Explore top 10 tips to secure your open-source projects now. Read More
×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Is continuous patching actually viable?
Loading...
Explore Latest Linux Security advisories
We found 157 articles for you...
100
security advisoryimportant updatesuse linuxSUSE: 2025:01757-1 important: slurm_24_11 permission issue
* bsc#1243666 Cross-References: * CVE-2025-43904 . # Security update for slurm_24_11 Announcement ID: SUSE-SU-2025:01757-1 Release Date: 2025-05-29T14:47:58Z Rating: important References: * bsc#1243666 Cross-References: * CVE-2025-43904 CVSS scores: * CVE-2025-43904 ( SUSE ): 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2025-43904 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * HPC Module 12 * SUSE Linux Enterprise High Performance Computing 12 SP2 * SUSE Linux Enterprise High Performance Computing 12 SP3 * SUSE Linux Enterprise High Performance Computing 12 SP4 * SUSE Linux Enterprise High Performance Computing 12 SP5 * SUSE Linux Enterprise Server 12 SP2 * SUSE Linux Enterprise Server 12 SP3 * SUSE Linux Enterprise Server 12 SP4 * SUSE Linux Enterprise Server 12 SP5 * SUSE Linux Enterprise Server for SAP Applications 12 SP2 * SUSE Linux Enterprise Server for SAP Applications 12 SP3 * SUSE Linux Enterprise Server for SAP Applications 12 SP4 * SUSE Linux Enterprise Server for SAP Applications 12 SP5 An update that solves one vulnerability can now be installed. ## Description: This update for slurm_24_11 fixes the following issues: Update to version 24.11.5. Security issues fixed: * CVE-2025-43904: an issue with permission handling for Coordinators within the accounting system allowed Coordinators to promote a user to Administrator (bsc#1243666). Other changes and issues fixed: * Changes from version 24.11.5 * Return error to `scontrol` reboot on bad nodelists. * `slurmrestd` \- Report an error when QOS resolution fails for v0.0.40 endpoints. * `slurmrestd` \- Report an error when QOS resolution fails for v0.0.41 endpoints. * `slurmrestd` \- Report an error when QOS resolution fails for v0.0.42 endpoints. * `data_parser/v0.0.42` \- Added `+inline_enums` flag which modifies the output when generating OpenAPI specification. It causesenum arrays to not be defined in their own schema with references (`$ref`) to them. Instead they will be dumped inline. * Fix binding error with `tres-bind map/mask` on partial node allocations. * Fix `stepmgr` enabled steps being able to request features. * Reject step creation if requested feature is not available in job. * `slurmd` \- Restrict listening for new incoming RPC requests further into startup. * `slurmd` \- Avoid `auth/slurm` related hangs of CLI commands during startup and shutdown. * `slurmctld` \- Restrict processing new incoming RPC requests further into startup. Stop processing requests sooner during shutdown. * `slurmcltd` \- Avoid auth/slurm related hangs of CLI commands during startup and shutdown. * `slurmctld` \- Avoid race condition during shutdown or ereconfigure that could result in a crash due delayed processing of a connection while plugins are unloaded. * Fix small memleak when getting the job list from the database. * Fix incorrect printing of `%` escape characters when printing stdio fields for jobs. * Fix padding parsing when printing stdio fields for jobs. * Fix printing `%A` array job id when expanding patterns. * Fix reservations causing jobs to be held for `Bad Constraints`. * `switch/hpe_slingshot` \- Prevent potential segfault on failed curl request to the fabric manager. * Fix printing incorrect array job id when expanding stdio file names. The `%A` will now be substituted by the correct value. * Fix printing incorrect array job id when expanding stdio file names. The `%A` will now be substituted by the correct value. * `switch/hpe_slingshot` \- Fix VNI range not updating on slurmctld restart or reconfigre. * Fix steps not being created when using certain combinations of `-c` and `-n` inferior to the jobs requested resources, when using stepmgr and nodes are configured with `CPUs == Sockets*CoresPerSocket`. * Permit configuring the number of retry attempts to destroy CXIservice via the new destroy_retries `SwitchParameter`. * Do not reset `memory.high` and `memory.swap.max` in slurmd startup or reconfigure as we are never really touching this in `slurmd`. * Fix reconfigure failure of slurmd when it has been started manually and the `CoreSpecLimits` have been removed from `slurm.conf`. * Set or reset CoreSpec limits when slurmd is reconfigured and it was started with systemd. * `switch/hpe-slingshot` \- Make sure the slurmctld can free step VNIs after the controller restarts or reconfigures while the job is running. * Fix backup `slurmctld` failure on 2nd takeover. * Changes from version 24.11.4 * `slurmctld`,`slurmrestd` \- Avoid possible race condition that could have caused process to crash when listener socket was closed while accepting a new connection. * `slurmrestd` \- Avoid race condition that could have resulted in address logged for a UNIX socket to be incorrect. * `slurmrestd` \- Fix parameters in OpenAPI specification for the following endpoints to have `job_id` field: `GET /slurm/v0.0.40/jobs/state/ GET /slurm/v0.0.41/jobs/state/ GET /slurm/v0.0.42/jobs/state/ GET /slurm/v0.0.43/jobs/state/` * `slurmd` \- Fix tracking of thread counts that could cause incoming connections to be ignored after burst of simultaneous incoming connections that trigger delayed response logic. * Avoid unnecessary `SRUN_TIMEOUT` forwarding to `stepmgr`. * Fix jobs being scheduled on higher weighted powered down nodes. * Fix how backfill scheduler filters nodes from the available nodes based on exclusive user and `mcs_label` requirements. * `acct_gather_energy/{gpu,ipmi}` \- Fix potential energy consumption adjustment calculation underflow. * `acct_gather_energy/ipmi` \- Fix regression introduced in 24.05.5 (which introduced the new way of preserving energy measurements through slurmd restarts) when `EnergyIPMICalcAdjustment=yes`. * Prevent `slurmctld` deadlock in the assoc mgr. * Fixmemory leak when `RestrictedCoresPerGPU` is enabled. * Fix preemptor jobs not entering execution due to wrong calculation of accounting policy limits. * Fix certain job requests that were incorrectly denied with node configuration unavailable error. * `slurmd` \- Avoid crash due when slurmd has a communications failure with `slurmstepd`. * Fix memory leak when parsing yaml input. * Prevent `slurmctld` from showing error message about `PreemptMode=GANG` being a cluster-wide option for `scontrol update part` calls that don't attempt to modify partition PreemptMode. * Fix setting `GANG` preemption on partition when updating `PreemptMode` with `scontrol`. * Fix `CoreSpec` and `MemSpec` limits not being removed from previously configured slurmd. * Avoid race condition that could lead to a deadlock when `slurmd`, `slurmstepd`, `slurmctld`, `slurmrestd` or `sackd` have a fatal event. * Fix jobs using `--ntasks-per-node` and `--mem` keep pending forever when the requested mem divided by the number of CPUs will surpass the configured `MaxMemPerCPU`. * `slurmd` \- Fix address logged upon new incoming RPC connection from `INVALID` to IP address. * Fix memory leak when retrieving reservations. This affects `scontrol`, `sinfo`, `sview`, and the following `slurmrestd` endpoints: `GET /slurm/{any_data_parser}/reservation/{reservation_name}` `GET /slurm/{any_data_parser}/reservations` * Log warning instead of `debuflags=conmgr` gated log when deferring new incoming connections when number of active connections exceed `conmgr_max_connections`. * Avoid race condition that could result in worker thread pool not activating all threads at once after a reconfigure resulting in lower utilization of available CPU threads until enough internal activity wakes up all threads in the worker pool. * Avoid theoretical race condition that could result in new incoming RPC socket connections being ignored after reconfigure. * slurmd -Avoid race condition that could result in a state where new incoming RPC connections will always be ignored. * Add ReconfigFlags=KeepNodeStateFuture to restore saved `FUTURE` node state on restart and reconfig instead of reverting to `FUTURE` state. This will be made the default in 25.05. * Fix case where hetjob submit would cause `slurmctld` to crash. * Fix jobs using `--cpus-per-gpu` and `--mem` keep pending forever when the requested mem divided by the number of CPUs will surpass the configured `MaxMemPerCPU`. * Enforce that jobs using `--mem` and several `--*-per-*` options do not violate the `MaxMemPerCPU` in place. * `slurmctld` \- Fix use-cases of jobs incorrectly pending held when `--prefer` features are not initially satisfied. * `slurmctld` \- Fix jobs incorrectly held when `--prefer` not satisfied in some use-cases. * Ensure `RestrictedCoresPerGPU` and `CoreSpecCount` don't overlap. * Changes from version 24.11.3 * Fix database cluster ID generation not being random. * Fix a regression in which `slurmd -G` gave no output. * Fix a long-standing crash in `slurmctld` after updating a reservation with an empty nodelist. The crash could occur after restarting slurmctld, or if downing/draining a node in the reservation with the `REPLACE` or `REPLACE_DOWN` flag. * Avoid changing process name to "`watch`" from original daemon name. This could potentially breaking some monitoring scripts. * Avoid `slurmctld` being killed by `SIGALRM` due to race condition at startup. * Fix race condition in slurmrestd that resulted in "`Requested data_parser plugin does not support OpenAPI plugin`" error being returned for valid endpoints. * Fix race between `task/cgroup` CPUset and `jobacctgather/cgroup`. The first was removing the pid from `task_X` cgroup directory causing memory limits to not being applied. * If multiple partitions are requested, set the `SLURM_JOB_PARTITION` output environment variable to thepartition in which the job is running for `salloc` and `srun` in order to match the documentation and the behavior of `sbatch`. * `srun` \- Fixed wrongly constructed `SLURM_CPU_BIND` env variable that could get propagated to downward srun calls in certain mpi environments, causing launch failures. * Don't print misleading errors for stepmgr enabled steps. * `slurmrestd` \- Avoid connection to slurmdbd for the following endpoints: `GET /slurm/v0.0.41/jobs GET /slurm/v0.0.41/job/{job_id}` * `slurmrestd` \- Avoid connection to slurmdbd for the following endpoints: `GET /slurm/v0.0.40/jobs GET /slurm/v0.0.40/job/{job_id}` * `slurmrestd` \- Fix possible memory leak when parsing arrays with `data_parser/v0.0.40`. * `slurmrestd` \- Fix possible memory leak when parsing arrays with `data_parser/v0.0.41`. * `slurmrestd` \- Fix possible memory leak when parsing arrays with `data_parser/v0.0.42`. * Changes from version 24.11.2 * Fix segfault when submitting `--test-only` jobs that can preempt. * Fix regression introduced in 23.11 that prevented the following flags from being added to a reservation on an update: `DAILY`, `HOURLY`, `WEEKLY`, `WEEKDAY`, and `WEEKEND`. * Fix crash and issues evaluating job's suitability for running in nodes with already suspended job(s) there. * `slurmctld` will ensure that healthy nodes are not reported as `UnavailableNodes` in job reason codes. * Fix handling of jobs submitted to a current reservation with flags `OVERLAP,FLEX` or `OVERLAP,ANY_NODES` when it overlaps nodes with a future maintenance reservation. When a job submission had a time limit that overlapped with the future maintenance reservation, it was rejected. Now the job is accepted but stays pending with the reason "`ReqNodeNotAvail, Reserved for maintenance`". * `pam_slurm_adopt` \- avoid errors when explicitly setting some arguments to the default value. * Fix QOS preemption with `PreemptMode=SUSPEND`. * `slurmdbd` \-When changing a user's name update lineage at the same time. * Fix regression in 24.11 in which `burst_buffer.lua` does not inherit the `SLURM_CONF` environment variable from `slurmctld` and fails to run if slurm.conf is in a non-standard location. * Fix memory leak in slurmctld if `select/linear` and the `PreemptParameters=reclaim_licenses` options are both set in `slurm.conf`. Regression in 24.11.1. * Fix running jobs, that requested multiple partitions, from potentially being set to the wrong partition on restart. * `switch/hpe_slingshot` \- Fix compatibility with newer cxi drivers, specifically when specifying `disable_rdzv_get`. * Add `ABORT_ON_FATAL` environment variable to capture a backtrace from any `fatal()` message. * Fix printing invalid address in rate limiting log statement. * `sched/backfill` \- Fix node state `PLANNED` not being cleared from fully allocated nodes during a backfill cycle. * `select/cons_tres` \- Fix future planning of jobs with `bf_licenses`. * Prevent redundant "`on_data returned rc: Rate limit exceeded, please retry momentarily`" error message from being printed in slurmctld logs. * Fix loading non-default QOS on pending jobs from pre-24.11 state. * Fix pending jobs displaying `QOS=(null)` when not explicitly requesting a QOS. * Fix segfault issue from job record with no `job_resrcs`. * Fix failing `sacctmgr delete/modify/show` account operations with `where` clauses. * Fix regression in 24.11 in which Slurm daemons started catching several `SIGTSTP`, `SIGTTIN` and `SIGUSR1` signals and ignored them, while before they were not ignoring them. This also caused slurmctld to not being able to shutdown after a `SIGTSTP` because slurmscriptd caught the signal and stopped while slurmctld ignored it. Unify and fix these situations and get back to the previous behavior for these signals. * Document that `SIGQUIT` is no longer ignored by `slurmctld`, `slurmdbd`, and slurmd in 24.11. As of24.11.0rc1, `SIGQUIT` is identical to `SIGINT` and `SIGTERM` for these daemons, but this change was not documented. * Fix not considering nodes marked for reboot without ASAP in the scheduler. * Remove the `boot^` state on unexpected node reboot after return to service. * Do not allow new jobs to start on a node which is being rebooted with the flag `nextstate=resume`. * Prevent lower priority job running after cancelling an ASAP reboot. * Fix srun jobs starting on `nextstate=resume` rebooting nodes. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * HPC Module 12 zypper in -t patch SUSE-SLE-Module-HPC-12-2025-1757=1 ## Package List: * HPC Module 12 (aarch64 x86_64) * slurm_24_11-24.11.5-3.8.1 * slurm_24_11-torque-debuginfo-24.11.5-3.8.1 * slurm_24_11-munge-debuginfo-24.11.5-3.8.1 * slurm_24_11-node-24.11.5-3.8.1 * slurm_24_11-auth-none-debuginfo-24.11.5-3.8.1 * slurm_24_11-node-debuginfo-24.11.5-3.8.1 * slurm_24_11-pam_slurm-24.11.5-3.8.1 * libnss_slurm2_24_11-debuginfo-24.11.5-3.8.1 * slurm_24_11-sview-24.11.5-3.8.1 * slurm_24_11-lua-debuginfo-24.11.5-3.8.1 * libnss_slurm2_24_11-24.11.5-3.8.1 * slurm_24_11-devel-24.11.5-3.8.1 * slurm_24_11-slurmdbd-debuginfo-24.11.5-3.8.1 * slurm_24_11-torque-24.11.5-3.8.1 * slurm_24_11-munge-24.11.5-3.8.1 * slurm_24_11-sview-debuginfo-24.11.5-3.8.1 * slurm_24_11-plugins-debuginfo-24.11.5-3.8.1 * slurm_24_11-sql-24.11.5-3.8.1 * libpmi0_24_11-24.11.5-3.8.1 * slurm_24_11-slurmdbd-24.11.5-3.8.1 * perl-slurm_24_11-24.11.5-3.8.1 * slurm_24_11-debuginfo-24.11.5-3.8.1 * libpmi0_24_11-debuginfo-24.11.5-3.8.1 * slurm_24_11-auth-none-24.11.5-3.8.1 * slurm_24_11-cray-24.11.5-3.8.1 * libslurm42-debuginfo-24.11.5-3.8.1 * slurm_24_11-plugins-24.11.5-3.8.1 *slurm_24_11-sql-debuginfo-24.11.5-3.8.1 * slurm_24_11-lua-24.11.5-3.8.1 * slurm_24_11-pam_slurm-debuginfo-24.11.5-3.8.1 * perl-slurm_24_11-debuginfo-24.11.5-3.8.1 * libslurm42-24.11.5-3.8.1 * HPC Module 12 (noarch) * slurm_24_11-doc-24.11.5-3.8.1 * slurm_24_11-webdoc-24.11.5-3.8.1 * slurm_24_11-config-man-24.11.5-3.8.1 * slurm_24_11-config-24.11.5-3.8.1 ## References: * https://www.suse.com/security/cve/CVE-2025-43904.html * https://bugzilla.suse.com/show_bug.cgi?id=1243666 . The latest release for slurm_24_11 tackles critical access control vulnerabilities, significantly bolstering the security framework within SUSE Linux high-performance computing environments.. SUSE Linux HPC, Slurm update, Permission fix, Security update. . Severity: Important. LinuxSecurity.com Team
May 29, 2025
•Important
SuSE
100
security advisoryremote code executionimportantSUSE LE 15 SP5: 2025:1024-1 important: tomcat10 critical fixes
* bsc#1239302 * bsc#1239676 Cross-References: * CVE-2024-56337 . # Security update for tomcat10 Announcement ID: SUSE-SU-2025:1024-1 Release Date: 2025-03-26T11:29:29Z Rating: important References: * bsc#1239302 * bsc#1239676 Cross-References: * CVE-2024-56337 * CVE-2025-24813 CVSS scores: * CVE-2024-56337 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2024-56337 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2025-24813 ( SUSE ): 9.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2025-24813 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2025-24813 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2025-24813 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.6 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP5 LTSS * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * Web and Scripting Module 15-SP6 An update that solves two vulnerabilities can now be installed. ## Description: This update for tomcat10 fixes the following issues: * CVE-2025-24813: Fixed potential RCE and/or information disclosure/corruption with partial PUT (bsc#1239302) Other fixes: * Update to Tomcat 10.1.39 * Fixes: * launch with java 17 (bsc#1239676) * Catalina * Fix: 69602: Fix regression in releases from 12-2024 that were too strict and rejected weak etags in the If-Range header with a 400 response. Instead will consider it as a failed match since strong etags are required for If-Range. (remm) * Fix: When looking up class loader resources by resource name, the resource name should notstart with '/'. If the resource name does start with '/', Tomcat is lenient and looks it up as if the '/' was not present. When the web application class loader was configured with external repositories and names starting with '/' were used for lookups, it was possible that cached 'not found' results could effectively hide lookup results using the correct resource name. (markt) * Fix: Enable the JNDIRealm to validate credentials provided to HttpServletRequest.login(String username, String password) when the realm is configured to use GSSAPI authentication. (markt) * Fix: Fix a bug in the JRE compatibility detection that incorrectly identified Java 19 and Java 20 as supporting Java 21 features. (markt) * Fix: Improve the checks for exposure to and protection against CVE-2024-56337 so that reflection is not used unless required. The checks for whether the file system is case sensitive or not have been removed. (markt) * Add: Add support for logging the connection ID (as returned by ServletRequest.getServletConnection().getConnectionId()) with the AccessLogValve and ExtendedAccessLogValve. Based on pull request #814 by Dmole. (markt) * Fix: Avoid scenarios where temporary files used for partial PUT would not be deleted. (remm) * Fix: 69576: Avoid possible failure initializing JreCompat due to uncaught exception introduced for the check for CVE-2024-56337. (remm) * Cluster * Add: 69598: Add detection of service account token changes to the KubernetesMembershipProvider implementation and reload the token if it changes. Based on a patch by Miroslav Jezbera. (markt) * Coyote * Fix: 69575: Avoid using compression if a response is already compressed using compress, deflate or zstd. (remm) * Update: Use Transfer-Encoding for compression rather than Content-Encoding if the client submits a TE header containing gzip. (remm) * Fix: Fix a race condition in the handling of HTTP/2 stream reset that could cause unexpected 500 responses. (markt) * Other * Add: Add makensis as anoption for building the Installer for Windows on non-Windows platforms. (rjung/markt) * Update: Update Byte Buddy to 1.17.1. (markt) * Update: Update Checkstyle to 10.21.3. (markt) * Update: Update SpotBugs to 4.9.1. (markt) * Update: Update JSign to 7.1. (markt) * Add: Improvements to French translations. (remm) * Add: Improvements to Japanese translations by tak7iji. (markt) * Add: Add org.apache.juli.JsonFormatter to format log as one line JSON documents. (remm) * Update to Tomcat 10.1.35 * Catalina * Update: Add tableName configuration on the DataSourcePropertyStore that may be used by the WebDAV Servlet. (remm) * Update: Improve HTTP If headers processing according to RFC 9110. Based on pull request #796 by Chenjp. (remm/markt) * Update: Allow readOnly attribute configuration on the Resources element and allow configure the readOnly attribute value of the main resources. The attribute value will also be used by the default and WebDAV Servlets. (remm) * Fix: 69285: Optimise the creation of the parameter map for included requests. Based on sample code and test cases provided by John Engebretson. (markt) * Fix: 69527: Avoid rare cases where a cached resource could be set with 0 content length, or could be evicted immediately. (remm) * Fix: Fix possible edge cases (such as HTTP/1.0) with trying to detect requests without body for WebDAV LOCK and PROPFIND. (remm) * Fix: 69528: Add multi-release JAR support for the bloom archiveIndexStrategy of the Resources. (remm) * Fix: Improve checks for WEB-INF and META-INF in the WebDAV servlet. Based on a patch submitted by Chenjp. (remm) * Fix: Remove unused session to client map from CrawlerSessionManagerValve. Submitted by Brian Matzon. (remm) * Add: Add a check to ensure that, if one or more web applications are potentially vulnerable to CVE-2024-56337, the JVM has been configured to protect against the vulnerability and to configure the JVM correctly if not. Where one or more web applicationsare potentially vulnerable to CVE-2024-56337 and the JVM cannot be correctly configured or it cannot be confirmed that the JVM has been correctly configured, prevent the impacted web applications from starting. (markt) * Fix: When using the WebDAV servlet with serveSubpathOnly set to true, ensure that the destination for any requested WebDAV operation is also restricted to the sub-path. (markt) * Fix: Generate an appropriate Allow HTTP header when the Default servlet returns a 405 (method not allowed) response in response to a DELETE request because the target resource cannot be deleted. Pull request #802 provided by Chenjp. (markt) * Code: Refactor creation of RequestDispatcher instances so that the processing of the provided path is consistent with normal request processing. (markt) * Add: Add encodedReverseSolidusHandling and encodedSolidusHandling attributes to Context to provide control over the handling of the path used to created a RequestDispatcher. (markt) * Fix: Handle a potential NullPointerException after an IOException occurs on a non-container thread during asynchronous processing. (markt) * Fix: Enhance lifecycle of temporary files used by partial PUT. (remm) * Coyote * Fix: Don't log warnings for registered HTTP/2 settings that Tomcat does not support. These settings are now silently ignored. (markt) * Fix: Avoid a rare NullPointerException when recycling the Http11InputBuffer. (markt) * Fix: Lower the log level to debug for logging an invalid socket channel when processing poller events for the NIO Connector as this may occur in normal usage. (markt) * Code: Clean-up references to the HTTP/2 stream once request processing has completed to aid GC and reduce the size of the HTTP/2 recycled request and response cache. (markt) * Add: Add a new Connector configuration attribute, encodedReverseSolidusHandling, to control how %5c sequences in URLs are handled. The default behaviour is unchanged (decode) keeping in mind that the allowBackslash attributedetermines how the decoded URI is processed. (markt) * Fix: 69545: Improve CRLF skipping for the available method of the ChunkedInputFilter. (remm) * Fix: Improve the performance of repeated calls to getHeader(). Pull request #813 provided by Adwait Kumar Singh. (markt) * Fix: 69559: Ensure that the Java 24 warning regarding the use of sun.misc.Unsafe::invokeCleaner is only reported by the JRE when the code will be used. (markt) * Jasper * Fix: 69508: Correct a regression in the fix for 69382 that broke JSP include actions if both the page attribute and the body contained parameters. Pull request #803 provided by Chenjp. (markt) * Fix: Update the identifier validation in the Expression Language parser to reflect that, as of Java 9, _ is also a Java keyword and may not be used as an identifier. (markt) * Fix: 69521: Update the EL Parser to allow the full range of valid characters in an EL identifier as defined by the Java Language Specification. (markt) * Fix: 69532: Optimise the creation of ExpressionFactory instances. Patch provided by John Engebretson. (markt) * Web applications * Add: Documentation. Expand the description of the security implications of setting mapperContextRootRedirectEnabled and/or mapperDirectoryRedirectEnabled to true. (markt) * Fix: Documentation. Better document the default for the truststoreProvider attribute of a SSLHostConfig element. (markt) * Other * Update: Update to Commons Daemon 1.4.1. (markt) * Update: Update the packaged version of the Tomcat Migration Tool for Jakarta EE to 1.0.9. (markt) * Update: Update the internal fork of Commons Pool to 2.12.1. (markt) * Update: Update Byte Buddy to 1.16.1. (markt) * Update: Update UnboundID to 7.0.2. (markt) * Update: Update Checkstyle to 10.21.2. (markt) * Update: Update SpotBugs to 4.9.0. (markt) * Add: Improvements to French translations. (remm) * Add: Improvements to Chinese translations by leeyazhou. (markt) * Add: Improvements to Japanesetranslations by tak7iji. (markt) * Add: Improvements to Japanese translations by tak7iji. (markt) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2025-1024=1 * Web and Scripting Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP6-2025-1024=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2025-1024=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2025-1024=1 * SUSE Linux Enterprise Server 15 SP5 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2025-1024=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2025-1024=1 ## Package List: * openSUSE Leap 15.6 (noarch) * tomcat10-el-5_0-api-10.1.39-150200.5.36.1 * tomcat10-admin-webapps-10.1.39-150200.5.36.1 * tomcat10-jsp-3_1-api-10.1.39-150200.5.36.1 * tomcat10-jsvc-10.1.39-150200.5.36.1 * tomcat10-servlet-6_0-api-10.1.39-150200.5.36.1 * tomcat10-lib-10.1.39-150200.5.36.1 * tomcat10-embed-10.1.39-150200.5.36.1 * tomcat10-docs-webapp-10.1.39-150200.5.36.1 * tomcat10-10.1.39-150200.5.36.1 * tomcat10-doc-10.1.39-150200.5.36.1 * tomcat10-webapps-10.1.39-150200.5.36.1 * Web and Scripting Module 15-SP6 (noarch) * tomcat10-el-5_0-api-10.1.39-150200.5.36.1 * tomcat10-admin-webapps-10.1.39-150200.5.36.1 * tomcat10-jsp-3_1-api-10.1.39-150200.5.36.1 * tomcat10-servlet-6_0-api-10.1.39-150200.5.36.1 * tomcat10-lib-10.1.39-150200.5.36.1 * tomcat10-10.1.39-150200.5.36.1 * tomcat10-webapps-10.1.39-150200.5.36.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (noarch) *tomcat10-el-5_0-api-10.1.39-150200.5.36.1 * tomcat10-admin-webapps-10.1.39-150200.5.36.1 * tomcat10-jsp-3_1-api-10.1.39-150200.5.36.1 * tomcat10-servlet-6_0-api-10.1.39-150200.5.36.1 * tomcat10-lib-10.1.39-150200.5.36.1 * tomcat10-10.1.39-150200.5.36.1 * tomcat10-webapps-10.1.39-150200.5.36.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (noarch) * tomcat10-el-5_0-api-10.1.39-150200.5.36.1 * tomcat10-admin-webapps-10.1.39-150200.5.36.1 * tomcat10-jsp-3_1-api-10.1.39-150200.5.36.1 * tomcat10-servlet-6_0-api-10.1.39-150200.5.36.1 * tomcat10-lib-10.1.39-150200.5.36.1 * tomcat10-10.1.39-150200.5.36.1 * tomcat10-webapps-10.1.39-150200.5.36.1 * SUSE Linux Enterprise Server 15 SP5 LTSS (noarch) * tomcat10-el-5_0-api-10.1.39-150200.5.36.1 * tomcat10-admin-webapps-10.1.39-150200.5.36.1 * tomcat10-jsp-3_1-api-10.1.39-150200.5.36.1 * tomcat10-servlet-6_0-api-10.1.39-150200.5.36.1 * tomcat10-lib-10.1.39-150200.5.36.1 * tomcat10-10.1.39-150200.5.36.1 * tomcat10-webapps-10.1.39-150200.5.36.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 (noarch) * tomcat10-el-5_0-api-10.1.39-150200.5.36.1 * tomcat10-admin-webapps-10.1.39-150200.5.36.1 * tomcat10-jsp-3_1-api-10.1.39-150200.5.36.1 * tomcat10-servlet-6_0-api-10.1.39-150200.5.36.1 * tomcat10-lib-10.1.39-150200.5.36.1 * tomcat10-10.1.39-150200.5.36.1 * tomcat10-webapps-10.1.39-150200.5.36.1 ## References: * https://www.suse.com/security/cve/CVE-2024-56337.html * https://www.suse.com/security/cve/CVE-2025-24813.html * https://bugzilla.suse.com/show_bug.cgi?id=1239302 * https://bugzilla.suse.com/show_bug.cgi?id=1239676 . This notice outlines essential changes for tomcat10 focusing on significant vulnerabilities, encompassing remote code execution and safeguarding sensitive information.. Tomcat security updates, SUSE Linux security patches, remote code execution fixes, information disclosure vulnerabilities. . Severity: Important.LinuxSecurity.com Team
Mar 26, 2025
•Important
SuSE
100
security advisorysoftware updateremote code executionopenSUSE: 2025:0611-1 important: google-osconfig-agent critical issue
* bsc#1236560 Cross-References: * CVE-2024-45339 . # Security update for google-osconfig-agent Announcement ID: SUSE-SU-2025:0611-1 Release Date: 2025-02-21T10:37:16Z Rating: important References: * bsc#1236560 Cross-References: * CVE-2024-45339 CVSS scores: * CVE-2024-45339 ( SUSE ): 6.9 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2024-45339 ( SUSE ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H * CVE-2024-45339 ( NVD ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Affected Products: * openSUSE Leap 15.6 * Public Cloud Module 15-SP3 * Public Cloud Module 15-SP4 * Public Cloud Module 15-SP5 * Public Cloud Module 15-SP6 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Manager Proxy 4.2 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.2 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.2 * SUSE Manager Server 4.3 An update that solves one vulnerability can now be installed. ## Description: This update for google-osconfig-agent fixes the following issues: * CVE-2024-45339: github.com/golang/glog: a privileged process' log file path can be easily predicted and used to overwrite other sensitive files in a system. (bsc#1236560) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the commandlisted for your product: * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2025-611=1 * SUSE Linux Enterprise Micro 5.5 zypper in -t patch SUSE-SLE-Micro-5.5-2025-611=1 * Public Cloud Module 15-SP3 zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP3-2025-611=1 * Public Cloud Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP4-2025-611=1 * Public Cloud Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP5-2025-611=1 * Public Cloud Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP6-2025-611=1 ## Package List: * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64) * google-osconfig-agent-20250115.01-150000.1.44.1 * SUSE Linux Enterprise Micro 5.5 (aarch64 ppc64le s390x x86_64) * google-osconfig-agent-20250115.01-150000.1.44.1 * Public Cloud Module 15-SP3 (aarch64 ppc64le s390x x86_64) * google-osconfig-agent-20250115.01-150000.1.44.1 * Public Cloud Module 15-SP4 (aarch64 ppc64le s390x x86_64) * google-osconfig-agent-20250115.01-150000.1.44.1 * Public Cloud Module 15-SP5 (aarch64 ppc64le s390x x86_64) * google-osconfig-agent-20250115.01-150000.1.44.1 * Public Cloud Module 15-SP6 (aarch64 ppc64le s390x x86_64) * google-osconfig-agent-20250115.01-150000.1.44.1 ## References: * https://www.suse.com/security/cve/CVE-2024-45339.html * https://bugzilla.suse.com/show_bug.cgi?id=1236560 . A new release of google-osconfig-agent addresses a significant vulnerability affecting SUSE offerings. Discover patch specifications to protect your infrastructure.. google-osconfig-agent, SUSE Linux updates, patch management, system security, important updates. . Severity: Important. LinuxSecurity.com Team
Feb 21, 2025
•Important
SuSE
100
security advisoryupdatepatchSUSE: 2025:0589-1 Critical: emacs shell command injection
* bsc#1237091 Cross-References: * CVE-2025-1244 . # Security update for emacs Announcement ID: SUSE-SU-2025:0589-1 Release Date: 2025-02-19T10:31:31Z Rating: important References: * bsc#1237091 Cross-References: * CVE-2025-1244 CVSS scores: * CVE-2025-1244 ( SUSE ): 7.1 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2025-1244 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2025-1244 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS * SUSE Linux Enterprise Server for SAP Applications 15 SP3 An update that solves one vulnerability can now be installed. ## Description: This update for emacs fixes the following issues: * CVE-2025-1244: improper handling of custom "man" URI schemes allow for shell command injections. (bsc#1237091) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2025-589=1 * SUSE Linux Enterprise Server 15 SP3 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2025-589=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2025-589=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2025-589=1 ## Package List: * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) * etags-debuginfo-25.3-150000.3.25.3 * emacs-debugsource-25.3-150000.3.25.3 * emacs-x11-debuginfo-25.3-150000.3.25.3 *emacs-nox-debuginfo-25.3-150000.3.25.3 * emacs-nox-25.3-150000.3.25.3 * emacs-25.3-150000.3.25.3 * etags-25.3-150000.3.25.3 * emacs-debuginfo-25.3-150000.3.25.3 * emacs-x11-25.3-150000.3.25.3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch) * emacs-info-25.3-150000.3.25.3 * emacs-el-25.3-150000.3.25.3 * SUSE Linux Enterprise Server 15 SP3 LTSS (aarch64 ppc64le s390x x86_64) * etags-debuginfo-25.3-150000.3.25.3 * emacs-debugsource-25.3-150000.3.25.3 * emacs-x11-debuginfo-25.3-150000.3.25.3 * emacs-nox-debuginfo-25.3-150000.3.25.3 * emacs-nox-25.3-150000.3.25.3 * emacs-25.3-150000.3.25.3 * etags-25.3-150000.3.25.3 * emacs-debuginfo-25.3-150000.3.25.3 * emacs-x11-25.3-150000.3.25.3 * SUSE Linux Enterprise Server 15 SP3 LTSS (noarch) * emacs-info-25.3-150000.3.25.3 * emacs-el-25.3-150000.3.25.3 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64) * etags-debuginfo-25.3-150000.3.25.3 * emacs-debugsource-25.3-150000.3.25.3 * emacs-x11-debuginfo-25.3-150000.3.25.3 * emacs-nox-debuginfo-25.3-150000.3.25.3 * emacs-nox-25.3-150000.3.25.3 * emacs-25.3-150000.3.25.3 * etags-25.3-150000.3.25.3 * emacs-debuginfo-25.3-150000.3.25.3 * emacs-x11-25.3-150000.3.25.3 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (noarch) * emacs-info-25.3-150000.3.25.3 * emacs-el-25.3-150000.3.25.3 * SUSE Enterprise Storage 7.1 (aarch64 x86_64) * etags-debuginfo-25.3-150000.3.25.3 * emacs-debugsource-25.3-150000.3.25.3 * emacs-x11-debuginfo-25.3-150000.3.25.3 * emacs-nox-debuginfo-25.3-150000.3.25.3 * emacs-nox-25.3-150000.3.25.3 * emacs-25.3-150000.3.25.3 * etags-25.3-150000.3.25.3 * emacs-debuginfo-25.3-150000.3.25.3 * emacs-x11-25.3-150000.3.25.3 * SUSE Enterprise Storage 7.1 (noarch) * emacs-info-25.3-150000.3.25.3 * emacs-el-25.3-150000.3.25.3 ## References: *https://www.suse.com/security/cve/CVE-2025-1244.html * https://bugzilla.suse.com/show_bug.cgi?id=1237091 . Crucial patch released addressing vulnerabilities related to shell command injections in Emacs. Recommended installation through SUSE's standard procedures.. Emacs Security, SUSE Updates, Shell Injection Fix, Software Patches. . Severity: Important. LinuxSecurity.com Team
Feb 19, 2025
•Important
SuSE
100
security advisorysoftware updateremote code executionSUSE 12 SP5: 2025-0394-1 important: tomcat RCE & DoS issues
* bsc#1234663 * bsc#1234664 Cross-References: * CVE-2024-50379 . # Security update for tomcat Announcement ID: SUSE-SU-2025:0394-1 Release Date: 2025-02-10T07:34:45Z Rating: important References: * bsc#1234663 * bsc#1234664 Cross-References: * CVE-2024-50379 * CVE-2024-54677 CVSS scores: * CVE-2024-50379 ( SUSE ): 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2024-50379 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-50379 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2024-54677 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2024-54677 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-54677 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: * SUSE Linux Enterprise High Performance Computing 12 SP5 * SUSE Linux Enterprise Server 12 SP5 * SUSE Linux Enterprise Server 12 SP5 LTSS * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security * SUSE Linux Enterprise Server for SAP Applications 12 SP5 An update that solves two vulnerabilities can now be installed. ## Description: This update for tomcat fixes the following issues: * CVE-2024-50379: Fixed remote code execution (RCE) due to TOCTOU issue in JSP compilation (bsc#1234663). * CVE-2024-54677: Fixed denial-of-service (DoS) attack in examples web application (bsc#1234664). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server 12 SP5 LTSS zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-2025-394=1 * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2025-394=1 ## Package List: * SUSE Linux Enterprise Server 12 SP5 LTSS (noarch) *tomcat-javadoc-9.0.36-3.136.1 * tomcat-servlet-4_0-api-9.0.36-3.136.1 * tomcat-jsp-2_3-api-9.0.36-3.136.1 * tomcat-el-3_0-api-9.0.36-3.136.1 * tomcat-docs-webapp-9.0.36-3.136.1 * tomcat-admin-webapps-9.0.36-3.136.1 * tomcat-lib-9.0.36-3.136.1 * tomcat-webapps-9.0.36-3.136.1 * tomcat-9.0.36-3.136.1 * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (noarch) * tomcat-javadoc-9.0.36-3.136.1 * tomcat-servlet-4_0-api-9.0.36-3.136.1 * tomcat-jsp-2_3-api-9.0.36-3.136.1 * tomcat-el-3_0-api-9.0.36-3.136.1 * tomcat-docs-webapp-9.0.36-3.136.1 * tomcat-admin-webapps-9.0.36-3.136.1 * tomcat-lib-9.0.36-3.136.1 * tomcat-webapps-9.0.36-3.136.1 * tomcat-9.0.36-3.136.1 ## References: * https://www.suse.com/security/cve/CVE-2024-50379.html * https://www.suse.com/security/cve/CVE-2024-54677.html * https://bugzilla.suse.com/show_bug.cgi?id=1234663 * https://bugzilla.suse.com/show_bug.cgi?id=1234664 . SUSE announces critical updates for Tomcat, tackling vulnerabilities related to remote code execution and denial-of-service concerns, including comprehensive fix insights.. tomcat security, software update, remote execution, DoS attack, SUSE advisory. . Severity: Important. LinuxSecurity.com Team
Feb 10, 2025
•Important
SuSE
100
security advisorymoderate severityarbitrary overwriteSUSE: 2024:4294-1 moderate: socat update for arbitrary file overwrite
* bsc#1225462 Cross-References: * CVE-2024-54661 . # Security update for socat Announcement ID: SUSE-SU-2024:4294-1 Release Date: 2024-12-11T13:06:43Z Rating: moderate References: * bsc#1225462 Cross-References: * CVE-2024-54661 CVSS scores: * CVE-2024-54661 ( SUSE ): 5.0 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H * CVE-2024-54661 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: * SUSE Linux Enterprise Server 12 SP5 * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security * SUSE Linux Enterprise Server for SAP Applications 12 SP5 An update that solves one vulnerability can now be installed. ## Description: This update for socat fixes the following issues: * CVE-2024-54661: Fixed arbitrary file overwrite via predictable /tmp directory (bsc#1225462) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2024-4294=1 ## Package List: * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (x86_64) * socat-debugsource-1.7.2.4-4.3.1 * socat-1.7.2.4-4.3.1 * socat-debuginfo-1.7.2.4-4.3.1 ## References: * https://www.suse.com/security/cve/CVE-2024-54661.html * https://bugzilla.suse.com/show_bug.cgi?id=1225462 . Important enhancement for socat addresses significant challenges. Adhere to setup guidelines for openSUSE platforms now.. socat security update, suse linux server, socat patch release. . LinuxSecurity.com Team
Dec 11, 2024
SuSE
100
security advisorykernel updateimportantSUSE 12 SP5: SUSE-SU-2024:3816-1 important: Linux kernel live patch
* bsc#1225011 * bsc#1225012 * bsc#1225309 * bsc#1225311 * bsc#1225819 . # Security update for the Linux Kernel (Live Patch 53 for SLE 12 SP5) Announcement ID: SUSE-SU-2024:3816-1 Release Date: 2024-10-30T18:03:40Z Rating: important References: * bsc#1225011 * bsc#1225012 * bsc#1225309 * bsc#1225311 * bsc#1225819 Cross-References: * CVE-2023-52752 * CVE-2024-35862 * CVE-2024-35863 * CVE-2024-35864 * CVE-2024-35867 CVSS scores: * CVE-2023-52752 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-52752 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-35862 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-35863 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-35864 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-35867 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * SUSE Linux Enterprise High Performance Computing 12 SP5 * SUSE Linux Enterprise Live Patching 12-SP5 * SUSE Linux Enterprise Server 12 SP5 * SUSE Linux Enterprise Server for SAP Applications 12 SP5 An update that solves five vulnerabilities can now be installed. ## Description: This update for the Linux Kernel 4.12.14-122_194 fixes several issues. The following security issues were fixed: * CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1225011). * CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225819). * CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1225311). * CVE-2024-35867: Fixed potential UAF in cifs_stats_proc_show() (bsc#1225012). * CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1225309). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Live Patching 12-SP5 zypper in -t patch SUSE-SLE-Live-Patching-12-SP5-2024-3816=1 SUSE-SLE-Live- Patching-12-SP5-2024-3823=1 SUSE-SLE-Live-Patching-12-SP5-2024-3817=1 SUSE-SLE- Live-Patching-12-SP5-2024-3818=1 SUSE-SLE-Live-Patching-12-SP5-2024-3819=1 ## Package List: * SUSE Linux Enterprise Live Patching 12-SP5 (ppc64le s390x x86_64) * kgraft-patch-4_12_14-122_183-default-14-2.1 * kgraft-patch-4_12_14-122_186-default-13-2.1 * kgraft-patch-4_12_14-122_194-default-10-2.1 * kgraft-patch-4_12_14-122_179-default-14-2.1 * kgraft-patch-4_12_14-122_189-default-12-2.1 ## References: * https://www.suse.com/security/cve/CVE-2023-52752.html * https://www.suse.com/security/cve/CVE-2024-35862.html * https://www.suse.com/security/cve/CVE-2024-35863.html * https://www.suse.com/security/cve/CVE-2024-35864.html * https://www.suse.com/security/cve/CVE-2024-35867.html * https://bugzilla.suse.com/show_bug.cgi?id=1225011 * https://bugzilla.suse.com/show_bug.cgi?id=1225012 * https://bugzilla.suse.com/show_bug.cgi?id=1225309 * https://bugzilla.suse.com/show_bug.cgi?id=1225311 * https://bugzilla.suse.com/show_bug.cgi?id=1225819 . A security update for Red Hat Enterprise Linux (RHEL) Kernel Patch 45 for RHEL 7 addresses several critical flaws.. SUSE Live Patch, Linux Kernel Update, Security Advisory. . Severity: Important. LinuxSecurity.com Team
Oct 30, 2024
•Important
SuSE
100
security advisorysoftware updatecritical threatSUSE: 2024:3181-1 Important: PostgreSQL16 Critical Security Threat
* bsc#1229013 Cross-References: * CVE-2024-7348 . # Security update for postgresql16 Announcement ID: SUSE-SU-2024:3181-1 Rating: important References: * bsc#1229013 Cross-References: * CVE-2024-7348 CVSS scores: * CVE-2024-7348 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2024-7348 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-7348 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * SUSE Linux Enterprise High Performance Computing 12 SP5 * SUSE Linux Enterprise Server 12 SP5 * SUSE Linux Enterprise Server for SAP Applications 12 SP5 * SUSE Linux Enterprise Software Development Kit 12 SP5 An update that solves one vulnerability can now be installed. ## Description: This update for postgresql16 fixes the following issues: * Upgrade to 16.4 (bsc#1229013) * CVE-2024-7348: PostgreSQL relation replacement during pg_dump executes arbitrary SQL. (bsc#1229013) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Software Development Kit 12 SP5 zypper in -t patch SUSE-SLE-SDK-12-SP5-2024-3181=1 * SUSE Linux Enterprise High Performance Computing 12 SP5 zypper in -t patch SUSE-SLE-SERVER-12-SP5-2024-3181=1 * SUSE Linux Enterprise Server 12 SP5 zypper in -t patch SUSE-SLE-SERVER-12-SP5-2024-3181=1 * SUSE Linux Enterprise Server for SAP Applications 12 SP5 zypper in -t patch SUSE-SLE-SERVER-12-SP5-2024-3181=1 ## Package List: * SUSE Linux Enterprise Software Development Kit 12 SP5 (aarch64 ppc64le s390x x86_64) * postgresql16-server-devel-debuginfo-16.4-3.16.1 * postgresql16-devel-debuginfo-16.4-3.16.1 * postgresql16-server-devel-16.4-3.16.1 * postgresql16-devel-16.4-3.16.1 * SUSE Linux Enterprise High Performance Computing 12 SP5(aarch64 x86_64) * postgresql16-server-debuginfo-16.4-3.16.1 * postgresql16-plperl-16.4-3.16.1 * postgresql16-plpython-debuginfo-16.4-3.16.1 * postgresql16-debugsource-16.4-3.16.1 * postgresql16-plperl-debuginfo-16.4-3.16.1 * postgresql16-plpython-16.4-3.16.1 * postgresql16-contrib-16.4-3.16.1 * postgresql16-16.4-3.16.1 * postgresql16-debuginfo-16.4-3.16.1 * libecpg6-debuginfo-16.4-3.16.1 * postgresql16-pltcl-16.4-3.16.1 * postgresql16-pltcl-debuginfo-16.4-3.16.1 * libpq5-debuginfo-16.4-3.16.1 * postgresql16-contrib-debuginfo-16.4-3.16.1 * libecpg6-16.4-3.16.1 * postgresql16-server-16.4-3.16.1 * libpq5-16.4-3.16.1 * SUSE Linux Enterprise High Performance Computing 12 SP5 (noarch) * postgresql16-docs-16.4-3.16.1 * SUSE Linux Enterprise High Performance Computing 12 SP5 (x86_64) * libpq5-32bit-16.4-3.16.1 * libecpg6-debuginfo-32bit-16.4-3.16.1 * libpq5-debuginfo-32bit-16.4-3.16.1 * libecpg6-32bit-16.4-3.16.1 * SUSE Linux Enterprise Server 12 SP5 (aarch64 ppc64le s390x x86_64) * postgresql16-server-debuginfo-16.4-3.16.1 * postgresql16-plperl-16.4-3.16.1 * postgresql16-plpython-debuginfo-16.4-3.16.1 * postgresql16-debugsource-16.4-3.16.1 * postgresql16-plperl-debuginfo-16.4-3.16.1 * postgresql16-plpython-16.4-3.16.1 * postgresql16-contrib-16.4-3.16.1 * postgresql16-16.4-3.16.1 * postgresql16-debuginfo-16.4-3.16.1 * libecpg6-debuginfo-16.4-3.16.1 * postgresql16-pltcl-16.4-3.16.1 * postgresql16-pltcl-debuginfo-16.4-3.16.1 * libpq5-debuginfo-16.4-3.16.1 * postgresql16-contrib-debuginfo-16.4-3.16.1 * libecpg6-16.4-3.16.1 * postgresql16-server-16.4-3.16.1 * libpq5-16.4-3.16.1 * SUSE Linux Enterprise Server 12 SP5 (noarch) * postgresql16-docs-16.4-3.16.1 * SUSE Linux Enterprise Server 12 SP5 (s390x x86_64) * libpq5-32bit-16.4-3.16.1 * libecpg6-debuginfo-32bit-16.4-3.16.1 * libpq5-debuginfo-32bit-16.4-3.16.1 * libecpg6-32bit-16.4-3.16.1 *SUSE Linux Enterprise Server for SAP Applications 12 SP5 (ppc64le x86_64) * postgresql16-server-debuginfo-16.4-3.16.1 * postgresql16-plperl-16.4-3.16.1 * postgresql16-plpython-debuginfo-16.4-3.16.1 * postgresql16-debugsource-16.4-3.16.1 * postgresql16-plperl-debuginfo-16.4-3.16.1 * postgresql16-plpython-16.4-3.16.1 * postgresql16-contrib-16.4-3.16.1 * postgresql16-16.4-3.16.1 * postgresql16-debuginfo-16.4-3.16.1 * libecpg6-debuginfo-16.4-3.16.1 * postgresql16-pltcl-16.4-3.16.1 * postgresql16-pltcl-debuginfo-16.4-3.16.1 * libpq5-debuginfo-16.4-3.16.1 * postgresql16-contrib-debuginfo-16.4-3.16.1 * libecpg6-16.4-3.16.1 * postgresql16-server-16.4-3.16.1 * libpq5-16.4-3.16.1 * SUSE Linux Enterprise Server for SAP Applications 12 SP5 (noarch) * postgresql16-docs-16.4-3.16.1 * SUSE Linux Enterprise Server for SAP Applications 12 SP5 (x86_64) * libpq5-32bit-16.4-3.16.1 * libecpg6-debuginfo-32bit-16.4-3.16.1 * libpq5-debuginfo-32bit-16.4-3.16.1 * libecpg6-32bit-16.4-3.16.1 ## References: * https://www.suse.com/security/cve/CVE-2024-7348.html * https://bugzilla.suse.com/show_bug.cgi?id=1229013 . This software patch resolves a significant vulnerability in the mysql8 module, mitigating risks proficiently.. PostgreSQL Security Update, SUSE Linux Update, Security Advisory, Database Threat, Software Patch. . Severity: Important. LinuxSecurity.com Team
Sep 09, 2024
•Important
SuSE
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Is continuous patching actually viable?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!