Privilege escalation (CVE-2021-3020) and other fixes. References: - https://bugs.mageia.org/show_bug.cgi?id=29047 - . MGASA-2023-0073 - Updated crmsh packages fix security vulnerability Publication date: 01 Mar 2023 URL: https://advisories.mageia.org/MGASA-2023-0073.html Type: security Affected Mageia releases: 8 CVE: CVE-2021-3020 Privilege escalation (CVE-2021-3020) and other fixes. References: - https://bugs.mageia.org/show_bug.cgi?id=29047 - - https://www.cve.org/CVERecord?id=CVE-2021-3020 SRPMS: - 8/core/crmsh-4.4.0-1.mga8 . Mageia's MGASA-2023-0074 addresses a vulnerability in httpd, reinforcing essential security measures for maintaining server reliability.. Mageia Security Update, Privilege Escalation Resolution, crmsh Package Security. . Severity: Important. LinuxSecurity.com Team
An update that solves one vulnerability, contains one feature and has 5 fixes is now available. . openSUSE Security Update: Security update for crmsh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1087-1 Rating: moderate References: #1163460 #1175982 #1179999 #1184465 #1185423 #1187553 SLE-17979 Cross-References: CVE-2020-35459 CVSS scores: CVE-2020-35459 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2020-35459 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability, contains one feature and has 5 fixes is now available. Description: This update for crmsh fixes the following issues: Update to version 4.3.1+20210624.67223df2: - Fix: ocfs2: Skip verifying UUID for ocfs2 device on top of raid or lvm on the join node (bsc#1187553) - Fix: history: use Path.mkdir instead of mkdir command(bsc#1179999, CVE-2020-35459) - Dev: crash_test: Add big warnings to have users' attention to potential failover(jsc#SLE-17979) - Dev: crash_test: rename preflight_check as crash_test(jsc#SLE-17979) - Fix: bootstrap: update sbd watchdog timeout when using diskless SBD with qdevice(bsc#1184465) - Dev: utils: allow configure link-local ipv6 address(bsc#1163460) - Fix: parse: shouldn't allow property setting with an empty value(bsc#1185423) - Fix: help: show help message from argparse(bsc#1175982) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1087=1 Package List: - openSUSE Leap 15.2 (noarch): crmsh-4.3.1+20210702.4e0ee8fb-lp152.4.59.1 crmsh-scripts-4.3.1+20210702.4e0ee8fb-lp152.4.59.1 crmsh-test-4.3.1+20210702.4e0ee8fb-lp152.4.59.1 References: https://www.suse.com/security/cve/CVE-2020-35459.html https://bugzilla.suse.com/1163460 https://bugzilla.suse.com/1175982 https://bugzilla.suse.com/1179999 https://bugzilla.suse.com/1184465 https://bugzilla.suse.com/1185423 https://bugzilla.suse.com/1187553 . The latest openSUSE Leap 15.2 patch addresses a critical bug, including improvements and optimizations for smoother operation.. openSUSE Security Update, crmsh fixes, software patch, system enhancement. . LinuxSecurity.com Team
An update that solves one vulnerability, contains one feature and has 5 fixes is now available. . openSUSE Security Update: Security update for crmsh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2435-1 Rating: moderate References: #1163460 #1175982 #1179999 #1184465 #1185423 #1187553 SLE-17979 Cross-References: CVE-2020-35459 CVSS scores: CVE-2020-35459 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2020-35459 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves one vulnerability, contains one feature and has 5 fixes is now available. Description: This update for crmsh fixes the following issues: Update to version 4.3.1+20210624.67223df2: - Fix: ocfs2: Skip verifying UUID for ocfs2 device on top of raid or lvm on the join node (bsc#1187553) - Fix: history: use Path.mkdir instead of mkdir command(bsc#1179999, CVE-2020-35459) - Dev: crash_test: Add big warnings to have users' attention to potential failover(jsc#SLE-17979) - Dev: crash_test: rename preflight_check as crash_test(jsc#SLE-17979) - Fix: bootstrap: update sbd watchdog timeout when using diskless SBD with qdevice(bsc#1184465) - Dev: utils: allow configure link-local ipv6 address(bsc#1163460) - Fix: parse: shouldn't allow property setting with an empty value(bsc#1185423) - Fix: help: show help message from argparse(bsc#1175982) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2435=1 Package List: -openSUSE Leap 15.3 (noarch): crmsh-4.3.1+20210702.4e0ee8fb-5.59.1 crmsh-scripts-4.3.1+20210702.4e0ee8fb-5.59.1 crmsh-test-4.3.1+20210702.4e0ee8fb-5.59.1 References: https://www.suse.com/security/cve/CVE-2020-35459.html https://bugzilla.suse.com/1163460 https://bugzilla.suse.com/1175982 https://bugzilla.suse.com/1179999 https://bugzilla.suse.com/1184465 https://bugzilla.suse.com/1185423 https://bugzilla.suse.com/1187553 . Critical security updates for openSUSE users improve crmsh protection against vulnerabilities. Update immediately to ensure system integrity and safety. crmsh update, openSUSE security, software patch, moderate fix. . LinuxSecurity.com Team
An update that solves one vulnerability, contains one feature and has 5 fixes is now available. . SUSE Security Update: Security update for crmsh ______________________________________________________________________________ Announcement ID: SUSE-SU-2021:2239-1 Rating: moderate References: #1163460 #1175982 #1179999 #1184465 #1185423 #1187553 SLE-17979 Cross-References: CVE-2020-35459 CVSS scores: CVE-2020-35459 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2020-35459 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise High Availability 15 ______________________________________________________________________________ An update that solves one vulnerability, contains one feature and has 5 fixes is now available. Description: This update for crmsh fixes the following issues: Update to version 4.3.1+20210624.67223df2: - Fix: ocfs2: Skip verifying UUID for ocfs2 device on top of raid or lvm on the join node (bsc#1187553) - Fix: history: use Path.mkdir instead of mkdir command(bsc#1179999, CVE-2020-35459) - Dev: crash_test: Add big warnings to have users' attention to potential failover(jsc#SLE-17979) - Dev: crash_test: rename preflight_check as crash_test(jsc#SLE-17979) - Fix: bootstrap: update sbd watchdog timeout when using diskless SBD with qdevice(bsc#1184465) - Dev: utils: allow configure link-local ipv6 address(bsc#1163460) - Fix: parse: shouldn't allow property setting with an empty value(bsc#1185423) - Fix: help: show help message from argparse(bsc#1175982) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise High Availability 15: zypper in -t patchSUSE-SLE-Product-HA-15-2021-2239=1 Package List: - SUSE Linux Enterprise High Availability 15 (noarch): crmsh-4.3.1+20210624.67223df2-3.74.1 crmsh-scripts-4.3.1+20210624.67223df2-3.74.1 References: https://www.suse.com/security/cve/CVE-2020-35459.html https://bugzilla.suse.com/1163460 https://bugzilla.suse.com/1175982 https://bugzilla.suse.com/1179999 https://bugzilla.suse.com/1184465 https://bugzilla.suse.com/1185423 https://bugzilla.suse.com/1187553 . A minor patch for the system management tool that rectifies a security flaw and incorporates multiple enhancements.. SUSE Enterprise, crmsh Security, update patch, software fixes. . LinuxSecurity.com Team
An update that solves one vulnerability, contains one feature and has 5 fixes is now available. . SUSE Security Update: Security update for crmsh ______________________________________________________________________________ Announcement ID: SUSE-SU-2021:2238-1 Rating: moderate References: #1163460 #1175982 #1179999 #1184465 #1185423 #1187553 SLE-17979 Cross-References: CVE-2020-35459 CVSS scores: CVE-2020-35459 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2020-35459 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise High Availability 15-SP1 ______________________________________________________________________________ An update that solves one vulnerability, contains one feature and has 5 fixes is now available. Description: This update for crmsh fixes the following issues: Update to version 4.3.1+20210624.67223df2: - Fix: ocfs2: Skip verifying UUID for ocfs2 device on top of raid or lvm on the join node (bsc#1187553) - Fix: history: use Path.mkdir instead of mkdir command(bsc#1179999, CVE-2020-35459) - Dev: crash_test: Add big warnings to have users' attention to potential failover(jsc#SLE-17979) - Dev: crash_test: rename preflight_check as crash_test(jsc#SLE-17979) - Fix: bootstrap: update sbd watchdog timeout when using diskless SBD with qdevice(bsc#1184465) - Dev: utils: allow configure link-local ipv6 address(bsc#1163460) - Fix: parse: shouldn't allow property setting with an empty value(bsc#1185423) - Fix: help: show help message from argparse(bsc#1175982) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise High Availability 15-SP1: zypper in -t patchSUSE-SLE-Product-HA-15-SP1-2021-2238=1 Package List: - SUSE Linux Enterprise High Availability 15-SP1 (noarch): crmsh-4.3.1+20210624.67223df2-3.69.1 crmsh-scripts-4.3.1+20210624.67223df2-3.69.1 References: https://www.suse.com/security/cve/CVE-2020-35459.html https://bugzilla.suse.com/1163460 https://bugzilla.suse.com/1175982 https://bugzilla.suse.com/1179999 https://bugzilla.suse.com/1184465 https://bugzilla.suse.com/1185423 https://bugzilla.suse.com/1187553 . The latest crmsh update brings multiple patches for known vulnerabilities and adds a new feature to improve SUSE Linux Enterprise High Availability. SUSE Linux Enterprise, crmsh, security fix, SUSE updates, moderate severity. . LinuxSecurity.com Team
An update that solves two vulnerabilities, contains one feature and has 5 fixes is now available. . SUSE Security Update: Security update for crmsh ______________________________________________________________________________ Announcement ID: SUSE-SU-2021:0806-1 Rating: important References: #1154927 #1178454 #1178869 #1179999 #1180137 #1180571 #1180688 ECO-1658 Cross-References: CVE-2020-35459 CVE-2021-3020 CVSS scores: CVE-2020-35459 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2020-35459 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-3020 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise High Availability 15 ______________________________________________________________________________ An update that solves two vulnerabilities, contains one feature and has 5 fixes is now available. Description: This update for crmsh fixes the following issues: - Update to version 4.3.0+20210219.5d1bf034: * Fix: hb_report: walk through hb_report process under hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571) * Fix: bootstrap: setup authorized ssh access for hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571) * Dev: analyze: Add analyze sublevel and put preflight_check in it(jsc#ECO-1658) * Dev: utils: change default file mod as 644 for str2file function * Dev: hb_report: Detect if any ocfs2 partitions exist * Dev: lock: give more specific error message when raise ClaimLockError * Fix: Replace mktemp() to mkstemp() for security * Fix: Remove the duplicate --cov-report html in tox. * Fix: fix some lint issues. * Fix: Replace utils.msg_info to task.info * Fix: Solve a circular import error of utils.py * Fix: hb_report: run lsof with specific ocfs2 device(bsc#1180688) * Dev: corosync:change the permission of corosync.conf to 644 * Fix: preflight_check: task: raise error when report_path isn't a directory * Fix: bootstrap: Use class Watchdog to simplify watchdog config(bsc#1154927, bsc#1178869) * Dev: Polish the sbd feature. * Dev: Replace -f with -c and run check when no parameter provide. * Fix: Fix the yes option not working * Fix: Remove useless import and show help when no input. * Dev: Correct SBD device id inconsistenc during ASR * Fix: completers: return complete start/stop resource id list correctly(bsc#1180137) * Dev: Makefile.am: change makefile to integrate preflight_check * Medium: integrate preflight_check into crmsh(jsc#ECO-1658) * Fix: bootstrap: make sure sbd device UUID was the same between nodes(bsc#1178454) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise High Availability 15: zypper in -t patch SUSE-SLE-Product-HA-15-2021-806=1 Package List: - SUSE Linux Enterprise High Availability 15 (noarch): crmsh-4.3.0+20210219.5d1bf034-3.62.3 crmsh-scripts-4.3.0+20210219.5d1bf034-3.62.3 References: https://www.suse.com/security/cve/CVE-2020-35459.html https://www.suse.com/security/cve/CVE-2021-3020.html https://bugzilla.suse.com/1154927 https://bugzilla.suse.com/1178454 https://bugzilla.suse.com/1178869 https://bugzilla.suse.com/1179999 https://bugzilla.suse.com/1180137 https://bugzilla.suse.com/1180571 https://bugzilla.suse.com/1180688 . Crucial SUSE security patch addresses various vulnerabilities in crmsh, bolstering system robustness and dependability.. SUSE Security Update, Crmsh Fixes, Linux System Update. . Severity: Important. LinuxSecurity.com Team
An update that solves two vulnerabilities and has 7 fixes is now available. . openSUSE Security Update: Security update for crmsh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0410-1 Rating: important References: #1154927 #1178454 #1178869 #1179999 #1180126 #1180137 #1180571 #1180688 #1181415 Cross-References: CVE-2020-35459 CVE-2021-3020 CVSS scores: CVE-2020-35459 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2020-35459 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-3020 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has 7 fixes is now available. Description: This update for crmsh fixes the following issues: - Update to version 4.3.0+20210305.9db5c9a8: * Fix: bootstrap: Adjust qdevice configure/remove process to avoid race condition due to quorum lost(bsc#1181415) * Dev: cibconfig: remove related code about detecting crm_diff support --no-verion * Fix: ui_configure: raise error when params not exist(bsc#1180126) * Dev: doc: remove doc for crm node status * Dev: ui_node: remove status subcommand - Update to version 4.3.0+20210219.5d1bf034: * Fix: hb_report: walk through hb_report process under hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571) * Fix: bootstrap: setup authorized ssh access for hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571) * Dev: analyze: Add analyze sublevel and put preflight_check in it(jsc#ECO-1658) * Dev: utils: change default file mod as 644 for str2file function * Dev: hb_report: Detect if any ocfs2 partitions exist * Dev: lock: give morespecific error message when raise ClaimLockError * Fix: Replace mktemp() to mkstemp() for security * Fix: Remove the duplicate --cov-report html in tox. * Fix: fix some lint issues. * Fix: Replace utils.msg_info to task.info * Fix: Solve a circular import error of utils.py * Fix: hb_report: run lsof with specific ocfs2 device(bsc#1180688) * Dev: corosync: change the permission of corosync.conf to 644 * Fix: preflight_check: task: raise error when report_path isn't a directory * Fix: bootstrap: Use class Watchdog to simplify watchdog config(bsc#1154927, bsc#1178869) * Dev: Polish the sbd feature. * Dev: Replace -f with -c and run check when no parameter provide. * Fix: Fix the yes option not working * Fix: Remove useless import and show help when no input. * Dev: Correct SBD device id inconsistenc during ASR * Fix: completers: return complete start/stop resource id list correctly(bsc#1180137) * Dev: Makefile.am: change makefile to integrate preflight_check * Medium: integrate preflight_check into crmsh(jsc#ECO-1658) * Fix: bootstrap: make sure sbd device UUID was the same between nodes(bsc#1178454) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-410=1 Package List: - openSUSE Leap 15.2 (noarch): crmsh-4.3.0+20210305.9db5c9a8-lp152.4.47.1 crmsh-scripts-4.3.0+20210305.9db5c9a8-lp152.4.47.1 crmsh-test-4.3.0+20210305.9db5c9a8-lp152.4.47.1 References: https://www.suse.com/security/cve/CVE-2020-35459.html https://www.suse.com/security/cve/CVE-2021-3020.html https://bugzilla.suse.com/1154927 https://bugzilla.suse.com/1178454 https://bugzilla.suse.com/1178869 https://bugzilla.suse.com/1179999 https://bugzilla.suse.com/1180126 https://bugzilla.suse.com/1180137 https://bugzilla.suse.com/1180571 https://bugzilla.suse.com/1180688 https://bugzilla.suse.com/1181415 . The latest release of crmsh addresses a pair of security flaws and incorporates seven critical patches designed to improve system integrity.. crmsh Security Update, openSUSE Patch, Important Security Fixes. . Severity: Important. LinuxSecurity.com Team
An update that solves two vulnerabilities, contains one feature and has 7 fixes is now available. . SUSE Security Update: Security update for crmsh ______________________________________________________________________________ Announcement ID: SUSE-SU-2021:0781-1 Rating: important References: #1154927 #1178454 #1178869 #1179999 #1180126 #1180137 #1180571 #1180688 #1181415 ECO-1658 Cross-References: CVE-2020-35459 CVE-2021-3020 CVSS scores: CVE-2020-35459 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2020-35459 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-3020 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise High Availability 15-SP2 ______________________________________________________________________________ An update that solves two vulnerabilities, contains one feature and has 7 fixes is now available. Description: This update for crmsh fixes the following issues: - Update to version 4.3.0+20210305.9db5c9a8: * Fix: bootstrap: Adjust qdevice configure/remove process to avoid race condition due to quorum lost(bsc#1181415) * Dev: cibconfig: remove related code about detecting crm_diff support --no-verion * Fix: ui_configure: raise error when params not exist(bsc#1180126) * Dev: doc: remove doc for crm node status * Dev: ui_node: remove status subcommand - Update to version 4.3.0+20210219.5d1bf034: * Fix: hb_report: walk through hb_report process under hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571) * Fix: bootstrap: setup authorized ssh access for hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571) * Dev: analyze: Add analyze sublevel and put preflight_check in it(jsc#ECO-1658) * Dev: utils: change default file mod as 644 for str2file function * Dev: hb_report: Detect if any ocfs2 partitions exist * Dev: lock: give more specific error message when raise ClaimLockError * Fix: Replace mktemp() to mkstemp() for security * Fix: Remove the duplicate --cov-report html in tox. * Fix: fix some lint issues. * Fix: Replace utils.msg_info to task.info * Fix: Solve a circular import error of utils.py * Fix: hb_report: run lsof with specific ocfs2 device(bsc#1180688) * Dev: corosync: change the permission of corosync.conf to 644 * Fix: preflight_check: task: raise error when report_path isn't a directory * Fix: bootstrap: Use class Watchdog to simplify watchdog config(bsc#1154927, bsc#1178869) * Dev: Polish the sbd feature. * Dev: Replace -f with -c and run check when no parameter provide. * Fix: Fix the yes option not working * Fix: Remove useless import and show help when no input. * Dev: Correct SBD device id inconsistenc during ASR * Fix: completers: return complete start/stop resource id list correctly(bsc#1180137) * Dev: Makefile.am: change makefile to integrate preflight_check * Medium: integrate preflight_check into crmsh(jsc#ECO-1658) * Fix: bootstrap: make sure sbd device UUID was the same between nodes(bsc#1178454) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise High Availability 15-SP2: zypper in -t patch SUSE-SLE-Product-HA-15-SP2-2021-781=1 Package List: - SUSE Linux Enterprise High Availability 15-SP2 (noarch): crmsh-4.3.0+20210305.9db5c9a8-5.42.1 crmsh-scripts-4.3.0+20210305.9db5c9a8-5.42.1 References: https://www.suse.com/security/cve/CVE-2020-35459.html https://www.suse.com/security/cve/CVE-2021-3020.html https://bugzilla.suse.com/1154927 https://bugzilla.suse.com/1178454 https://bugzilla.suse.com/1178869 https://bugzilla.suse.com/1179999 https://bugzilla.suse.com/1180126 https://bugzilla.suse.com/1180137 https://bugzilla.suse.com/1180571 https://bugzilla.suse.com/1180688 https://bugzilla.suse.com/1181415 . The latest enhancement for crmsh tackles various concerns and integrates functionalities related to SUSE's Security Advisory ID: SUSE-SU-2021:0781-1.. crmsh, SUSE Security Update, High Availability, security patch. . Severity: Important. LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.