An update that fixes one vulnerability is now available. . openSUSE Security Update: Security update for python-mysql-connector-python ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0351-1 Rating: important References: #1231740 Cross-References: CVE-2024-21272 Affected Products: openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-mysql-connector-python fixes the following issues: - Update to 9.1.0 (boo#1231740, CVE-2024-21272) - WL#16452: Bundle all installable authentication plugins when building the C-extension - WL#16444: Drop build support for DEB packages - WL#16442: Upgrade gssapi version to 1.8.3 - WL#16411: Improve wheel metadata information for Classic and XDevAPI connectors - WL#16341: OpenID Connect (Oauth2 - JWT) Authentication Support - WL#16307: Remove Python 3.8 support - WL#16306: Add support for Python 3.13 - BUG#37055435: Connection fails during the TLS negotiation when specifying TLSv1.3 ciphers - BUG#37013057: mysql-connector-python Parameterized query SQL injection - BUG#36765200: python mysql connector 8.3.0 raise %-.100s:%u when input a wrong host - BUG#36577957: Update charset/collation description indicate this is 16 bits - 9.0.0: - WL#16350: Update dnspython version - WL#16318: Deprecate Cursors Prepared Raw and Named Tuple - WL#16284: Update the Python Protobuf version - WL#16283: Remove OpenTelemetry Bundled Installation - BUG#36664998: Packets out of order error is raised while changing user in aio - BUG#36611371: Update dnspython required versions to allow latest 2.6.1 - BUG#36570707: Collation set on connect using C-Extension is ignored - BUG#36476195: Incorrectescaping in pure Python mode if sql_mode includes NO_BACKSLASH_ESCAPES - BUG#36289767: MySQLCursorBufferedRaw does not skip conversion - 8.4.0 - WL#16203: GPL License Exception Update - WL#16173: Update allowed cipher and cipher-suite lists - WL#16164: Implement support for new vector data type - WL#16127: Remove the FIDO authentication mechanism - WL#16053: Support GSSAPI/Kerberos authentication on Windows using authentication_ldap_sasl_client plug-in for C-extension - BUG#36227964: Improve OpenTelemetry span coverage - BUG#36167880: Massive memory leak mysqlx native Protobuf adding to collection - 8.3.0 - WL#16015: Remove use of removed COM_ commands - WL#15985: Support GSSAPI/Kerberos authentication on Windows using authentication_ldap_sasl_client plug-in for Pure Python - WL#15983: Stop using mysql_ssl_set api - WL#15982: Remove use of mysql_shutdown - WL#15950: Support query parameters for prepared statements - WL#15942: Improve type hints and standardize byte type handling - WL#15836: Split mysql and mysqlx into different packages - WL#15523: Support Python DB API asynchronous execution - BUG#35912790: Binary strings are converted when using prepared statements - BUG#35832148: Fix Django timezone.utc deprecation warning - BUG#35710145: Bad MySQLCursor.statement and result when query text contains code comments - BUG#21390859: STATEMENTS GET OUT OF SYNCH WITH RESULT SETS Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2024-351=1 Package List: - openSUSE Backports SLE-15-SP5 (aarch64 i586 ppc64le s390x x86_64): python3-mysql-connector-python-9.1.0-bp155.3.3.1 References: https://www.suse.com/security/cve/CVE-2024-21272.html https://bugzilla.suse.com/1231740 . A significant patch has been released for python-mysql-connector-python due to a serious security vulnerability.. openSUSE python-mysql-connector-python security issue. . Severity: Important. LinuxSecurity.com Team
Low: openldap security and bug fix update. Date: Wed, 8 Aug 2012 16:27:11 -0500 Reply-To: Connie Sieh Sender: Security Errata for Scientific Linux From: Connie Sieh Subject: Security ERRATA Low: openldap on SL6.x i386/x86_64 Comments: To: scientific MIME-Version: 1.0 Synopsis: Low: openldap security and bug fix update Issue Date: 2012-08-08 CVE Numbers: CVE-2012-2668 It was found that the OpenLDAP server daemon ignored olcTLSCipherSuite settings. This resulted in the default cipher suite always being used, which could lead to weaker than expected ciphers being accepted during Transport Layer Security (TLS) negotiation with OpenLDAP clients. (CVE-2012-2668) This update also fixes the following bug: - When the smbk5pwd overlay was enabled in an OpenLDAP server, and a user changed their password, the Microsoft NT LAN Manager (NTLM) and Microsoft LAN Manager (LM) hashes were not computed correctly. This led to the sambaLMPassword and sambaNTPassword attributes being updated with incorrect values, preventing the user logging in using a Windows-based client or a Samba client. With this update, the smbk5pwd overlay is linked against OpenSSL. As such, the NTLM and LM hashes are computed correctly, and password changes work as expected when using smbk5pwd. (BZ#844428) After installing this update, the OpenLDAP daemons will be restarted automatically. SL6 x86_64 openldap-2.4.23-26.el6_3.2.i686.rpm openldap-2.4.23-26.el6_3.2.x86_64.rpm openldap-clients-2.4.23-26.el6_3.2.x86_64.rpm openldap-devel-2.4.23-26.el6_3.2.i686.rpm openldap-devel-2.4.23-26.el6_3.2.x86_64.rpm openldap-servers-2.4.23-26.el6_3.2.x86_64.rpm openldap-servers-sql-2.4.23-26.el6_3.2.x86_64.rpm i386 openldap-2.4.23-26.el6_3.2.i686.rpm openldap-clients-2.4.23-26.el6_3.2.i686.rpm openldap-devel-2.4.23-26.el6_3.2.i686.rpm openldap-servers-2.4.23-26.el6_3.2.i686.rpm openldap-servers-sql-2.4.23-26.el6_3.2.i686.rpm - Scientific Linux Development Team . Recent security patches for OpenLDAP have been implemented in ScientificLinux, addressing vulnerabilities and enhancing TLS and authentication mechanisms during health assessments.. OpenLDAP Security Update, Scientific Linux Security Advisory, OpenLDAP TLS Fix. . Severity: Low. LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.