SUSE: 2022:4351-1 important: osc | LinuxSecurity.com

   SUSE Security Update: Security update for osc
______________________________________________________________________________

Announcement ID:    SUSE-SU-2022:4351-1
Rating:             important
References:         #1089025 #1097996 #1122675 #1125243 #1126055 
                    #1126058 #1127932 #1129757 #1129889 #1131512 
                    #1136584 #1137477 #1138165 #1138977 #1140697 
                    #1142518 #1142662 #1144211 #1154972 #1155953 
                    #1156501 #1160446 #1166537 #1173926 OBS-203 
                    
Cross-References:   CVE-2019-3681 CVE-2019-3685
CVSS scores:
                    CVE-2019-3681 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
                    CVE-2019-3681 (SUSE): 4.2 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
                    CVE-2019-3685 (NVD) : 7.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
                    CVE-2019-3685 (SUSE): 7.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected Products:
                    SUSE Linux Enterprise Server 12-SP5
                    SUSE Linux Enterprise Server for SAP Applications 12-SP5
                    SUSE Linux Enterprise Software Development Kit 12-SP5
______________________________________________________________________________

   An update that solves two vulnerabilities, contains one
   feature and has 22 fixes is now available.

Description:

   This update for osc fixes the following issues:

     osc was updated to version 0.182.0 (bsc#1154972, bsc#1144211,
      bsc#1142662, bsc#1140697, bsc#1138165):

     - Added MFA support (jsc#OBS-203).
     - CVE-2019-3681: Fixed vulnerability where osc stored downloaded RPMs in
       network controlled paths (bsc#1122675).
     - CVE-2019-3685: Fixed broken TLS certificate handling (bsc#1142518).

     Bugfixes:
     - Removed use of chardet to guess encoding. Utf-8 or latin-1 is now
       assumed, which will speed up decoding (bsc#1173926).
     - Added helper method _html_escape to enable python3.8 and python2.*
       compatibility (bsc#1166537).
     - Added MR creation to honor orev (bsc#1160446).
     - Fixed local build outside of the working copy of a package
       (bsc#1136584).
     - Don't enforce password reuse (bsc#1156501).
     - osc vc --file=foo bar.changes now writes the content from foo into
       bar.changes instead of creating a new file (bsc#1155953).
     - Fixed decoding on osc lbl (bsc#1137477).
     - Simplified and fixed osc meta -e (bsc#1138977).
     - osc lbl now works with non utf8 encoding (bsc#1129889).
     - Added full python3 compatibility (bsc#1125243, bsc#1131512,
       bsc#1129757).
     - Fixed slowdown of rbl with readline(bufsize) function (bsc#1127932).
     - Fixed osc build -p dir TypeError (bsc#1126055).
     - Fixed osc buildinfo -p TypeError (bsc#1126058).
     - Added new options --unexpand and --meta to diff command (bsc#1089025).
     - Fixed Requires to python-base which does not contain ssl.py
       (bsc#1097996).


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Software Development Kit 12-SP5:

      zypper in -t patch SUSE-SLE-SDK-12-SP5-2022-4351=1



Package List:

   - SUSE Linux Enterprise Software Development Kit 12-SP5 (noarch):

      osc-0.182.0-15.12.1


References:

   https://www.suse.com/security/cve/CVE-2019-3681.html
   https://www.suse.com/security/cve/CVE-2019-3685.html
   https://bugzilla.suse.com/1089025
   https://bugzilla.suse.com/1097996
   https://bugzilla.suse.com/1122675
   https://bugzilla.suse.com/1125243
   https://bugzilla.suse.com/1126055
   https://bugzilla.suse.com/1126058
   https://bugzilla.suse.com/1127932
   https://bugzilla.suse.com/1129757
   https://bugzilla.suse.com/1129889
   https://bugzilla.suse.com/1131512
   https://bugzilla.suse.com/1136584
   https://bugzilla.suse.com/1137477
   https://bugzilla.suse.com/1138165
   https://bugzilla.suse.com/1138977
   https://bugzilla.suse.com/1140697
   https://bugzilla.suse.com/1142518
   https://bugzilla.suse.com/1142662
   https://bugzilla.suse.com/1144211
   https://bugzilla.suse.com/1154972
   https://bugzilla.suse.com/1155953
   https://bugzilla.suse.com/1156501
   https://bugzilla.suse.com/1160446
   https://bugzilla.suse.com/1166537
   https://bugzilla.suse.com/1173926

SUSE: 2022:4351-1 important: osc

December 7, 2022
An update that solves two vulnerabilities, contains one feature and has 22 fixes is now available

Summary

This update for osc fixes the following issues: osc was updated to version 0.182.0 (bsc#1154972, bsc#1144211, bsc#1142662, bsc#1140697, bsc#1138165): - Added MFA support (jsc#OBS-203). - CVE-2019-3681: Fixed vulnerability where osc stored downloaded RPMs in network controlled paths (bsc#1122675). - CVE-2019-3685: Fixed broken TLS certificate handling (bsc#1142518). Bugfixes: - Removed use of chardet to guess encoding. Utf-8 or latin-1 is now assumed, which will speed up decoding (bsc#1173926). - Added helper method _html_escape to enable python3.8 and python2.* compatibility (bsc#1166537). - Added MR creation to honor orev (bsc#1160446). - Fixed local build outside of the working copy of a package (bsc#1136584). - Don't enforce password reuse (bsc#1156501). - osc vc --file=foo bar.changes now writes the content from foo into bar.changes instead of creating a new file (bsc#1155953). - Fixed decoding on osc lbl (bsc#1137477). - Simplified and fixed osc meta -e (bsc#1138977). - osc lbl now works with non utf8 encoding (bsc#1129889). - Added full python3 compatibility (bsc#1125243, bsc#1131512, bsc#1129757). - Fixed slowdown of rbl with readline(bufsize) function (bsc#1127932). - Fixed osc build -p dir TypeError (bsc#1126055). - Fixed osc buildinfo -p TypeError (bsc#1126058). - Added new options --unexpand and --meta to diff command (bsc#1089025). - Fixed Requires to python-base which does not contain ssl.py (bsc#1097996). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP5: zypper in -t patch SUSE-SLE-SDK-12-SP5-2022-4351=1 Package List: - SUSE Linux Enterprise Software Development Kit 12-SP5 (noarch): osc-0.182.0-15.12.1

References

#1089025 #1097996 #1122675 #1125243 #1126055

#1126058 #1127932 #1129757 #1129889 #1131512

#1136584 #1137477 #1138165 #1138977 #1140697

#1142518 #1142662 #1144211 #1154972 #1155953

#1156501 #1160446 #1166537 #1173926 OBS-203

Cross- CVE-2019-3681 CVE-2019-3685

CVSS scores:

CVE-2019-3681 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2019-3681 (SUSE): 4.2 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

CVE-2019-3685 (NVD) : 7.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

CVE-2019-3685 (SUSE): 7.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected Products:

SUSE Linux Enterprise Server 12-SP5

SUSE Linux Enterprise Server for SAP Applications 12-SP5

SUSE Linux Enterprise Software Development Kit 12-SP5

https://www.suse.com/security/cve/CVE-2019-3681.html

https://www.suse.com/security/cve/CVE-2019-3685.html

https://bugzilla.suse.com/1089025

https://bugzilla.suse.com/1097996

https://bugzilla.suse.com/1122675

https://bugzilla.suse.com/1125243

https://bugzilla.suse.com/1126055

https://bugzilla.suse.com/1126058

https://bugzilla.suse.com/1127932

https://bugzilla.suse.com/1129757

https://bugzilla.suse.com/1129889

https://bugzilla.suse.com/1131512

https://bugzilla.suse.com/1136584

https://bugzilla.suse.com/1137477

https://bugzilla.suse.com/1138165

https://bugzilla.suse.com/1138977

https://bugzilla.suse.com/1140697

https://bugzilla.suse.com/1142518

https://bugzilla.suse.com/1142662

https://bugzilla.suse.com/1144211

https://bugzilla.suse.com/1154972

https://bugzilla.suse.com/1155953

https://bugzilla.suse.com/1156501

https://bugzilla.suse.com/1160446

https://bugzilla.suse.com/1166537

https://bugzilla.suse.com/1173926

Severity
Announcement ID: SUSE-SU-2022:4351-1
Rating: important

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.