri Jun 18 17:28:57 2021 Summary: Recommended update for pam Type: recommended Severity: important Advisory ID: SUSE-SU-2021:2156-1 Released: Thu Jun 24 15:39:39 2021 Summary: Security update for libgcrypt Type: security Severity: important Advisory ID: SUSE-SU-2021:2180-1 Released: Mon Jun 28 17:40:39 2021 Summary: Security update for libsolv Type: security Severity: important Advisory ID: SUSE-SU-2021:2423-1 Released: Wed Jul 21 11:03:43 2021 Summary: Security update for systemd Type: security Severity: important Advisory ID: SUSE-SU-2021:2425-1 Released: Wed Jul 21 11:26:08 2021 Summary: Security update for curl Type: security Severity: moderate Advisory ID: SUSE-SU-2021:2480-1 Released: Tue Jul 27 13:47:22 2021 Summary: Security update for glibc Type: security Severity: moderate Advisory ID: SUSE-RU-2021:2578-1 Released: Sun Aug 1 15:54:42 2021 Summary: Recommended update for openldap2 Type: recommended Severity: moderate

References

References : 1027496 1131330 1161510 1178561 1181443 1184761 1184967 1185046

1185331 1185562 1185807 1186015 1186229 1187212 1187784 1187911

1188063 1188217 1188218 1188219 1188220 CVE-2016-10228 CVE-2019-20387

CVE-2021-22922 CVE-2021-22923 CVE-2021-22924 CVE-2021-22925 CVE-2021-3200

CVE-2021-33560 CVE-2021-33910 CVE-2021-3541 CVE-2021-35942

1186015,CVE-2021-3541

This update for libxml2 fixes the following issues:

- CVE-2021-3541: Fixed exponential entity expansion attack that could bypass all existing protection mechanisms (bsc#1186015).

1181443,1185562

This update for pam fixes the following issues:

- Fixed a bug, where the 'unlimited'/'-1' value was not interpreted correctly (bsc#1181443)

- In the 32-bit compatibility package for 64-bit architectures, require 'systemd-32bit' to be also installed as it contains pam_systemd.so for 32 bit applications. (bsc#1185562)

1187212,CVE-2021-33560

This update for libgcrypt fixes the following issues:

- CVE-2021-33560: Fixed a side-channel against ElGamal encryption, caused by missing exponent blinding (bsc#1187212).

1161510,1186229,CVE-2019-20387,CVE-2021-3200

This update for libsolv fixes the following issues:

Security issues fixed:

- CVE-2019-20387: Fixed heap-buffer-overflow in repodata_schema2id (bsc#1161510)

- CVE-2021-3200: testcase_read: error out if repos are added or the system is changed too late (bsc#1186229)

Other issues fixed:

- backport support for blacklisted packages to support ptf packages and retracted patches

- fix ruleinfo of complex dependencies returning the wrong origin

- fix SOLVER_FLAG_FOCUS_BEST updateing packages without reason

- fix add_complex_recommends() selecting conflicted packages in rare cases

- fix potential segfault in resolve_jobrules

- fix solv_zchunk decoding error if large chunks are used

1178561,1184761,1184967,1185046,1185331,1185807,1188063,CVE-2021-33910

This update for systemd fixes the following issues:

Security issues fixed:

- CVE-2021-33910: Fixed a denial of service (stack exhaustion) in systemd (PID 1) (bsc#1188063)

Other fixes:

- mount-util: shorten the loop a bit (#7545)

- mount-util: do not use the official MAX_HANDLE_SZ (#7523)

- mount-util: tape over name_to_handle_at() flakiness (#7517) (bsc#1184761)

- mount-util: fix bad indenting

- mount-util: EOVERFLOW might have other causes than buffer size issues

- mount-util: fix error propagation in fd_fdinfo_mnt_id()

- mount-util: drop exponential buffer growing in name_to_handle_at_loop()

- udev: port udev_has_devtmpfs() to use path_get_mnt_id()

- mount-util: add new path_get_mnt_id() call that queries the mnt ID of a path

- mount-util: add name_to_handle_at_loop() wrapper around name_to_handle_at()

- mount-util: accept that name_to_handle_at() might fail with EPERM (#5499)

- basic: fallback to the fstat if we don't have access to the /proc/self/fdinfo

- sysusers: use the usual comment style

- test/TEST-21-SYSUSERS: add tests for new functionality

- sysusers: allow admin/runtime overrides to command-line config

- basic/strv: add function to insert items at position

- sysusers: allow the shell to be specified

- sysusers: move various user credential validity checks to src/basic/

- man: reformat table in sysusers.d(5)

- sysusers: take configuration as positional arguments

- sysusers: emit a bit more info at debug level when locking fails

- sysusers: allow force reusing existing user/group IDs (#8037)

- sysusers: ensure GID in uid:gid syntax exists

- sysusers: make ADD_GROUP always create a group

- test: add TEST-21-SYSUSERS test

- sysuser: use OrderedHashmap

- sysusers: allow uid:gid in sysusers.conf files

- sysusers: fix memleak (#4430)

- These commits implement the option '--replace' for systemd-sysusers so %sysusers_create_package can be introduced in SLE and packages

can rely on this rpm macro without wondering whether the macro is

available on the different target the package is submitted to.

- Expect 644 permissions for /usr/lib/udev/compat-symlink-generation (bsc#1185807)

- systemctl: add --value option

- execute: make sure to call into PAM after initializing resource limits (bsc#1184967)

- rlimit-util: introduce setrlimit_closest_all()

- system-conf: drop reference to ShutdownWatchdogUsec- core: rename ShutdownWatchdogSec to RebootWatchdogSec (bsc#1185331)

- Return -EAGAIN instead of -EALREADY from unit_reload (bsc#1185046)

- rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)

- write_net_rules: set execute bits (bsc#1178561)

- udev: rework network device renaming

- Revert 'Revert 'udev: network device renaming - immediately give up if the target name isn't available''

1188217,1188218,1188219,1188220,CVE-2021-22922,CVE-2021-22923,CVE-2021-22924,CVE-2021-22925

This update for curl fixes the following issues:

- CVE-2021-22925: TELNET stack contents disclosure again. (bsc#1188220)

- CVE-2021-22924: Bad connection reuse due to flawed path name checks. (bsc#1188219)

- CVE-2021-22923: Insufficiently Protected Credentials. (bsc#1188218)

- CVE-2021-22922: Wrong content via metalink not discarded. (bsc#1188217)

1027496,1131330,1187911,CVE-2016-10228,CVE-2021-35942

This update for glibc fixes the following issues:

Security issues fixed:

- CVE-2021-35942: wordexp: Fixed handle overflow in positional parameter number (bsc#1187911)

- CVE-2016-10228: Rewrite iconv option parsing (bsc#1027496)

Other fixes:

- Fixed race in pthread_mutex_lock while promoting to PTHREAD_MUTEX_ELISION_NP (bsc#1131330)

1187784

This update for openldap2 rebuilds openldap2 against a symbol

versioned enabled openssl 1.0 library.

This is an enablemend for migrations to openssl 1.1.1 which will enable TLS 1.3 support.

Severity
Container Advisory ID : SUSE-CU-2021:277-1
Container Tags : suse/sles12sp4:26.325 , suse/sles12sp4:latest
Container Release : 26.325
Severity : important
Type : security

Related News