SUSE: 2022:953-1 suse-sles-15-sp4-chost-byos-v20220718-x86_64-gen2 ...
SUSE Image Update Advisory: suse-sles-15-sp4-chost-byos-v20220718-x86_64-gen2
-----------------------------------------------------------------
Image Advisory ID : SUSE-IU-2022:953-1
Image Tags        : suse-sles-15-sp4-chost-byos-v20220718-x86_64-gen2:20220718
Image Release     : 
Severity          : important
Type              : security
References        : 1027519 1080338 1118508 1173429 1185637 1192051 1192449 1195896
                        1196025 1196026 1196168 1196169 1196171 1196224 1196308 1196784
                        1196788 1197216 1197443 1197718 1197995 1198255 1198331 1198457
                        1198511 1198939 1199140 1199166 1199232 1199232 1199247 1199264
                        1199362 1199460 1199565 1199652 1199756 1199965 1199966 1200088
                        1200145 1200278 1200334 1200550 1200734 1200735 1200736 1200737
                        1200802 1200855 1201099 CVE-2015-20107 CVE-2020-25659 CVE-2021-3670
                        CVE-2022-1292 CVE-2022-1348 CVE-2022-1586 CVE-2022-1586 CVE-2022-2068
                        CVE-2022-2097 CVE-2022-25235 CVE-2022-25236 CVE-2022-25313 CVE-2022-25314
                        CVE-2022-25315 CVE-2022-26362 CVE-2022-26363 CVE-2022-26364 CVE-2022-27239
                        CVE-2022-29162 CVE-2022-29217 CVE-2022-31030 CVE-2022-32205 CVE-2022-32206
                        CVE-2022-32207 CVE-2022-32208 
-----------------------------------------------------------------

The container suse-sles-15-sp4-chost-byos-v20220718-x86_64-gen2 was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:2294-1
Released:    Wed Jul  6 13:34:15 2022
Summary:     Security update for expat
Type:        security
Severity:    important
References:  1196025,1196026,1196168,1196169,1196171,1196784,CVE-2022-25235,CVE-2022-25236,CVE-2022-25313,CVE-2022-25314,CVE-2022-25315
This update for expat fixes the following issues:

- CVE-2022-25236: Fixed possible namespace-separator characters insertion into namespace URIs (bsc#1196025).
- Fixed a regression caused by the patch for CVE-2022-25236 (bsc#1196784).
- CVE-2022-25235: Fixed UTF-8 character validation in a certain context (bsc#1196026).
- CVE-2022-25313: Fixed stack exhaustion in build_model() via uncontrolled recursion (bsc#1196168).
- CVE-2022-25314: Fixed integer overflow in copyString (bsc#1196169).
- CVE-2022-25315: Fixed integer overflow in storeRawNames (bsc#1196171).

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:2296-1
Released:    Wed Jul  6 13:35:00 2022
Summary:     Security update for xen
Type:        security
Severity:    important
References:  1027519,1199965,1199966,CVE-2022-26362,CVE-2022-26363,CVE-2022-26364
This update for xen fixes the following issues:

- CVE-2022-26362: Fixed race condition in typeref acquisition (bsc#1199965)
- CVE-2022-26363, CVE-2022-26364: Fixed insufficient care with non-coherent mappings (bsc#1199966)

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:2300-1
Released:    Wed Jul  6 13:36:19 2022
Summary:     Recommended update for open-iscsi
Type:        recommended
Severity:    moderate
References:  1198457,1199264
This update for open-iscsi fixes the following issues:

- Set initiatorname in %post (at end of install), for cases where root is read-only at startup time (bsc#1198457)

- Update to latest upstream, including:
  Added 'distclean' to Makefile targets.
  Ensure Makefile '.PHONY' targets set up correctly.
  Fix an iscsid logout bug generating a false error and cleanup logout error messages.
  Updated/fixed test script.
  Updated build system.
  Syntax error in ibft-rule-generator. (bsc#1199264)

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:2305-1
Released:    Wed Jul  6 13:38:42 2022
Summary:     Security update for curl
Type:        security
Severity:    important
References:  1200734,1200735,1200736,1200737,CVE-2022-32205,CVE-2022-32206,CVE-2022-32207,CVE-2022-32208
This update for curl fixes the following issues:

- CVE-2022-32205: Set-Cookie denial of service (bsc#1200734)
- CVE-2022-32206: HTTP compression denial of service (bsc#1200735)
- CVE-2022-32207: Unpreserved file permissions (bsc#1200736)
- CVE-2022-32208: FTP-KRB bad message verification (bsc#1200737)

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:2307-1
Released:    Wed Jul  6 14:04:19 2022
Summary:     Security update for ldb, samba
Type:        security
Severity:    moderate
References:  1080338,1118508,1173429,1195896,1196224,1196308,1196788,1197995,1198255,1199247,1199362,CVE-2021-3670
This update for ldb, samba fixes the following issues:

ldb was updated to version 2.4.2 to fix:

+ Fix for CVE-2021-3670, ensure that the LDB request has not
  timed out during filter processing as the LDAP server
  MaxQueryDuration is otherwise not honoured.

samba was updated to fix:

- Revert NIS support removal; (bsc#1199247);

- Use requires_eq macro to require the libldb2 version available at
  samba-dsdb-modules build time; (bsc#1199362);

- Add missing samba-client requirement to samba-winbind package; (bsc#1198255);

Update to 4.15.7

* Share and server swapped in smbget password prompt; (bso#14831);
* Durable handles won't reconnect if the leased file is written
  to; (bso#15022);
* rmdir silently fails if directory contains unreadable files and
  hide unreadable is yes; (bso#15023);
* SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information
  on renamed file handle; (bso#15038);
* vfs_shadow_copy2 breaks 'smbd async dosmode' sync fallback;
  (bso#14957);
* shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes;
  (bso#15035);
* PAM Kerberos authentication incorrectly fails with a clock skew
  error; (bso#15046);
* username map - samba erroneously applies unix group memberships
  to user account entries; (bso#15041);
* NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES
  in SMBC_server_internal; (bso#14983);
* Simple bind doesn't work against an RODC (with non-preloaded users);
  (bso#13879);
* Crash of winbind on RODC; (bso#14641);
* uncached logon on RODC always fails once; (bso#14865);
* KVNO off by 100000; (bso#14951);
* LDAP simple binds should honour 'old password allowed period';
  (bso#15001);
* wbinfo -a doesn't work reliable with upn names; (bso#15003);
* Simple bind doesn't work against an RODC (with non-preloaded
  users); (bso#13879);
* Uninitialized litemask in variable in vfs_gpfs module; (bso#15027);
* Regression: create krb5 conf = yes doesn't work with a single KDC;
  (bso#15016);

- Add provides to samba-client-libs package to fix upgrades from
  previous versions; (bsc#1197995);

- Add missing samba-libs requirement to samba-winbind package;
  (bsc#1198255);

Update to 4.15.6

* Renaming file on DFS root fails with
  NT_STATUS_OBJECT_PATH_NOT_FOUND; (bso#14169);
* Samba does not response STATUS_INVALID_PARAMETER when opening 2
  objects with same lease key; (bso#14737);
* NT error code is not set when overwriting a file during rename
  in libsmbclient; (bso#14938);
* Fix ldap simple bind with TLS auditing; (bso#14996);
* net ads info shows LDAP Server: 0.0.0.0 depending on contacted
  server; (bso#14674);
* Problem when winbind renews Kerberos; (bso#14979);
  (bsc#1196224);
* pam_winbind will not allow gdm login if password about to
  expire; (bso#8691);
* virusfilter_vfs_openat: Not scanned: Directory or special file;
  (bso#14971);
* DFS fix for AIX broken; (bso#13631);
* Solaris and AIX acl modules: wrong function arguments;
  (bso#14974);
* Function aixacl_sys_acl_get_file not declared / coredump;
  (bso#7239);
* Regression: Samba 4.15.2 on macOS segfaults intermittently
  during strcpy in tdbsam_getsampwnam; (bso#14900);
* Fix a use-after-free in SMB1 server; (bso#14989);
* smb2_signing_decrypt_pdu() may not decrypt with
  gnutls_aead_cipher_decrypt() from gnutls before 3.5.2;
  (bso#14968);
* Changing the machine password against an RODC likely destroys
  the domain join; (bso#14984);
* authsam_make_user_info_dc() steals memory from its struct
  ldb_message *msg argument; (bso#14993);
* Use Heimdal 8.0 (pre) rather than an earlier snapshot;
  (bso#14995);
* Samba autorid fails to map AD users if id rangesize fits in the
  id range only once; (bso#14967);

Other SUSE fixes:

- Fix mismatched version of libldb2; (bsc#1196788).
- Drop obsolete SuSEfirewall2 service files.
- Drop obsolete Samba fsrvp v0->v1 state upgrade functionality; (bsc#1080338).
- Fix ntlm authentications with 'winbind use default domain = yes';
  (bso#13126); (bsc#1173429); (bsc#1196308).
- Fix samba-ad-dc status warning notification message by disabling
  systemd notifications in bgqd; (bsc#1195896); (bso#14947).
- libldb version mismatch in Samba dsdb component; (bsc#1118508);

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:2308-1
Released:    Wed Jul  6 14:15:13 2022
Summary:     Security update for openssl-1_1
Type:        security
Severity:    important
References:  1185637,1199166,1200550,1201099,CVE-2022-1292,CVE-2022-2068,CVE-2022-2097
This update for openssl-1_1 fixes the following issues:

- CVE-2022-1292: Fixed command injection in c_rehash (bsc#1199166).
- CVE-2022-2068: Fixed more shell code injection issues in c_rehash. (bsc#1200550)
- CVE-2022-2097: Fixed partial missing encryption in AES OCB mode (bsc#1201099).

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:2323-1
Released:    Thu Jul  7 12:16:58 2022
Summary:     Recommended update for systemd-presets-branding-SLE
Type:        recommended
Severity:    low
References:  
This update for systemd-presets-branding-SLE fixes the following issues:

- Enable suseconnect-keepalive.timer for SUSEConnect (jsc#SLE-23312)

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:2341-1
Released:    Fri Jul  8 16:09:12 2022
Summary:     Security update for containerd, docker and runc
Type:        security
Severity:    important
References:  1192051,1199460,1199565,1200088,1200145,CVE-2022-29162,CVE-2022-31030
This update for containerd, docker and runc fixes the following issues:

containerd:

- CVE-2022-31030: Fixed denial of service via invocation of the ExecSync API (bsc#1200145)

docker:

- Update to Docker 20.10.17-ce. See upstream changelog online at
  https://docs.docker.com/engine/release-notes/#201017. (bsc#1200145)

runc:

Update to runc v1.1.3.

Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3.

* Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on
  s390 and s390x. This solves the issue where syscalls the host kernel did not
  support would return `-EPERM` despite the existence of the `-ENOSYS` stub
  code (this was due to how s390x does syscall multiplexing).
* Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as
  intended; this fix does not affect runc binary itself but is important for
  libcontainer users such as Kubernetes.
* Inability to compile with recent clang due to an issue with duplicate
  constants in libseccomp-golang.
* When using systemd cgroup driver, skip adding device paths that don't exist,
  to stop systemd from emitting warnings about those paths.
* Socket activation was failing when more than 3 sockets were used.
* Various CI fixes.
* Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container.
- Fixed issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by
  that platform's syscall multiplexing semantics. (bsc#1192051 bsc#1199565)

Update to runc v1.1.2.

Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2.

Security issue fixed:

- CVE-2022-29162: A bug was found in runc where runc exec --cap executed processes with
  non-empty inheritable Linux process capabilities, creating an atypical Linux
  environment. (bsc#1199460)

- `runc spec` no longer sets any inheritable capabilities in the created
  example OCI spec (`config.json`) file.

Update to runc v1.1.1.

Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1.

* runc run/start can now run a container with read-only /dev in OCI spec,
  rather than error out. (#3355)
* runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403)
  libcontainer systemd v2 manager no longer errors out if one of the files
  listed in /sys/kernel/cgroup/delegate do not exist in container's
  cgroup. (#3387, #3404)
* Loosen OCI spec validation to avoid bogus 'Intel RDT is not supported'
  error. (#3406)
* libcontainer/cgroups no longer panics in cgroup v1 managers if stat
  of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435)

Update to runc v1.1.0.

Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0.

- libcontainer will now refuse to build without the nsenter package being
  correctly compiled (specifically this requires CGO to be enabled). This
  should avoid folks accidentally creating broken runc binaries (and
  incorrectly importing our internal libraries into their projects). (#3331)

Update to runc v1.1.0~rc1.

Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1.

+ Add support for RDMA cgroup added in Linux 4.11.
* runc exec now produces exit code of 255 when the exec failed.
  This may help in distinguishing between runc exec failures
  (such as invalid options, non-running container or non-existent
  binary etc.) and failures of the command being executed.
+ runc run: new --keep option to skip removal exited containers artefacts.
  This might be useful to check the state (e.g. of cgroup controllers) after
  the container hasexited.
+ seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD
  (the latter is just an alias for SCMP_ACT_KILL).
+ seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows
  users to create sophisticated seccomp filters where syscalls can be
  efficiently emulated by privileged processes on the host.
+ checkpoint/restore: add an option (--lsm-mount-context) to set
  a different LSM mount context on restore.
+ intelrdt: support ClosID parameter.
+ runc exec --cgroup: an option to specify a (non-top) in-container cgroup
  to use for the process being executed.
+ cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1
  machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc
  run/exec now adds the container to the appropriate cgroup under it).
+ sysctl: allow slashes in sysctl names, to better match sysctl(8)'s
  behaviour.
+ mounts: add support for bind-mounts which are inaccessible after switching
  the user namespace. Note that this does not permit the container any
  additional access to the host filesystem, it simply allows containers to
  have bind-mounts configured for paths the user can access but have
  restrictive access control settings for other users.
+ Add support for recursive mount attributes using mount_setattr(2). These
  have the same names as the proposed mount(8) options -- just prepend r
  to the option name (such as rro).
+ Add runc features subcommand to allow runc users to detect what features
  runc has been built with. This includes critical information such as
  supported mount flags, hook names, and so on. Note that the output of this
  command is subject to change and will not be considered stable until runc
  1.2 at the earliest. The runtime-spec specification for this feature is
  being developed in opencontainers/runtime-spec#1130.
* system: improve performance of /proc/$pid/stat parsing.
* cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change
  the ownership of certain cgroup control files (as per
  /sys/kernel/cgroup/delegate) to allow for proper deferral to the container
  process.
* runc checkpoint/restore: fixed for containers with an external bind mount
  which destination is a symlink.
* cgroup: improve openat2 handling for cgroup directory handle hardening.
  runc delete -f now succeeds (rather than timing out) on a paused
  container.
* runc run/start/exec now refuses a frozen cgroup (paused container in case of
  exec). Users can disable this using --ignore-paused.
- Update version data embedded in binary to correctly include the git commit of the release.

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:2355-1
Released:    Mon Jul 11 12:44:33 2022
Summary:     Recommended update for python-cryptography
Type:        recommended
Severity:    moderate
References:  1198331,CVE-2020-25659

This update for python-cryptography fixes the following issues:

python-cryptography was updated to 3.3.2.

update to 3.3.0:

* BACKWARDS INCOMPATIBLE: The GCM and AESGCM now require 64-bit
  to 1024-bit (8 byte to 128 byte) initialization vectors. This
  change is to conform with an upcoming OpenSSL release that will
  no longer support sizes outside this window.
* BACKWARDS INCOMPATIBLE: When deserializing asymmetric keys we
  now raise ValueError rather than UnsupportedAlgorithm when an
  unsupported cipher is used. This change is to conform with an
  upcoming OpenSSL release that will no longer distinguish
  between error types.
* BACKWARDS INCOMPATIBLE: We no longer allow loading of finite
  field Diffie-Hellman parameters of less than 512 bits in
  length. This change is to conform with an upcoming OpenSSL
  release that no longer supports smaller sizes. These keys were
  already wildly insecure and should not have been used in any
  application outside of testing.
* Added the recover_data_from_signature() function to
  RSAPublicKey for recovering the signed data from an RSA
  signature. 

Update to 3.2.1:

Disable blinding on RSA public keys to address an error with
some versions of OpenSSL.

update to 3.2 (bsc#1178168, CVE-2020-25659):

* CVE-2020-25659: Attempted to make RSA PKCS#1v1.5 decryption more constant time,
  to protect against Bleichenbacher vulnerabilities. Due to limitations imposed
  by our API, we cannot completely mitigate this vulnerability.
* Added basic support for PKCS7 signing (including SMIME) via PKCS7SignatureBuilder.

update to 3.1:

* **BACKWARDS INCOMPATIBLE:** Removed support for ``idna`` based
  :term:`U-label` parsing in various X.509 classes. This support was originally
  deprecated in version 2.1 and moved to an extra in 2.5.
* ``backend`` arguments to functions are no longer required and the
  default backend will automatically be selected if no ``backend`` is provided.
* Added initial support for parsing certificates from PKCS7 files with
  :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_pem_pkcs7_certificates`
  and
  :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_der_pkcs7_certificates`
  .
* Calling ``update`` or ``update_into`` on
  :class:`~cryptography.hazmat.primitives.ciphers.CipherContext` with ``data``
  longer than 2\ :sup:`31` bytes no longer raises an ``OverflowError``. This
  also resolves the same issue in :doc:`/fernet`.

update to 3.0:

* RSA generate_private_key() no longer accepts public_exponent values except
   65537 and 3 (the latter for legacy purposes).
* X.509 certificate parsing now enforces that the version field contains
   a valid value, rather than deferring this check until version is accessed.
* Deprecated support for Python 2
* Added support for OpenSSH serialization format for ec, ed25519, rsa and dsa
   private keys: load_ssh_private_key() for loading and OpenSSH for writing.
* Added support for OpenSSH certificates to load_ssh_public_key().
* Added encrypt_at_time() and decrypt_at_time() to Fernet.
* Added support for the SubjectInformationAccess X.509 extension.
* Added support for parsing SignedCertificateTimestamps in OCSP responses.
* Added support for parsing attributes in certificate signing requests via get_attribute_for_oid().
* Added support for encoding attributes in certificate signing requests via add_attribute().
* On OpenSSL 1.1.1d and higher cryptography now uses OpenSSL’s built-in CSPRNG
   instead of its own OS random engine because these versions of OpenSSL properly reseed on fork.
* Added initial support for creating PKCS12 files with serialize_key_and_certificates().

Update to 2.9:

* BACKWARDS INCOMPATIBLE: Support for Python 3.4 has been removed due to
  low usage and maintenance burden.
* BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.0.1 has been removed.
  Users on older version of OpenSSL will need to upgrade.
* BACKWARDS INCOMPATIBLE: Support for LibreSSL 2.6.x has been removed.
* Removed support for calling public_bytes() with no arguments, as per 
  our deprecation policy. You must now pass encoding and format.
* BACKWARDS INCOMPATIBLE: Reversed the order in which rfc4514_string()
  returns the RDNs as required by RFC 4514.
* Added support for parsing single_extensions in an OCSP response.
* NameAttribute values can now be empty strings.


-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:2357-1
Released:    Mon Jul 11 20:34:20 2022
Summary:     Security update for python3
Type:        security
Severity:    important
References:  1198511,CVE-2015-20107
This update for python3 fixes the following issues:

- CVE-2015-20107: avoid command injection in the mailcap module (bsc#1198511).

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:2358-1
Released:    Tue Jul 12 04:21:59 2022
Summary:     Recommended update for augeas
Type:        recommended
Severity:    moderate
References:  1197443
This update for augeas fixes the following issues:

- Fix handling of keywords in new sysctl.conf (bsc#1197443)

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:2360-1
Released:    Tue Jul 12 12:01:39 2022
Summary:     Security update for pcre2
Type:        security
Severity:    important
References:  1199232,CVE-2022-1586
This update for pcre2 fixes the following issues:

- CVE-2022-1586: Fixed unicode property matching issue. (bsc#1199232)

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:2361-1
Released:    Tue Jul 12 12:05:01 2022
Summary:     Security update for pcre
Type:        security
Severity:    important
References:  1199232,CVE-2022-1586
This update for pcre fixes the following issues:

- CVE-2022-1586: Fixed unicode property matching issue. (bsc#1199232)

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:2378-1
Released:    Wed Jul 13 10:27:03 2022
Summary:     Security update for cifs-utils
Type:        security
Severity:    important
References:  1197216,CVE-2022-27239
This update for cifs-utils fixes the following issues:

- CVE-2022-27239: Fixed a buffer overflow in the command line ip option (bsc#1197216).

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:2396-1
Released:    Thu Jul 14 11:57:58 2022
Summary:     Security update for logrotate
Type:        security
Severity:    important
References:  1192449,1199652,1200278,1200802,CVE-2022-1348
This update for logrotate fixes the following issues:

Security issues fixed:

- CVE-2022-1348: Fixed insecure permissions for state file creation (bsc#1199652).
- Improved coredump handing for SUID binaries (bsc#1192449).

Non-security issues fixed:

- Fixed 'logrotate emits unintended warning: keyword size not properly separated, found 0x3d' (bsc#1200278, bsc#1200802).

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:2402-1
Released:    Thu Jul 14 16:58:22 2022
Summary:     Security update for python-PyJWT
Type:        security
Severity:    important
References:  1199756,CVE-2022-29217
This update for python-PyJWT fixes the following issues:

- CVE-2022-29217: Fixed key confusion through non-blocklisted public key format (bsc#1199756).

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:2406-1
Released:    Fri Jul 15 11:49:01 2022
Summary:     Recommended update for glibc
Type:        recommended
Severity:    moderate
References:  1197718,1199140,1200334,1200855
This update for glibc fixes the following issues:

- powerpc: Fix VSX register number on __strncpy_power9 (bsc#1200334)
- Disable warnings due to deprecated libselinux symbols used by nss and nscd (bsc#1197718)
- i386: Remove broken CAN_USE_REGISTER_ASM_EBP (bsc#1197718)
- rtld: Avoid using up static TLS surplus for optimizations (bsc#1200855, BZ #25051)

This readds the s390 32bit glibc and libcrypt1 libraries (glibc-32bit, glibc-locale-base-32bit, libcrypt1-32bit).

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:2426-1
Released:    Mon Jul 18 09:27:51 2022
Summary:     Recommended update for rsyslog
Type:        recommended
Severity:    moderate
References:  1198939
This update for rsyslog fixes the following issues:

- Remove inotify watch descriptor in imfile on inode change detected (bsc#1198939)


The following package changes have been done:

- cifs-utils-6.15-150400.3.6.1 updated
- containerd-ctr-1.6.6-150000.73.2 updated
- containerd-1.6.6-150000.73.2 updated
- curl-7.79.1-150400.5.3.1 updated
- docker-20.10.17_ce-150000.166.1 updated
- glibc-locale-base-2.31-150300.31.2 updated
- glibc-locale-2.31-150300.31.2 updated
- glibc-2.31-150300.31.2 updated
- libaugeas0-1.12.0-150400.3.3.6 updated
- libcrypt1-4.4.15-150300.4.4.3 updated
- libcurl4-7.79.1-150400.5.3.1 updated
- libexpat1-2.4.4-150400.3.6.9 updated
- libldb2-2.4.2-150400.4.3.11 updated
- libopeniscsiusr0_2_0-2.1.7-150400.39.3.1 updated
- libopenssl1_1-1.1.1l-150400.7.7.1 updated
- libpcre1-8.45-150000.20.13.1 updated
- libpcre2-8-0-10.39-150400.4.3.1 updated
- libpython3_6m1_0-3.6.15-150300.10.27.1 updated
- logrotate-3.18.1-150400.3.7.1 updated
- open-iscsi-2.1.7-150400.39.3.1 updated
- openssl-1_1-1.1.1l-150400.7.7.1 updated
- python3-PyJWT-1.7.1-150200.3.3.1 updated
- python3-base-3.6.15-150300.10.27.1 updated
- python3-cryptography-3.3.2-150400.16.3.1 updated
- python3-3.6.15-150300.10.27.1 updated
- rsyslog-8.2106.0-150400.5.3.1 updated
- runc-1.1.3-150000.30.1 updated
- samba-client-libs-4.15.7+git.376.dd43aca9ab2-150400.3.5.3 updated
- systemd-presets-branding-SLE-15.1-150100.20.11.1 updated
- xen-libs-4.16.1_04-150400.4.5.2 updated

SUSE: 2022:953-1 suse-sles-15-sp4-chost-byos-v20220718-x86_64-gen2 Security Update

July 22, 2022
The container suse-sles-15-sp4-chost-byos-v20220718-x86_64-gen2 was updated

Summary

Advisory ID: SUSE-SU-2022:2294-1 Released: Wed Jul 6 13:34:15 2022 Summary: Security update for expat Type: security Severity: important Advisory ID: SUSE-SU-2022:2296-1 Released: Wed Jul 6 13:35:00 2022 Summary: Security update for xen Type: security Severity: important Advisory ID: SUSE-RU-2022:2300-1 Released: Wed Jul 6 13:36:19 2022 Summary: Recommended update for open-iscsi Type: recommended Severity: moderate Advisory ID: SUSE-SU-2022:2305-1 Released: Wed Jul 6 13:38:42 2022 Summary: Security update for curl Type: security Severity: important Advisory ID: SUSE-SU-2022:2307-1 Released: Wed Jul 6 14:04:19 2022 Summary: Security update for ldb, samba Type: security Severity: moderate Advisory ID: SUSE-SU-2022:2308-1 Released: Wed Jul 6 14:15:13 2022 Summary: Security update for openssl-1_1 Type: security Severity: important Advisory ID: SUSE-RU-2022:2323-1 Released: Thu Jul 7 12:16:58 2022 Summary: Recommended update for systemd-presets-branding-SLE Type: recommended Severity: low Advisory ID: SUSE-SU-2022:2341-1 Released: Fri Jul 8 16:09:12 2022 Summary: Security update for containerd, docker and runc Type: security Severity: important Advisory ID: SUSE-RU-2022:2355-1 Released: Mon Jul 11 12:44:33 2022 Summary: Recommended update for python-cryptography Type: recommended Severity: moderate Advisory ID: SUSE-SU-2022:2357-1 Released: Mon Jul 11 20:34:20 2022 Summary: Security update for python3 Type: security Severity: important Advisory ID: SUSE-RU-2022:2358-1 Released: Tue Jul 12 04:21:59 2022 Summary: Recommended update for augeas Type: recommended Severity: moderate Advisory ID: SUSE-SU-2022:2360-1 Released: Tue Jul 12 12:01:39 2022 Summary: Security update for pcre2 Type: security Severity: important Advisory ID: SUSE-SU-2022:2361-1 Released: Tue Jul 12 12:05:01 2022 Summary: Security update for pcre Type: security Severity: important Advisory ID: SUSE-SU-2022:2378-1 Released: Wed Jul 13 10:27:03 2022 Summary: Security update for cifs-utils Type: security Severity: important Advisory ID: SUSE-SU-2022:2396-1 Released: Thu Jul 14 11:57:58 2022 Summary: Security update for logrotate Type: security Severity: important Advisory ID: SUSE-SU-2022:2402-1 Released: Thu Jul 14 16:58:22 2022 Summary: Security update for python-PyJWT Type: security Severity: important Advisory ID: SUSE-RU-2022:2406-1 Released: Fri Jul 15 11:49:01 2022 Summary: Recommended update for glibc Type: recommended Severity: moderate Advisory ID: SUSE-RU-2022:2426-1 Released: Mon Jul 18 09:27:51 2022 Summary: Recommended update for rsyslog Type: recommended Severity: moderate

References

References : 1027519 1080338 1118508 1173429 1185637 1192051 1192449 1195896

1196025 1196026 1196168 1196169 1196171 1196224 1196308 1196784

1196788 1197216 1197443 1197718 1197995 1198255 1198331 1198457

1198511 1198939 1199140 1199166 1199232 1199232 1199247 1199264

1199362 1199460 1199565 1199652 1199756 1199965 1199966 1200088

1200145 1200278 1200334 1200550 1200734 1200735 1200736 1200737

1200802 1200855 1201099 CVE-2015-20107 CVE-2020-25659 CVE-2021-3670

CVE-2022-1292 CVE-2022-1348 CVE-2022-1586 CVE-2022-1586 CVE-2022-2068

CVE-2022-2097 CVE-2022-25235 CVE-2022-25236 CVE-2022-25313 CVE-2022-25314

CVE-2022-25315 CVE-2022-26362 CVE-2022-26363 CVE-2022-26364 CVE-2022-27239

CVE-2022-29162 CVE-2022-29217 CVE-2022-31030 CVE-2022-32205 CVE-2022-32206

CVE-2022-32207 CVE-2022-32208

1196025,1196026,1196168,1196169,1196171,1196784,CVE-2022-25235,CVE-2022-25236,CVE-2022-25313,CVE-2022-25314,CVE-2022-25315

This update for expat fixes the following issues:

- CVE-2022-25236: Fixed possible namespace-separator characters insertion into namespace URIs (bsc#1196025).

- Fixed a regression caused by the patch for CVE-2022-25236 (bsc#1196784).

- CVE-2022-25235: Fixed UTF-8 character validation in a certain context (bsc#1196026).

- CVE-2022-25313: Fixed stack exhaustion in build_model() via uncontrolled recursion (bsc#1196168).

- CVE-2022-25314: Fixed integer overflow in copyString (bsc#1196169).

- CVE-2022-25315: Fixed integer overflow in storeRawNames (bsc#1196171).

1027519,1199965,1199966,CVE-2022-26362,CVE-2022-26363,CVE-2022-26364

This update for xen fixes the following issues:

- CVE-2022-26362: Fixed race condition in typeref acquisition (bsc#1199965)

- CVE-2022-26363, CVE-2022-26364: Fixed insufficient care with non-coherent mappings (bsc#1199966)

1198457,1199264

This update for open-iscsi fixes the following issues:

- Set initiatorname in %post (at end of install), for cases where root is read-only at startup time (bsc#1198457)

- Update to latest upstream, including:

Added 'distclean' to Makefile targets.

Ensure Makefile '.PHONY' targets set up correctly.

Fix an iscsid logout bug generating a false error and cleanup logout error messages.

Updated/fixed test script.

Updated build system.

Syntax error in ibft-rule-generator. (bsc#1199264)

1200734,1200735,1200736,1200737,CVE-2022-32205,CVE-2022-32206,CVE-2022-32207,CVE-2022-32208

This update for curl fixes the following issues:

- CVE-2022-32205: Set-Cookie denial of service (bsc#1200734)

- CVE-2022-32206: HTTP compression denial of service (bsc#1200735)

- CVE-2022-32207: Unpreserved file permissions (bsc#1200736)

- CVE-2022-32208: FTP-KRB bad message verification (bsc#1200737)

1080338,1118508,1173429,1195896,1196224,1196308,1196788,1197995,1198255,1199247,1199362,CVE-2021-3670

This update for ldb, samba fixes the following issues:

ldb was updated to version 2.4.2 to fix:

+ Fix for CVE-2021-3670, ensure that the LDB request has not

timed out during filter processing as the LDAP server

MaxQueryDuration is otherwise not honoured.

samba was updated to fix:

- Revert NIS support removal; (bsc#1199247);

- Use requires_eq macro to require the libldb2 version available at

samba-dsdb-modules build time; (bsc#1199362);

- Add missing samba-client requirement to samba-winbind package; (bsc#1198255);

Update to 4.15.7

* Share and server swapped in smbget password prompt; (bso#14831);

* Durable handles won't reconnect if the leased file is written

to; (bso#15022);

* rmdir silently fails if directory contains unreadable files and

hide unreadable is yes; (bso#15023);

* SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information

on renamed file handle; (bso#15038);

* vfs_shadow_copy2 breaks 'smbd async dosmode' sync fallback;

(bso#14957);

* shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes;

(bso#15035);

* PAM Kerberos authentication incorrectly fails with a clock skew

error; (bso#15046);

* username map - samba erroneously applies unix group memberships

to user account entries; (bso#15041);

* NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES

in SMBC_server_internal; (bso#14983);

* Simple bind doesn't work against an RODC (with non-preloaded users);

(bso#13879);

* Crash of winbind on RODC; (bso#14641);

* uncached logon on RODC always fails once; (bso#14865);

* KVNO off by 100000; (bso#14951);

* LDAP simple binds should honour 'old password allowed period';

(bso#15001);

* wbinfo -a doesn't work reliable with upn names; (bso#15003);

* Simple bind doesn't work against an RODC (with non-preloaded

users); (bso#13879);

* Uninitialized litemask in variable in vfs_gpfs module; (bso#15027);

* Regression: create krb5 conf = yes doesn't work with a single KDC;

(bso#15016);

- Add provides to samba-client-libs package to fix upgrades from

previous versions; (bsc#1197995);

- Add missing samba-libs requirement to samba-winbind package;

(bsc#1198255);

Update to 4.15.6

* Renaming file on DFS root fails with

NT_STATUS_OBJECT_PATH_NOT_FOUND; (bso#14169);

* Samba does not response STATUS_INVALID_PARAMETER when opening 2

objects with same lease key; (bso#14737);

* NT error code is not set when overwriting a file during rename

in libsmbclient; (bso#14938);

* Fix ldap simple bind with TLS auditing; (bso#14996);

* net ads info shows LDAP Server: 0.0.0.0 depending on contacted

server; (bso#14674);

* Problem when winbind renews Kerberos; (bso#14979);

(bsc#1196224);

* pam_winbind will not allow gdm login if password about to

expire; (bso#8691);

* virusfilter_vfs_openat: Not scanned: Directory or special file;

(bso#14971);

* DFS fix for AIX broken; (bso#13631);

* Solaris and AIX acl modules: wrong function arguments;

(bso#14974);

* Function aixacl_sys_acl_get_file not declared / coredump;

(bso#7239);

* Regression: Samba 4.15.2 on macOS segfaults intermittently

during strcpy in tdbsam_getsampwnam; (bso#14900);

* Fix a use-after-free in SMB1 server; (bso#14989);

* smb2_signing_decrypt_pdu() may not decrypt with

gnutls_aead_cipher_decrypt() from gnutls before 3.5.2;

(bso#14968);

* Changing the machine password against an RODC likely destroys

the domain join; (bso#14984);

* authsam_make_user_info_dc() steals memory from its struct

ldb_message *msg argument; (bso#14993);

* Use Heimdal 8.0 (pre) rather than an earlier snapshot;

(bso#14995);

* Samba autorid fails to map AD users if id rangesize fits in the

id range only once; (bso#14967);

Other SUSE fixes:

- Fix mismatched version of libldb2; (bsc#1196788).

- Drop obsolete SuSEfirewall2 service files.

- Drop obsolete Samba fsrvp v0->v1 state upgrade functionality; (bsc#1080338).

- Fix ntlm authentications with 'winbind use default domain = yes';

(bso#13126); (bsc#1173429); (bsc#1196308).

- Fix samba-ad-dc status warning notification message by disabling

systemd notifications in bgqd; (bsc#1195896); (bso#14947).

- libldb version mismatch in Samba dsdb component; (bsc#1118508);

1185637,1199166,1200550,1201099,CVE-2022-1292,CVE-2022-2068,CVE-2022-2097

This update for openssl-1_1 fixes the following issues:

- CVE-2022-1292: Fixed command injection in c_rehash (bsc#1199166).

- CVE-2022-2068: Fixed more shell code injection issues in c_rehash. (bsc#1200550)

- CVE-2022-2097: Fixed partial missing encryption in AES OCB mode (bsc#1201099).

This update for systemd-presets-branding-SLE fixes the following issues:

- Enable suseconnect-keepalive.timer for SUSEConnect (jsc#SLE-23312)

1192051,1199460,1199565,1200088,1200145,CVE-2022-29162,CVE-2022-31030

This update for containerd, docker and runc fixes the following issues:

containerd:

- CVE-2022-31030: Fixed denial of service via invocation of the ExecSync API (bsc#1200145)

docker:

- Update to Docker 20.10.17-ce. See upstream changelog online at

https://docs.docker.com/engine/release-notes/#201017. (bsc#1200145)

runc:

Update to runc v1.1.3.

Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3.

* Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on

s390 and s390x. This solves the issue where syscalls the host kernel did not

support would return `-EPERM` despite the existence of the `-ENOSYS` stub

code (this was due to how s390x does syscall multiplexing).

* Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as

intended; this fix does not affect runc binary itself but is important for

libcontainer users such as Kubernetes.

* Inability to compile with recent clang due to an issue with duplicate

constants in libseccomp-golang.

* When using systemd cgroup driver, skip adding device paths that don't exist,

to stop systemd from emitting warnings about those paths.

* Socket activation was failing when more than 3 sockets were used.

* Various CI fixes.

* Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container.

- Fixed issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by

that platform's syscall multiplexing semantics. (bsc#1192051 bsc#1199565)

Update to runc v1.1.2.

Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2.

Security issue fixed:

- CVE-2022-29162: A bug was found in runc where runc exec --cap executed processes with

non-empty inheritable Linux process capabilities, creating an atypical Linux

environment. (bsc#1199460)

- `runc spec` no longer sets any inheritable capabilities in the created

example OCI spec (`config.json`) file.

Update to runc v1.1.1.

Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1.

* runc run/start can now run a container with read-only /dev in OCI spec,

rather than error out. (#3355)

* runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403)

libcontainer systemd v2 manager no longer errors out if one of the files

listed in /sys/kernel/cgroup/delegate do not exist in container's

cgroup. (#3387, #3404)

* Loosen OCI spec validation to avoid bogus 'Intel RDT is not supported'

error. (#3406)

* libcontainer/cgroups no longer panics in cgroup v1 managers if stat

of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435)

Update to runc v1.1.0.

Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0.

- libcontainer will now refuse to build without the nsenter package being

correctly compiled (specifically this requires CGO to be enabled). This

should avoid folks accidentally creating broken runc binaries (and

incorrectly importing our internal libraries into their projects). (#3331)

Update to runc v1.1.0~rc1.

Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1.

+ Add support for RDMA cgroup added in Linux 4.11.

* runc exec now produces exit code of 255 when the exec failed.

This may help in distinguishing between runc exec failures

(such as invalid options, non-running container or non-existent

binary etc.) and failures of the command being executed.

+ runc run: new --keep option to skip removal exited containers artefacts.

This might be useful to check the state (e.g. of cgroup controllers) after

the container hasexited.

+ seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD

(the latter is just an alias for SCMP_ACT_KILL).

+ seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows

users to create sophisticated seccomp filters where syscalls can be

efficiently emulated by privileged processes on the host.

+ checkpoint/restore: add an option (--lsm-mount-context) to set

a different LSM mount context on restore.

+ intelrdt: support ClosID parameter.

+ runc exec --cgroup: an option to specify a (non-top) in-container cgroup

to use for the process being executed.

+ cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1

machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc

run/exec now adds the container to the appropriate cgroup under it).

+ sysctl: allow slashes in sysctl names, to better match sysctl(8)'s

behaviour.

+ mounts: add support for bind-mounts which are inaccessible after switching

the user namespace. Note that this does not permit the container any

additional access to the host filesystem, it simply allows containers to

have bind-mounts configured for paths the user can access but have

restrictive access control settings for other users.

+ Add support for recursive mount attributes using mount_setattr(2). These

have the same names as the proposed mount(8) options -- just prepend r

to the option name (such as rro).

+ Add runc features subcommand to allow runc users to detect what features

runc has been built with. This includes critical information such as

supported mount flags, hook names, and so on. Note that the output of this

command is subject to change and will not be considered stable until runc

1.2 at the earliest. The runtime-spec specification for this feature is

being developed in opencontainers/runtime-spec#1130.

* system: improve performance of /proc/$pid/stat parsing.

* cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change

the ownership of certain cgroup control files (as per

/sys/kernel/cgroup/delegate) to allow for proper deferral to the container

process.

* runc checkpoint/restore: fixed for containers with an external bind mount

which destination is a symlink.

* cgroup: improve openat2 handling for cgroup directory handle hardening.

runc delete -f now succeeds (rather than timing out) on a paused

container.

* runc run/start/exec now refuses a frozen cgroup (paused container in case of

exec). Users can disable this using --ignore-paused.

- Update version data embedded in binary to correctly include the git commit of the release.

1198331,CVE-2020-25659

This update for python-cryptography fixes the following issues:

python-cryptography was updated to 3.3.2.

update to 3.3.0:

* BACKWARDS INCOMPATIBLE: The GCM and AESGCM now require 64-bit

to 1024-bit (8 byte to 128 byte) initialization vectors. This

change is to conform with an upcoming OpenSSL release that will

no longer support sizes outside this window.

* BACKWARDS INCOMPATIBLE: When deserializing asymmetric keys we

now raise ValueError rather than UnsupportedAlgorithm when an

unsupported cipher is used. This change is to conform with an

upcoming OpenSSL release that will no longer distinguish

between error types.

* BACKWARDS INCOMPATIBLE: We no longer allow loading of finite

field Diffie-Hellman parameters of less than 512 bits in

length. This change is to conform with an upcoming OpenSSL

release that no longer supports smaller sizes. These keys were

already wildly insecure and should not have been used in any

application outside of testing.

* Added the recover_data_from_signature() function to

RSAPublicKey for recovering the signed data from an RSA

signature.

Update to 3.2.1:

Disable blinding on RSA public keys to address an error with

some versions of OpenSSL.

update to 3.2 (bsc#1178168, CVE-2020-25659):

* CVE-2020-25659: Attempted to make RSA PKCS#1v1.5 decryption more constant time,

to protect against Bleichenbacher vulnerabilities. Due to limitations imposed

by our API, we cannot completely mitigate this vulnerability.

* Added basic support for PKCS7 signing (including SMIME) via PKCS7SignatureBuilder.

update to 3.1:

* **BACKWARDS INCOMPATIBLE:** Removed support for ``idna`` based

:term:`U-label` parsing in various X.509 classes. This support was originally

deprecated in version 2.1 and moved to an extra in 2.5.

* ``backend`` arguments to functions are no longer required and the

default backend will automatically be selected if no ``backend`` is provided.

* Added initial support for parsing certificates from PKCS7 files with

:func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_pem_pkcs7_certificates`

and

:func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_der_pkcs7_certificates`

.

* Calling ``update`` or ``update_into`` on

:class:`~cryptography.hazmat.primitives.ciphers.CipherContext` with ``data``

longer than 2\ :sup:`31` bytes no longer raises an ``OverflowError``. This

also resolves the same issue in :doc:`/fernet`.

update to 3.0:

* RSA generate_private_key() no longer accepts public_exponent values except

65537 and 3 (the latter for legacy purposes).

* X.509 certificate parsing now enforces that the version field contains

a valid value, rather than deferring this check until version is accessed.

* Deprecated support for Python 2

* Added support for OpenSSH serialization format for ec, ed25519, rsa and dsa

private keys: load_ssh_private_key() for loading and OpenSSH for writing.

* Added support for OpenSSH certificates to load_ssh_public_key().

* Added encrypt_at_time() and decrypt_at_time() to Fernet.

* Added support for the SubjectInformationAccess X.509 extension.

* Added support for parsing SignedCertificateTimestamps in OCSP responses.

* Added support for parsing attributes in certificate signing requests via get_attribute_for_oid().

* Added support for encoding attributes in certificate signing requests via add_attribute().

* On OpenSSL 1.1.1d and higher cryptography now uses OpenSSL’s built-in CSPRNG

instead of its own OS random engine because these versions of OpenSSL properly reseed on fork.

* Added initial support for creating PKCS12 files with serialize_key_and_certificates().

Update to 2.9:

* BACKWARDS INCOMPATIBLE: Support for Python 3.4 has been removed due to

low usage and maintenance burden.

* BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.0.1 has been removed.

Users on older version of OpenSSL will need to upgrade.

* BACKWARDS INCOMPATIBLE: Support for LibreSSL 2.6.x has been removed.

* Removed support for calling public_bytes() with no arguments, as per

our deprecation policy. You must now pass encoding and format.

* BACKWARDS INCOMPATIBLE: Reversed the order in which rfc4514_string()

returns the RDNs as required by RFC 4514.

* Added support for parsing single_extensions in an OCSP response.

* NameAttribute values can now be empty strings.

1198511,CVE-2015-20107

This update for python3 fixes the following issues:

- CVE-2015-20107: avoid command injection in the mailcap module (bsc#1198511).

1197443

This update for augeas fixes the following issues:

- Fix handling of keywords in new sysctl.conf (bsc#1197443)

1199232,CVE-2022-1586

This update for pcre2 fixes the following issues:

- CVE-2022-1586: Fixed unicode property matching issue. (bsc#1199232)

1199232,CVE-2022-1586

This update for pcre fixes the following issues:

- CVE-2022-1586: Fixed unicode property matching issue. (bsc#1199232)

1197216,CVE-2022-27239

This update for cifs-utils fixes the following issues:

- CVE-2022-27239: Fixed a buffer overflow in the command line ip option (bsc#1197216).

1192449,1199652,1200278,1200802,CVE-2022-1348

This update for logrotate fixes the following issues:

Security issues fixed:

- CVE-2022-1348: Fixed insecure permissions for state file creation (bsc#1199652).

- Improved coredump handing for SUID binaries (bsc#1192449).

Non-security issues fixed:

- Fixed 'logrotate emits unintended warning: keyword size not properly separated, found 0x3d' (bsc#1200278, bsc#1200802).

1199756,CVE-2022-29217

This update for python-PyJWT fixes the following issues:

- CVE-2022-29217: Fixed key confusion through non-blocklisted public key format (bsc#1199756).

1197718,1199140,1200334,1200855

This update for glibc fixes the following issues:

- powerpc: Fix VSX register number on __strncpy_power9 (bsc#1200334)

- Disable warnings due to deprecated libselinux symbols used by nss and nscd (bsc#1197718)

- i386: Remove broken CAN_USE_REGISTER_ASM_EBP (bsc#1197718)

- rtld: Avoid using up static TLS surplus for optimizations (bsc#1200855, BZ #25051)

This readds the s390 32bit glibc and libcrypt1 libraries (glibc-32bit, glibc-locale-base-32bit, libcrypt1-32bit).

1198939

This update for rsyslog fixes the following issues:

- Remove inotify watch descriptor in imfile on inode change detected (bsc#1198939)

The following package changes have been done:

- cifs-utils-6.15-150400.3.6.1 updated

- containerd-ctr-1.6.6-150000.73.2 updated

- containerd-1.6.6-150000.73.2 updated

- curl-7.79.1-150400.5.3.1 updated

- docker-20.10.17_ce-150000.166.1 updated

- glibc-locale-base-2.31-150300.31.2 updated

- glibc-locale-2.31-150300.31.2 updated

- glibc-2.31-150300.31.2 updated

- libaugeas0-1.12.0-150400.3.3.6 updated

- libcrypt1-4.4.15-150300.4.4.3 updated

- libcurl4-7.79.1-150400.5.3.1 updated

- libexpat1-2.4.4-150400.3.6.9 updated

- libldb2-2.4.2-150400.4.3.11 updated

- libopeniscsiusr0_2_0-2.1.7-150400.39.3.1 updated

- libopenssl1_1-1.1.1l-150400.7.7.1 updated

- libpcre1-8.45-150000.20.13.1 updated

- libpcre2-8-0-10.39-150400.4.3.1 updated

- libpython3_6m1_0-3.6.15-150300.10.27.1 updated

- logrotate-3.18.1-150400.3.7.1 updated

- open-iscsi-2.1.7-150400.39.3.1 updated

- openssl-1_1-1.1.1l-150400.7.7.1 updated

- python3-PyJWT-1.7.1-150200.3.3.1 updated

- python3-base-3.6.15-150300.10.27.1 updated

- python3-cryptography-3.3.2-150400.16.3.1 updated

- python3-3.6.15-150300.10.27.1 updated

- rsyslog-8.2106.0-150400.5.3.1 updated

- runc-1.1.3-150000.30.1 updated

- samba-client-libs-4.15.7+git.376.dd43aca9ab2-150400.3.5.3 updated

- systemd-presets-branding-SLE-15.1-150100.20.11.1 updated

- xen-libs-4.16.1_04-150400.4.5.2 updated

Severity
Image Advisory ID : SUSE-IU-2022:953-1
Image Tags : suse-sles-15-sp4-chost-byos-v20220718-x86_64-gen2:20220718
Image Release :
Severity : important
Type : security

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.