SUSE: 2021:357-1 suse/sles12sp3 Security Update
Summary
Advisory ID: SUSE-SU-2021:3176-1 Released: Tue Sep 21 16:28:07 2021 Summary: Security update for curl Type: security Severity: moderate Advisory ID: SUSE-RU-2021:3230-1 Released: Mon Sep 27 11:19:10 2021 Summary: Recommended update for ca-certificates-mozilla Type: recommended Severity: important
References
References : 1190373 1190374 1190858 CVE-2021-22946 CVE-2021-22947
1190373,1190374,CVE-2021-22946,CVE-2021-22947
This update for curl fixes the following issues:
- CVE-2021-22947: Fixed STARTTLS protocol injection via MITM (bsc#1190374).
- CVE-2021-22946: Fixed protocol downgrade required TLS bypassed (bsc#1190373).
1190858
This update for ca-certificates-mozilla fixes the following issues:
- remove one of the Letsencrypt CAs DST_Root_CA_X3.pem, as it expires
September 30th 2021 and openssl certificate chain handling does not
handle this correctly in SUSE Linux Enterprise 12 and older. (bsc#1190858)