Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

SUSE: 2022:3711-1 Important: Multipath-Tools Symlink Attack Fix

suse
Calendar Grey October 24, 2022
Dist Suse Esm H88
SUSE releases an update for multipath-tools that resolves two vulnerabilities, one being a symlink attack flaw and the other an authorization bypass; patches deployed.
An update that solves two vulnerabilities and has 6 fixes is now available

Summary

This update for multipath-tools fixes the following issues: - CVE-2022-41973: Fixed a symlink attack in multipathd. (bsc#1202739) - CVE-2022-41974: Fixed an authorization bypass issue in multipathd. (bsc#1202739) - Avoid linking to libreadline to avoid licensing issue (bsc#1202616) - libmultipath: fix find_multipaths_timeout for unknown hardware (bsc#1201483) - multipath-tools: fix "multipath -ll" for Native NVME Multipath devices (bsc#1201483) - multipathd: don't switch to DAEMON_IDLE during startup (bsc#1199346, bsc#1197570) - multipathd: avoid delays during uevent processing (bsc#1199347) - multipathd: Don't keep starting TUR threads, if they always hang. (bsc#1199345) - Fix busy loop with delayed_reconfigure (bsc#1199342)

Topics%20covered

Topics Covered

security advisory symlink attack SUSE important update server patch authorization bypass multipath-tools

References

#1197570 #1199342 #1199345 #1199346 #1199347

#1201483 #1202616 #1202739

Cross- CVE-2022-41973 CVE-2022-41974

CVSS scores:

CVE-2022-41973 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVE-2022-41974 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products:

SUSE Linux Enterprise Desktop 15-SP4

SUSE Linux Enterprise High Performance Computing 15-SP4

SUSE Linux Enterprise Micro 5.3

SUSE Linux Enterprise Module for Basesystem 15-SP4

SUSE Linux Enterprise Server 15-SP4

SUSE Linux Enterprise Server for SAP Applications 15-SP4

SUSE Manager Proxy 4.3

SUSE Manager Retail Branch Server 4.3

SUSE Manager Server 4.3

openSUSE Leap 15.4

https://www.suse.com/security/cve/CVE-2022-41973.html

https://www.suse.com/sec...

Read the Full Advisory

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2022:3711-1
Rating: important

Topics%20covered

Topics Covered

security advisory symlink attack SUSE important update server patch authorization bypass multipath-tools

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here