Rebuild to mitigate CVE-2022-{1705,32148,30631,30633,28131,30635,30632,30630,1962} in golang --- See https://groups.google.com/g/golang-dev/c/frczlF8OFQ0/m/4lrZh5BHDgAJ for more information about the specific vulnerabilities.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-ea8f4e232d 2022-07-30 01:52:05.591840 --------------------------------------------------------------------------------Name : golang-github-googleapis-gnostic Product : Fedora 36 Version : 0.5.3 Release : 7.fc36 URL : https://github.com/google/gnostic Summary : Compiler for APIs described by the OpenAPI Specification Description : This package contains a Go command line tool which converts JSON and YAML OpenAPI descriptions to and from equivalent Protocol Buffer representations. Protocol Buffers provide a language-neutral, platform-neutral, extensible mechanism for serializing structured data. gnostic's Protocol Buffer models for the OpenAPI Specification can be used to generate code that includes data structures with explicit fields for the elements of an OpenAPI description. This makes it possible for developers to work with OpenAPI descriptions in type-safe ways, which is particularly useful in strongly-typed languages like Go and Swift. gnostic reads OpenAPI descriptions into these generated data structures, reports errors, resolves internal dependencies, and writes the results in a binary form that can be used in any language that is supported by the Protocol Buffer tools. A plugin interface simplifies integration with API tools written in a variety of different languages, and when necessary, Protocol Buffer OpenAPI descriptions can be reexported as JSON or YAML. gnostic compilation code and OpenAPI Protocol Buffer models are automatically generated from an OpenAPI JSON Schema. Source code for the generator is in the generate-gnosticdirectory. --------------------------------------------------------------------------------Update Information: Rebuild to mitigate CVE-2022-{1705,32148,30631,30633,28131,30635,30632,30630,1962} in golang ---See https://groups.google.com/g/golang-dev/c/frczlF8OFQ0/m/4lrZh5BHDgAJ for more information about the specific vulnerabilities. --------------------------------------------------------------------------------ChangeLog: * Tue Jul 19 2022 Maxwell G - 0.5.3-7 - Rebuild for CVE-2022-{1705,32148,30631,30633,28131,30635,30632,30630,1962} in golang --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-ea8f4e232d' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
An update that fixes one vulnerability is now available. . SUSE Security Update: Security update for libvirt ______________________________________________________________________________ Announcement ID: SUSE-SU-2019:1690-1 Rating: important References: #1138301 Cross-References: CVE-2019-10161 Affected Products: SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libvirt fixes the following issue: Security issue fixed: - CVE-2019-10161: Fixed virDomainSaveImageGetXMLDesc API which could accept a path parameter pointing anywhere on the system and potentially leading to execution of a malicious file with root privileges by libvirtd (bsc#1138301). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2019-1690=1 Package List: - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): libvirt-1.2.5-27.19.1 libvirt-client-1.2.5-27.19.1 libvirt-client-debuginfo-1.2.5-27.19.1 libvirt-daemon-1.2.5-27.19.1 libvirt-daemon-config-network-1.2.5-27.19.1 libvirt-daemon-config-nwfilter-1.2.5-27.19.1 libvirt-daemon-debuginfo-1.2.5-27.19.1 libvirt-daemon-driver-interface-1.2.5-27.19.1 libvirt-daemon-driver-interface-debuginfo-1.2.5-27.19.1 libvirt-daemon-driver-lxc-1.2.5-27.19.1 libvirt-daemon-driver-lxc-debuginfo-1.2.5-27.19.1 libvirt-daemon-driver-network-1.2.5-27.19.1 libvirt-daemon-driver-network-debuginfo-1.2.5-27.19.1 libvirt-daemon-driver-nodedev-1.2.5-27.19.1 libvirt-daemon-driver-nodedev-debuginfo-1.2.5-27.19.1 libvirt-daemon-driver-nwfilter-1.2.5-27.19.1 libvirt-daemon-driver-nwfilter-debuginfo-1.2.5-27.19.1 libvirt-daemon-driver-qemu-1.2.5-27.19.1 libvirt-daemon-driver-qemu-debuginfo-1.2.5-27.19.1 libvirt-daemon-driver-secret-1.2.5-27.19.1 libvirt-daemon-driver-secret-debuginfo-1.2.5-27.19.1 libvirt-daemon-driver-storage-1.2.5-27.19.1 libvirt-daemon-driver-storage-debuginfo-1.2.5-27.19.1 libvirt-daemon-lxc-1.2.5-27.19.1 libvirt-daemon-qemu-1.2.5-27.19.1 libvirt-debugsource-1.2.5-27.19.1 libvirt-doc-1.2.5-27.19.1 libvirt-lock-sanlock-1.2.5-27.19.1 libvirt-lock-sanlock-debuginfo-1.2.5-27.19.1 - SUSE Linux Enterprise Server 12-LTSS (x86_64): libvirt-daemon-driver-libxl-1.2.5-27.19.1 libvirt-daemon-driver-libxl-debuginfo-1.2.5-27.19.1 libvirt-daemon-xen-1.2.5-27.19.1 References: https://www.suse.com/security/cve/CVE-2019-10161.html https://bugzilla.suse.com/1138301 _______________________________________________ sle-security-updates mailing list
Get the latest Linux and open source security news straight to your inbox.