SUSE Container Update Advisory: rancher/elemental-teal-rt/5.4
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2023:3482-1
Container Tags        : rancher/elemental-teal-rt/5.4:1.2.3 , rancher/elemental-teal-rt/5.4:1.2.3-2.2.19 , rancher/elemental-teal-rt/5.4:latest
Container Release     : 2.2.19
Severity              : important
Type                  : security
References            : 1201066 1205767 1210335 1211078 1211829 1212819 1212910 1213428
                        1214052 1214458 1214768 1215026 1215064 1215215 1215286 1215713
                        1215888 1215889 1215891 CVE-2023-1829 CVE-2023-22652 CVE-2023-23559
                        CVE-2023-30078 CVE-2023-30079 CVE-2023-32181 CVE-2023-35945 CVE-2023-38039
                        CVE-2023-38545 CVE-2023-38546 CVE-2023-39615 CVE-2023-4039 CVE-2023-4813
-----------------------------------------------------------------

The container rancher/elemental-teal-rt/5.4 was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:3661-1
Released:    Mon Sep 18 21:44:09 2023
Summary:     Security update for gcc12
Type:        security
Severity:    important
References:  1214052,CVE-2023-4039
This update for gcc12 fixes the following issues:

- CVE-2023-4039: Fixed incorrect stack protector for C99 VLAs on Aarch64 (bsc#1214052).

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:3663-1
Released:    Mon Sep 18 21:49:09 2023
Summary:     Recommended update for perl-Bootloader
Type:        recommended
Severity:    important
References:  1215064
This update for perl-Bootloader fixes the following issues:

- bootloader_entry script can have an optional 'force-default'
  argument (bsc#1215064)
- skip warning about unsupported options when in compat mode
  
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:3699-1
Released:    Wed Sep 20 11:02:50 2023
Summary:     Security update for libxml2
Type:        security
Severity:    important
References:  1214768,CVE-2023-39615
This update for libxml2 fixes the following issues:

- CVE-2023-39615: Fixed crafted xml can cause global buffer overflow (bsc#1214768).

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:3814-1
Released:    Wed Sep 27 18:08:17 2023
Summary:     Recommended update for glibc
Type:        recommended
Severity:    moderate
References:  1211829,1212819,1212910
This update for glibc fixes the following issues:

- nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415)
- Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457)
- elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688)
- elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676)
- ld.so: Always use MAP_COPY to map the first segment (BZ #30452)
- add GB18030-2022 charmap (jsc#PED-4908, BZ #30243)


-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:3823-1
Released:    Wed Sep 27 18:42:38 2023
Summary:     Security update for curl
Type:        security
Severity:    important
References:  1215026,CVE-2023-38039
This update for curl fixes the following issues:

- CVE-2023-38039: Fixed possible DoS when receiving too large HTTP header. (bsc#1215026)

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:3856-1
Released:    Thu Sep 28 09:42:16 2023
Summary:     Recommended update for apparmor
Type:        recommended
Severity:    moderate
References:  1214458
This update for apparmor fixes the following issues:

- Update zgrep profile to allow egrep helper use (bsc#1214458)

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:3954-1
Released:    Tue Oct  3 20:09:47 2023
Summary:     Security update for libeconf
Type:        security
Severity:    important
References:  1211078,CVE-2023-22652,CVE-2023-30078,CVE-2023-30079,CVE-2023-32181
This update for libeconf fixes the following issues:

Update to version 0.5.2.

- CVE-2023-30078, CVE-2023-32181: Fixed a stack-buffer-overflow vulnerability in 'econf_writeFile' function (bsc#1211078).
- CVE-2023-30079, CVE-2023-22652: Fixed a stack-buffer-overflow vulnerability in 'read_file' function. (bsc#1211078)

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:3986-1
Released:    Thu Oct  5 14:07:58 2023
Summary:     Recommended update for suse-module-tools
Type:        recommended
Severity:    important
References:  1201066,1213428
This update for suse-module-tools fixes the following issues:

- Update to version 15.4.17:
  * cert-script: warn only once about non-writable efivarfs
  * cert-script: skip cert handling if efivarfs is not writable (bsc#1213428, bsc#1201066)

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:3997-1
Released:    Fri Oct  6 14:13:56 2023
Summary:     Security update for nghttp2
Type:        security
Severity:    important
References:  1215713,CVE-2023-35945
This update for nghttp2 fixes the following issues:

- CVE-2023-35945: Fixed memory leak when PUSH_PROMISE or HEADERS frame cannot be sent (bsc#1215713).

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:4044-1
Released:    Wed Oct 11 09:01:14 2023
Summary:     Security update for curl
Type:        security
Severity:    important
References:  1215888,1215889,CVE-2023-38545,CVE-2023-38546
This update for curl fixes the following issues:

- CVE-2023-38545: Fixed a heap buffer overflow in SOCKS5. (bsc#1215888)
- CVE-2023-38546: Fixed a cookie injection with none file. (bsc#1215889)

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:4110-1
Released:    Wed Oct 18 12:35:26 2023
Summary:     Security update for glibc
Type:        security
Severity:    important
References:  1215286,1215891,CVE-2023-4813
This update for glibc fixes the following issues:

Security issue fixed:

- CVE-2023-4813: Fixed a potential use-after-free in gaih_inet() (bsc#1215286, BZ #28931)

Also a regression from a previous update was fixed:

- elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676)

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:4122-1
Released:    Thu Oct 19 08:24:34 2023
Summary:     Recommended update for openssl-1_1
Type:        recommended
Severity:    moderate
References:  1215215
This update for openssl-1_1 fixes the following issues:

- Displays 'fips' in the version string (bsc#1215215)

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:4135-1
Released:    Thu Oct 19 14:14:23 2023
Summary:     Security update for suse-module-tools
Type:        security
Severity:    important
References:  1205767,1210335,CVE-2023-1829,CVE-2023-23559
This update for suse-module-tools fixes the following issues:

- Updated to version 15.4.18:

  - CVE-2023-1829: Blacklisted the Linux kernel tcindex classifier
    module (bsc#1210335).
  - CVE-2023-23559: Blacklisted the Linux kernel RNDIS modules
    (bsc#1205767, jsc#PED-5731).

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:4138-1
Released:    Thu Oct 19 17:15:38 2023
Summary:     Recommended update for systemd-rpm-macros
Type:        recommended
Severity:    moderate
References:  
This update for systemd-rpm-macros fixes the following issues:

- Switch to `systemd-hwdb` tool when updating the HW database. It's been
  introduced in systemd v219 and replaces the deprecated command `udevadm hwdb`.

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:4151-1
Released:    Fri Oct 20 17:19:18 2023
Summary:     Recommended update for build-iso, elemental, elemental-operator, elemental-operator-crds-helm, elemental-operator-helm, elemental-system-agent, operator-image, seedimage-builder, teal-channel-image, teal-rt-channel-image
Type:        recommended
Severity:    moderate
References:  
This update for build-iso, elemental, elemental-operator, elemental-operator-crds-helm, elemental-operator-helm, elemental-system-agent, operator-image, seedimage-builder, teal-channel-image, teal-rt-channel-image fixes the following issues:

- Update build-iso to version 1.2.3:
  * Include system agent unit file in specfile

- Update to version 1.3.5:
  * Use the proper format for command arguments
  * Prevent recalling bootstrap.sh on 'systemctl restart elemental-system-agent'
  * Small refactor to centralize registration config checks
  * Ensure Elemental registration data includes the registration URL
  * Remove --debug flag from helm pull
  * Attempt to use charts from PR project in e2e tests
  * Publish OBS charts to gh-pages
  * Apply a regex on tags to match the same criteria as in OBS
  * Publish all OBS repositories on PRs
  * Fix repository url
  * Use OBS PR builds for the e2e tests
  * Build and publish charts for OBS/IBS artifacts in gh-pages

- Update to elemental-operator version 1.3.5
- Remove the systemd unit file as this is now included as part of
  elemental package


The following package changes have been done:

- glibc-2.31-150300.63.1 updated
- libnghttp2-14-1.40.0-150200.9.1 updated
- libeconf0-0.5.2-150400.3.6.1 updated
- libapparmor1-3.0.4-150400.5.9.1 updated
- libgcc_s1-12.3.0+git1204-150000.1.16.1 updated
- libstdc++6-12.3.0+git1204-150000.1.16.1 updated
- elemental-system-agent-0.3.3-150400.4.3.1 updated
- elemental-updater-1.2.3-150400.3.3.1 updated
- libxml2-2-2.9.14-150400.5.22.1 updated
- login_defs-4.8.1-150400.3.3.1 updated
- glibc-locale-base-2.31-150300.63.1 updated
- systemd-rpm-macros-14-150000.7.36.1 updated
- perl-Bootloader-0.945-150400.3.9.1 updated
- libopenssl1_1-1.1.1l-150400.7.57.1 updated
- libcurl4-8.0.1-150400.5.32.1 updated
- shadow-4.8.1-150400.3.3.1 updated
- sysuser-shadow-3.2-150400.3.5.3 updated
- suse-module-tools-15.4.18-150400.3.14.1 updated
- elemental-register-1.3.5-150400.4.3.1 updated
- elemental-support-1.3.5-150400.4.3.1 updated
- elemental-1.2.3-150400.3.3.1 updated

SUSE: 2023:3482-1 rancher/elemental-teal-rt/5.4 Security Update

October 21, 2023
The container rancher/elemental-teal-rt/5.4 was updated

Summary

Advisory ID: SUSE-SU-2023:3661-1 Released: Mon Sep 18 21:44:09 2023 Summary: Security update for gcc12 Type: security Severity: important Advisory ID: SUSE-RU-2023:3663-1 Released: Mon Sep 18 21:49:09 2023 Summary: Recommended update for perl-Bootloader Type: recommended Severity: important Advisory ID: SUSE-SU-2023:3699-1 Released: Wed Sep 20 11:02:50 2023 Summary: Security update for libxml2 Type: security Severity: important Advisory ID: SUSE-RU-2023:3814-1 Released: Wed Sep 27 18:08:17 2023 Summary: Recommended update for glibc Type: recommended Severity: moderate Advisory ID: SUSE-SU-2023:3823-1 Released: Wed Sep 27 18:42:38 2023 Summary: Security update for curl Type: security Severity: important Advisory ID: SUSE-RU-2023:3856-1 Released: Thu Sep 28 09:42:16 2023 Summary: Recommended update for apparmor Type: recommended Severity: moderate Advisory ID: SUSE-SU-2023:3954-1 Released: Tue Oct 3 20:09:47 2023 Summary: Security update for libeconf Type: security Severity: important Advisory ID: SUSE-RU-2023:3986-1 Released: Thu Oct 5 14:07:58 2023 Summary: Recommended update for suse-module-tools Type: recommended Severity: important Advisory ID: SUSE-SU-2023:3997-1 Released: Fri Oct 6 14:13:56 2023 Summary: Security update for nghttp2 Type: security Severity: important Advisory ID: SUSE-SU-2023:4044-1 Released: Wed Oct 11 09:01:14 2023 Summary: Security update for curl Type: security Severity: important Advisory ID: SUSE-SU-2023:4110-1 Released: Wed Oct 18 12:35:26 2023 Summary: Security update for glibc Type: security Severity: important Advisory ID: SUSE-RU-2023:4122-1 Released: Thu Oct 19 08:24:34 2023 Summary: Recommended update for openssl-1_1 Type: recommended Severity: moderate Advisory ID: SUSE-SU-2023:4135-1 Released: Thu Oct 19 14:14:23 2023 Summary: Security update for suse-module-tools Type: security Severity: important Advisory ID: SUSE-RU-2023:4138-1 Released: Thu Oct 19 17:15:38 2023 Summary: Recommended update for systemd-rpm-macros Type: recommended Severity: moderate Advisory ID: SUSE-RU-2023:4151-1 Released: Fri Oct 20 17:19:18 2023 Summary: Recommended update for build-iso, elemental, elemental-operator, elemental-operator-crds-helm, elemental-operator-helm, elemental-system-agent, operator-image, seedimage-builder, teal-channel-image, teal-rt-channel-image Type: recommended Severity: moderate

References

References : 1201066 1205767 1210335 1211078 1211829 1212819 1212910 1213428

1214052 1214458 1214768 1215026 1215064 1215215 1215286 1215713

1215888 1215889 1215891 CVE-2023-1829 CVE-2023-22652 CVE-2023-23559

CVE-2023-30078 CVE-2023-30079 CVE-2023-32181 CVE-2023-35945 CVE-2023-38039

CVE-2023-38545 CVE-2023-38546 CVE-2023-39615 CVE-2023-4039 CVE-2023-4813

1214052,CVE-2023-4039

This update for gcc12 fixes the following issues:

- CVE-2023-4039: Fixed incorrect stack protector for C99 VLAs on Aarch64 (bsc#1214052).

1215064

This update for perl-Bootloader fixes the following issues:

- bootloader_entry script can have an optional 'force-default'

argument (bsc#1215064)

- skip warning about unsupported options when in compat mode

1214768,CVE-2023-39615

This update for libxml2 fixes the following issues:

- CVE-2023-39615: Fixed crafted xml can cause global buffer overflow (bsc#1214768).

1211829,1212819,1212910

This update for glibc fixes the following issues:

- nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415)

- Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457)

- elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688)

- elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676)

- ld.so: Always use MAP_COPY to map the first segment (BZ #30452)

- add GB18030-2022 charmap (jsc#PED-4908, BZ #30243)

1215026,CVE-2023-38039

This update for curl fixes the following issues:

- CVE-2023-38039: Fixed possible DoS when receiving too large HTTP header. (bsc#1215026)

1214458

This update for apparmor fixes the following issues:

- Update zgrep profile to allow egrep helper use (bsc#1214458)

1211078,CVE-2023-22652,CVE-2023-30078,CVE-2023-30079,CVE-2023-32181

This update for libeconf fixes the following issues:

Update to version 0.5.2.

- CVE-2023-30078, CVE-2023-32181: Fixed a stack-buffer-overflow vulnerability in 'econf_writeFile' function (bsc#1211078).

- CVE-2023-30079, CVE-2023-22652: Fixed a stack-buffer-overflow vulnerability in 'read_file' function. (bsc#1211078)

1201066,1213428

This update for suse-module-tools fixes the following issues:

- Update to version 15.4.17:

* cert-script: warn only once about non-writable efivarfs

* cert-script: skip cert handling if efivarfs is not writable (bsc#1213428, bsc#1201066)

1215713,CVE-2023-35945

This update for nghttp2 fixes the following issues:

- CVE-2023-35945: Fixed memory leak when PUSH_PROMISE or HEADERS frame cannot be sent (bsc#1215713).

1215888,1215889,CVE-2023-38545,CVE-2023-38546

This update for curl fixes the following issues:

- CVE-2023-38545: Fixed a heap buffer overflow in SOCKS5. (bsc#1215888)

- CVE-2023-38546: Fixed a cookie injection with none file. (bsc#1215889)

1215286,1215891,CVE-2023-4813

This update for glibc fixes the following issues:

Security issue fixed:

- CVE-2023-4813: Fixed a potential use-after-free in gaih_inet() (bsc#1215286, BZ #28931)

Also a regression from a previous update was fixed:

- elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676)

1215215

This update for openssl-1_1 fixes the following issues:

- Displays 'fips' in the version string (bsc#1215215)

1205767,1210335,CVE-2023-1829,CVE-2023-23559

This update for suse-module-tools fixes the following issues:

- Updated to version 15.4.18:

- CVE-2023-1829: Blacklisted the Linux kernel tcindex classifier

module (bsc#1210335).

- CVE-2023-23559: Blacklisted the Linux kernel RNDIS modules

(bsc#1205767, jsc#PED-5731).

This update for systemd-rpm-macros fixes the following issues:

- Switch to `systemd-hwdb` tool when updating the HW database. It's been

introduced in systemd v219 and replaces the deprecated command `udevadm hwdb`.

This update for build-iso, elemental, elemental-operator, elemental-operator-crds-helm, elemental-operator-helm, elemental-system-agent, operator-image, seedimage-builder, teal-channel-image, teal-rt-channel-image fixes the following issues:

- Update build-iso to version 1.2.3:

* Include system agent unit file in specfile

- Update to version 1.3.5:

* Use the proper format for command arguments

* Prevent recalling bootstrap.sh on 'systemctl restart elemental-system-agent'

* Small refactor to centralize registration config checks

* Ensure Elemental registration data includes the registration URL

* Remove --debug flag from helm pull

* Attempt to use charts from PR project in e2e tests

* Publish OBS charts to gh-pages

* Apply a regex on tags to match the same criteria as in OBS

* Publish all OBS repositories on PRs

* Fix repository url

* Use OBS PR builds for the e2e tests

* Build and publish charts for OBS/IBS artifacts in gh-pages

- Update to elemental-operator version 1.3.5

- Remove the systemd unit file as this is now included as part of

elemental package

The following package changes have been done:

- glibc-2.31-150300.63.1 updated

- libnghttp2-14-1.40.0-150200.9.1 updated

- libeconf0-0.5.2-150400.3.6.1 updated

- libapparmor1-3.0.4-150400.5.9.1 updated

- libgcc_s1-12.3.0+git1204-150000.1.16.1 updated

- libstdc++6-12.3.0+git1204-150000.1.16.1 updated

- elemental-system-agent-0.3.3-150400.4.3.1 updated

- elemental-updater-1.2.3-150400.3.3.1 updated

- libxml2-2-2.9.14-150400.5.22.1 updated

- login_defs-4.8.1-150400.3.3.1 updated

- glibc-locale-base-2.31-150300.63.1 updated

- systemd-rpm-macros-14-150000.7.36.1 updated

- perl-Bootloader-0.945-150400.3.9.1 updated

- libopenssl1_1-1.1.1l-150400.7.57.1 updated

- libcurl4-8.0.1-150400.5.32.1 updated

- shadow-4.8.1-150400.3.3.1 updated

- sysuser-shadow-3.2-150400.3.5.3 updated

- suse-module-tools-15.4.18-150400.3.14.1 updated

- elemental-register-1.3.5-150400.4.3.1 updated

- elemental-support-1.3.5-150400.4.3.1 updated

- elemental-1.2.3-150400.3.3.1 updated

Severity
Container Advisory ID : SUSE-CU-2023:3482-1
Container Tags : rancher/elemental-teal-rt/5.4:1.2.3 , rancher/elemental-teal-rt/5.4:1.2.3-2.2.19 , rancher/elemental-teal-rt/5.4:latest
Container Release : 2.2.19
Severity : important
Type : security

Related News