* bsc#1224788 Cross-References: * CVE-2024-35195 . # Security update for python-requests Announcement ID: SUSE-SU-2024:1880-1 Rating: moderate References: * bsc#1224788 Cross-References: * CVE-2024-35195 CVSS scores: * CVE-2024-35195 ( SUSE ): 6.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N Affected Products: * Basesystem Module 15-SP5 * Basesystem Module 15-SP6 * openSUSE Leap 15.3 * openSUSE Leap 15.5 * openSUSE Leap Micro 5.3 * openSUSE Leap Micro 5.4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.1 * SUSE Linux Enterprise Micro 5.2 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Micro for Rancher 5.2 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 An update that solves one vulnerability can now be installed. ## Description: This update for python-requests fixes the following issues: * CVE-2024-35195: Fixed cert verification regardless of changes to the value of `verify` (bsc#1224788). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.3 zypper in -t patch SUSE-2024-1880=1 * openSUSE Leap Micro 5.3 zypper in -t patch openSUSE-Leap-Micro-5.3-2024-1880=1 * openSUSE Leap Micro 5.4 zypper in -t patch openSUSE-Leap-Micro-5.4-2024-1880=1 * openSUSE Leap 15.5 zypper in -t patchopenSUSE-SLE-15.5-2024-1880=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2024-1880=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2024-1880=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2024-1880=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2024-1880=1 * SUSE Linux Enterprise Micro 5.5 zypper in -t patch SUSE-SLE-Micro-5.5-2024-1880=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2024-1880=1 * Basesystem Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP6-2024-1880=1 * SUSE Linux Enterprise Micro 5.1 zypper in -t patch SUSE-SUSE-MicroOS-5.1-2024-1880=1 * SUSE Linux Enterprise Micro 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2024-1880=1 * SUSE Linux Enterprise Micro for Rancher 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2024-1880=1 ## Package List: * openSUSE Leap 15.3 (noarch) * python3-requests-2.25.1-150300.3.9.1 * python2-requests-2.25.1-150300.3.9.1 * openSUSE Leap Micro 5.3 (noarch) * python3-requests-2.25.1-150300.3.9.1 * openSUSE Leap Micro 5.4 (noarch) * python3-requests-2.25.1-150300.3.9.1 * openSUSE Leap 15.5 (noarch) * python3-requests-2.25.1-150300.3.9.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (noarch) * python3-requests-2.25.1-150300.3.9.1 * SUSE Linux Enterprise Micro 5.3 (noarch) * python3-requests-2.25.1-150300.3.9.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (noarch) * python3-requests-2.25.1-150300.3.9.1 * SUSE Linux Enterprise Micro 5.4 (noarch) * python3-requests-2.25.1-150300.3.9.1 * SUSE Linux Enterprise Micro 5.5 (noarch) * python3-requests-2.25.1-150300.3.9.1 * Basesystem Module 15-SP5 (noarch) * python3-requests-2.25.1-150300.3.9.1 * Basesystem Module 15-SP6 (noarch) * python3-requests-2.25.1-150300.3.9.1 * SUSE Linux EnterpriseMicro 5.1 (noarch) * python3-requests-2.25.1-150300.3.9.1 * SUSE Linux Enterprise Micro 5.2 (noarch) * python3-requests-2.25.1-150300.3.9.1 * SUSE Linux Enterprise Micro for Rancher 5.2 (noarch) * python3-requests-2.25.1-150300.3.9.1 ## References: * https://www.suse.com/security/cve/CVE-2024-35195.html * https://bugzilla.suse.com/show_bug.cgi?id=1224788 . The latest Python-requests upgrade delivers an important patch addressing certificate validation vulnerabilities. Make sure to update for improved security measures.. python Security Updates, SUSE Linux Updates, Security Advisory Steps. . Severity: Important. LinuxSecurity.com Team
Update to 1.9.2. Fixes CVE-2015-3908 (hostname and cert matching in some modules and plugins) and another not yet issued CVE on chroot/jail/zone connection plugins as well as a number of bugfixes.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2015-10797 2015-06-26 18:11:26 -------------------------------------------------------------------------------- Name : ansible Product : Fedora 22 Version : 1.9.2 Release : 1.fc22 URL : https://www.redhat.com/en/ansible-collaborative Summary : SSH-based configuration management, deployment, and task execution system Description : Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically. -------------------------------------------------------------------------------- Update Information: Update to 1.9.2. Fixes CVE-2015-3908 (hostname and cert matching in some modules and plugins) and another not yet issued CVE on chroot/jail/zone connection plugins as well as a number of bugfixes. -------------------------------------------------------------------------------- ChangeLog: * Thu Jun 25 2015 Kevin Fenzi 1.9.2-1 - Update to 1.9.2 * Tue Jun 16 2015 Fedora Release Engineering - 1.9.1-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild * Wed May 27 2015 Toshio Kuratomi - 1.9.1-2 - Fix for dnf -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update ansible' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Get the latest Linux and open source security news straight to your inbox.