This update for python-urllib3 fixes the following issues: CVE-2023-45803: Fix a request body leak that could occur when receiving a 303 HTTP response (bsc#1216377).. # Security update for python-urllib3 Announcement ID: SUSE-SU-2023:4467-1 Rating: moderate References: * bsc#1216377 Cross-References: * CVE-2023-45803 CVSS scores: * CVE-2023-45803 ( SUSE ): 4.2 CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N * CVE-2023-45803 ( NVD ): 4.2 CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N Affected Products: * Basesystem Module 15-SP4 * Basesystem Module 15-SP5 * openSUSE Leap 15.3 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * openSUSE Leap Micro 5.3 * openSUSE Leap Micro 5.4 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.1 * SUSE Linux Enterprise Micro 5.2 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Micro for Rancher 5.2 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.2 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.2 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.2 * SUSE Manager Server 4.3 An update that solves one vulnerability can now be installed. ## Description: This update for python-urllib3 fixes the following issues: * CVE-2023-45803: Fix a request body leak that could occur when receiving a 303 HTTP response (bsc#1216377). ## Patch Instructions: To install this SUSE update usethe SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.3 zypper in -t patch SUSE-2023-4467=1 * openSUSE Leap Micro 5.3 zypper in -t patch openSUSE-Leap-Micro-5.3-2023-4467=1 * openSUSE Leap Micro 5.4 zypper in -t patch openSUSE-Leap-Micro-5.4-2023-4467=1 * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-4467=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-4467=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2023-4467=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2023-4467=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2023-4467=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2023-4467=1 * SUSE Linux Enterprise Micro 5.5 zypper in -t patch SUSE-SLE-Micro-5.5-2023-4467=1 * Basesystem Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-4467=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-4467=1 * SUSE Manager Proxy 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.2-2023-4467=1 * SUSE Manager Retail Branch Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.2-2023-4467=1 * SUSE Manager Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-4467=1 * SUSE Linux Enterprise Micro 5.1 zypper in -t patch SUSE-SUSE-MicroOS-5.1-2023-4467=1 * SUSE Linux Enterprise Micro 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2023-4467=1 * SUSE Linux Enterprise Micro for Rancher 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2023-4467=1 ## Package List: * openSUSE Leap 15.3 (noarch) * python3-urllib3-1.25.10-150300.4.9.1 * openSUSE Leap Micro 5.3 (noarch) *python3-urllib3-1.25.10-150300.4.9.1 * openSUSE Leap Micro 5.4 (noarch) * python3-urllib3-1.25.10-150300.4.9.1 * openSUSE Leap 15.4 (noarch) * python3-urllib3-1.25.10-150300.4.9.1 * openSUSE Leap 15.5 (noarch) * python3-urllib3-1.25.10-150300.4.9.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (noarch) * python3-urllib3-1.25.10-150300.4.9.1 * SUSE Linux Enterprise Micro 5.3 (noarch) * python3-urllib3-1.25.10-150300.4.9.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (noarch) * python3-urllib3-1.25.10-150300.4.9.1 * SUSE Linux Enterprise Micro 5.4 (noarch) * python3-urllib3-1.25.10-150300.4.9.1 * SUSE Linux Enterprise Micro 5.5 (noarch) * python3-urllib3-1.25.10-150300.4.9.1 * Basesystem Module 15-SP4 (noarch) * python3-urllib3-1.25.10-150300.4.9.1 * Basesystem Module 15-SP5 (noarch) * python3-urllib3-1.25.10-150300.4.9.1 * SUSE Manager Proxy 4.2 (noarch) * python3-urllib3-1.25.10-150300.4.9.1 * SUSE Manager Retail Branch Server 4.2 (noarch) * python3-urllib3-1.25.10-150300.4.9.1 * SUSE Manager Server 4.2 (noarch) * python3-urllib3-1.25.10-150300.4.9.1 * SUSE Linux Enterprise Micro 5.1 (noarch) * python3-urllib3-1.25.10-150300.4.9.1 * SUSE Linux Enterprise Micro 5.2 (noarch) * python3-urllib3-1.25.10-150300.4.9.1 * SUSE Linux Enterprise Micro for Rancher 5.2 (noarch) * python3-urllib3-1.25.10-150300.4.9.1 ## References: * https://www.suse.com/security/cve/CVE-2023-45803.html * https://bugzilla.suse.com/show_bug.cgi?id=1216377 . Important patch for python-urllib3 tackles CVE-2023-45803, resolving a leak of request body data in various openSUSE versions.. python urllib3 security, openSUSE patch details, request body leak fix. . LinuxSecurity.com Team
New libX11 packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] libX11 (SSA:2021-139-01) New libX11 packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: +--------------------------+ patches/packages/libX11-1.7.1-i586-1_slack14.2.txz: Upgraded. This update fixes missing request length checks in libX11 that can lead to the emission of extra X protocol requests to the X server. For more information, see: https://lists.x.org/archives/xorg-announce/2021-May/003088.html https://www.cve.org/CVERecord?id=CVE-2021-31535 (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ Thanks to the friendly folks at the OSU Open Source Lab (https://osuosl.org/) for donating FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://www.slackware.com/ for additional mirror sites near you. Updated package for Slackware 14.0: Updated package for Slackware x86_64 14.0: Updated package for Slackware 14.1: Updated package for Slackware x86_64 14.1: Updated package for Slackware 14.2: Updated package for Slackware x86_64 14.2: Updated package for Slackware -current: Updated package for Slackware x86_64 -current: MD5 signatures: +-------------+ Slackware 14.0 package: 037e061214b75602fecda02dbeff4594 libX11-1.7.1-i486-1_slack14.0.txz Slackware x86_64 14.0 package: 2d361c4a57965f7717c6baeeb64bfbdc libX11-1.7.1-x86_64-1_slack14.0.txz Slackware 14.1 package: 2d248166e3300b2eddf1bf7cdfd9c48e libX11-1.7.1-i486-1_slack14.1.txz Slackware x86_64 14.1 package: 1cbc196fc2b572d9ef1d782780e715c4 libX11-1.7.1-x86_64-1_slack14.1.txz Slackware 14.2 package: e7a8f6730ee2a9f0c1d1b882ef19a328 libX11-1.7.1-i586-1_slack14.2.txz Slackware x86_64 14.2 package: 93c50f408507ca0ec710ec0652911fc5 libX11-1.7.1-x86_64-1_slack14.2.txz Slackware -current package: c4e7afb55aa5cbac724d078bac62d48e x/libX11-1.7.1-i586-1.txz Slackware x86_64 -current package: 4c6d385206e5c2ba7614b1301b850115 x/libX11-1.7.1-x86_64-1.txz Installation instructions: +------------------------+ Upgrade the package as root: # upgradepkg libX11-1.7.1-i586-1_slack14.2.txz +-----+ . Recent updates to the libX11 packages for Slackware address a significant security vulnerability, enhancing overall system safety and integrity.. libX11,Slackware Security,Software Update. . Severity: Medium. LinuxSecurity.com Team
Fixed a memory leak when decompression fails "unexpectedly". (CVE-2021-20216) Prevent an assertion from getting triggered by a crafted CGI request. (CVE-2021-20217) References: . MGASA-2021-0089 - Updated privoxy package fixes security vulnerabilities Publication date: 19 Feb 2021 URL: https://advisories.mageia.org/MGASA-2021-0089.html Type: security Affected Mageia releases: 7 CVE: CVE-2021-20216, CVE-2021-20217 Fixed a memory leak when decompression fails "unexpectedly". (CVE-2021-20216) Prevent an assertion from getting triggered by a crafted CGI request. (CVE-2021-20217) References: - https://bugs.mageia.org/show_bug.cgi?id=28281 - http://www.privoxy.org/announce.txt - https://www.openwall.com/lists/oss-security/2021/02/04/4 - - https://www.cve.org/CVERecord?id=CVE-2021-20216 - https://www.cve.org/CVERecord?id=CVE-2021-20217 SRPMS: - 7/core/privoxy-3.0.31-1.mga7 . Mageia 2021-0090 enhances openSSL to address severe vulnerabilities impacting encryption protocols and data integrity checks.. Mageia Privoxy Update, Memory Leak, CGI Security. . Severity: Critical. LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.