Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found 1 articles for you...
100
security advisorysoftware updatemoderate threatSUSE Linux Micro: 2025:20103-1 moderate: avahi DNS exploit mitigation
* bsc#1212476 * bsc#1226586 * bsc#1233420 Cross-References: . # Security update for avahi Announcement ID: SUSE-SU-2025:20103-1 Release Date: 2025-02-03T09:17:39Z Rating: moderate References: * bsc#1212476 * bsc#1226586 * bsc#1233420 Cross-References: * CVE-2024-52616 CVSS scores: * CVE-2024-52616 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2024-52616 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2024-52616 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affected Products: * SUSE Linux Micro 6.0 An update that solves one vulnerability and has two fixes can now be installed. ## Description: This update for avahi fixes the following issues: * CVE-2024-52616: Properly randomize query id of DNS packets (bsc#1233420). Bug fixes: * No longer supply bogus services to callbacks (bsc#1226586). * Tag hardening patches as PATCH-FEATURE-OPENSUSE * Remove dependency on /usr/bin/python3 using %python3_fix_shebang macro (bsc#1212476). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Micro 6.0 zypper in -t patch SUSE-SLE-Micro-6.0-155=1 ## Package List: * SUSE Linux Micro 6.0 (aarch64 s390x x86_64) * avahi-debugsource-0.8-6.1 * libavahi-common3-debuginfo-0.8-6.1 * libavahi-common3-0.8-6.1 * avahi-0.8-6.1 * libavahi-core7-0.8-6.1 * libavahi-client3-debuginfo-0.8-6.1 * libavahi-core7-debuginfo-0.8-6.1 * libavahi-client3-0.8-6.1 * avahi-debuginfo-0.8-6.1 ## References: * https://www.suse.com/security/cve/CVE-2024-52616.html * https://bugzilla.suse.com/show_bug.cgi?id=1212476 * https://bugzilla.suse.com/show_bug.cgi?id=1226586 * https://bugzilla.suse.com/show_bug.cgi?id=1233420 . SUSE has released an update to fix a moderate-severity DNS issue in the Avahi servicethat could affect local network service discovery and security. SUSE Linux, avahi, security update, DNS issues, software patches. . LinuxSecurity.com Team
Jun 04, 2025
SuSE
202
security advisorydenial of servicesoftware updateopenSUSE 15.5: 2024:1167-1 Important: Denial Of Service Fix
This update for nghttp2 fixes the following issues: CVE-2024-28182: Fixed denial of service via http/2 continuation frames (bsc#1221399). # Security update for nghttp2 Announcement ID: SUSE-SU-2024:1167-1 Rating: important References: * bsc#1221399 Cross-References: * CVE-2024-28182 CVSS scores: * CVE-2024-28182 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.5 * openSUSE Leap Micro 5.3 * openSUSE Leap Micro 5.4 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Micro 5.1 * SUSE Linux Enterprise Micro 5.2 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Micro for Rancher 5.2 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE LinuxEnterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves one vulnerability can now be installed. ## Description: This update for nghttp2 fixes the following issues: * CVE-2024-28182: Fixed denial of service via http/2 continuation frames (bsc#1221399) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap Micro 5.3 zypper in -t patch openSUSE-Leap-Micro-5.3-2024-1167=1 * openSUSE Leap Micro 5.4 zypper in -t patch openSUSE-Leap-Micro-5.4-2024-1167=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-1167=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2024-1167=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2024-1167=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2024-1167=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2024-1167=1 * SUSE Linux Enterprise Micro 5.5 zypper in -t patch SUSE-SLE-Micro-5.5-2024-1167=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2024-1167=1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-1167=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-1167=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-1167=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-1167=1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-1167=1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2024-1167=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-1167=1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-1167=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2024-1167=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-1167=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-1167=1 * SUSE Manager Proxy 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2024-1167=1 * SUSE Manager Retail Branch Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.3-2024-1167=1 * SUSE Manager Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.3-2024-1167=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2024-1167=1 * SUSE Linux Enterprise Micro 5.1 zypper in -t patch SUSE-SUSE-MicroOS-5.1-2024-1167=1 * SUSE Linux Enterprise Micro 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2024-1167=1 * SUSE Linux Enterprise Micro for Rancher 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2024-1167=1 ## Package List: * openSUSE Leap Micro 5.3 (aarch64 x86_64) * libnghttp2-14-debuginfo-1.40.0-150200.17.1 * libnghttp2-14-1.40.0-150200.17.1 * nghttp2-debugsource-1.40.0-150200.17.1 * nghttp2-debuginfo-1.40.0-150200.17.1 * openSUSE Leap Micro 5.4 (aarch64 s390x x86_64) * libnghttp2-14-debuginfo-1.40.0-150200.17.1 * libnghttp2-14-1.40.0-150200.17.1 * nghttp2-debugsource-1.40.0-150200.17.1 * nghttp2-debuginfo-1.40.0-150200.17.1 * openSUSELeap 15.5 (aarch64 ppc64le s390x x86_64) * nghttp2-python-debugsource-1.40.0-150200.17.1 * libnghttp2-14-1.40.0-150200.17.1 * libnghttp2-14-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio1-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio1-1.40.0-150200.17.1 * nghttp2-1.40.0-150200.17.1 * nghttp2-debugsource-1.40.0-150200.17.1 * nghttp2-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio-devel-1.40.0-150200.17.1 * python3-nghttp2-1.40.0-150200.17.1 * python3-nghttp2-debuginfo-1.40.0-150200.17.1 * libnghttp2-devel-1.40.0-150200.17.1 * openSUSE Leap 15.5 (x86_64) * libnghttp2-14-32bit-1.40.0-150200.17.1 * libnghttp2_asio1-32bit-1.40.0-150200.17.1 * libnghttp2_asio1-32bit-debuginfo-1.40.0-150200.17.1 * libnghttp2-14-32bit-debuginfo-1.40.0-150200.17.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64) * libnghttp2-14-debuginfo-1.40.0-150200.17.1 * libnghttp2-14-1.40.0-150200.17.1 * nghttp2-debugsource-1.40.0-150200.17.1 * nghttp2-debuginfo-1.40.0-150200.17.1 * SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64) * libnghttp2-14-debuginfo-1.40.0-150200.17.1 * libnghttp2-14-1.40.0-150200.17.1 * nghttp2-debugsource-1.40.0-150200.17.1 * nghttp2-debuginfo-1.40.0-150200.17.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64) * libnghttp2-14-debuginfo-1.40.0-150200.17.1 * libnghttp2-14-1.40.0-150200.17.1 * nghttp2-debugsource-1.40.0-150200.17.1 * nghttp2-debuginfo-1.40.0-150200.17.1 * SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64) * libnghttp2-14-debuginfo-1.40.0-150200.17.1 * libnghttp2-14-1.40.0-150200.17.1 * nghttp2-debugsource-1.40.0-150200.17.1 * nghttp2-debuginfo-1.40.0-150200.17.1 * SUSE Linux Enterprise Micro 5.5 (aarch64 s390x x86_64) * libnghttp2-14-debuginfo-1.40.0-150200.17.1 * libnghttp2-14-1.40.0-150200.17.1 * nghttp2-debugsource-1.40.0-150200.17.1 * nghttp2-debuginfo-1.40.0-150200.17.1 * Basesystem Module 15-SP5(aarch64 ppc64le s390x x86_64) * libnghttp2-14-1.40.0-150200.17.1 * libnghttp2-14-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio1-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio1-1.40.0-150200.17.1 * nghttp2-debugsource-1.40.0-150200.17.1 * nghttp2-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio-devel-1.40.0-150200.17.1 * libnghttp2-devel-1.40.0-150200.17.1 * Basesystem Module 15-SP5 (x86_64) * libnghttp2-14-32bit-1.40.0-150200.17.1 * libnghttp2-14-32bit-debuginfo-1.40.0-150200.17.1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (aarch64 x86_64) * libnghttp2-14-1.40.0-150200.17.1 * libnghttp2-14-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio1-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio1-1.40.0-150200.17.1 * nghttp2-debugsource-1.40.0-150200.17.1 * nghttp2-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio-devel-1.40.0-150200.17.1 * libnghttp2-devel-1.40.0-150200.17.1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (x86_64) * libnghttp2-14-32bit-1.40.0-150200.17.1 * libnghttp2-14-32bit-debuginfo-1.40.0-150200.17.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) * libnghttp2-14-1.40.0-150200.17.1 * libnghttp2-14-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio1-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio1-1.40.0-150200.17.1 * nghttp2-debugsource-1.40.0-150200.17.1 * nghttp2-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio-devel-1.40.0-150200.17.1 * libnghttp2-devel-1.40.0-150200.17.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (x86_64) * libnghttp2-14-32bit-1.40.0-150200.17.1 * libnghttp2-14-32bit-debuginfo-1.40.0-150200.17.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * libnghttp2-14-1.40.0-150200.17.1 * libnghttp2-14-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio1-debuginfo-1.40.0-150200.17.1 *libnghttp2_asio1-1.40.0-150200.17.1 * nghttp2-debugsource-1.40.0-150200.17.1 * nghttp2-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio-devel-1.40.0-150200.17.1 * libnghttp2-devel-1.40.0-150200.17.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (x86_64) * libnghttp2-14-32bit-1.40.0-150200.17.1 * libnghttp2-14-32bit-debuginfo-1.40.0-150200.17.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * libnghttp2-14-1.40.0-150200.17.1 * libnghttp2-14-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio1-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio1-1.40.0-150200.17.1 * nghttp2-debugsource-1.40.0-150200.17.1 * nghttp2-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio-devel-1.40.0-150200.17.1 * libnghttp2-devel-1.40.0-150200.17.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (x86_64) * libnghttp2-14-32bit-1.40.0-150200.17.1 * libnghttp2-14-32bit-debuginfo-1.40.0-150200.17.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (x86_64) * libnghttp2-14-32bit-1.40.0-150200.17.1 * libnghttp2-14-1.40.0-150200.17.1 * libnghttp2-14-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio1-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio1-1.40.0-150200.17.1 * nghttp2-debugsource-1.40.0-150200.17.1 * nghttp2-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio-devel-1.40.0-150200.17.1 * libnghttp2-14-32bit-debuginfo-1.40.0-150200.17.1 * libnghttp2-devel-1.40.0-150200.17.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (aarch64 ppc64le s390x x86_64) * libnghttp2-14-1.40.0-150200.17.1 * libnghttp2-14-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio1-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio1-1.40.0-150200.17.1 * nghttp2-debugsource-1.40.0-150200.17.1 * nghttp2-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio-devel-1.40.0-150200.17.1 * libnghttp2-devel-1.40.0-150200.17.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (x86_64) *libnghttp2-14-32bit-1.40.0-150200.17.1 * libnghttp2-14-32bit-debuginfo-1.40.0-150200.17.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x x86_64) * libnghttp2-14-1.40.0-150200.17.1 * libnghttp2-14-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio1-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio1-1.40.0-150200.17.1 * nghttp2-debugsource-1.40.0-150200.17.1 * nghttp2-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio-devel-1.40.0-150200.17.1 * libnghttp2-devel-1.40.0-150200.17.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (x86_64) * libnghttp2-14-32bit-1.40.0-150200.17.1 * libnghttp2-14-32bit-debuginfo-1.40.0-150200.17.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (aarch64 ppc64le s390x x86_64) * libnghttp2-14-1.40.0-150200.17.1 * libnghttp2-14-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio1-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio1-1.40.0-150200.17.1 * nghttp2-debugsource-1.40.0-150200.17.1 * nghttp2-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio-devel-1.40.0-150200.17.1 * libnghttp2-devel-1.40.0-150200.17.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (x86_64) * libnghttp2-14-32bit-1.40.0-150200.17.1 * libnghttp2-14-32bit-debuginfo-1.40.0-150200.17.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (ppc64le x86_64) * libnghttp2-14-1.40.0-150200.17.1 * libnghttp2-14-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio1-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio1-1.40.0-150200.17.1 * nghttp2-debugsource-1.40.0-150200.17.1 * nghttp2-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio-devel-1.40.0-150200.17.1 * libnghttp2-devel-1.40.0-150200.17.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (x86_64) * libnghttp2-14-32bit-1.40.0-150200.17.1 * libnghttp2-14-32bit-debuginfo-1.40.0-150200.17.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64) * libnghttp2-14-1.40.0-150200.17.1 *libnghttp2-14-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio1-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio1-1.40.0-150200.17.1 * nghttp2-debugsource-1.40.0-150200.17.1 * nghttp2-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio-devel-1.40.0-150200.17.1 * libnghttp2-devel-1.40.0-150200.17.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (x86_64) * libnghttp2-14-32bit-1.40.0-150200.17.1 * libnghttp2-14-32bit-debuginfo-1.40.0-150200.17.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * libnghttp2-14-1.40.0-150200.17.1 * libnghttp2-14-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio1-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio1-1.40.0-150200.17.1 * nghttp2-debugsource-1.40.0-150200.17.1 * nghttp2-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio-devel-1.40.0-150200.17.1 * libnghttp2-devel-1.40.0-150200.17.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (x86_64) * libnghttp2-14-32bit-1.40.0-150200.17.1 * libnghttp2-14-32bit-debuginfo-1.40.0-150200.17.1 * SUSE Manager Proxy 4.3 (x86_64) * libnghttp2-14-32bit-1.40.0-150200.17.1 * libnghttp2-14-1.40.0-150200.17.1 * libnghttp2-14-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio1-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio1-1.40.0-150200.17.1 * nghttp2-debugsource-1.40.0-150200.17.1 * nghttp2-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio-devel-1.40.0-150200.17.1 * libnghttp2-14-32bit-debuginfo-1.40.0-150200.17.1 * libnghttp2-devel-1.40.0-150200.17.1 * SUSE Manager Retail Branch Server 4.3 (x86_64) * libnghttp2-14-32bit-1.40.0-150200.17.1 * libnghttp2-14-1.40.0-150200.17.1 * libnghttp2-14-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio1-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio1-1.40.0-150200.17.1 * nghttp2-debugsource-1.40.0-150200.17.1 * nghttp2-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio-devel-1.40.0-150200.17.1 *libnghttp2-14-32bit-debuginfo-1.40.0-150200.17.1 * libnghttp2-devel-1.40.0-150200.17.1 * SUSE Manager Server 4.3 (ppc64le s390x x86_64) * libnghttp2-14-1.40.0-150200.17.1 * libnghttp2-14-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio1-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio1-1.40.0-150200.17.1 * nghttp2-debugsource-1.40.0-150200.17.1 * nghttp2-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio-devel-1.40.0-150200.17.1 * libnghttp2-devel-1.40.0-150200.17.1 * SUSE Manager Server 4.3 (x86_64) * libnghttp2-14-32bit-1.40.0-150200.17.1 * libnghttp2-14-32bit-debuginfo-1.40.0-150200.17.1 * SUSE Enterprise Storage 7.1 (aarch64 x86_64) * libnghttp2-14-1.40.0-150200.17.1 * libnghttp2-14-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio1-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio1-1.40.0-150200.17.1 * nghttp2-debugsource-1.40.0-150200.17.1 * nghttp2-debuginfo-1.40.0-150200.17.1 * libnghttp2_asio-devel-1.40.0-150200.17.1 * libnghttp2-devel-1.40.0-150200.17.1 * SUSE Enterprise Storage 7.1 (x86_64) * libnghttp2-14-32bit-1.40.0-150200.17.1 * libnghttp2-14-32bit-debuginfo-1.40.0-150200.17.1 * SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64) * libnghttp2-14-debuginfo-1.40.0-150200.17.1 * libnghttp2-14-1.40.0-150200.17.1 * nghttp2-debugsource-1.40.0-150200.17.1 * nghttp2-debuginfo-1.40.0-150200.17.1 * SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64) * libnghttp2-14-debuginfo-1.40.0-150200.17.1 * libnghttp2-14-1.40.0-150200.17.1 * nghttp2-debugsource-1.40.0-150200.17.1 * nghttp2-debuginfo-1.40.0-150200.17.1 * SUSE Linux Enterprise Micro for Rancher 5.2 (aarch64 s390x x86_64) * libnghttp2-14-debuginfo-1.40.0-150200.17.1 * libnghttp2-14-1.40.0-150200.17.1 * nghttp2-debugsource-1.40.0-150200.17.1 * nghttp2-debuginfo-1.40.0-150200.17.1 ## References: * https://www.suse.com/security/cve/CVE-2024-28182.html * https://bugzilla.suse.com/show_bug.cgi?id=1221399 . Criticalnghttp2 update released, addressing significant denial of service vulnerability in openSUSE versions. Discover further details.. nghttp2 Update, OpenSUSE Advisories, Service Issues, Security Updates. . Severity: Important. LinuxSecurity.com Team
Apr 08, 2024
•Important
OpenSUSE
217
security advisorycriticalOracle LinuxOracle Linux: ELSA-2022-9058-1 Critical Update for Prometheus JMX Exporter
The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network: . Oracle Linux Security Advisory ELSA-2022-9058-1 https://linux.oracle.com/errata/ELSA-2022-9058-1.html The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network: x86_64: prometheus-jmx-exporter-0.12.0-9.el8_7.noarch.rpm prometheus-jmx-exporter-openjdk11-0.12.0-9.el8_7.noarch.rpm prometheus-jmx-exporter-openjdk17-0.12.0-9.el8_7.noarch.rpm prometheus-jmx-exporter-openjdk8-0.12.0-9.el8_7.noarch.rpm aarch64: prometheus-jmx-exporter-0.12.0-9.el8_7.noarch.rpm prometheus-jmx-exporter-openjdk11-0.12.0-9.el8_7.noarch.rpm prometheus-jmx-exporter-openjdk17-0.12.0-9.el8_7.noarch.rpm prometheus-jmx-exporter-openjdk8-0.12.0-9.el8_7.noarch.rpm SRPMS: https://oss.oracle.com:443/ol8/SRPMS-updates/prometheus-jmx-exporter-0.12.0-9.el8_7.src.rpm Related CVEs: CVE-2022-1471 Description of changes: [0.12.0-9] - Fix CVE-2022-1471 by using SafeConstructor. _______________________________________________ El-errata mailing list
Dec 15, 2022
•Critical
Oracle
100
security advisorymoderateupdateSUSE MicroOS: 2021:3530-1 Moderate: Dnsmasq Service Correction
An update that solves two vulnerabilities, contains one feature and has one errata is now available. . SUSE Security Update: Security update for dnsmasq ______________________________________________________________________________ Announcement ID: SUSE-SU-2021:3530-1 Rating: moderate References: #1173646 #1180914 #1183709 SLE-17936 Cross-References: CVE-2020-14312 CVE-2021-3448 CVSS scores: CVE-2020-14312 (NVD) : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-14312 (SUSE): 4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L CVE-2021-3448 (NVD) : 4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N CVE-2021-3448 (SUSE): 4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N Affected Products: SUSE MicroOS 5.1 SUSE MicroOS 5.0 SUSE Linux Enterprise Server for SAP 15-SP1 SUSE Linux Enterprise Server 15-SP1-LTSS SUSE Linux Enterprise Server 15-SP1-BCL SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP2 SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS SUSE Enterprise Storage 6 SUSE CaaS Platform 4.0 ______________________________________________________________________________ An update that solves two vulnerabilities, contains one feature and has one errata is now available. Description: This update for dnsmasq fixes the following issues: Update to version 2.86 - CVE-2021-3448: fixed outgoing port used when --server is used with an interface name. (bsc#1183709) - CVE-2020-14312: Set --local-service by default (bsc#1173646). - Open inotify socket only when used (bsc#1180914). Patch Instructions: To install this SUSE Security Update usethe SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE MicroOS 5.1: zypper in -t patch SUSE-SUSE-MicroOS-5.1-2021-3530=1 - SUSE MicroOS 5.0: zypper in -t patch SUSE-SUSE-MicroOS-5.0-2021-3530=1 - SUSE Linux Enterprise Server for SAP 15-SP1: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2021-3530=1 - SUSE Linux Enterprise Server 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2021-3530=1 - SUSE Linux Enterprise Server 15-SP1-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-BCL-2021-3530=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2021-3530=1 - SUSE Linux Enterprise Module for Basesystem 15-SP2: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP2-2021-3530=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2021-3530=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-ESPOS-2021-3530=1 - SUSE Enterprise Storage 6: zypper in -t patch SUSE-Storage-6-2021-3530=1 - SUSE CaaS Platform 4.0: To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. Package List: - SUSE MicroOS 5.1 (aarch64 s390x x86_64): dnsmasq-2.86-7.14.1 dnsmasq-debuginfo-2.86-7.14.1 dnsmasq-debugsource-2.86-7.14.1 - SUSE MicroOS 5.0 (aarch64 x86_64): dnsmasq-2.86-7.14.1 dnsmasq-debuginfo-2.86-7.14.1 dnsmasq-debugsource-2.86-7.14.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (ppc64le x86_64): dnsmasq-2.86-7.14.1 dnsmasq-debuginfo-2.86-7.14.1 dnsmasq-debugsource-2.86-7.14.1 - SUSE LinuxEnterprise Server 15-SP1-LTSS (aarch64 ppc64le s390x x86_64): dnsmasq-2.86-7.14.1 dnsmasq-debuginfo-2.86-7.14.1 dnsmasq-debugsource-2.86-7.14.1 - SUSE Linux Enterprise Server 15-SP1-BCL (x86_64): dnsmasq-2.86-7.14.1 dnsmasq-debuginfo-2.86-7.14.1 dnsmasq-debugsource-2.86-7.14.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): dnsmasq-2.86-7.14.1 dnsmasq-debuginfo-2.86-7.14.1 dnsmasq-debugsource-2.86-7.14.1 - SUSE Linux Enterprise Module for Basesystem 15-SP2 (aarch64 ppc64le s390x x86_64): dnsmasq-2.86-7.14.1 dnsmasq-debuginfo-2.86-7.14.1 dnsmasq-debugsource-2.86-7.14.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (aarch64 x86_64): dnsmasq-2.86-7.14.1 dnsmasq-debuginfo-2.86-7.14.1 dnsmasq-debugsource-2.86-7.14.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (aarch64 x86_64): dnsmasq-2.86-7.14.1 dnsmasq-debuginfo-2.86-7.14.1 dnsmasq-debugsource-2.86-7.14.1 - SUSE Enterprise Storage 6 (aarch64 x86_64): dnsmasq-2.86-7.14.1 dnsmasq-debuginfo-2.86-7.14.1 dnsmasq-debugsource-2.86-7.14.1 - SUSE CaaS Platform 4.0 (x86_64): dnsmasq-2.86-7.14.1 dnsmasq-debuginfo-2.86-7.14.1 dnsmasq-debugsource-2.86-7.14.1 References: https://www.suse.com/security/cve/CVE-2020-14312.html https://www.suse.com/security/cve/CVE-2021-3448.html https://bugzilla.suse.com/1173646 https://bugzilla.suse.com/1180914 https://bugzilla.suse.com/1183709 . A dnsmasq revision resolves various problems related to IP addresses, functionalities, and discrepancies. Review the comprehensive patch guidelines.. dnsmasq Security, SUSE Updates, Service Configuration Fixes. . LinuxSecurity.com Team
Oct 27, 2021
SuSE
98
security advisorydenial of serviceRed HatRed Hat: RHSA-2020-1470-01 Low: NTP Buffer Overflow Risk Mitigated
An update for ntp is now available for Red Hat Enterprise Linux 7.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Low: ntp security update Advisory ID: RHSA-2020:1470-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2020:1470 Issue date: 2020-04-14 CVE Names: CVE-2018-12327 ==================================================================== 1. Summary: An update for ntp is now available for Red Hat Enterprise Linux 7.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) - x86_64 Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) - noarch, x86_64 Red Hat Enterprise Linux Server EUS (v. 7.6) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional EUS (v. 7.6) - noarch, ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) - aarch64, ppc64le, s390x Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) - aarch64, noarch, ppc64le, s390x 3. Description: The Network Time Protocol (NTP) is used to synchronize a computer's time with another referenced time source. These packages include the ntpd service which continuously adjusts system time and utilities used to query and configure the ntpd service. Security Fix(es): * ntp: Stack-based buffer overflow in ntpq and ntpdc allows denial of service or code execution(CVE-2018-12327) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the ntpd daemon will restart automatically. 5. Bugs fixed (https://bugzilla.redhat.com/): 1593580 - CVE-2018-12327 ntp: Stack-based buffer overflow in ntpq and ntpdc allows denial of service or code execution 6. Package List: Red Hat Enterprise Linux ComputeNode EUS (v. 7.6): Source: ntp-4.2.6p5-28.el7_6.1.src.rpm x86_64: ntp-4.2.6p5-28.el7_6.1.x86_64.rpm ntp-debuginfo-4.2.6p5-28.el7_6.1.x86_64.rpm ntpdate-4.2.6p5-28.el7_6.1.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6): noarch: ntp-doc-4.2.6p5-28.el7_6.1.noarch.rpm ntp-perl-4.2.6p5-28.el7_6.1.noarch.rpm x86_64: ntp-debuginfo-4.2.6p5-28.el7_6.1.x86_64.rpm sntp-4.2.6p5-28.el7_6.1.x86_64.rpm Red Hat Enterprise Linux Server EUS (v. 7.6): Source: ntp-4.2.6p5-28.el7_6.1.src.rpm ppc64: ntp-4.2.6p5-28.el7_6.1.ppc64.rpm ntp-debuginfo-4.2.6p5-28.el7_6.1.ppc64.rpm ntpdate-4.2.6p5-28.el7_6.1.ppc64.rpm ppc64le: ntp-4.2.6p5-28.el7_6.1.ppc64le.rpm ntp-debuginfo-4.2.6p5-28.el7_6.1.ppc64le.rpm ntpdate-4.2.6p5-28.el7_6.1.ppc64le.rpm s390x: ntp-4.2.6p5-28.el7_6.1.s390x.rpm ntp-debuginfo-4.2.6p5-28.el7_6.1.s390x.rpm ntpdate-4.2.6p5-28.el7_6.1.s390x.rpm x86_64: ntp-4.2.6p5-28.el7_6.1.x86_64.rpm ntp-debuginfo-4.2.6p5-28.el7_6.1.x86_64.rpm ntpdate-4.2.6p5-28.el7_6.1.x86_64.rpm Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v.7): Source: ntp-4.2.6p5-28.el7_6.1.src.rpm aarch64: ntp-4.2.6p5-28.el7_6.1.aarch64.rpm ntp-debuginfo-4.2.6p5-28.el7_6.1.aarch64.rpm ntpdate-4.2.6p5-28.el7_6.1.aarch64.rpm ppc64le: ntp-4.2.6p5-28.el7_6.1.ppc64le.rpm ntp-debuginfo-4.2.6p5-28.el7_6.1.ppc64le.rpm ntpdate-4.2.6p5-28.el7_6.1.ppc64le.rpm s390x: ntp-4.2.6p5-28.el7_6.1.s390x.rpm ntp-debuginfo-4.2.6p5-28.el7_6.1.s390x.rpm ntpdate-4.2.6p5-28.el7_6.1.s390x.rpm Red Hat Enterprise Linux Server Optional EUS (v. 7.6): noarch: ntp-doc-4.2.6p5-28.el7_6.1.noarch.rpm ntp-perl-4.2.6p5-28.el7_6.1.noarch.rpm ppc64: ntp-debuginfo-4.2.6p5-28.el7_6.1.ppc64.rpm sntp-4.2.6p5-28.el7_6.1.ppc64.rpm ppc64le: ntp-debuginfo-4.2.6p5-28.el7_6.1.ppc64le.rpm sntp-4.2.6p5-28.el7_6.1.ppc64le.rpm s390x: ntp-debuginfo-4.2.6p5-28.el7_6.1.s390x.rpm sntp-4.2.6p5-28.el7_6.1.s390x.rpm x86_64: ntp-debuginfo-4.2.6p5-28.el7_6.1.x86_64.rpm sntp-4.2.6p5-28.el7_6.1.x86_64.rpm Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7): aarch64: ntp-debuginfo-4.2.6p5-28.el7_6.1.aarch64.rpm sntp-4.2.6p5-28.el7_6.1.aarch64.rpm noarch: ntp-doc-4.2.6p5-28.el7_6.1.noarch.rpm ntp-perl-4.2.6p5-28.el7_6.1.noarch.rpm ppc64le: ntp-debuginfo-4.2.6p5-28.el7_6.1.ppc64le.rpm sntp-4.2.6p5-28.el7_6.1.ppc64le.rpm s390x: ntp-debuginfo-4.2.6p5-28.el7_6.1.s390x.rpm sntp-4.2.6p5-28.el7_6.1.s390x.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2018-12327 https://access.redhat.com/security/updates/classification/#low 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBXpX189zjgjWX9erEAQiHwg//ZpvjQ1n+z1UTHcWnXF8wSdCY7Bxkk0Xo bL1rkCPEOqc6j91Bx21zYne4MjGEKxGyyPNVQJ6szAG/IBt1OXe19iO+lzsYcfPr dSYRaRmv6x1Ak/yLzN2VIS1v2/V2s0ZLVTkO65h/0znNkz9YqJlOGDkG1qG4x2lH bnOgFx8lwFts29JvkFIhvo37fa1yu+CUqwMrsW3x10MBYeir0N355Sw9PyXn3vbv 0YMWVMRrRlgBw2nTujUt3q6eXpBP9z7jJkhaO2yooPvwXM6AnSGhhhcDk8i43qIM 3a2AORXciBxaZ7pmw0CumiTZVhJZ/X1NdDXJ5w4z/VDBfILA5hpe2WnGztoHyIy3 05Th6+9WXqsChAL3jzLcpMADwDKXPNbjJS3LA/CWmFjI5T3n3nfcfPRG5fAtV2Kk M1HjAeMPRyoz6EI9dlk8MDhBmmJPi/+RTmDV/vFzdntaLBAja4fDYzbwgiJuFtFP rpqG+tpb4qC3RVY9LfvyGic5zMyMhEfjyVp4IcIQBqzMVprb6q/pKAdS7aDhxtDb cI3mDVQTKmU9/9+D6ES50+hiImf3hLkNruEt6KmnPdOxBO7IINVm7Y0heoKarQ++ bT8sDKppcg5vFoRmoLUFMbfa91GLTpV+JLaU8F/VQTNaEpYsBihaGPNpEPOWNd8D RYYqzIy6m6s=Nb06 -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Apr 14, 2020
•Low
Red Hat
100
security advisorymoderatedhcpSUSE: 2019:2727-2 Moderate: DHCP Service Fix and Security Update
An update that solves one vulnerability and has two fixes is now available. . SUSE Security Update: Security update for dhcp ______________________________________________________________________________ Announcement ID: SUSE-SU-2019:2727-2 Rating: moderate References: #1089524 #1134078 #1136572 Cross-References: CVE-2019-6470 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP5 SUSE Linux Enterprise Server 12-SP5 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for dhcp fixes the following issues: Secuirty issue fixed: - CVE-2019-6470: Fixed DHCPv6 server crashes (bsc#1134078). Bug fixes: - Add compile option --enable-secs-byteorder to avoid duplicate lease warnings (bsc#1089524). - Use IPv6 when called as dhclient6, dhcpd6, and dhcrelay6 (bsc#1136572). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP5: zypper in -t patch SUSE-SLE-SDK-12-SP5-2019-2727=1 - SUSE Linux Enterprise Server 12-SP5: zypper in -t patch SUSE-SLE-SERVER-12-SP5-2019-2727=1 Package List: - SUSE Linux Enterprise Software Development Kit 12-SP5 (aarch64 ppc64le s390x x86_64): dhcp-debuginfo-4.3.3-10.19.1 dhcp-debugsource-4.3.3-10.19.1 dhcp-devel-4.3.3-10.19.1 - SUSE Linux Enterprise Server 12-SP5 (aarch64 ppc64le s390x x86_64): dhcp-4.3.3-10.19.1 dhcp-client-4.3.3-10.19.1 dhcp-client-debuginfo-4.3.3-10.19.1 dhcp-debuginfo-4.3.3-10.19.1 dhcp-debugsource-4.3.3-10.19.1 dhcp-relay-4.3.3-10.19.1 dhcp-relay-debuginfo-4.3.3-10.19.1 dhcp-server-4.3.3-10.19.1 dhcp-server-debuginfo-4.3.3-10.19.1 References: https://www.suse.com/security/cve/CVE-2019-6470.html https://bugzilla.suse.com/1089524 https://bugzilla.suse.com/1134078 https://bugzilla.suse.com/1136572 _______________________________________________ sle-security-updates mailing list
Nov 12, 2019
SuSE
100
security advisorysoftware updateimportantSUSE: 2019:1381-1 Important: Rmt-Server Security Threats Addressed
An update that solves two vulnerabilities and has 10 fixes is now available. . SUSE Security Update: Security update for rmt-server ______________________________________________________________________________ Announcement ID: SUSE-SU-2019:1381-1 Rating: important References: #1107806 #1117722 #1118745 #1125770 #1128858 #1129271 #1129392 #1132160 #1132690 #1134190 #1134428 #1135222 Cross-References: CVE-2019-11068 CVE-2019-5419 Affected Products: SUSE Linux Enterprise Module for Server Applications 15 ______________________________________________________________________________ An update that solves two vulnerabilities and has 10 fixes is now available. Description: This update for rmt-server to version 2.1.4 fixes the following issues: - Fix duplicate nginx location in rmt-server-pubcloud (bsc#1135222) - Mirror additional repos that were enabled during mirroring (bsc#1132690) - Make service IDs consistent across different RMT instances (bsc#1134428) - Make SMT data import scripts faster (bsc#1134190) - Fix incorrect triggering of registration sharing (bsc#1129392) - Fix license mirroring issue in some non-SUSE repositories (bsc#1128858) - Set CURLOPT_LOW_SPEED_LIMIT to prevent downloads from getting stuck (bsc#1107806) - Truncate the RMT lockfile when writing a new PID (bsc#1125770) - Fix missing trailing slashes on custom repository import from SMT (bsc#1118745) - Zypper authentication plugin (fate#326629) - Instance verification plugin in rmt-server-pubcloud (fate#326629) - Update dependencies to fix vulnerabilities in rails (CVE-2019-5419, bsc#1129271) and nokogiri (CVE-2019-11068, bsc#1132160) - Allow RMT registration to work under HTTP as well as HTTPS. - Offline migration from SLE 15 to SLE 15 SP1 will add Python2 module - Online migrations will automatically add additional modules to the client systems depending on the base product - Supply log severity to journald - Breaking Change: Added headers to generated CSV files Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Server Applications 15: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-2019-1381=1 Package List: - SUSE Linux Enterprise Module for Server Applications 15 (aarch64 ppc64le s390x x86_64): rmt-server-2.1.4-3.17.1 rmt-server-debuginfo-2.1.4-3.17.1 References: https://www.suse.com/security/cve/CVE-2019-11068.html https://www.suse.com/security/cve/CVE-2019-5419.html https://bugzilla.suse.com/1107806 https://bugzilla.suse.com/1117722 https://bugzilla.suse.com/1118745 https://bugzilla.suse.com/1125770 https://bugzilla.suse.com/1128858 https://bugzilla.suse.com/1129271 https://bugzilla.suse.com/1129392 https://bugzilla.suse.com/1132160 https://bugzilla.suse.com/1132690 https://bugzilla.suse.com/1134190 https://bugzilla.suse.com/1134428 https://bugzilla.suse.com/1135222 _______________________________________________ sle-security-updates mailing list
May 30, 2019
•Important
SuSE
100
security advisorycriticalpatchSUSE: 2017:1443-1 Important: OpenStack Components Important Update
An update that solves two vulnerabilities and has one An update that solves two vulnerabilities and has one An update that solves two vulnerabilities and has one errata is now available. errata is now available.. SUSE Security Update: Security update for several openstack-components ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1443-1 Rating: important References: #1024328 #1030406 #1032322 Cross-References: CVE-2017-7214 CVE-2017-7400 Affected Products: SUSE OpenStack Cloud 7 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for openstack-ceilometer, -cinder, -dashboard, -glance, -heat, -keystone, -manila, -magnum and -novaopenstack-keystone provides the latest code from OpenStack Newton. - nova: Add release note that legacy notification exception contexts appearing in ERROR level logs may include sensitive information such as account passwords and authorization tokens. (bsc#1030406, CVE-2017-7214) - nova: Remove PrivTmp from openstack-nova-compute service. (bsc#1024328) - dashboard: Remove dangerous safestring declaration. (bsc#1032322, CVE-2017-7400) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 7: zypper in -t patch SUSE-OpenStack-Cloud-7-2017-882=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 7 (noarch): openstack-ceilometer-7.0.4~a0~dev7-3.1 openstack-ceilometer-agent-central-7.0.4~a0~dev7-3.1 openstack-ceilometer-agent-compute-7.0.4~a0~dev7-3.1 openstack-ceilometer-agent-ipmi-7.0.4~a0~dev7-3.1 openstack-ceilometer-agent-notification-7.0.4~a0~dev7-3.1 openstack-ceilometer-api-7.0.4~a0~dev7-3.1 openstack-ceilometer-collector-7.0.4~a0~dev7-3.1 openstack-ceilometer-doc-7.0.4~a0~dev7-3.2 openstack-ceilometer-polling-7.0.4~a0~dev7-3.1 openstack-cinder-9.1.5~a0~dev1-3.1 openstack-cinder-api-9.1.5~a0~dev1-3.1 openstack-cinder-backup-9.1.5~a0~dev1-3.1 openstack-cinder-doc-9.1.5~a0~dev1-3.1 openstack-cinder-scheduler-9.1.5~a0~dev1-3.1 openstack-cinder-volume-9.1.5~a0~dev1-3.1 openstack-dashboard-10.0.4~a0~dev2-3.1 openstack-glance-13.0.1~a0~dev6-3.1 openstack-glance-api-13.0.1~a0~dev6-3.1 openstack-glance-doc-13.0.1~a0~dev6-3.3 openstack-glance-glare-13.0.1~a0~dev6-3.1 openstack-glance-registry-13.0.1~a0~dev6-3.1 openstack-heat-7.0.4~a0~dev4-4.1 openstack-heat-api-7.0.4~a0~dev4-4.1 openstack-heat-api-cfn-7.0.4~a0~dev4-4.1 openstack-heat-api-cloudwatch-7.0.4~a0~dev4-4.1 openstack-heat-doc-7.0.4~a0~dev4-4.2 openstack-heat-engine-7.0.4~a0~dev4-4.1 openstack-heat-plugin-heat_docker-7.0.4~a0~dev4-4.1 openstack-heat-test-7.0.4~a0~dev4-4.1 openstack-keystone-10.0.2~a0~dev2-6.1 openstack-keystone-doc-10.0.2~a0~dev2-6.2 openstack-magnum-3.1.2~a0~dev22-13.1 openstack-magnum-api-3.1.2~a0~dev22-13.1 openstack-magnum-conductor-3.1.2~a0~dev22-13.1 openstack-magnum-doc-3.1.2~a0~dev22-13.1 openstack-manila-3.0.1~a0~dev27-3.1 openstack-manila-api-3.0.1~a0~dev27-3.1 openstack-manila-data-3.0.1~a0~dev27-3.1 openstack-manila-doc-3.0.1~a0~dev27-3.1 openstack-manila-scheduler-3.0.1~a0~dev27-3.1 openstack-manila-share-3.0.1~a0~dev27-3.1 openstack-nova-14.0.6~a0~dev16-3.1 openstack-nova-api-14.0.6~a0~dev16-3.1 openstack-nova-cells-14.0.6~a0~dev16-3.1 openstack-nova-cert-14.0.6~a0~dev16-3.1 openstack-nova-compute-14.0.6~a0~dev16-3.1 openstack-nova-conductor-14.0.6~a0~dev16-3.1 openstack-nova-console-14.0.6~a0~dev16-3.1 openstack-nova-consoleauth-14.0.6~a0~dev16-3.1 openstack-nova-doc-14.0.6~a0~dev16-3.3 openstack-nova-novncproxy-14.0.6~a0~dev16-3.1 openstack-nova-placement-api-14.0.6~a0~dev16-3.1 openstack-nova-scheduler-14.0.6~a0~dev16-3.1 openstack-nova-serialproxy-14.0.6~a0~dev16-3.1 openstack-nova-vncproxy-14.0.6~a0~dev16-3.1 python-ceilometer-7.0.4~a0~dev7-3.1 python-cinder-9.1.5~a0~dev1-3.1 python-glance-13.0.1~a0~dev6-3.1 python-heat-7.0.4~a0~dev4-4.1 python-horizon-10.0.4~a0~dev2-3.1 python-keystone-10.0.2~a0~dev2-6.1 python-magnum-3.1.2~a0~dev22-13.1 python-manila-3.0.1~a0~dev27-3.1 python-nova-14.0.6~a0~dev16-3.1 References: https://www.suse.com/security/cve/CVE-2017-7214.html https://www.suse.com/security/cve/CVE-2017-7400.html https://bugzilla.suse.com/1024328 https://bugzilla.suse.com/1030406 https://bugzilla.suse.com/1032322 . SUSE has released a crucial security update that tackles significant vulnerabilities in OpenStack modules. Keep updated to ensure your system's protection.. OpenStack Security Update,SUSE Patch Instructions,Software Fixes. . Severity: Important. LinuxSecurity.com Team
May 30, 2017
•Important
SuSE
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!