* bsc#1216588 Cross-References: * CVE-2023-46137 . # Security update for python3-Twisted Announcement ID: SUSE-SU-2023:4607-1 Rating: moderate References: * bsc#1216588 Cross-References: * CVE-2023-46137 CVSS scores: * CVE-2023-46137 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2023-46137 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * Server Applications Module 15-SP4 * Server Applications Module 15-SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves one vulnerability can now be installed. ## Description: This update for python3-Twisted fixes the following issues: * CVE-2023-46137: Fixed issue inside serializing pipelined HTTP requests. (bsc#1216588) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2023-4607=1 openSUSE-SLE-15.4-2023-4607=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-4607=1 * Server Applications Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2023-4607=1 * Server Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP5-2023-4607=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * python3-Twisted-22.2.0-150400.15.1 *python-Twisted-doc-22.2.0-150400.15.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * python3-Twisted-22.2.0-150400.15.1 * Server Applications Module 15-SP4 (aarch64 ppc64le s390x x86_64) * python3-Twisted-22.2.0-150400.15.1 * Server Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64) * python3-Twisted-22.2.0-150400.15.1 ## References: * https://www.suse.com/security/cve/CVE-2023-46137.html * https://bugzilla.suse.com/show_bug.cgi?id=1216588 . An important patch for python3-Twisted has been deployed to address serious HTTP processing flaws in SUSE 15.4 and 15.5.. SUSE update, python3-Twisted security, HTTP requests fix, openSUSE vulnerability. . LinuxSecurity.com Team
An update is now available for Red Hat AMQ Clients 2.6.0. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: AMQ Clients 2.6.0 Release Advisory ID: RHSA-2020:0601-01 Product: Red Hat AMQ Clients Advisory URL: https://access.redhat.com/errata/RHSA-2020:0601 Issue date: 2020-02-25 CVE Names: CVE-2019-20444 CVE-2019-20445 CVE-2020-7238 ==================================================================== 1. Summary: An update is now available for Red Hat AMQ Clients 2.6.0. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: 6Client-AMQ-Clients-2 - i386, noarch, x86_64 6ComputeNode-AMQ-Clients-2 - noarch, x86_64 6Server-AMQ-Clients-2 - i386, noarch, x86_64 6Workstation-AMQ-Clients-2 - i386, noarch, x86_64 7Client-AMQ-Clients-2 - noarch, x86_64 7ComputeNode-AMQ-Clients-2 - noarch, x86_64 7Server-AMQ-Clients-2 - noarch, x86_64 7Workstation-AMQ-Clients-2 - noarch, x86_64 8Base-AMQ-Clients-2 - noarch, x86_64 3. Description: Red Hat AMQ Clients enable connecting, sending, and receiving messages over the AMQP 1.0 wire transport protocol to or from AMQ Broker 6 and 7. This update provides various bug fixes and enhancements in addition to the client package versions previously released on Red Hat Enterprise Linux 6, 7, and 8. Security Fix(es): * netty: HTTP request smuggling (CVE-2019-20444) * netty: HttpObjectDecoder.java allows Content-Length header toaccompanied by second Content-Length header (CVE-2019-20445) * netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling (CVE-2020-7238) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1796225 - CVE-2020-7238 netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling 1798509 - CVE-2019-20445 netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header 1798524 - CVE-2019-20444 netty: HTTP request smuggling 6. JIRA issues fixed (https://redhat.atlassian.net/jira/projects): ENTMQCL-1075 - [python] Example broker.py is using collections.deque.count from Python 2.7 ENTMQCL-1076 - [python] Example abstract_server.py is using relative import ENTMQCL-1246 - [python] Install egg-info directory ENTMQCL-1287 - [python] Read a config file to get default connection parameters (Windows) ENTMQCL-1322 - amqpnetlite-sdk-2.1.6 does not export resource strings ENTMQCL-1361 - [python] Convert strings in the API to AMQP symbols where required ENTMQCL-1364 - [python] P2P detach frame not received results in connection aborted ENTMQCL-1578 - [python] qpid-proton-0.28.0-1.el7 leaks memory ENTMQCL-1583 - [doc] Broken links in rh-messaging/amq-docs master ENTMQCL-1635 - [javascript] File-based connection configuration can't use named ports ENTMQCL-1641 - [dotnet] Update AMQ .NET Client based on amqpnetlite 2.2 ENTMQCL-1679 - [python] HOME location of file-based connection configuration does not point to HOME location ENTMQCL-1717 - [python] Default port should be amqps ENTMQCL-1726 - [jms] Improve performance when using simulated anonymousproducersENTMQCL-1781 - Established connections are aborted after the system clock is shifted forward ENTMQCL-1818 - [javascript] npm install fails due to missing configuration file for ESLint ENTMQCL-1835 - [jms] client-ack consumers don't increment remote delivery count on closure after fresh recover 7. PackageList: 6Client-AMQ-Clients-2: Source: qpid-proton-0.30.0-4.el6_10.src.rpm i386: python-qpid-proton-0.30.0-4.el6_10.i686.rpm qpid-proton-c-0.30.0-4.el6_10.i686.rpm qpid-proton-c-devel-0.30.0-4.el6_10.i686.rpm qpid-proton-cpp-0.30.0-4.el6_10.i686.rpm qpid-proton-cpp-devel-0.30.0-4.el6_10.i686.rpm qpid-proton-debuginfo-0.30.0-4.el6_10.i686.rpm noarch: python-qpid-proton-docs-0.30.0-4.el6_10.noarch.rpm qpid-proton-c-docs-0.30.0-4.el6_10.noarch.rpm qpid-proton-cpp-docs-0.30.0-4.el6_10.noarch.rpm qpid-proton-tests-0.30.0-4.el6_10.noarch.rpm x86_64: python-qpid-proton-0.30.0-4.el6_10.x86_64.rpm qpid-proton-c-0.30.0-4.el6_10.x86_64.rpm qpid-proton-c-devel-0.30.0-4.el6_10.x86_64.rpm qpid-proton-cpp-0.30.0-4.el6_10.x86_64.rpm qpid-proton-cpp-devel-0.30.0-4.el6_10.x86_64.rpm qpid-proton-debuginfo-0.30.0-4.el6_10.x86_64.rpm 6ComputeNode-AMQ-Clients-2: Source: qpid-proton-0.30.0-4.el6_10.src.rpm noarch: python-qpid-proton-docs-0.30.0-4.el6_10.noarch.rpm qpid-proton-c-docs-0.30.0-4.el6_10.noarch.rpm qpid-proton-cpp-docs-0.30.0-4.el6_10.noarch.rpm qpid-proton-tests-0.30.0-4.el6_10.noarch.rpm x86_64: python-qpid-proton-0.30.0-4.el6_10.x86_64.rpm qpid-proton-c-0.30.0-4.el6_10.x86_64.rpm qpid-proton-c-devel-0.30.0-4.el6_10.x86_64.rpm qpid-proton-cpp-0.30.0-4.el6_10.x86_64.rpm qpid-proton-cpp-devel-0.30.0-4.el6_10.x86_64.rpm qpid-proton-debuginfo-0.30.0-4.el6_10.x86_64.rpm 6Server-AMQ-Clients-2: Source: qpid-proton-0.30.0-4.el6_10.src.rpm i386: python-qpid-proton-0.30.0-4.el6_10.i686.rpm qpid-proton-c-0.30.0-4.el6_10.i686.rpm qpid-proton-c-devel-0.30.0-4.el6_10.i686.rpm qpid-proton-cpp-0.30.0-4.el6_10.i686.rpm qpid-proton-cpp-devel-0.30.0-4.el6_10.i686.rpm qpid-proton-debuginfo-0.30.0-4.el6_10.i686.rpm noarch: python-qpid-proton-docs-0.30.0-4.el6_10.noarch.rpm qpid-proton-c-docs-0.30.0-4.el6_10.noarch.rpm qpid-proton-cpp-docs-0.30.0-4.el6_10.noarch.rpm qpid-proton-tests-0.30.0-4.el6_10.noarch.rpm x86_64: python-qpid-proton-0.30.0-4.el6_10.x86_64.rpm qpid-proton-c-0.30.0-4.el6_10.x86_64.rpm qpid-proton-c-devel-0.30.0-4.el6_10.x86_64.rpm qpid-proton-cpp-0.30.0-4.el6_10.x86_64.rpm qpid-proton-cpp-devel-0.30.0-4.el6_10.x86_64.rpm qpid-proton-debuginfo-0.30.0-4.el6_10.x86_64.rpm 6Workstation-AMQ-Clients-2: Source: qpid-proton-0.30.0-4.el6_10.src.rpm i386: python-qpid-proton-0.30.0-4.el6_10.i686.rpm qpid-proton-c-0.30.0-4.el6_10.i686.rpm qpid-proton-c-devel-0.30.0-4.el6_10.i686.rpm qpid-proton-cpp-0.30.0-4.el6_10.i686.rpm qpid-proton-cpp-devel-0.30.0-4.el6_10.i686.rpm qpid-proton-debuginfo-0.30.0-4.el6_10.i686.rpm noarch: python-qpid-proton-docs-0.30.0-4.el6_10.noarch.rpm qpid-proton-c-docs-0.30.0-4.el6_10.noarch.rpm qpid-proton-cpp-docs-0.30.0-4.el6_10.noarch.rpm qpid-proton-tests-0.30.0-4.el6_10.noarch.rpm x86_64: python-qpid-proton-0.30.0-4.el6_10.x86_64.rpm qpid-proton-c-0.30.0-4.el6_10.x86_64.rpm qpid-proton-c-devel-0.30.0-4.el6_10.x86_64.rpm qpid-proton-cpp-0.30.0-4.el6_10.x86_64.rpm qpid-proton-cpp-devel-0.30.0-4.el6_10.x86_64.rpm qpid-proton-debuginfo-0.30.0-4.el6_10.x86_64.rpm 7Client-AMQ-Clients-2: Source: qpid-proton-0.30.0-2.el7.src.rpm rubygem-qpid_proton-0.30.0-1.el7.src.rpm noarch: python-qpid-proton-docs-0.30.0-2.el7.noarch.rpm qpid-proton-c-docs-0.30.0-2.el7.noarch.rpm qpid-proton-cpp-docs-0.30.0-2.el7.noarch.rpm qpid-proton-tests-0.30.0-2.el7.noarch.rpm rubygem-qpid_proton-doc-0.30.0-1.el7.noarch.rpm x86_64: python-qpid-proton-0.30.0-2.el7.x86_64.rpm qpid-proton-c-0.30.0-2.el7.x86_64.rpm qpid-proton-c-devel-0.30.0-2.el7.x86_64.rpm qpid-proton-cpp-0.30.0-2.el7.x86_64.rpm qpid-proton-cpp-devel-0.30.0-2.el7.x86_64.rpm qpid-proton-debuginfo-0.30.0-2.el7.x86_64.rpm rubygem-qpid_proton-0.30.0-1.el7.x86_64.rpm rubygem-qpid_proton-debuginfo-0.30.0-1.el7.x86_64.rpm 7ComputeNode-AMQ-Clients-2: Source: qpid-proton-0.30.0-2.el7.src.rpm rubygem-qpid_proton-0.30.0-1.el7.src.rpm noarch: python-qpid-proton-docs-0.30.0-2.el7.noarch.rpm qpid-proton-c-docs-0.30.0-2.el7.noarch.rpm qpid-proton-cpp-docs-0.30.0-2.el7.noarch.rpm qpid-proton-tests-0.30.0-2.el7.noarch.rpm rubygem-qpid_proton-doc-0.30.0-1.el7.noarch.rpm x86_64: python-qpid-proton-0.30.0-2.el7.x86_64.rpm qpid-proton-c-0.30.0-2.el7.x86_64.rpm qpid-proton-c-devel-0.30.0-2.el7.x86_64.rpm qpid-proton-cpp-0.30.0-2.el7.x86_64.rpm qpid-proton-cpp-devel-0.30.0-2.el7.x86_64.rpm qpid-proton-debuginfo-0.30.0-2.el7.x86_64.rpm rubygem-qpid_proton-0.30.0-1.el7.x86_64.rpm rubygem-qpid_proton-debuginfo-0.30.0-1.el7.x86_64.rpm 7Server-AMQ-Clients-2: Source: qpid-proton-0.30.0-2.el7.src.rpm rubygem-qpid_proton-0.30.0-1.el7.src.rpm noarch: python-qpid-proton-docs-0.30.0-2.el7.noarch.rpm qpid-proton-c-docs-0.30.0-2.el7.noarch.rpm qpid-proton-cpp-docs-0.30.0-2.el7.noarch.rpm qpid-proton-tests-0.30.0-2.el7.noarch.rpm rubygem-qpid_proton-doc-0.30.0-1.el7.noarch.rpm x86_64: python-qpid-proton-0.30.0-2.el7.x86_64.rpm qpid-proton-c-0.30.0-2.el7.x86_64.rpm qpid-proton-c-devel-0.30.0-2.el7.x86_64.rpm qpid-proton-cpp-0.30.0-2.el7.x86_64.rpm qpid-proton-cpp-devel-0.30.0-2.el7.x86_64.rpm qpid-proton-debuginfo-0.30.0-2.el7.x86_64.rpm rubygem-qpid_proton-0.30.0-1.el7.x86_64.rpm rubygem-qpid_proton-debuginfo-0.30.0-1.el7.x86_64.rpm 7Workstation-AMQ-Clients-2: Source: qpid-proton-0.30.0-2.el7.src.rpm rubygem-qpid_proton-0.30.0-1.el7.src.rpm noarch: python-qpid-proton-docs-0.30.0-2.el7.noarch.rpm qpid-proton-c-docs-0.30.0-2.el7.noarch.rpm qpid-proton-cpp-docs-0.30.0-2.el7.noarch.rpm qpid-proton-tests-0.30.0-2.el7.noarch.rpm rubygem-qpid_proton-doc-0.30.0-1.el7.noarch.rpm x86_64: python-qpid-proton-0.30.0-2.el7.x86_64.rpm qpid-proton-c-0.30.0-2.el7.x86_64.rpm qpid-proton-c-devel-0.30.0-2.el7.x86_64.rpm qpid-proton-cpp-0.30.0-2.el7.x86_64.rpm qpid-proton-cpp-devel-0.30.0-2.el7.x86_64.rpm qpid-proton-debuginfo-0.30.0-2.el7.x86_64.rpm rubygem-qpid_proton-0.30.0-1.el7.x86_64.rpm rubygem-qpid_proton-debuginfo-0.30.0-1.el7.x86_64.rpm 8Base-AMQ-Clients-2: Source: nodejs-rhea-1.0.16-1.el8.src.rpm qpid-proton-0.30.0-3.el8.src.rpm rubygem-qpid_proton-0.30.0-1.el8.src.rpm noarch: nodejs-rhea-1.0.16-1.el8.noarch.rpm python-qpid-proton-docs-0.30.0-3.el8.noarch.rpm qpid-proton-c-docs-0.30.0-3.el8.noarch.rpm qpid-proton-cpp-docs-0.30.0-3.el8.noarch.rpm qpid-proton-tests-0.30.0-3.el8.noarch.rpm rubygem-qpid_proton-doc-0.30.0-1.el8.noarch.rpm x86_64: python3-qpid-proton-0.30.0-3.el8.x86_64.rpm python3-qpid-proton-debuginfo-0.30.0-3.el8.x86_64.rpm qpid-proton-c-0.30.0-3.el8.x86_64.rpm qpid-proton-c-debuginfo-0.30.0-3.el8.x86_64.rpm qpid-proton-c-devel-0.30.0-3.el8.x86_64.rpm qpid-proton-cpp-0.30.0-3.el8.x86_64.rpm qpid-proton-cpp-debuginfo-0.30.0-3.el8.x86_64.rpm qpid-proton-cpp-devel-0.30.0-3.el8.x86_64.rpm qpid-proton-debuginfo-0.30.0-3.el8.x86_64.rpm qpid-proton-debugsource-0.30.0-3.el8.x86_64.rpm rubygem-qpid_proton-0.30.0-1.el8.x86_64.rpm rubygem-qpid_proton-debuginfo-0.30.0-1.el8.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 8. References: https://access.redhat.com/security/cve/CVE-2019-20444 https://access.redhat.com/security/cve/CVE-2019-20445 https://access.redhat.com/security/cve/CVE-2020-7238 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/documentation/en-us/red_hat_amq/ 9. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBXlU9u9zjgjWX9erEAQjJRg/9EWdSUKhNIQBO7WFXvi/PO/2ebxBePbDH l0mUNYaOeKyLJvSDLdE8OY25r1zdG6ZgrZLsiPUV31MLlyqXIUXPpFaylv74yZDy /oP8HnhaHQ29/RhooT5QLxqyCF7f4Bh+1C8VrrwSVKVvlt0Nwz3pC2uZudD6qv8r juZ8qNjWaQrD5RjWNKljRIzP/VWTU+9GTpACHmK5aTzcN+IgwSP+xJ9oIxnCvjNZ OhEPTnbYwVA645klWUpFKlj/eFIPSVl3/LTY3F5U1RPlU8qAGIBqPS6gUJSvFg5i HPOSa0yhFYD7jnPOR4SC24+/eLJaroP+GmnujWGSR10wnE4UZzoFtaw1OJblMdPt 8Ucs5Y0h7KBZwirSLVKEn8hW92cb3IjnCWde4aZjg46fbXrpeGi0tCtE+gh3shUC 3EBEtgU3/I3FoakQty7ePe6YHfFN3+u8Z3TsIQ9GJUCtZj/eeQyqGKLFgAncA6O6 cfZTDMzDU36snL11T8hAcVi2AKoJTxkbqzKy/A28xT11FYrGAGkATsb7mH16CRb9 zFmcsOEdNYBnh7r6QIeJmo0dyFLvAHUfjTabYqimPqABqhvjPeWc2OH5wXuyxV7l nHSLM62VhwLcRF5AAvxaNL+QE1B0GUH69Bhqn++0iTVoop0vluvE0DS5T4Gu0AYQ ZlNPuesCwnc=ypok -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Get the latest Linux and open source security news straight to your inbox.