Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

SUSE: 2022:3320-1 Critical: vsftpd ALPACA Exploit Mitigation Released

suse
Calendar Grey September 20, 2022
Dist Suse Esm H88
SUSE has released a security update for OpenSSH addressing CVE-2022-1364 with critical fixes and enhancements. Access comprehensive release notes today.
An update that solves one vulnerability, contains one feature and has four fixes is now available

Summary

This update for vsftpd fixes the following issues: - CVE-2021-3618: Enforced security checks against ALPACA attack (bsc#1187678, bsc#1187686, PM-3322). Bugfixes: - Fixed a seccomp failure in FIPS mode when SSL was enabled (bsc#1052900). - Allowed wait4() to be called so that the broker can wait for its child processes (bsc#1021387). - Allowed sendto() syscall when /dev/log support is enabled (bsc#786024). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3320=1 - SUSE Linux Enterprise Module for Server Applications 15-SP4:

Topics%20covered

Topics Covered

security advisory important SUSE Linux vsftpd ALPACA

References

#1021387 #1052900 #1187678 #1187686 #786024

PM-3322

Cross- CVE-2021-3618

CVSS scores:

CVE-2021-3618 (NVD) : 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CVE-2021-3618 (SUSE): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected Products:

SUSE Linux Enterprise High Performance Computing 15-SP4

SUSE Linux Enterprise Module for Server Applications 15-SP4

SUSE Linux Enterprise Server 15-SP4

SUSE Linux Enterprise Server for SAP Applications 15-SP4

SUSE Manager Proxy 4.3

SUSE Manager Retail Branch Server 4.3

SUSE Manager Server 4.3

openSUSE Leap 15.4

https://www.suse.com/security/cve/CVE-2021-3618.html

https://bugzilla.suse.com/1021387

https://bugzilla.suse.com/1052900

https://bugzilla.suse.com/1187678

https://bugzilla.suse.com/1187686

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2022:3320-1
Rating: important

Topics%20covered

Topics Covered

security advisory important SUSE Linux vsftpd ALPACA

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here