SUSE-IU-2023:673-1 SUSE Image security@suse.de SUSE Security Team SUSE Image SUSE-IU-2023:673-1 Interim 1 1 2023-10-18T06:28:28Z current 2023-09-22T01:00:00Z 2023-09-22T01:00:00Z cve-database/bin/generate-cvrf-publiccloud.pl 2021-02-18T01:00:00Z Image update for SUSE-IU-2023:673-1 / google/suse-manager-proxy-4-2-byos-v20230922-x86-64 This image update for google/suse-manager-proxy-4-2-byos-v20230922-x86-64 contains the following changes: Package autoyast2 was updated: - Rebuild the RPM database during upgrade (--rebuilddb) (bsc#1209565)- 4.3.106 - Properly install the selected products, do not lose them after resetting the package manager internally (bsc#1202234) - 4.3.105 Package bind was updated: - Security Fix: * The overmem cleaning process has been improved, to prevent the cache from significantly exceeding the configured max-cache-size limit. [bsc#1212544, CVE-2023-2828, bind-CVE-2023-2828.patch] Package binutils was updated: - Add binutils-disable-dt-relr.sh for an compatibility problem caused by binutils-revert-rela.diff in SLE codestreams. Needed for update of glibc as that would otherwise pick up the broken relative relocs support. [bsc#1213282, PED-1435] Package blog was updated: - Add patch blog.dif * Fix big endian cast problems to be able to read commands and ansers (blogctl) as well as passphrases (blogd) Package ca-certificates-mozilla was updated: - Updated to 2.62 state of Mozilla SSL root CAs (bsc#1214248) Added: - Atos TrustedRoot Root CA ECC G2 2020 - Atos TrustedRoot Root CA ECC TLS 2021 - Atos TrustedRoot Root CA RSA G2 2020 - Atos TrustedRoot Root CA RSA TLS 2021 - BJCA Global Root CA1 - BJCA Global Root CA2 - LAWtrust Root CA2 (4096) - Sectigo Public Email Protection Root E46 - Sectigo Public Email Protection Root R46 - Sectigo Public Server Authentication Root E46 - Sectigo Public Server Authentication Root R46 - SSL.com Client ECC Root CA 2022 - SSL.com Client RSA Root CA 2022 - SSL.com TLS ECC Root CA 2022 - SSL.com TLS RSA Root CA 2022 Removed CAs: - Chambers of Commerce Root - E-Tugra Certification Authority - E-Tugra Global Root CA ECC v3 - E-Tugra Global Root CA RSA v3 - Hongkong Post Root CA 1 Package cloud-netconfig was updated: - Update to version 1.8: + Fix Azure metadata check (bsc#1214715) + Fix cleanup on ifdown Package containerd was updated: - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. [ This was only released in SLE. ] Package gcc7 was updated: - Add gcc7-aarch64-bsc1214052.patch to fix -fstack-protector issues with variable length stack allocations on aarch64. Fixes CVE-2023-4039. [bsc#1214052] - Add gcc7-aarch64-untyped_call.patch to fix issue with __builtin_apply - Add gcc7-lra-elim.patch to fix internal compiler error when forming paired loads and stores on aarch64. - Disable multilib and go on riscv64 - libgcc-riscv-div.patch: Backport of r12-5799-g45116f342057b7 to fix build with current binutils - Backport _multibuild auto-generation. Remove redundant .changes files. - Add _multibuild to define 2nd spec file as additional flavor. Eliminates the need for source package links in OBS. - Add gcc7-pr89124.patch to fix KASAN kernel compile. [bsc#1205145] - Add gcc7-pr72764.patch to fix ICE with C++17 code as reported in [bsc#1204505] - Add gcc7-libsanitizer-cherry-pick-9cf13067cb5088626ba7-from-u.patch and gcc7-libgo-don-t-include-linux-fs.h-when-building-gen-sys.patch in order to support glibc 2.36. - Enable format_spec_file otherwise one gets huge diff after running change_spec. - Remove fixed sys/mount.h. - Add patch from upstream to fix altivec.h redefining bool in C++ which makes bool unusable (boo#1195517): * gcc7-pr78263.patch - Add gcc7-ada-Target_Name.patch to adjust gnats idea of the target, fixing the build of gprbuild. [bsc#1196861] - Remove include-fixed/sys/rseq.h to fix build on openSUSE:Factory. - Avoid duplicate license in cross packages. Package cups was updated: - cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504 "CUPS PostScript Parsing Heap Overflow" https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h bsc#1215204 - cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360 "Information leak through Cups-Get-Document operation" by requiring authentication for CUPS-Get-Document in cupsd.conf https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g bsc#1214254 - cups-2.2.7-additional_policies.patch is an updated version of cups-2.0.3-additional_policies.patch that replaces it to add the 'allowallforanybody' policy to cupsd.conf after cups-2.2.7-CVE-2023-32360.patch was applied - cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241 "use-after-free in cupsdAcceptClient()" https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 bsc#1212230 Package dbus-1 was updated: - Sometimes unprivileged users were able to crash dbus-daemon (CVE-2023-34969, bsc#1212126) * fix-upstream-CVE-2023-34969.patch Package lvm2 was updated: - blkdeactivate calls wrong mountpoint cmd (bsc#1214071) + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch Package docker was updated: - update to Docker 24.0.5-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2405>. bsc#1213229 - Update to Docker 24.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2404>. bsc#1213500 - Update to Docker 24.0.3-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2403>. bsc#1213120 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Recommend docker-rootless-extras instead of Require(ing) it, given it's an additional functionality and not inherently required for docker to function. - Add docker-rootless-extras subpackage (https://docs.docker.com/engine/security/rootless) - Update to Docker 24.0.2-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2402>. bsc#1212368 * Includes the upstreamed fix for the mount table pollution issue. bsc#1210797 - Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as being provided by this package. - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2306>. bsc#1211578 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Re-unify packaging for SLE-12 and SLE-15. - Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers (the uapi headers in SLE-12 are too old). + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch - Re-numbered patches: - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch` - Update to Docker 23.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2305>. - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2304>. bsc#1208074 - Fixes: * bsc#1214107 - CVE-2023-28840 * bsc#1214108 - CVE-2023-28841 * bsc#1214109 - CVE-2023-28842 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Renumbered patches: - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Remove upstreamed patches: - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - Backport <https://github.com/docker/cli/pull/4228> to allow man pages to be built without internet access in OBS. + cli-0001-docs-include-required-tools-in-source-tree.patch Package dracut was updated: - Update to version 049.1+suse.255.g19bd61fd: * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) Package firewalld was updated: - Fix firewalld does not longer understand IPv4 network masks of type `255.255.255.0` Added following patch (boo#1212974) [+ 0004-fix_rich_source_address_with_netmask.patch] Package fonts-config was updated: - get the homedir from getpwuid when no $ENV{"HOME"} set- added patches fix bsc#1210700 + fonts-config-homedir-getpwuid.patch Package gawk was updated: - format-tree-positional-arg.patch: Validate index into argument list (CVE-2023-4156, bsc#1214025) Package glibc was updated: - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - Exclude static archives from preparation for live patching (bnc#1208721) Package google-guest-agent was updated: - Update to version 20230601.00 (bsc#1212418, bsc#1212759) * Revert "Avoid conflict with automated package updates (#212)" (#214) * Don't block google-osconfig-agent (#213) - from version 20230531.00 * Avoid conflict with automated package updates (#212) * Add a support of TrustedUserCAKeys into sshd configuration (#206) - Update to version 20230510.00 * Fix dependencies after updating go ver to 1.17 (#211) * Update Go version (#210) - from version 20230426.00 * Fix compilation directives (#207) - from version 20230403.00 * Mod update (#205) * Update mod: update golang.org/x/net to 0.8.0 and its dependencies (#204) Package google-guest-configs was updated: - Update to version 20230808.00 (bsc#1214546, bsc#1214572) * 64-gce-disk-removal.rules: delete (#51) - from version 20230801.00 * Replace xxd with dd for google_nvme_id (#56) - from version 20230729.00 * Setup irq binding for a3 8g vm (#57) - from version 20230724.00 * Debian packaging: add xxd dependency (#55) - Update to version 20230626.00 (bsc#1212418, bsc#1212759) * Revert "Replace `xxd` to `cut` for google_nvme_id (#49)" (#54) - Update to version 20230526.00 * dracut: Add a new dracut module for gcp udev rules (#53) - from version 20230522.00 * src/lib/udev: only create symlinks for GCP devices (#52) - from version 20230515.00 * Replace `xxd` to `cut` for google_nvme_id (#49) - from version 20230328.00 * Set hostname: consider fully qualified static hostname (#46) - Update to version 20230217.01 * Support multiple local SSD controllers (#39) - from version 20230217.00 * Update OWNERS (#45) - from version 20230215.00 * DHCP hostname: don't reset hostname if the hostname hasn't changed (#44) - from version 20230202.00 * Update OWNERS file (#43) - from version 20230123.00 * Fix a repository URL in packaging specs (#41) Package google-osconfig-agent was updated: - Update to version 20230706.02 (bsc#1212418, bsc#1212759) * Update go version in go.mod (#479) - from version 20230706.01 * Fix condition to have 10 attempts rather than 11. (#477) - from version 20230706.00 * Remove tests for Ubuntu 18.04 (EOL) (#476) - from version 20230605.00 * Update old SLES images paths (#475) - from version 20230602.00 * Adding what exit codes mean for OS Config policy (#474) - from version 20230504.00 * Set DEBIAN_FRONTEND=noninteractive for apt-get (#472) - from version 20230403.00 * Disable repos clean-up (#471) - from version 20230330.00 * Revert "Call FQDN (#454)" (#470) - from version 20230327.00 * support new format of zypper patch (#469) * Fix comparing exec.Cmd in mock on Go1.20 - from version 20230316.00 * Remove old images from e2e tests image list - from version 20230227.01 * Update dependencies (#466) - from version 20230227.00 * Bump golang.org/x/sys from 0.0.0-20210923061019-b8560ed6a9b7 to 0.1.0 (#463) Package grub2 was updated: Package hwdata was updated: - update to 0.371: * Update pci, usb and vendor ids - update to 0.370: * Update pci, usb and vendor ids - update to 0.369: * Update pci, usb and vendor ids Package hwinfo was updated: - merge gh#openSUSE/hwinfo#132- avoid linking problems with libsamba (bsc#1212756) - 21.85 - merge gh#openSUSE/hwinfo#127 - create xen usb controller device if necessary (bsc#1204294) - 21.84 - merge gh#openSUSE/hwinfo#115 - improve treatment of NVME devices (bsc#1200975) - fix compiler warnings - 21.83 Package open-iscsi was updated: - Branched SLE-15-SP3 from Factory. No longer in sync with Tumbleweed. - Backported upstream commit, which sets 'safe_logout' and 'startup' in iscsid.conf, to address bsc#1207157 - Updated year in SPEC file Package kernel-default was updated: - Refresh patches.suse/powerpc-Move-DMA64_PROPNAME-define-to-a-header.patch.- commit d263157 - x86/speculation: Mark all Skylake CPUs as vulnerable to GDS (git-fixes). - commit a3ff58c - drm/vmwgfx: Test shader type against SVGA3d_SHADERTYPE_MIN (bsc#1203517 CVE-2022-36402) - commit 5b2dbae - powerpc/rtas: remove ibm_suspend_me_token (bsc#1023051). - commit 4f01e57 - Do not add and remove genksyms ifdefs - Refresh patches.kabi/lockdown-kABI-workaround-for-lockdown_reason-changes.patch. - Refresh patches.suse/lockdown-also-lock-down-previous-kgdb-use.patch. - commit e497b88 - powerpc/rtas: move syscall filter setup into separate function (bsc#1023051). - commit a36442d - x86/speculation: Add cpu_show_gds() prototype (git-fixes). - commit 5d94fff - x86: Move gds_ucode_mitigated() declaration to header (git-fixes). - commit 5ab0096 - blacklist.conf: Blacklist redundant docu patch - commit 1c6d737 - Sort recent hw security-related patches Move them to the sorted section and adjust patches accordingly. - Refresh patches.suse/kvm-add-gds_no-support-to-kvm.patch. - Refresh patches.suse/x86-speculation-add-force-option-to-gds-mitigation.patch. - Refresh patches.suse/x86-speculation-add-gather-data-sampling-mitigation.patch. - Refresh patches.suse/x86-speculation-add-kconfig-option-for-gds.patch. - Refresh patches.suse/x86-srso-add-a-speculative-ras-overflow-mitigation.patch. - Refresh patches.suse/x86-srso-add-srso_no-support.patch. - commit 5c87dd7 - Input: cyttsp4_core - change del_timer_sync() to timer_shutdown_sync() (bsc#1213971 CVE-2023-4134). - commit 3ffe891 - powerpc/rtas: block error injection when locked down (bsc#1023051). Refresh patches.kabi/lockdown-kABI-workaround-for-lockdown_reason-changes.patch - commit 3bd253d - powerpc/rtas: mandate RTAS syscall filtering (bsc#1023051). - commit 3251f7a - powerpc: Move DMA64_PROPNAME define to a header (bsc#1214297 ltc#197503). - commit c36e5b8 - x86/CPU/AMD: Fix the DIV(0) initial fix attempt (bsc#1213927, CVE-2023-20588). - commit 48fc5d8 - x86/CPU/AMD: Do not leak quotient data after a division by 0 (bsc#1213927, CVE-2023-20588). - commit 5e5738e - net: vmxnet3: fix possible NULL pointer dereference in vmxnet3_rq_cleanup() (bsc#1214451 CVE-2023-4459). - commit 1ac9015 - net: nfc: Fix use-after-free caused by nfc_llcp_find_local (bsc#1213601 CVE-2023-3863). - nfc: llcp: simplify llcp_sock_connect() error paths (bsc#1213601 CVE-2023-3863). - nfc: llcp: nullify llcp_sock->dev on connect() error paths (bsc#1213601 CVE-2023-3863). - commit 9d4529d - kabi/severities: Ignore newly added SRSO mitigation functions - commit 95ed32f - x86/srso: Correct the mitigation status when SMT is disabled (git-fixes). - commit 309af7f - x86/srso: Explain the untraining sequences a bit more (git-fixes). - commit fa09ab7 - x86/cpu/kvm: Provide UNTRAIN_RET_VM (git-fixes). - commit 5038558 - x86/cpu: Cleanup the untrain mess (git-fixes). - commit eda7e6d - x86/cpu: Rename srso_(.*)_alias to srso_alias_\1 (git-fixes). - commit 6e5dea6 - xfrm: add NULL check in xfrm_update_ae_params (bsc#1213666 CVE-2023-3772). - commit fdc40c6 - x86/cpu: Rename original retbleed methods (git-fixes). - commit 554babe - x86/srso: Disable the mitigation on unaffected configurations (git-fixes). - commit a99796e - x86/retpoline: Don't clobber RFLAGS during srso_safe_ret() (git-fixes). - commit 2b91cd9 - Update config files. Drop the dpt_i2o kernel module. For: jsc#PED-4579, CVE-2023-2007 - commit 6a43698 - fs: jfs: fix possible NULL pointer dereference in dbFree() (bsc#1214348 CVE-2023-4385). - commit ee83171 - xfs: fix sb write verify for lazysbcount (bsc#1214275). - commit 37c728c - xfs: update superblock counters correctly for !lazysbcount (bsc#1214275). - commit 2b6e01d - xfs: gut error handling in xfs_trans_unreserve_and_mod_sb() (bsc#1214275). - commit e55f7c6 - pseries/iommu/ddw: Fix kdump to work in absence of ibm,dma-window (bsc#1214297 ltc#197503). - commit ea499bc - net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf() (bsc#1214350 CVE-2023-4387). - commit 0fa208f - e1000: Remove unnecessary use of kmap_atomic() (jsc#PED-5738). - commit dfa3fd7 - intel/e1000:fix repeated words in comments (jsc#PED-5738). - commit e5d93d0 - e1000: Fix typos in comments (jsc#PED-5738). - commit 64fd6bc - e1000: switch to napi_consume_skb() (jsc#PED-5738). - commit 1ad8d9c - intel: remove checker warning (jsc#PED-5738). - commit c3ad152 - net: e1000: remove repeated words for e1000_hw.c (jsc#PED-5738). - commit ace3bf9 - net: e1000: remove repeated word "slot" for e1000_main.c (jsc#PED-5738). - commit cfd4849 - e1000: Fix fall-through warnings for Clang (jsc#PED-5738). - commit 7817f78 - e1000: drop unneeded assignment in e1000_set_itr() (jsc#PED-5738). - commit d2ba4db - io_uring: Acquire completion_lock around io_get_deferred_req (bsc#1213272 CVE-2023-21400). - commit 84db304 - md/raid0: Fix performance regression for large sequential writes (bsc#1213916). - md/raid0: Factor out helper for mapping and submitting a bio (bsc#1213916). - commit b0544bd - media: usb: siano: Fix warning due to null work_func_t function pointer (bsc#1213969 CVE-2023-4132). - commit c44d7c3 - media: usb: siano: Fix use after free bugs caused by do_submit_urb (bsc#1213969 CVE-2023-4132). - commit a27f430 - net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free (bsc#1214149 CVE-2023-4128). - net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free (bsc#1214149 CVE-2023-4128). - net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free (bsc#1214149 CVE-2023-4128). - commit ea3bad4 - exfat: check if filename entries exceeds max filename length (bsc#1214120 CVE-2023-4273). - commit d8c4244 - series.conf: resort - commit b2ee92a - netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID (CVE-2023-4147 bsc#1213968). - commit 1258138 - cxgb4: fix use after free bugs caused by circular dependency problem (bsc#1213970 CVE-2023-4133). - timers: Provide timer_shutdown[_sync]() (bsc#1213970). - timers: Add shutdown mechanism to the internal functions (bsc#1213970). - timers: Split [try_to_]del_timer[_sync]() to prepare for shutdown mode (bsc#1213970). - timers: Silently ignore timers with a NULL function (bsc#1213970). - timers: Rename del_timer() to timer_delete() (bsc#1213970). - timers: Rename del_timer_sync() to timer_delete_sync() (bsc#1213970). - timers: Use del_timer_sync() even on UP (bsc#1213970). - timers: Update kernel-doc for various functions (bsc#1213970). - timers: Replace BUG_ON()s (bsc#1213970). - clocksource/drivers/sp804: Do not use timer namespace for timer_shutdown() function (bsc#1213970). - clocksource/drivers/arm_arch_timer: Do not use timer namespace for timer_shutdown() function (bsc#1213970). - ARM: spear: Do not use timer namespace for timer_shutdown() function (bsc#1213970). - commit 6a1c404 - xen/netback: Fix buffer overrun triggered by unusual packet (CVE-2023-34319, XSA-432, bsc#1213546). - commit 3617080 - x86/srso: Tie SBPB bit setting to microcode patch detection (bsc#1213287, CVE-2023-20569). - commit 3f35ab4 - net: tun_chr_open(): set sk_uid from current_fsuid() (CVE-2023-4194 bsc#1214019). - commit 25c979d - net: tap_open(): set sk_uid from current_fsuid() (CVE-2023-4194 bsc#1214019). - commit b03d1d8 - x86/microcode/AMD: Make stub function static inline (bsc#1213868). - Refresh patches.suse/x86-cpu-amd-add-a-zenbleed-fix.patch. - commit f587833 - mm: Move mm_cachep initialization to mm_init() (bsc#1206418, CVE-2022-40982). - commit 487512d - bpf: add missing header file include (bsc#1211738 CVE-2023-0459). - commit 0e6ab49 - locking/rwsem: Add __always_inline annotation to __down_read_common() and inlined callers (bsc#1207270 jsc#PED-4567). - commit 9e46337 - locking/rwsem: Disable preemption in all down_write*() and up_write() code paths (bsc#1207270 jsc#PED-4567). - commit e8b39d0 - locking/rwsem: Disable preemption in all down_read*() and up_read() code paths (bsc#1207270 jsc#PED-4567). - commit f20a53f - locking/rwsem: Prevent non-first waiter from spinning in down_write() slowpath (bsc#1207270 jsc#PED-4567). - commit 9c40fdf - locking/rwsem: Disable preemption while trying for rwsem lock (bsc#1207270 jsc#PED-4567). - commit d6741e8 - locking/rwsem: Allow slowpath writer to ignore handoff bit if not set by first waiter (bsc#1207270 jsc#PED-4567). - commit 22681e5 - locking/rwsem: Always try to wake waiters in out_nolock path (bsc#1207270 jsc#PED-4567). - commit 2dd13e8 - locking/rwsem: Conditionally wake waiters in reader/writer slowpaths (bsc#1207270 jsc#PED-4567). - commit c20a7d3 - locking/rwsem: No need to check for handoff bit if wait queue empty (bsc#1207270 jsc#PED-4567). - commit 7d6a2e9 - locking: Add missing __sched attributes (bsc#1207270 jsc#PED-4567). - commit 0f7a2d1 - locking/rwsem: Optimize down_read_trylock() under highly contended case (bsc#1207270 jsc#PED-4567). - commit 46658e6 - locking/rwsem: Make handoff bit handling more consistent (bsc#1207270 jsc#PED-4567). - commit e47427d - locking/rwsem: Fix comments about reader optimistic lock stealing conditions (bsc#1207270 jsc#PED-4567). - commit 4a0d7cf - locking: Remove rcu_read_{,un}lock() for preempt_{dis,en}able() (bsc#1207270 jsc#PED-4567). - commit ee007db - lockdep: Add preemption enabled/disabled assertion APIs (bsc#1207270 jsc#PED-4567). - commit 1386d93 - locking/rwsem: Disable preemption for spinning region (bsc#1207270 jsc#PED-4567). - commit 0fad749 - locking/rwsem: Remove an unused parameter of rwsem_wake() (bsc#1207270 jsc#PED-4567). - commit b255b46 - locking/rwsem: Fix comment typo (bsc#1207270 jsc#PED-4567). - commit 0ac673a - locking/rwsem: Remove reader optimistic spinning (bsc#1207270 jsc#PED-4567). - commit 4b129c1 - locking/rwsem: Enable reader optimistic lock stealing (bsc#1207270 jsc#PED-4567). - commit 7c0e82a - locking/rwsem: Prevent potential lock starvation (bsc#1207270 jsc#PED-4567). - commit 00b076e - locking/rwsem: Pass the current atomic count to rwsem_down_read_slowpath() (bsc#1207270 jsc#PED-4567). - commit 1d2b5fa - locking/rwsem: Fold __down_{read,write}*() (bsc#1207270 jsc#PED-4567). - commit fd0b8b5 - locking/rwsem: Introduce rwsem_write_trylock() (bsc#1207270 jsc#PED-4567). - commit daa9d5f - locking/rwsem: Better collate rwsem_read_trylock() (bsc#1207270 jsc#PED-4567). - commit 23252c2 - rwsem: Implement down_read_interruptible (bsc#1207270 jsc#PED-4567). - commit 07e26fd - rwsem: Implement down_read_killable_nested (bsc#1207270 jsc#PED-4567). - commit 42f4ca4 - locking/rwsem: Prepare for a rwsem backport The rwsem backport will enable the kernel to run on large VMs in Azure (M416v2, M832v2). The rwsem code is going to be updated with newest features one of which disables optimistic spinning for readers. - blacklist.conf: Remove an entry that is part of the backported patch set. - Delete patches.suse/locking-rwsem-Disable-reader-optimistic-spinning.patch. - commit d354394 - ipv6: rpl: Fix Route of Death (CVE-2023-2156 bsc#1211131). - commit 5601bfa - x86/srso: Add IBPB on VMEXIT (bsc#1213287, CVE-2023-20569). - commit f2c709c - x86/srso: Add IBPB (bsc#1213287, CVE-2023-20569). - commit ef6bc71 - x86/srso: Add SRSO_NO support (bsc#1213287, CVE-2023-20569). - commit a905016 - x86/cpu, kvm: Add support for CPUID_80000021_EAX (bsc#1213287, CVE-2023-20569). - Refresh patches.suse/x86-cpufeatures-add-kabi-padding.patch. - commit f39cd8f - x86/srso: Add IBPB_BRTYPE support (bsc#1213287, CVE-2023-20569). - commit 5d6a6a0 - x86: Sanitize linker script (bsc#1213287, CVE-2023-20569). - commit 8ff4f99 - x86/retbleed: Add __x86_return_thunk alignment checks (bsc#1213287, CVE-2023-20569). - commit e623809 - x86/srso: Add a Speculative RAS Overflow mitigation (bsc#1213287, CVE-2023-20569). - commit 707be59 - kernel-binary.spec.in: Remove superfluous %% in Supplements Fixes: 02b7735e0caf ("rpm/kernel-binary.spec.in: Add Enhances and Supplements tags to in-tree KMPs") - commit 264db74 - net/sched: sch_qfq: account for stab overhead in qfq_enqueue (CVE-2023-3611 bsc#1213585). - net/sched: sch_qfq: refactor parsing of netlink parameters (bsc#1213585). - blacklist follow-up commit 158810b261d0 ("net/sched: sch_qfq: reintroduce lmax bound check for MTU") as unlike the original upstream commit, our backport does not remove the check - commit 609da2e - net/sched: cls_u32: Fix reference counter leak leading to overflow (CVE-2023-3609 bsc#1213586). - commit b22e9b9 - net/sched: cls_fw: Fix improper refcount update leads to use-after-free (CVE-2023-3776 bsc#1213588). - commit b7fc513 - vc_screen: don't clobber return value in vcs_read (bsc#1213167 CVE-2023-3567). - vc_screen: modify vcs_size() handling in vcs_read() (bsc#1213167 CVE-2023-3567). - vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF (bsc#1213167 CVE-2023-3567). - commit da930b7 - block, bfq: Fix division by zero error on zero wsum (bsc#1213653). - commit 67879a5 - x86/xen: Fix secondary processors' FPU initialization (bsc#1206418, CVE-2022-40982). - commit 8a9c409 - x86/fpu: Move FPU initialization into arch_cpu_finalize_init() (bsc#1206418, CVE-2022-40982). - commit d9e45bd - x86/fpu: Mark init functions __init (bsc#1206418, CVE-2022-40982). - commit 613212d - x86/fpu: Remove cpuinfo argument from init functions (bsc#1206418). - commit 82c61db - init, x86: Move mem_encrypt_init() into arch_cpu_finalize_init() (bsc#1206418). - commit 6fb5f8f - init: Invoke arch_cpu_finalize_init() earlier (bsc#1206418). - commit 8ef61c6 - init: Remove check_bugs() leftovers (bsc#1206418). - commit a639423 - ARM: cpu: Switch to arch_cpu_finalize_init() (bsc#1206418). - commit cbb96e9 - x86/cpu: Switch to arch_cpu_finalize_init() (bsc#1206418). - commit 7fa4777 - x86/mm: Initialize text poking earlier (bsc#1206418, CVE-2022-40982). - Refresh patches.suse/init-provide-arch_cpu_finalize_init.patch. - commit 9784a5e - init: Provide arch_cpu_finalize_init() (bsc#1206418). - commit f81d332 - x86/mm: fix poking_init() for Xen PV guests (bsc#1206418, CVE-2022-40982). - commit b12d1bf - x86/mm: Use mm_alloc() in poking_init() (bsc#1206418, CVE-2022-40982). - commit 9a1d45f - net: tun: fix bugs for oversize packet when napi frags enabled (bsc#1213543 CVE-2023-3812). - commit 5e9be17 - netfilter: nf_tables: do not ignore genmask when looking up chain by id (CVE-2023-31248 bsc#1213061). - commit 414921d - netfilter: nf_tables: prevent OOB access in nft_byteorder_eval (CVE-2023-35001 bsc#1213059). - commit b0acbe2 - uaccess: Add speculation barrier to copy_from_user() (bsc#1211738 CVE-2023-0459). - commit 93eec59 - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE (CVE-2023-3390 CVE-2023-3117 bsc#1212846 bsc#1213245). - commit 176a7df - KVM: Add GDS_NO support to KVM (bsc#1206418, CVE-2022-40982). - commit 6550823 - x86/speculation: Add Kconfig option for GDS (bsc#1206418, CVE-2022-40982). - commit eb94624 - x86/speculation: Add force option to GDS mitigation (bsc#1206418, CVE-2022-40982). - commit 79691d3 - x86/speculation: Add Gather Data Sampling mitigation (bsc#1206418, CVE-2022-40982). - commit 74a70bc - ocfs2: fix defrag path triggering jbd2 ASSERT (bsc#1199304). - ocfs2: fix a deadlock when commit trans (bsc#1199304). - jbd2: export jbd2_journal_[grab|put]_journal_head (bsc#1199304). - ocfs2: fix race between searching chunks and release journal_head from buffer_head (bsc#1199304). - commit f86bdfe - Refresh patches.suse/keys-Fix-linking-a-duplicate-key-to-a-keyring-s-asso.patch. - commit d8b8cf8 - x86/cpu/amd: Add a Zenbleed fix (bsc#1213286, CVE-2023-20593). - commit c2a9155 - x86/cpu/amd: Move the errata checking functionality up (bsc#1213286, CVE-2023-20593). - commit d7a9bc3 - rpm: Update dependency to match current kmod. - commit d687dc3 - keys: Do not cache key in task struct if key is requested from kernel thread (bsc#1213354). - commit 0121b9a - net: mana: Add support for vlan tagging (bsc#1212301). - commit 613e87e - fs: hfsplus: fix UAF issue in hfsplus_put_super (bsc#1211867, CVE-2023-2985). - commit e01b911 - rpm/check-for-config-changes: ignore also RISCV_ISA_* and DYNAMIC_SIGFRAME They depend on CONFIG_TOOLCHAIN_HAS_*. - commit 1007103 - ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size (bsc#1210584). - ubi: ensure that VID header offset + VID header size <= alloc, size (bsc#1210584). - commit 8f5f025 - Remove more packaging cruft for SLE < 12 SP3 - commit a16781c - Get module prefix from kmod (bsc#1212835). - commit f6691b0 - rpm/check-for-config-changes: ignore also PAHOLE_HAS_* We now also have options like CONFIG_PAHOLE_HAS_LANG_EXCLUDE. - commit 86b52c1 - usrmerge: Adjust module path in the kernel sources (bsc#1212835). With the module path adjustment applied as source patch only ALP/Tumbleweed kernel built on SLE/Leap needs the path changed back to non-usrmerged. - commit dd9a820 - ipvlan:Fix out-of-bounds caused by unclear skb->cb (bsc#1212842 CVE-2023-3090). - commit ddb6922 - x86/build: Avoid relocation information in final vmlinux (bsc#1187829). - commit 88b515e - Refresh patches.suse/cifs-fix-open-leaks-in-open_cached_dir.patch. s/sync_hdr/hdr/ - fix build breakage on CONFIG_CIFS_DEBUG2=y. - commit c3cb631 - kernel-docs: Use python3 together with python3-Sphinx (bsc#1212741). - commit 95a40a6 - HID: intel_ish-hid: Add check for ishtp_dma_tx_map (git-fixes bsc#1212606 CVE-2023-3358). - commit 7077c4f - usb: gadget: udc: renesas_usb3: Fix use after free bug in renesas_usb3_remove due to race condition (bsc#1212513 CVE-2023-35828). - commit 1f06f62 - binfmt_elf: Take the mmap lock when walking the VMA list (bsc#1209039 CVE-2023-1249). - commit 3f46ff2 - bluetooth: Perform careful capability checks in hci_sock_ioctl() (bsc#1210533 CVE-2023-2002). - commit cb86eb0 - relayfs: fix out-of-bounds access in relay_file_read (bsc#1212502 CVE-2023-3268). - kernel/relay.c: fix read_pos error when multiple readers (bsc#1212502 CVE-2023-3268). - commit 73e4027 - media: dm1105: Fix use after free bug in dm1105_remove due to race condition (bsc#1212501 CVE-2023-35824). - commit 0c9d507 - media: saa7134: fix use after free bug in saa7134_finidev due to race condition (bsc#1212494 CVE-2023-35823). - commit 61b38d8 - net/sched: flower: fix possible OOB write in fl_set_geneve_opt() (CVE-2023-35788 bsc#1212504). - commit 865936b - Drop a buggy dvb-core fix patch (bsc#1205758) Also the kabi workaround is dropped, too - commit 7ace3fb - cifs: fix open leaks in open_cached_dir() (bsc#1209342). - commit 82c30e2 - kernel-docs: Add buildrequires on python3-base when using python3 The python3 binary is provided by python3-base. - commit c5df526 - fbcon: Check font dimension limits (CVE-2023-3161 bsc#1212154). - commit 6f6d21f - Move setting %%build_html to config.sh - commit 3f65cd5 - memstick: r592: Fix UAF bug in r592_remove due to race condition (CVE-2023-3141 bsc#1212129 bsc#1211449). - commit 4d760e7 - firewire: fix potential uaf in outbound_phy_packet_callback() (CVE-2023-3159 bsc#1212128). - commit 444321d - Fix missing top level chapter numbers on SLE12 SP5 (bsc#1212158). - commit 7ebcbd5 - Move setting %%split_optional to config.sh - commit 4519250 - Move setting %%supported_modules_check to config.sh - commit d9c64aa - rpm/kernel-docs.spec.in: pass PYTHON=python3 to fix build error (bsc#1160435) - commit 799f050 - rpm/kernel-binary.spec.in: Fix compatibility wth newer rpm - commit 334fb4d - Also include kernel-docs build requirements for ALP - commit 114d088 - Move the kernel-binary conflicts out of the spec file. Thie list of conflicting packages varies per release. To reduce merge conflicts move the list out of the spec file. - commit 4d81125 - sched/rt: pick_next_rt_entity(): check list_entry (bsc#1208600 CVE-2023-1077) - commit a8f82d0 - Avoid unsuported tar parameter on SLE12 - commit f11765a - gve: Remove the code of clearing PBA bit (bsc#1211519). - gve: Secure enough bytes in the first TX desc for all TCP pkts (bsc#1211519). - gve: Cache link_speed value from device (bsc#1211519). - gve: Handle alternate miss completions (bsc#1211519). - gve: Adding a new AdminQ command to verify driver (bsc#1211519). - gve: Fix error return code in gve_prefill_rx_pages() (bsc#1211519). - gve: Reduce alloc and copy costs in the GQ rx path (bsc#1211519). - gve: Fix GFP flags when allocing pages (bsc#1211519). - google/gve:fix repeated words in comments (bsc#1211519). - gve: Fix spelling mistake "droping" -> "dropping" (bsc#1211519). - gve: enhance no queue page list detection (bsc#1211519). - commit 5088617 - Move obsolete KMP list into a separate file. The list of obsoleted KMPs varies per release, move it out of the spec file. - commit 016bc55 - Trim obsolete KMP list. SLE11 is out of support, we do not need to handle upgrading from SLE11 SP1. - commit 08819bb - Generalize kernel-doc build requirements. - commit 23b058f - kernel-binary: Add back kernel-default-base guarded by option Add configsh option for splitting off kernel-default-base, and for not signing the kernel on non-efi - commit 28c22af - net: rpl: fix rpl header size calculation (CVE-2023-2156 bsc#1211131). - commit 884cd15 - Drivers: hv: vmbus: Optimize vmbus_on_event (bsc#1211622). - commit 6cf7013 - usrmerge: Compatibility with earlier rpm (boo#1211796) - commit 2191d32 - Fix usrmerge error (boo#1211796) - commit da84579 - Update References patches.suse/x86-speculation-restore-speculation-related-msrs-during-s3-resume.patch (bsc#1198400 bsc#1209779 CVE-2023-1637). - commit 23e11e7 - tcp: Fix data races around icsk->icsk_af_ops (bsc#1204405 CVE-2022-3566). - commit d1f836b - Remove usrmerge compatibility symlink in buildroot (boo#1211796) Besides Makefile depmod.sh needs to be patched to prefix /lib/modules. Requires corresponding patch to kmod. - commit b8e00c5 - Update patches.suse/netfilter-x_tables-use-correct-memory-barriers.patch (bsc#1184208 CVE-2021-29650 bsc#1211596 CVE-2020-36694). - commit 0092ed2 - HID: asus: use spinlock to safely schedule workers (bsc#1208604 CVE-2023-1079). - commit df4ce9a - HID: asus: use spinlock to protect concurrent accesses (bsc#1208604 CVE-2023-1079). - commit 4b7a2e4 - ipv6: sr: fix out-of-bounds read when setting HMAC data (bsc#1211592). - commit f37c1a1 - power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition (CVE-2023-33288 bsc#1211590). - commit 3e2047c - kernel-source: Remove unused macro variant_symbols - commit 915ac72 - media: dvb_net: kABI workaround (CVE-2022-45886 bsc#1205760). - media: dvb_frontend: kABI workaround (CVE-2022-45885 bsc#1205758). - commit c99685c - media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb() (CVE-2022-45887 bsc#1205762). - media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 (CVE-2022-45919 bsc#1205803). - media: dvb-core: Fix use-after-free due to race at dvb_register_device() (CVE-2022-45884 bsc#1205756). - media: dvb-core: Fix use-after-free due on race condition at dvb_net (CVE-2022-45886 bsc#1205760). - media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*() (CVE-2023-31084 bsc#1210783). - media: dvb-core: Fix use-after-free on race condition at dvb_frontend (CVE-2022-45885 bsc#1205758). - commit f5d1bea - media: dvbdev: fix error logic at dvb_register_device() (CVE-2022-45884 bsc#1205756). - media: dvbdev: Fix memleak in dvb_register_device (CVE-2022-45884 bsc#1205756). - media: media/dvb: Use kmemdup rather than duplicating its implementation (CVE-2022-45884 bsc#1205756). - commit fa580d0 - net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg (bsc#1210940 CVE-2023-31436). - commit eeb865d - i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer() (bsc#1210715 CVE-2023-2194). - commit e9b03ca - netrom: Fix use-after-free caused by accept on already connected socket (bsc#1211186 CVE-2023-32269). - commit e76516d - SUNRPC: Ensure the transport backchannel association (bsc#1211203). - commit db18275 - rpm/constraints.in: Increase disk size constraint for riscv64 to 52GB - commit 1c1a4cd - netfilter: nf_tables: deactivate anonymous set from preparation phase (CVE-2023-32233 bsc#1211043). - commit 8d253dc - act_mirred: use the backlog for nested calls to mirred ingress (CVE-2022-4269 bsc#1206024). - net/sched: act_mirred: better wording on protection against excessive stack growth (CVE-2022-4269 bsc#1206024). - net/sched: act_mirred: refactor the handle of xmit (CVE-2022-4269 bsc#1206024). - commit c36d39a - wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() (bsc#1209287 CVE-2023-1380). - commit 238a208 - Remove obsolete rpm spec constructs defattr does not need to be specified anymore buildroot does not need to be specified anymore - commit c963185 - kernel-spec-macros: Fix up obsolete_rebuilds_subpackage to generate obsoletes correctly (boo#1172073 bsc#1191731). rpm only supports full length release, no provides - commit c9b5bc4 - ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h (bsc#1206878 bsc#1211105 CVE-2023-2513). - commit 2a8658b - ext4: fix use-after-free in ext4_xattr_set_entry (bsc#1206878 bsc#1211105 CVE-2023-2513). - commit 880db90 - kernel-binary: install expoline.o (boo#1210791 bsc#1211089) - commit d6c8c20 - net: qcom/emac: Fix use after free bug in emac_remove due to race condition (bsc#1211037 CVE-2023-2483). - commit d3abec2 - Update patches.suse/io_uring-prevent-race-on-registering-fixed-files.patch Fix the missing the bsc# prefix for the bug number in the References tag. - commit 704a6c4 - timens: Forbid changing time namespace for an io_uring process (bsc#1208474 CVE-2023-23586). - commit 89cf4b3 - s390,dcssblk,dax: Add dax zero_page_range operation to dcssblk driver (bsc#1199636). - commit 6a9faa3 Package krb5 was updated: - Ensure array count consistency in kadm5 RPC; (bsc#1214054); (CVE-2023-36054); - Added patches: * 0011-Ensure-array-count-consistency-in-kadm5-RPC.patch Package libX11 was updated: - U_InitExt.c-Add-bounds-checks-for-extension-request-ev.patch * Buffer overflows in InitExt.c (boo#1212102, CVE-2023-3138) Package gcc12 was updated: - Add gcc12-aarch64-bsc1214052.patch to fix -fstack-protector issues with variable length stack allocations on aarch64. Fixes CVE-2023-4039. [bsc#1214052] - Update to GCC 12.3 release, 0c61aa720e62f1baf0bfd178e283, git1204 * includes regression bug fixes - Add gcc12-testsuite-fixes.patch to pick testsuite related fixes from the branch after the release. - Speed up builds with --enable-link-serialization. - Update to gcc-12 branch head, 193f7e62815b4089dfaed4c2bd3, git749 - Don't rely on %usrmerged, set it based on standard %suse_version - Update to gcc-12 branch head, e4b5fec75aa8d0d01f6e042ec28, git696 * remove gcc12-fifo-jobserver-support.patch which is now included upstream - avoid trailing backslashes at the end of post install scripts - Update to gcc-12 branch head, 0aaef83351473e8f4eb774f8f99, git537 - Update embedded newlib to version 4.2.0 * includes newlib-4.1.0-aligned_alloc.patch - add gcc12-riscv-inline-atomics.patch, gcc12-riscv-pthread.patch: handle subword size inline atomics (needed by several openSUSE packages) Package libcap was updated: - Fixed integer overflow or wraparound in libcap/cap_alloc.c:_libcap_strdup() (bsc#1211419 / CVE-2023-2603) CVE-2023-2603.patch Package cryptsetup was updated: - luksFormat: Handle system with low memory and no swap space [bsc#1211079] * Check for physical memory available also in PBKDF benchmark. * Try to avoid OOM killer on low-memory systems without swap. * Use only half of detected free memory on systems without swap. * Add patches: - cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch - cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch - cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch Package libdb-4_8 was updated: Package libeconf was updated: - Additional info for version 0.5.2: * Fixed a stack-buffer-overflow vulnerability in "econf_writeFile" function. (CVE-2023-30078, CVE-2023-32181, bsc#1211078) * Fixed a stack-buffer-overflow vulnerability in "read_file" function. (CVE-2023-30079, CVE-2023-22652, bsc#1211078) - Update to version 0.5.2: * Fixed build for aarch64 and gcc13. * Making the output verbose when a test fails. * Fixed a stack-buffer-overflow vulnerability in "econf_writeFile" function. * Fixed a stack-buffer-overflow vulnerability in "read_file" function. * Added new feature: econf_set_conf_dirs (const char **dir_postfix_list) Sets a list of directory structures (with order) which describes the directories in which the files have to be parsed. E.G. with the given list: {"/conf.d/", ".d/", "/", NULL} files in following directories will be parsed: "<default_dirs>/<project_name>.<suffix>.d/" "<default_dirs>/<project_name>/conf.d/" "<default_dirs>/<project_name>.d/" "<default_dirs>/<project_name>/" The entry "<default_dirs>/<project_name>.<suffix>.d/" will be added automatically. * General code cleanup. - Update to version 0.5.1: * Reading files in /usr/_vendor_/_example_._suffix_.d/* regardless there is a /etc/_example_._suffix_ file. (#175) - Update to version 0.5.0: * API calls econf_read*WithCallback supporting a general (void *) argument for user defined data with which the callback function is called. * Tagged following functions deprecated: econf_requireOwner, econf_requireGroup, econf_requirePermissions, econf_followSymlinks, econf_reset_security_settings Use one of the econf_read*WithCallback functions instead. - Update to version 0.4.9: * libeconf.h: added missing sys/types.h header (#171) * new API calls: econf_readFileWithCallback, econf_readDirsWithCallback, econf_readDirsHistoryWithCallback (#172) * Checking NULL comment parameter in the parsing functions. - Update to version 0.4.8+git20221114.7ff7704: * Parsing files which are containing keys only (#170) All delimiters are allowed now : "", " =", " ", "=". But the user should use "" in order to be distinct. * /usr/etc/shells.d/<file_name> will not be parsed if /etc/shells.d/<file_name> is defined too. * Lto build fixed (#168) * New calls: econf_comment_tag, econf_delimiter_tag, econf_set_comment_tag, econf_set_delimiter_tag * Checking UID,GroupID, permissions,... of the parsed files (#165) New calls: econf_requireOwner, econf_requireGroup, econf_requirePermissions, econf_followSymlinks * Ignoring Group without brackets; Do not hold brackets in the internal data structure. (#164) * Error handling improved for nums and booleans (#163) - Update to version 0.4.6+git20220427.3016f4e: * econftool: * * Parsing error: Reporting file and line nr. * * --delimeters=spaces Taking all kind of spaces for delimiter * libeconf: Fixed bsc#1198165: Parsing files correctly which have space characters AND none space characters as delimiters. - Update to version 0.4.5+git20220406.c9658f2: * econftool: * * New call "syntax" for checking the configuration files only. Returns an error string with line number if an error occurs. * * New options "--comment" and "--delimeters" * * Parsing one file only if needed. Package mozilla-nss was updated: - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. Package freetype2 was updated: - Added patch: * CVE-2023-2004.patch + fixes bsc#1210419, CVE-2023-2004: Integer overflow Package libjansson was updated: - Update to 2.14 (boo#1201817): * New Features: + Add `json_object_getn`, `json_object_setn`, `json_object_deln`, and the corresponding `nocheck` functions. + Add jansson_version_str() and jansson_version_cmp() for runtime version checking + Add json_object_update_new(), json_object_update_existing_new() and json_object_update_missing_new() functions + Add json_object_update_recursive() + Add `json_pack()` format specifiers s*, o* and O* for values that can be omitted if null (#339). + Add `json_error_code()` to retrieve numeric error codes (#365, #380, #381). + Enable thread safety for `json_dump()` on all systems. Enable thread safe `json_decref()` and `json_incref()` for modern compilers (#389). + Add `json_sprintf()` and `json_vsprintf()` (#393). * Fixes: + Handle `sprintf` corner cases. + Add infinite loop check in json_deep_copy() + Enhance JANSSON_ATTRS macro to support earlier C standard(C89) + Update version detection for sphinx-build + Fix error message in `json_pack()` for NULL object (#409). + Avoid invalid memory read in `json_pack()` (#421). + Call va_end after va_copy in `json_vsprintf()` (#427). + Improve handling of formats with '?' and '*' in `json_pack()` (#438). + Remove inappropriate `jsonp_free()` which caused segmentation fault in error handling (#444). + Fix incorrect report of success from `json_dump_file()` when an error is returned by `fclose()` (#359). + Make json_equal() const-correct (#344). + Fix incomplete stealing of references by `json_pack()` (#374) - Use GitHub as source URLs: Release hasn't been uploaded to digip.org. - Add check section. Package openldap2 was updated: - bsc#1212260 - crash in libldap when non-ldap data responds * 0245-ITS-9803-Drop-connection-when-receiving-non-LDAP-dat.patch Package liblognorm was updated: - Upgrade to liblognorm v2.0.6 (jsc#PED-4883) * 2018-11-02: nitfixes: issues deteced by CodeFactor.com * 2018-11-01: more cleanup of shell scripting * 2018-10-31: cleanup shell scripting * 2018-10-26: implement Checkpoint LEA transfer format * 2018-10-31: fix mising shebangs in test scripts * 2018-10-30: fix some bash style nits * 2018-07-15: fix very theoretic misadressing (gcc-8 warning) * 2018-06-26: string parser: add "lazy" matching mode * 2018-05-30: Update lognormalizer.c * 2018-05-30: Update lognormalizer.c to support case fallthrough * 2018-05-30: Update README * 2018-05-10: Fix for #229 (cisco-interface-spec at end of line) * 2018-03-21: Suppress invalid param error for name to fix #270 - Upgrade to liblognorm v2.0.5 * 2018-04-25: fix potential NULL pointer addressing * 2018-04-07: Add test for nested user types * 2018-04-07: Fix use after free with nested user types (#235) * 2018-04-25: build system: fix gcc warning * 2018-04-25: make "make check" "succeed" on solaris 10 * 2018-04-16: fix build warnings with some newer compilers * 2018-04-16: remove dead code * 2018-04-16: fix potential memory leaks during config processing * 2018-04-16: fix memory leak during config processing * 2018-04-16: csv encoder: fix format error when processing arrays * 2018-03-29: Explicitly list supported whitespace characters * 2018-03-28: "fix" return type of unused dummy function - replaces liblognorm-2.0.4-no-return-in-nonvoid-function.patch * 2018-03-21: Suppress invalid param error for name to fix #270 * 2018-03-19: fix header guard * 2018-03-06: Correct CLI options in the docs * 2018-01-13: AIX port : added compatibility and modified lognormalizer for AIX. * 2017-11-29: codestyle: correct line length to 120 * 2017-11-29: codestyle: set max line length to 120 * 2017-11-25: fix some very bad line length violations * 2017-11-25: travis: temporarily permit longer line length * 2017-10-19: make build with gcc7 * 2017-10-05: es_str2cstr leak in string-to v1 parse Package openssl-1_1 was updated: - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed openssl-CVE-2023-0286.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch Package parted was updated: - fix null pointer dereference (bsc#1193412) - add: parted-fix-check-diskp-in-do_name.patch - update mkpart options in manpage (bsc#1182142) - add: parted-mkpart-manpage.patch Package pcre2 was updated: - Security fix: [bsc#1213514, CVE-2022-41409] * Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input. * Add pcre2-CVE-2022-41409.patch Package procps was updated: - Add patch CVE-2023-4016.patch * CVE-2023-4016: ps buffer overflow (bsc#1214290) Package libxml2 was updated: - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch Package libyajl was updated: Package libzypp was updated: - Fixup changes for 17.31.16. Remove faulty reference to a bug actually fixed in 2019. - version 17.31.20 (22) - Fix zypp-tui/output/Out.h to build with clang. - Fix zypp/Arch.h for clang (fixes #478) Clang seems to have issues with picking the overload in std::men_fn if there is a static overload of a member function. We need to explicitely specify the correct type of the function pointer. To make sure this would not break compiling a application with clang that builds against libzypp this patch works around the problem. - version 17.31.19 (22) - SINGLE_RPMTRANS: Respect ZYPP_READONLY_HACK when checking the zypp-rpm lock (fixes openSUSE/openSUSE-repos#29) - version 17.31.18 (22) - Fix wrong filesize exceeded dl abort in zyppng::Downloader (bsc#1213673) In some cases when downloading very small files we can run into issues when the URL is protected by credentials. - version 17.31.17 (22) - Fix negative ZYPP_LOCK_TIMEOUT not waiting forever (bsc#1213231) - Don't cleanup orphaned dirs if read-only mode was promised (bsc#1210740) - version 17.31.16 (22) - Fix build against protobuf >= 22 (fixes #465, closes #466) Port away from protobuf_generate_cpp. Upstream protobuf does not export protobuf_generate_cpp by default anymore. Use protobuf_generate instead, which is also available on older versions. - Remove SUSE < SLE11 constructs (fixes #464). - version 17.31.15 (22) - build: honor libproxy.pc's includedir (bsc#1212222) - Curl: trim all custom headers (bsc#1212187) HTTP/2 RFC 9113 forbids fields ending with a space. So we make sure all custom headers are trimmed. This also includes headers returned by URL-Resolver plugins. - version 17.31.14 (22) Package shadow was updated: - bsc#1213189: Change lock mechanism to file locking to prevent lock files after power interruptions - Add shadow-4.8.1-lock-mechanism.patch - bsc#1206627: Add --prefix support to passwd, chpasswd and chage Needed for YaST - Add shadow-4.8.1-add-prefix-passwd-chpasswd-chage.patch Package man was updated: - Use inverted exit status in exec option of find command to avoid refreshing man database (boo#1155879) - Minor corrections on %ghost /var/cache/man Package mozilla-nspr was updated: - update to version 4.35 * fixes for building with clang * use the number of online processors for the PR_GetNumberOfProcessors() API on some platforms * fix build on mips+musl libc * Add support for the LoongArch 64-bit architecture Package nfs-utils was updated: - Add 0032-exportfs-Ingnore-export-failures-in-nfs-server.seriv.patch Inconsistencies in /etc/exports shouldn't be fatal. (bsc#1212594) - Add 0030-systemd-use-correct-modprobe-d-directory SLE15-SP5 an earlier don't use /usr/lib/modprobe.d (bsc#1200710) - Add 0031-mountd-don-t-advertise-krb5-for-v4root-when-not-conf.patch Avoid unhelpful warning if rpcsec_gss_krb5.ko not installed - Add 0028-mount.nfs-always-include-mountpoint-or-spec-if-error.patch boo#1157881 - Add 0029-nfsd.man-fix-typo-in-section-on-scope.patch bsc#1209859 - Allow scope to be set in sysconfig: NFSD_SCOPE Package openssh was updated: - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) Package perl-Bootloader was updated: - merge gh#openSUSE/perl-bootloader#152- use signed grub EFI binary when updating grub in default EFI location (bsc#1210799) - check whether grub2-install supports --suse-force-signed option - 0.944 - merge gh#openSUSE/perl-bootloader#147 - UEFI: update also default location, if it is controlled by SUSE (bsc#1210799, bsc#1201399) - 0.943 - merge gh#openSUSE/perl-bootloader#142 - use fw_platform_size to distinguish between 32 bit and 64 bit UEFI platforms (bsc#1208003) - 0.942 - merge gh#openSUSE/perl-bootloader#141 - systemd-boot: easier initial setup - 0.941 - merge gh#openSUSE/perl-bootloader#140 - add basic support for systemd-boot - 0.940 Package perl was updated: - enable TLS cert verification in CPAN [bnc#1210999] [CVE-2023-31484] new patch: perl-cpan_verify_cert.diff Package python-libxml2-python was updated: - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch Package python-pyasn1 was updated: - To avoid users of this package having to recompile bytecode files, change the mtime of any __init__.py. (bsc#1207805) Package python-requests was updated: - Add CVE-2023-32681.patch to fix unintended leak of Proxy-Authorization header (CVE-2023-32681, bsc#1211674) Upstream commit: gh#psf/requests@74ea7cf7a6a2 Package salt was updated: - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994)- Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Update to Salt release version 3006.0 (jsc#PED-4360) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add missing patch after rebase to fix collections Mapping issues - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Create new salt-tests subpackage containing Salt tests - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Prevent deadlocks in salt-ssh executions - Require python3-jmespath runtime dependency (bsc#1209233) - Added: * 3005.1-implement-zypper-removeptf-573.patch * control-the-collection-of-lvm-grains-via-config.patch * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch * skip-package-names-without-colon-bsc-1208691-578.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * adds-explicit-type-cast-for-port.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * normalize-package-names-once-with-pkg.installed-remo.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch Package spacewalk-certs-tools was updated: - version 4.2.20-1 * Update translations Package rsync was updated: - Drop rsync-fix-external-compression.patch, rsync-iconv-segfault.patch - Fix --delay-updates never updates after interruption [bsc#1204538] * Added patch rsync-fix-delay-updates-never-updates-after-interruption.patch Package rsyslog was updated: - fix segfaults in modExit() of imklog.c (bsc#1211757) * add 0001-imklog-fix-invalid-memory-adressing-could-cause-abor.patch - fix removal of imfile state files (bsc#1213212) * add 0001-fixing-the-deleteStateOnFileDelete-option.patch Package runc was updated: - Update to runc v1.1.7. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.7>. - Update runc.keyring to upstream version. - Update to runc v1.1.6. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.6>. Package samba was updated: - Move libcluster-samba4.so from samba-libs to samba-client-libs; (bsc#1213940); - secure channel faulty since Windows 10/11 update 07/2023; (bso#15418); (bsc#1213384). - CVE-2022-2127: lm_resp_len not checked properly in winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174). - CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173). - CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172). - CVE-2023-34968: Spotlight server-side Share Path Disclosure; (bso#15388); (bsc#1213171). Package 000release-packages:sle-module-basesystem-release was updated: Package 000release-packages:sle-module-public-cloud-release was updated: Package 000release-packages:sle-module-server-applications-release was updated: Package 000product:sle-module-suse-manager-proxy-release was updated: Package spacewalk-backend was updated: - version 4.2.29-1 * Use a constant to get the product name in python code rather than reading rhn.conf (bsc#1212943) * Only show missing /root/.curlrc error with log_level = 5 (bsc#1212507) - version 4.2.28-1 * Filter CLM modular packages using release strings (bsc#1207814) * Add package details to reposync error logging Package spacewalk-web was updated: - version 4.2.36-1 * Update the translations from weblate * Fix VHM CPU and RAM display when 0 (bsc#1175823) * Fix parsing error when showing notification message details (bsc#1211469) - version 4.2.35-1 * Show loading indicator on formula details pages (bsc#1179747) * Increase datetimepicker font sizes (bsc#1210437) * Fix an issue where the datetimepicker shows wrong date (bsc#1209231) Package spacewalk-proxy-installer was updated: - version 4.2.12-1 * Fix squid refresh_pattern for "venv-enabled-*.txt" files to avoid serving outdated version of the file (bsc#1211956) Package spacewalk-ssl-cert-check was updated: - version 4.2.3-1 * Update translations Package supportutils-plugin-suse-public-cloud was updated: - Update to version 1.0.8 (bsc#1213951) + Capture CSP billing adapter config and log (issue#13) + Accept upper case Amazon string in DMI table (issue#12) Package susemanager-build-keys was updated: - Version 15.3.9 * add SUSE Liberty v2 key (bsc#1212096) + Added: RPM-GPG-KEY-SUSE-Liberty-v2 * add Debian 12 (bookworm) GPG keys (bsc#1212363) + Added: debian-archive-key-12-security-254CF3B5AEC0A8F0.asc debian-archive-key-12-B7C5D7D6350947F8.asc debian-release-12-F8D2585B8783D481.asc * add new 4096 bit RSA package hub key + Added: packagehub-gpg-pubkey-8A49EB0325DB7AE0.asc - Version 15.3.8 * fix installation of sle15 RSA reserve build key * add new 4096 bit RSA openSUSE build key gpg-pubkey-29b700a4.asc Package vim was updated: - Updated to version 9.0 with patch level 1572, fixes the following security problems * Fixing bsc#1210996 (CVE-2023-2426) - VUL-0: CVE-2023-2426: vim: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. * Fixing bsc#1211256 (CVE-2023-2609) - VUL-1: CVE-2023-2609: vim: NULL Pointer Dereference prior to 9.0.1531 * Fixing bsc#1211257 (CVE-2023-2610) - VUL-1: CVE-2023-2610: vim: Integer Overflow or Wraparound prior to 9.0.1532 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1572 - Fixing bsc#1211461 - L3: vim "eats" first character from prompt in xterm * Add: reorder-exit-raw-mode.patch * Swaps out_str_t_TE() and cursor_on() during exit to prevent missing characters in xterm prompt on exit. Package wicked was updated: - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - bond: workaround 6.1 kernel enslave regression (boo#1206674) - update to version 0.6.72 - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling. - client: improve error handling in netif firmware discovery extension execution and extension definition overrides in the wicked-config. - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise mode names - update to version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package on tumbleweed (https://github.com/openSUSE/wicked/pull/939). Package xen was updated: - Update to Xen 4.14.6 bug fix release (bsc#1027519) xen-4.14.6-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - bsc#1214082 - VUL-0: CVE-2023-20569: xen: x86/AMD: Speculative Return Stack Overflow (XSA-434) - bsc#1214083 - VUL-0: CVE-2022-40982: xen: x86/Intel: Gather Data Sampling (XSA-435) - Dropped patches contained in new tarball 62a1e594-x86-clean-up-_get_page_type.patch 62a1e5b0-x86-ABAC-race-in-_get_page_type.patch 62a1e5d2-x86-introduce-_PAGE_-for-mem-types.patch 62a1e5f0-x86-dont-change-cacheability-of-directmap.patch 62a1e60e-x86-split-cache_flush-out-of-cache_writeback.patch 62a1e62b-x86-AMD-work-around-CLFLUSH-ordering.patch 62a1e649-x86-track-and-flush-non-coherent.patch 62ab0fab-x86-spec-ctrl-VERW-flushing-runtime-cond.patch 62ab0fac-x86-spec-ctrl-enum-for-MMIO-Stale-Data.patch 62ab0fad-x86-spec-ctrl-add-unpriv-mmio.patch 62bdd840-x86-spec-ctrl-only-adjust-idle-with-legacy-IBRS.patch 62bdd841-x86-spec-ctrl-knobs-for-STIBP-and-PSFD.patch 62cc31ee-cmdline-extend-parse_boolean.patch 62cc31ef-x86-spec-ctrl-fine-grained-cmdline-subopts.patch 62cd91d0-x86-spec-ctrl-rework-context-switching.patch 62cd91d1-x86-spec-ctrl-rename-SCF_ist_wrmsr.patch 62cd91d2-x86-spec-ctrl-rename-opt_ibpb.patch 62cd91d3-x86-spec-ctrl-rework-SPEC_CTRL_ENTRY_FROM_INTR_IST.patch 62cd91d4-x86-spec-ctrl-IBPB-on-entry.patch 62cd91d5-x86-cpuid-BTC_NO-enum.patch 62cd91d6-x86-spec-ctrl-enable-Zen2-chickenbit.patch 62cd91d7-x86-spec-ctrl-mitigate-Branch-Type-Confusion.patch 62dfe40a-x86-mm-gpt-TLB-flush-condition.patch 62f27ebd-x86-expose-more-MSR_ARCH_CAPS-to-hwdom.patch 62f51e16-x86-spec-ctrl-enum-PBRSB_NO.patch 62f523da-AMD-setup_force_cpu_cap-BSP-only.patch 63455f82-Arm-P2M-prevent-adding-mapping-when-dying.patch 63455fa8-Arm-P2M-preempt-when-freeing-intermediate.patch 63455fc3-x86-p2m_teardown-allow-skip-root-pt-removal.patch 63455fe4-x86-HAP-monitor-table-error-handling.patch 63456000-x86-tolerate-sh_set_toplevel_shadow-failure.patch 6345601d-x86-tolerate-shadow_prealloc-failure.patch 6345603a-x86-P2M-refuse-new-alloc-for-dying.patch 63456057-x86-P2M-truly-free-paging-pool-for-dying.patch 63456075-x86-P2M-free-paging-pool-preemptively.patch 63456090-x86-p2m_teardown-preemption.patch 63456175-libxl-per-arch-extra-default-paging-memory.patch 63456177-Arm-construct-P2M-pool-for-guests.patch 6345617a-Arm-XEN_DOMCTL_shadow_op.patch 6345617c-Arm-take-P2M-pages-P2M-pool.patch 634561aa-gnttab-locking-on-transitive-copy-error-path.patch 6351095c-Arm-rework-p2m_init.patch 6351096a-Arm-P2M-populate-pages-for-GICv2-mapping.patch 63569723-x86-shadow-replace-bogus-assertions.patch 636a9130-x86-spec-ctrl-Enumeration-for-IBPB_RET.patch 636a9130-x86-spec-ctrl-Mitigate-IBPB-not-flushing-the-RSB-RAS.patch xsa326-01.patch xsa326-02.patch xsa326-03.patch xsa326-04.patch xsa326-05.patch xsa326-06.patch xsa326-07.patch xsa326-08.patch xsa326-09.patch xsa326-10.patch xsa326-11.patch xsa326-12.patch xsa326-13.patch xsa326-14.patch xsa326-15.patch xsa326-16.patch xsa403.patch xsa414.patch xsa415.patch xsa416.patch xsa417.patch xsa418-01.patch xsa418-02.patch xsa418-03.patch xsa418-04.patch xsa418-05.patch xsa418-06.patch xsa419-01.patch xsa419-02.patch xsa419-03.patch xsa421-01.patch xsa421-02.patch xsa427.patch xsa428-1.patch xsa428-2.patch xsa429.patch xsa433.patch - Handle potential off-by-one errors in libxc-sr-xg_sr_bitmap.patch A bit is an index in bitmap, while bits is the allocated size of the bitmap. - bsc#1213616 - VUL-0: CVE-2023-20593: xen: x86/AMD: Zenbleed (XSA-433) xsa433.patch - Updated fix for XSA-417 (bsc#1204489) 64ba268b-xenstore-fix-XSA-417.patch Package yast2-network was updated: - Fix typo when writing the wireless channel (bsc#1212976)- 4.3.88 - bsc#1211431 - Do not crash installation when storing vlan configuration into NetworkManager - 4.3.87 Package yast2-pkg-bindings was updated: - Pkg.TargetInitializeOptions() - added a new option for rebuilding the RPM database (--rebuilddb) (bsc#1209565) - 4.3.12 Package yast2-update was updated: - Rebuild the RPM database during upgrade (--rebuilddb) (bsc#1209565)- 4.3.5 Package zypper was updated: - Changed location of bash-complication (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://publiccloudimagechangeinfo.suse.com/google/suse-manager-proxy-4-2-byos-v20230922-x86-64/ Public Cloud Image Info https://www.suse.com/support/security/rating/ SUSE Security Ratings Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 autoyast2-installation-4.3.106-150300.3.56.1 bind-utils-9.16.6-150300.22.30.1 binutils-2.39-150100.7.43.2 blog-2.26-150300.4.6.1 ca-certificates-mozilla-2.62-150200.30.1 cloud-netconfig-gce-1.8-150000.25.11.1 containerd-1.6.21-150000.93.1 cpp7-7.5.0+r278197-150000.4.35.1 cups-config-2.2.7-150000.3.51.2 dbus-1-1.12.2-150100.8.17.1 device-mapper-2.03.05_1.02.163-150200.8.52.1 docker-24.0.5_ce-150000.185.1 dracut-049.1+suse.255.g19bd61fd-150200.3.72.1 firewalld-0.9.3-150300.3.15.1 fonts-config-20200609+git0.42e2b1b-150000.4.10.1 gawk-4.2.1-150000.3.3.1 gcc7-7.5.0+r278197-150000.4.35.1 glibc-2.31-150300.52.2 glibc-devel-2.31-150300.52.2 glibc-i18ndata-2.31-150300.52.2 glibc-locale-2.31-150300.52.2 glibc-locale-base-2.31-150300.52.2 google-guest-agent-20230601.00-150000.1.37.1 google-guest-configs-20230808.00-150000.1.28.1 google-osconfig-agent-20230706.02-150000.1.30.1 grub2-2.04-150300.22.40.1 grub2-i386-pc-2.04-150300.22.40.1 grub2-x86_64-efi-2.04-150300.22.40.1 hwdata-0.371-150000.3.62.1 hwinfo-21.85-150300.3.6.1 iscsiuio-0.7.8.6-150300.32.24.1 kernel-default-5.3.18-150300.59.133.1 krb5-1.19.2-150300.13.1 krb5-client-1.19.2-150300.13.1 libX11-6-1.6.5-150000.3.30.1 libX11-data-1.6.5-150000.3.30.1 libasan4-7.5.0+r278197-150000.4.35.1 libassuan0-2.5.5-150000.4.5.2 libatomic1-12.3.0+git1204-150000.1.16.1 libbind9-1600-9.16.6-150300.22.30.1 libblogger2-2.26-150300.4.6.1 libcap2-2.26-150000.4.9.1 libcilkrts5-7.5.0+r278197-150000.4.35.1 libcryptsetup12-2.3.7-150300.3.8.1 libctf-nobfd0-2.39-150100.7.43.2 libctf0-2.39-150100.7.43.2 libcups2-2.2.7-150000.3.51.2 libdb-4_8-4.8.30-150000.7.9.1 libdbus-1-3-1.12.2-150100.8.17.1 libdevmapper-event1_03-2.03.05_1.02.163-150200.8.52.1 libdevmapper1_03-2.03.05_1.02.163-150200.8.52.1 libdns1605-9.16.6-150300.22.30.1 libeconf0-0.5.2-150300.3.11.1 libfreebl3-3.90-150000.3.101.1 libfreetype6-2.10.4-150000.4.15.1 libgcc_s1-12.3.0+git1204-150000.1.16.1 libgomp1-12.3.0+git1204-150000.1.16.1 libicu-suse65_1-65.1-150200.4.8.1 libicu65_1-ledata-65.1-150200.4.8.1 libirs1601-9.16.6-150300.22.30.1 libisc1606-9.16.6-150300.22.30.1 libisccc1600-9.16.6-150300.22.30.1 libisccfg1600-9.16.6-150300.22.30.1 libitm1-12.3.0+git1204-150000.1.16.1 libjansson4-2.14-150000.3.3.1 libldap-2_4-2-2.4.46-150200.14.17.1 libldap-data-2.4.46-150200.14.17.1 liblognorm5-2.0.6-150000.3.3.1 liblsan0-12.3.0+git1204-150000.1.16.1 liblvm2cmd2_03-2.03.05-150200.8.52.1 libns1604-9.16.6-150300.22.30.1 libopeniscsiusr0_2_0-2.1.7-150300.32.24.1 libopenssl1_1-1.1.1d-150200.11.75.1 libparted0-3.2-150300.21.3.1 libpcre2-8-0-10.31-150000.3.15.1 libprocps7-3.3.15-150000.7.34.1 libprotobuf-lite20-3.9.2-150200.4.21.1 libsoftokn3-3.90-150000.3.101.1 libsolv-tools-0.7.24-150200.20.2 libstdc++6-12.3.0+git1204-150000.1.16.1 libubsan0-7.5.0+r278197-150000.4.35.1 libxml2-2-2.9.7-150000.3.60.1 libyajl2-2.1.0-150000.4.6.1 libzypp-17.31.20-150200.75.1 login_defs-4.8.1-150300.4.9.1 lvm2-2.03.05-150200.8.52.1 man-2.7.6-150100.8.3.1 mozilla-nspr-4.35-150000.3.29.1 mozilla-nss-3.90-150000.3.101.1 mozilla-nss-certs-3.90-150000.3.101.1 nfs-client-2.1.1-150100.10.37.1 nfs-kernel-server-2.1.1-150100.10.37.1 nscd-2.31-150300.52.2 open-iscsi-2.1.7-150300.32.24.1 openldap2-client-2.4.46-150200.14.17.1 openssh-8.4p1-150300.3.22.1 openssh-clients-8.4p1-150300.3.22.1 openssh-common-8.4p1-150300.3.22.1 openssh-server-8.4p1-150300.3.22.1 openssl-1_1-1.1.1d-150200.11.75.1 parted-3.2-150300.21.3.1 perl-5.26.1-150300.17.14.1 perl-Bootloader-0.944-150300.3.9.1 perl-base-5.26.1-150300.17.14.1 procps-3.3.15-150000.7.34.1 python3-apipkg-1.4-150000.3.6.1 python3-bind-9.16.6-150300.22.30.1 python3-firewall-0.9.3-150300.3.15.1 python3-iniconfig-1.1.1-150000.1.11.1 python3-libxml2-python-2.9.7-150000.3.60.1 python3-ply-3.10-150000.3.3.4 python3-pyasn1-0.4.2-150000.3.5.1 python3-pyzmq-17.1.2-150000.3.5.2 python3-requests-2.24.0-150300.3.3.1 python3-salt-3006.0-150300.53.53.2 python3-solv-0.7.24-150200.20.2 python3-spacewalk-certs-tools-4.2.20-150300.3.30.4 rsync-3.2.3-150000.4.23.2 rsyslog-8.2106.0-150200.4.40.1 ruby-solv-0.7.24-150200.20.2 runc-1.1.7-150000.46.1 salt-3006.0-150300.53.53.2 salt-minion-3006.0-150300.53.53.2 samba-client-libs-4.15.13+git.666.851db7b9ff-150300.3.60.1 shadow-4.8.1-150300.4.9.1 spacewalk-backend-4.2.29-150300.4.44.5 spacewalk-base-minimal-4.2.36-150300.3.47.5 spacewalk-base-minimal-config-4.2.36-150300.3.47.5 spacewalk-certs-tools-4.2.20-150300.3.30.4 spacewalk-proxy-installer-4.2.12-150300.3.17.2 spacewalk-ssl-cert-check-4.2.3-150300.3.3.2 supportutils-plugin-suse-public-cloud-1.0.8-150000.3.17.1 susemanager-build-keys-15.3.9-150300.3.14.1 susemanager-build-keys-web-15.3.9-150300.3.14.1 vim-9.0.1572-150000.5.49.1 vim-data-common-9.0.1572-150000.5.49.1 wicked-0.6.73-150300.4.13.1 wicked-service-0.6.73-150300.4.13.1 xen-libs-4.14.6_02-150300.3.51.1 yast2-network-4.3.88-150300.3.38.1 yast2-pkg-bindings-4.3.12-150300.3.3.2 yast2-update-4.3.5-150300.3.9.1 zypper-1.14.63-150200.59.1 autoyast2-installation-4.3.106-150300.3.56.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 bind-utils-9.16.6-150300.22.30.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 binutils-2.39-150100.7.43.2 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 blog-2.26-150300.4.6.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 ca-certificates-mozilla-2.62-150200.30.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 cloud-netconfig-gce-1.8-150000.25.11.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 containerd-1.6.21-150000.93.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 cpp7-7.5.0+r278197-150000.4.35.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 cups-config-2.2.7-150000.3.51.2 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 dbus-1-1.12.2-150100.8.17.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 device-mapper-2.03.05_1.02.163-150200.8.52.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 docker-24.0.5_ce-150000.185.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 dracut-049.1+suse.255.g19bd61fd-150200.3.72.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 firewalld-0.9.3-150300.3.15.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 fonts-config-20200609+git0.42e2b1b-150000.4.10.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 gawk-4.2.1-150000.3.3.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 gcc7-7.5.0+r278197-150000.4.35.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 glibc-2.31-150300.52.2 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 glibc-devel-2.31-150300.52.2 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 glibc-i18ndata-2.31-150300.52.2 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 glibc-locale-2.31-150300.52.2 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 glibc-locale-base-2.31-150300.52.2 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 google-guest-agent-20230601.00-150000.1.37.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 google-guest-configs-20230808.00-150000.1.28.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 google-osconfig-agent-20230706.02-150000.1.30.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 grub2-2.04-150300.22.40.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 grub2-i386-pc-2.04-150300.22.40.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 grub2-x86_64-efi-2.04-150300.22.40.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 hwdata-0.371-150000.3.62.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 hwinfo-21.85-150300.3.6.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 iscsiuio-0.7.8.6-150300.32.24.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 kernel-default-5.3.18-150300.59.133.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 krb5-1.19.2-150300.13.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 krb5-client-1.19.2-150300.13.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libX11-6-1.6.5-150000.3.30.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libX11-data-1.6.5-150000.3.30.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libasan4-7.5.0+r278197-150000.4.35.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libassuan0-2.5.5-150000.4.5.2 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libatomic1-12.3.0+git1204-150000.1.16.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libbind9-1600-9.16.6-150300.22.30.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libblogger2-2.26-150300.4.6.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libcap2-2.26-150000.4.9.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libcilkrts5-7.5.0+r278197-150000.4.35.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libcryptsetup12-2.3.7-150300.3.8.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libctf-nobfd0-2.39-150100.7.43.2 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libctf0-2.39-150100.7.43.2 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libcups2-2.2.7-150000.3.51.2 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libdb-4_8-4.8.30-150000.7.9.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libdbus-1-3-1.12.2-150100.8.17.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libdevmapper-event1_03-2.03.05_1.02.163-150200.8.52.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libdevmapper1_03-2.03.05_1.02.163-150200.8.52.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libdns1605-9.16.6-150300.22.30.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libeconf0-0.5.2-150300.3.11.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libfreebl3-3.90-150000.3.101.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libfreetype6-2.10.4-150000.4.15.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libgcc_s1-12.3.0+git1204-150000.1.16.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libgomp1-12.3.0+git1204-150000.1.16.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libicu-suse65_1-65.1-150200.4.8.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libicu65_1-ledata-65.1-150200.4.8.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libirs1601-9.16.6-150300.22.30.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libisc1606-9.16.6-150300.22.30.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libisccc1600-9.16.6-150300.22.30.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libisccfg1600-9.16.6-150300.22.30.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libitm1-12.3.0+git1204-150000.1.16.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libjansson4-2.14-150000.3.3.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libldap-2_4-2-2.4.46-150200.14.17.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libldap-data-2.4.46-150200.14.17.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 liblognorm5-2.0.6-150000.3.3.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 liblsan0-12.3.0+git1204-150000.1.16.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 liblvm2cmd2_03-2.03.05-150200.8.52.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libns1604-9.16.6-150300.22.30.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libopeniscsiusr0_2_0-2.1.7-150300.32.24.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libopenssl1_1-1.1.1d-150200.11.75.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libparted0-3.2-150300.21.3.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libpcre2-8-0-10.31-150000.3.15.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libprocps7-3.3.15-150000.7.34.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libprotobuf-lite20-3.9.2-150200.4.21.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libsoftokn3-3.90-150000.3.101.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libsolv-tools-0.7.24-150200.20.2 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libstdc++6-12.3.0+git1204-150000.1.16.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libubsan0-7.5.0+r278197-150000.4.35.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libxml2-2-2.9.7-150000.3.60.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libyajl2-2.1.0-150000.4.6.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 libzypp-17.31.20-150200.75.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 login_defs-4.8.1-150300.4.9.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 lvm2-2.03.05-150200.8.52.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 man-2.7.6-150100.8.3.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 mozilla-nspr-4.35-150000.3.29.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 mozilla-nss-3.90-150000.3.101.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 mozilla-nss-certs-3.90-150000.3.101.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 nfs-client-2.1.1-150100.10.37.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 nfs-kernel-server-2.1.1-150100.10.37.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 nscd-2.31-150300.52.2 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 open-iscsi-2.1.7-150300.32.24.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 openldap2-client-2.4.46-150200.14.17.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 openssh-8.4p1-150300.3.22.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 openssh-clients-8.4p1-150300.3.22.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 openssh-common-8.4p1-150300.3.22.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 openssh-server-8.4p1-150300.3.22.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 openssl-1_1-1.1.1d-150200.11.75.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 parted-3.2-150300.21.3.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 perl-5.26.1-150300.17.14.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 perl-Bootloader-0.944-150300.3.9.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 perl-base-5.26.1-150300.17.14.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 procps-3.3.15-150000.7.34.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 python3-apipkg-1.4-150000.3.6.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 python3-bind-9.16.6-150300.22.30.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 python3-firewall-0.9.3-150300.3.15.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 python3-iniconfig-1.1.1-150000.1.11.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 python3-libxml2-python-2.9.7-150000.3.60.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 python3-ply-3.10-150000.3.3.4 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 python3-pyasn1-0.4.2-150000.3.5.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 python3-pyzmq-17.1.2-150000.3.5.2 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 python3-requests-2.24.0-150300.3.3.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 python3-salt-3006.0-150300.53.53.2 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 python3-solv-0.7.24-150200.20.2 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 python3-spacewalk-certs-tools-4.2.20-150300.3.30.4 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 rsync-3.2.3-150000.4.23.2 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 rsyslog-8.2106.0-150200.4.40.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 ruby-solv-0.7.24-150200.20.2 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 runc-1.1.7-150000.46.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 salt-3006.0-150300.53.53.2 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 salt-minion-3006.0-150300.53.53.2 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 samba-client-libs-4.15.13+git.666.851db7b9ff-150300.3.60.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 shadow-4.8.1-150300.4.9.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 spacewalk-backend-4.2.29-150300.4.44.5 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 spacewalk-base-minimal-4.2.36-150300.3.47.5 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 spacewalk-base-minimal-config-4.2.36-150300.3.47.5 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 spacewalk-certs-tools-4.2.20-150300.3.30.4 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 spacewalk-proxy-installer-4.2.12-150300.3.17.2 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 spacewalk-ssl-cert-check-4.2.3-150300.3.3.2 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 supportutils-plugin-suse-public-cloud-1.0.8-150000.3.17.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 susemanager-build-keys-15.3.9-150300.3.14.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 susemanager-build-keys-web-15.3.9-150300.3.14.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 vim-9.0.1572-150000.5.49.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 vim-data-common-9.0.1572-150000.5.49.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 wicked-0.6.73-150300.4.13.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 wicked-service-0.6.73-150300.4.13.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 xen-libs-4.14.6_02-150300.3.51.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 yast2-network-4.3.88-150300.3.38.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 yast2-pkg-bindings-4.3.12-150300.3.3.2 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 yast2-update-4.3.5-150300.3.9.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 zypper-1.14.63-150200.59.1 as a component of Public Cloud Image google/suse-manager-proxy-4-2-byos-v20230922-x86-64 An issue was discovered in the Linux kernel before 5.11.11. The netfilter subsystem allows attackers to cause a denial of service (panic) because net/netfilter/x_tables.c and include/linux/netfilter/x_tables.h lack a full memory barrier upon the assignment of a new table value, aka CID-175e476b8cdf. CVE-2021-29650 moderate 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can trigger an out-of-bounds read in Winbind, possibly resulting in a crash. CVE-2022-2127 moderate A vulnerability, which was classified as problematic, was found in Linux Kernel. This affects the function tcp_getsockopt/tcp_setsockopt of the component TCP Handler. The manipulation leads to race condition. It is recommended to apply a patch to fix this issue. The identifier VDB-211089 was assigned to this vulnerability. CVE-2022-3566 moderate An integer overflow vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS). CVE-2022-36402 moderate Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. CVE-2022-40982 moderate Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input. CVE-2022-41409 moderate A flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using a specific networking configuration (redirecting egress packets to ingress using TC action "mirred") a local unprivileged user could trigger a CPU soft lockup (ABBA deadlock) when the transport protocol in use (TCP or SCTP) does a retransmission, resulting in a denial of service condition. CVE-2022-4269 moderate A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection. CVE-2022-4304 moderate An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-after-free, related to dvb_register_device dynamically allocating fops. CVE-2022-45884 moderate An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_frontend.c has a race condition that can cause a use-after-free when a device is disconnected. CVE-2022-45885 moderate An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a .disconnect versus dvb_device_open race condition that leads to a use-after-free. CVE-2022-45886 moderate An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak because of the lack of a dvb_frontend_detach call. CVE-2022-45887 moderate An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event. CVE-2022-45919 important There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network. CVE-2023-0286 important Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec allowing a user to bypass the "access_ok" check and pass a kernel pointer to copy_from_user(). This would allow an attacker to leak information. We recommend upgrading beyond commit 74e19ef0ff8061ef55957c3abd71614ef0f42f47 CVE-2023-0459 moderate In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON condition, as the confused entry will not be NULL, but list_head.The buggy error condition would lead to a type confused entry with the list head,which would then be used as a type confused sched_rt_entity,causing memory corruption. CVE-2023-1077 important A flaw was found in the Linux kernel. A use-after-free may be triggered in asus_kbd_backlight_set when plugging/disconnecting in a malicious USB device, which advertises itself as an Asus device. Similarly to the previous known CVE-2023-25012, but in asus devices, the work_struct may be scheduled by the LED controller while the device is disconnecting, triggering a use-after-free on the struct asus_kbd_leds *led structure. A malicious USB device may exploit the issue to cause memory corruption with controlled data. CVE-2023-1079 moderate A use-after-free flaw was found in the Linux kernel’s core dump subsystem. This flaw allows a local user to crash the system. Only if patch 390031c94211 ("coredump: Use the vma snapshot in fill_files_note") not applied yet, then kernel could be affected. CVE-2023-1249 moderate A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur when assoc_info->req_len data is bigger than the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading to a denial of service. CVE-2023-1380 low A flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the Linux kernel X86 CPU Power management options functionality was found in the way user resuming CPU from suspend-to-RAM. A local user could use this flaw to potentially get unauthorized access to some memory of the CPU similar to the speculative execution behavior kind of attacks. CVE-2023-1637 moderate A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth communication. CVE-2023-2002 moderate ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. CVE-2023-2004 moderate The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel. CVE-2023-2007 moderate A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. This may result in speculative execution at an attacker-controlled address, potentially leading to information disclosure. CVE-2023-20569 moderate A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality.  CVE-2023-20588 moderate An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information. CVE-2023-20593 moderate In multiple functions of io_uring.c, there is a possible kernel memory corruption due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation. CVE-2023-21400 moderate A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol. This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion failure. This may allow an unauthenticated remote attacker to create a denial of service condition on the system. CVE-2023-2156 important An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The userspace "data->block[0]" variable was not capped to a number between 0-255 and was used as the size of a memcpy, possibly writing beyond the end of dma_buffer. This flaw could allow a local privileged user to crash the system or potentially achieve code execution. CVE-2023-2194 moderate Due to a vulnerability in the io_uring subsystem, it is possible to leak kernel memory information to the user process. timens_install calls current_is_single_threaded to determine if the current process is single-threaded, but this call does not consider io_uring's io_worker threads, thus it is possible to insert a time namespace's vvar page to process's memory space via a page fault. When this time namespace is destroyed, the vvar page is also freed, but not removed from the process' memory, and a next page allocated by the kernel will be still available from the user-space process and can leak memory contents via this (read-only) use-after-free vulnerability. We recommend upgrading past version 5.10.161 or commit 788d0824269bef539fe31a785b1517882eafed93 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/io_uring CVE-2023-23586 moderate Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. CVE-2023-2426 moderate ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-33203. Reason: This candidate is a reservation duplicate of CVE-2023-33203. Notes: All CVE users should reference CVE-2023-33203 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. CVE-2023-2483 moderate A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system crash or other undefined behaviors. CVE-2023-2513 moderate A vulnerability was found in libcap. This issue occurs in the _libcap_strdup() function and can lead to an integer overflow if the input string is close to 4GiB. CVE-2023-2603 moderate NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531. CVE-2023-2609 important Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532. CVE-2023-2610 important Every `named` instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to authoritative servers. The size limit for that cache database can be configured using the `max-cache-size` statement in the configuration file; it defaults to 90% of the total amount of memory available on the host. When the size of the cache reaches 7/8 of the configured limit, a cache-cleaning algorithm starts to remove expired and/or least-recently used RRsets from the cache, to keep memory use below the configured limit. It has been discovered that the effectiveness of the cache-cleaning algorithm used in `named` can be severely diminished by querying the resolver for specific RRsets in a certain order, effectively allowing the configured `max-cache-size` limit to be significantly exceeded. This issue affects BIND 9 versions 9.11.0 through 9.16.41, 9.18.0 through 9.18.15, 9.19.0 through 9.19.13, 9.11.3-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1. CVE-2023-2828 important Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL. CVE-2023-28370 low Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby, is commonly referred to as *Docker*. Swarm Mode, which is compiled in and delivered by default in dockerd and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code. The overlay network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frames in UDP datagrams that tag the frame with a VXLAN Network ID (VNI) that identifies the originating overlay network. In addition, the overlay network driver supports an optional, off-by-default encrypted mode, which is especially useful when VXLAN packets traverses an untrusted network between nodes. Encrypted overlay networks function by encapsulating the VXLAN datagrams through the use of the IPsec Encapsulating Security Payload protocol in Transport mode. By deploying IPSec encapsulation, encrypted overlay networks gain the additional properties of source authentication through cryptographic proof, data integrity through check-summing, and confidentiality through encryption. When setting an endpoint up on an encrypted overlay network, Moby installs three iptables (Linux kernel firewall) rules that enforce both incoming and outgoing IPSec. These rules rely on the u32 iptables extension provided by the xt_u32 kernel module to directly filter on a VXLAN packet's VNI field, so that IPSec guarantees can be enforced on encrypted overlay networks without interfering with other overlay networks or other users of VXLAN. Two iptables rules serve to filter incoming VXLAN datagrams with a VNI that corresponds to an encrypted network and discards unencrypted datagrams. The rules are appended to the end of the INPUT filter chain, following any rules that have been previously set by the system administrator. Administrator-set rules take precedence over the rules Moby sets to discard unencrypted VXLAN datagrams, which can potentially admit unencrypted datagrams that should have been discarded. The injection of arbitrary Ethernet frames can enable a Denial of Service attack. A sophisticated attacker may be able to establish a UDP or TCP connection by way of the container’s outbound gateway that would otherwise be blocked by a stateful firewall, or carry out other escalations beyond simple injection by smuggling packets into the overlay network. Patches are available in Moby releases 23.0.3 and 20.10.24. As Mirantis Container Runtime's 20.10 releases are numbered differently, users of that platform should update to 20.10.16. Some workarounds are available. Close the VXLAN port (by default, UDP port 4789) to incoming traffic at the Internet boundary to prevent all VXLAN packet injection, and/or ensure that the `xt_u32` kernel module is available on all nodes of the Swarm cluster. CVE-2023-28840 important Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly referred to as *Docker*. Swarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code. The `overlay` network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frames in UDP datagrams that tag the frame with the VXLAN metadata, including a VXLAN Network ID (VNI) that identifies the originating overlay network. In addition, the overlay network driver supports an optional, off-by-default encrypted mode, which is especially useful when VXLAN packets traverses an untrusted network between nodes. Encrypted overlay networks function by encapsulating the VXLAN datagrams through the use of the IPsec Encapsulating Security Payload protocol in Transport mode. By deploying IPSec encapsulation, encrypted overlay networks gain the additional properties of source authentication through cryptographic proof, data integrity through check-summing, and confidentiality through encryption. When setting an endpoint up on an encrypted overlay network, Moby installs three iptables (Linux kernel firewall) rules that enforce both incoming and outgoing IPSec. These rules rely on the `u32` iptables extension provided by the `xt_u32` kernel module to directly filter on a VXLAN packet's VNI field, so that IPSec guarantees can be enforced on encrypted overlay networks without interfering with other overlay networks or other users of VXLAN. An iptables rule designates outgoing VXLAN datagrams with a VNI that corresponds to an encrypted overlay network for IPsec encapsulation. Encrypted overlay networks on affected platforms silently transmit unencrypted data. As a result, `overlay` networks may appear to be functional, passing traffic as expected, but without any of the expected confidentiality or data integrity guarantees. It is possible for an attacker sitting in a trusted position on the network to read all of the application traffic that is moving across the overlay network, resulting in unexpected secrets or user data disclosure. Thus, because many database protocols, internal APIs, etc. are not protected by a second layer of encryption, a user may use Swarm encrypted overlay networks to provide confidentiality, which due to this vulnerability this is no longer guaranteed. Patches are available in Moby releases 23.0.3, and 20.10.24. As Mirantis Container Runtime's 20.10 releases are numbered differently, users of that platform should update to 20.10.16. Some workarounds are available. Close the VXLAN port (by default, UDP port 4789) to outgoing traffic at the Internet boundary in order to prevent unintentionally leaking unencrypted traffic over the Internet, and/or ensure that the `xt_u32` kernel module is available on all nodes of the Swarm cluster. CVE-2023-28841 moderate Moby) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly referred to as *Docker*. Swarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code. The `overlay` network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frames in UDP datagrams that tag the frame with the VXLAN metadata, including a VXLAN Network ID (VNI) that identifies the originating overlay network. In addition, the overlay network driver supports an optional, off-by-default encrypted mode, which is especially useful when VXLAN packets traverses an untrusted network between nodes. Encrypted overlay networks function by encapsulating the VXLAN datagrams through the use of the IPsec Encapsulating Security Payload protocol in Transport mode. By deploying IPSec encapsulation, encrypted overlay networks gain the additional properties of source authentication through cryptographic proof, data integrity through check-summing, and confidentiality through encryption. When setting an endpoint up on an encrypted overlay network, Moby installs three iptables (Linux kernel firewall) rules that enforce both incoming and outgoing IPSec. These rules rely on the `u32` iptables extension provided by the `xt_u32` kernel module to directly filter on a VXLAN packet's VNI field, so that IPSec guarantees can be enforced on encrypted overlay networks without interfering with other overlay networks or other users of VXLAN. The `overlay` driver dynamically and lazily defines the kernel configuration for the VXLAN network on each node as containers are attached and detached. Routes and encryption parameters are only defined for destination nodes that participate in the network. The iptables rules that prevent encrypted overlay networks from accepting unencrypted packets are not created until a peer is available with which to communicate. Encrypted overlay networks silently accept cleartext VXLAN datagrams that are tagged with the VNI of an encrypted overlay network. As a result, it is possible to inject arbitrary Ethernet frames into the encrypted overlay network by encapsulating them in VXLAN datagrams. The implications of this can be quite dire, and GHSA-vwm3-crmr-xfxw should be referenced for a deeper exploration. Patches are available in Moby releases 23.0.3, and 20.10.24. As Mirantis Container Runtime's 20.10 releases are numbered differently, users of that platform should update to 20.10.16. Some workarounds are available. In multi-node clusters, deploy a global ‘pause’ container for each encrypted overlay network, on every node. For a single-node cluster, do not use overlay networks of any sort. Bridge networks provide the same connectivity on a single node and have no multi-node features. The Swarm ingress feature is implemented using an overlay network, but can be disabled by publishing ports in `host` mode instead of `ingress` mode (allowing the use of an external load balancer), and removing the `ingress` network. If encrypted overlay networks are in exclusive use, block UDP port 4789 from traffic that has not been validated by IPSec. CVE-2023-28842 moderate A use after free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw could allow a local user to cause a denial of service problem. CVE-2023-2985 moderate A stack overflow vulnerability exists in function econf_writeFile in file atlibeconf/lib/libeconf.c in libeconf 0.5.1 allows attackers to cause a Denial of service or execute arbitrary code. CVE-2023-30078 moderate A stack overflow vulnerability exists in function read_file in atlibeconf/lib/getfilecontents.c in libeconf 0.5.1 allows attackers to cause a Denial of service or execute arbitrary code. CVE-2023-30079 moderate A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation. The out-of-bounds write is caused by missing skb->cb initialization in the ipvlan network driver. The vulnerability is reachable if CONFIG_IPVLAN is enabled. We recommend upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e. CVE-2023-3090 important An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a blocking operation when a task is in !TASK_RUNNING. In dvb_frontend_get_event, wait_event_interruptible is called; the condition is dvb_frontend_test_event(fepriv,events). In dvb_frontend_test_event, down(&fepriv->sem) is called. However, wait_event_interruptible would put the process to sleep, and down(&fepriv->sem) may block the process. CVE-2023-31084 moderate Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace CVE-2023-31248 important A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of the arrays that those functions write to, using those IDs as array indexes. They trust that they were called with values provided by an Xserver adhering to the bounds specified in the X11 protocol, as all X servers provided by X.Org do. As the protocol only specifies a single byte for these values, an out-of-bounds value provided by a malicious server (or a malicious proxy-in-the-middle) can only overwrite other portions of the Display structure and not write outside the bounds of the Display structure itself, possibly causing the client to crash with this memory corruption. CVE-2023-3138 important A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading to a kernel information leak. CVE-2023-3141 moderate qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQ_MIN_LMAX. CVE-2023-31436 moderate CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. CVE-2023-31484 important A use after free issue was discovered in driver/firewire in outbound_phy_packet_callback in the Linux Kernel. In this flaw a local attacker with special privilege may cause a use after free problem when queue_event() fails. CVE-2023-3159 important A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and font->height greater than 32 to fbcon_set_font, since there are no checks in place, a shift-out-of-bounds occurs leading to undefined behavior and possible denial of service. CVE-2023-3161 moderate In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled. CVE-2023-32233 important An issue was discovered in the Linux kernel before 6.1.11. In net/netrom/af_netrom.c, there is a use-after-free because accept is also allowed for a successfully connected AF_NETROM socket. However, in order for an attacker to exploit this, the system must have netrom routing configured or the attacker must have the CAP_NET_ADMIN capability. CVE-2023-32269 moderate An authentication issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.7.7, macOS Monterey 12.6.6, macOS Ventura 13.4. An unauthenticated user may be able to access recently printed documents. CVE-2023-32360 moderate An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel internal information. CVE-2023-3268 moderate Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue has been patched in version 2.31.0. CVE-2023-32681 moderate An issue was discovered in the Linux kernel before 6.2.9. A use-after-free was found in bq24190_remove in drivers/power/supply/bq24190_charger.c. It could allow a local attacker to crash the system due to a race condition. CVE-2023-33288 moderate There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory in server and cause crash. CVE-2023-33460 moderate A null pointer dereference was found in the Linux kernel's Integrated Sensor Hub (ISH) driver. This issue could allow a local user to crash the system. CVE-2023-3358 moderate A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to cause a privilege escalation issue. We recommend upgrading past commit 1240eb93f0616b21c675416516ff3d74798fdc97. CVE-2023-3390 important OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Starting in version 2.0.0 and prior to version 2.4.6, CUPS logs data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data right before. This is a use-after-free bug that impacts the entire cupsd process. The exact cause of this issue is the function `httpClose(con->http)` being called in `scheduler/client.c`. The problem is that httpClose always, provided its argument is not null, frees the pointer at the end of the call, only for cupsdLogClient to pass the pointer to httpGetHostname. This issue happens in function `cupsdAcceptClient` if LogLevel is warn or higher and in two scenarios: there is a double-lookup for the IP Address (HostNameLookups Double is set in `cupsd.conf`) which fails to resolve, or if CUPS is compiled with TCP wrappers and the connection is refused by rules from `/etc/hosts.allow` and `/etc/hosts.deny`. Version 2.4.6 has a patch for this issue. CVE-2023-34241 important The fix for XSA-423 added logic to Linux'es netback driver to deal with a frontend splitting a packet in a way such that not all of the headers would come in one piece. Unfortunately the logic introduced there didn't account for the extreme case of the entire packet being split into as many pieces as permitted by the protocol, yet still being smaller than the area that's specially dealt with to keep all (possible) headers together. Such an unusual packet would therefore trigger a buffer overrun in the driver. CVE-2023-34319 moderate Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ('p' parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulernable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the '-check' option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue. CVE-2023-3446 moderate An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not validate a field in the network packet that contains the count of elements in an array-like structure. By passing 0 as the count value, the attacked function will run in an endless loop consuming 100% CPU. This flaw allows an attacker to issue a malformed RPC request, triggering an infinite loop, resulting in a denial of service condition. CVE-2023-34966 important A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a lack of type checking in callers of the dalloc_value_for_key() function, which returns the object associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker process, affecting all other clients this worker serves. CVE-2023-34967 moderate A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the server-side absolute path of shares, files, and directories in the results for search queries. This flaw allows a malicious client or an attacker with a targeted RPC request to view the information that is part of the disclosed path. CVE-2023-34968 moderate D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-daemon crash under some circumstances via an unreplyable message. When done on the well-known system bus, this is a denial-of-service vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6. CVE-2023-34969 moderate Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace CVE-2023-35001 important A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This issue may allow an attacker with local user access to cause a system crash or leak internal kernel information. CVE-2023-3567 important An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets. This may result in denial of service or privilege escalation. CVE-2023-35788 important An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in drivers/media/pci/saa7134/saa7134-core.c. CVE-2023-35823 moderate An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105_remove in drivers/media/pci/dm1105/dm1105.c. CVE-2023-35824 moderate An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in renesas_usb3_remove in drivers/usb/gadget/udc/renesas_usb3.c. CVE-2023-35828 moderate lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count. CVE-2023-36054 important A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability. We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc. CVE-2023-3609 moderate An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64. CVE-2023-3611 moderate A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in xfrm_update_ae_params(), leading to a possible kernel crash and denial of service. CVE-2023-3772 moderate A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability. We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f. CVE-2023-3776 moderate An out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows a local user to crash or potentially escalate their privileges on the system. CVE-2023-3812 important Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the "-check" option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue. CVE-2023-3817 moderate The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009. CVE-2023-38408 important A use-after-free flaw was found in nfc_llcp_find_local in net/nfc/llcp_core.c in NFC in the Linux kernel. This flaw allows a local user with special privileges to impact a kernel information leak issue. CVE-2023-3863 important ** DISPUTED ** Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. NOTE: the vendor's position is that the product does not support the legacy SAX1 interface with custom callbacks; there is a crash even without crafted input. CVE-2023-39615 moderate Under some circumstances, this weakness allows a user who has access to run the “ps” utility on a machine, the ability to write almost unlimited amounts of unfiltered data into the process heap. CVE-2023-4016 low A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables. The default behavior when the stack-protector detects an overflow is to terminate your application, resulting in controlled loss of availability. An attacker who can exploit a buffer overflow without triggering the stack-protector might be able to change program flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity. CVE-2023-4039 important A use-after-free flaw was found in net/sched/cls_fw.c in classifiers (cls_fw, cls_u32, and cls_route) in the Linux Kernel. This flaw allows a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue. CVE-2023-4128 moderate A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs during device initialization when the siano device is plugged in. This flaw allows a local user to crash the system, causing a denial of service condition. CVE-2023-4132 moderate A use-after-free vulnerability was found in the cxgb4 driver in the Linux kernel. The bug occurs when the cxgb4 device is detaching due to a possible rearming of the flower_stats_timer from the work queue. This flaw allows a local user to crash the system, causing a denial of service condition. CVE-2023-4133 moderate ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVE-2023-4134 moderate A use-after-free flaw was found in the Linux kernel’s Netfilter functionality when adding a rule with NFTA_RULE_CHAIN_ID. This flaw allows a local user to crash or escalate their privileges on the system. CVE-2023-4147 important A heap out-of-bounds read flaw was found in builtin.c in the gawk package. This issue may lead to a crash and could be used to read sensitive information. CVE-2023-4156 low A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and gain unauthorized access to some resources. The original patches fixing CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits - a096ccca6e50 ("tun: tun_chr_open(): correctly initialize socket uid"), - 66b2c338adce ("tap: tap_open(): correctly initialize socket uid"), pass "inode->i_uid" to sock_init_data_uid() as the last parameter and that turns out to not be accurate. CVE-2023-4194 moderate A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation of the file name reconstruction function, which is responsible for reading file name entries from a directory index and merging file name parts belonging to one file into a single long file name. Since the file name characters are copied into a stack variable, a local privileged attacker could use this flaw to overflow the kernel stack. CVE-2023-4273 important A NULL pointer dereference flaw was found in dbFree in fs/jfs/jfs_dmap.c in the journaling file system (JFS) in the Linux Kernel. This issue may allow a local attacker to crash the system due to a missing sanity check. CVE-2023-4385 moderate A use-after-free flaw was found in vmxnet3_rq_alloc_rx_buf in drivers/net/vmxnet3/vmxnet3_drv.c in VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. This issue could allow a local attacker to crash the system due to a double-free while cleaning up vmxnet3_rq_cleanup_all, which could also lead to a kernel information leak problem. CVE-2023-4387 moderate A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers/net/vmxnet3/vmxnet3_drv.c in the networking sub-component in vmxnet3 in the Linux Kernel. This issue may allow a local attacker with normal user privilege to cause a denial of service due to a missing sanity check during cleanup. CVE-2023-4459 moderate Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been fixed in CUPS version 2.4.7, released in September of 2023. CVE-2023-4504 important