SUSE Container Update Advisory: suse/sle15
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2023:3677-1
Container Tags        : bci/bci-base:15.5 , bci/bci-base:15.5.36.5.52 , suse/sle15:15.5 , suse/sle15:15.5.36.5.52
Container Release     : 36.5.52
Severity              : important
Type                  : security
References            : 1196647 1212475 
-----------------------------------------------------------------

The container suse/sle15 was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:4309-1
Released:    Tue Oct 31 14:09:03 2023
Summary:     Security update for container-suseconnect
Type:        security
Severity:    important
References:  1212475

This update of container-suseconnect fixes the following issues:

- rebuild the package with the go 1.21 security release (bsc#1212475).

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:4310-1
Released:    Tue Oct 31 14:10:47 2023
Summary:     Recommended update for libtirpc
Type:        recommended
Severity:    moderate
References:  1196647
This Update for libtirpc to 1.3.4, fixing the following issues:
    
Update to 1.3.4 (bsc#1199467)

 * binddynport.c honor ip_local_reserved_ports
   - replaces: binddynport-honor-ip_local_reserved_ports.patch
 * gss-api: expose gss major/minor error in authgss_refresh()
 * rpcb_clnt.c: Eliminate double frees in delete_cache()
 * rpcb_clnt.c: memory leak in destroy_addr
 * portmapper: allow TCP-only portmapper
 * getnetconfigent: avoid potential DoS issue by removing unnecessary sleep
 * clnt_raw.c: fix a possible null pointer dereference
 * bindresvport.c: fix a potential resource leakage

Update to 1.3.3:

* Fix DoS vulnerability in libtirpc
  - replaces: 0001-Fix-DoS-vulnerability-in-libtirpc.patch
* _rpc_dtablesize: use portable system call
* libtirpc: Fix use-after-free accessing the error number
* Fix potential memory leak of parms.r_addr
  - replaces 0001-fix-parms.r_addr-memory-leak.patch
* rpcb_clnt.c add mechanism to try v2 protocol first
  - preplaces: 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch
* Eliminate deadlocks in connects with an MT environment
* clnt_dg_freeres() uncleared set active state may deadlock
* thread safe clnt destruction
* SUNRPC: mutexed access blacklist_read state variable
* SUNRPC: MT-safe overhaul of address cache management in rpcb_clnt.c

Update to 1.3.2:

* Replace the final SunRPC licenses with BSD licenses
* blacklist: Add a few more well known ports
* libtirpc: disallow calling auth_refresh from clnt_call with RPCSEC_GSS

Update to 1.3.1:

* Remove AUTH_DES interfaces from auth_des.h
  The unsupported  AUTH_DES authentication has be
  compiled out since commit d918e41d889 (Wed Oct 9 2019)
  replaced by API routines that return errors.
* svc_dg: Free xp_netid during destroy
* Fix memory management issues of fd locks
* libtirpc: replace array with list for per-fd locks
* __svc_vc_dodestroy: fix double free of xp_ltaddr.buf
* __rpc_dtbsize: rlim_cur instead of rlim_max
* pkg-config: use the correct replacements for libdir/includedir


The following package changes have been done:

- container-suseconnect-2.4.0-150000.4.42.1 updated
- libtirpc-netconfig-1.3.4-150300.3.20.1 updated
- libtirpc3-1.3.4-150300.3.20.1 updated

SUSE: 2023:3677-1 suse/sle15 Security Update

November 2, 2023
The container suse/sle15 was updated

Summary

Advisory ID: SUSE-SU-2023:4309-1 Released: Tue Oct 31 14:09:03 2023 Summary: Security update for container-suseconnect Type: security Severity: important Advisory ID: SUSE-RU-2023:4310-1 Released: Tue Oct 31 14:10:47 2023 Summary: Recommended update for libtirpc Type: recommended Severity: moderate

References

References : 1196647 1212475

1212475

This update of container-suseconnect fixes the following issues:

- rebuild the package with the go 1.21 security release (bsc#1212475).

1196647

This Update for libtirpc to 1.3.4, fixing the following issues:

Update to 1.3.4 (bsc#1199467)

* binddynport.c honor ip_local_reserved_ports

- replaces: binddynport-honor-ip_local_reserved_ports.patch

* gss-api: expose gss major/minor error in authgss_refresh()

* rpcb_clnt.c: Eliminate double frees in delete_cache()

* rpcb_clnt.c: memory leak in destroy_addr

* portmapper: allow TCP-only portmapper

* getnetconfigent: avoid potential DoS issue by removing unnecessary sleep

* clnt_raw.c: fix a possible null pointer dereference

* bindresvport.c: fix a potential resource leakage

Update to 1.3.3:

* Fix DoS vulnerability in libtirpc

- replaces: 0001-Fix-DoS-vulnerability-in-libtirpc.patch

* _rpc_dtablesize: use portable system call

* libtirpc: Fix use-after-free accessing the error number

* Fix potential memory leak of parms.r_addr

- replaces 0001-fix-parms.r_addr-memory-leak.patch

* rpcb_clnt.c add mechanism to try v2 protocol first

- preplaces: 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch

* Eliminate deadlocks in connects with an MT environment

* clnt_dg_freeres() uncleared set active state may deadlock

* thread safe clnt destruction

* SUNRPC: mutexed access blacklist_read state variable

* SUNRPC: MT-safe overhaul of address cache management in rpcb_clnt.c

Update to 1.3.2:

* Replace the final SunRPC licenses with BSD licenses

* blacklist: Add a few more well known ports

* libtirpc: disallow calling auth_refresh from clnt_call with RPCSEC_GSS

Update to 1.3.1:

* Remove AUTH_DES interfaces from auth_des.h

The unsupported AUTH_DES authentication has be

compiled out since commit d918e41d889 (Wed Oct 9 2019)

replaced by API routines that return errors.

* svc_dg: Free xp_netid during destroy

* Fix memory management issues of fd locks

* libtirpc: replace array with list for per-fd locks

* __svc_vc_dodestroy: fix double free of xp_ltaddr.buf

* __rpc_dtbsize: rlim_cur instead of rlim_max

* pkg-config: use the correct replacements for libdir/includedir

The following package changes have been done:

- container-suseconnect-2.4.0-150000.4.42.1 updated

- libtirpc-netconfig-1.3.4-150300.3.20.1 updated

- libtirpc3-1.3.4-150300.3.20.1 updated

Severity
Container Advisory ID : SUSE-CU-2023:3677-1
Container Tags : bci/bci-base:15.5 , bci/bci-base:15.5.36.5.52 , suse/sle15:15.5 , suse/sle15:15.5.36.5.52
Container Release : 36.5.52
Severity : important
Type : security

Related News

News

Powered By

Footer Logo

Linux Security - Your source for Top Linux News, Advisories, HowTo's and Feature Release.

Powered By

Footer Logo