Security update for libsolv, libzypp, zypper SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:0087-1 Final 1 1 2020-01-13T13:12:48Z current 2020-01-13T13:12:48Z 2020-01-13T13:12:48Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libsolv, libzypp, zypper This update for libsolv, libzypp, zypper fixes the following issues: Security issue fixed: - CVE-2019-18900: Fixed assert cookie file that was world readable (bsc#1158763). Bug fixes - Fixed removing orphaned packages dropped by to-be-installed products (bsc#1155819). - Adds libzypp API to mark all obsolete kernels according to the existing purge-kernel script rules (bsc#1155198). - Do not enforce 'en' being in RequestedLocales If the user decides to have a system without explicit language support he may do so (bsc#1155678). - Load only target resolvables for zypper rm (bsc#1157377). - Fix broken search by filelist (bsc#1135114). - Replace python by a bash script in zypper-log (fixes#304, fixes#306, bsc#1156158). - Do not sort out requested locales which are not available (bsc#1155678). - Prevent listing duplicate matches in tables. XML result is provided within the new list-patches-byissue element (bsc#1154805). - XML add patch issue-date and issue-list (bsc#1154805). - Fix zypper lp --cve/bugzilla/issue options (bsc#1155298). - Always execute commit when adding/removing locales (fixes bsc#1155205). - Fix description of --table-style,-s in man page (bsc#1154804). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container suse/sle15:15.0-2020-87,Image SLES15-Azure-BYOS-2020-87,Image SLES15-EC2-CHOST-HVM-BYOS-2020-87,Image SLES15-EC2-HVM-BYOS-2020-87,Image SLES15-GCE-BYOS-2020-87,Image SLES15-OCI-BYOS-2020-87,Image SLES15-SAP-Azure-2020-87,Image SLES15-SAP-Azure-BYOS-2020-87,Image SLES15-SAP-Azure-LI-BYOS-Production-2020-87,Image SLES15-SAP-Azure-VLI-BYOS-Production-2020-87,Image SLES15-SAP-EC2-HVM-2020-87,Image SLES15-SAP-EC2-HVM-BYOS-2020-87,Image SLES15-SAP-GCE-2020-87,Image SLES15-SAP-GCE-BYOS-2020-87,Image SLES15-SAP-OCI-BYOS-2020-87,SUSE-2020-87,SUSE-SLE-INSTALLER-15-2020-87,SUSE-SLE-Module-Basesystem-15-2020-87,SUSE-SLE-Module-Development-Tools-15-2020-87,SUSE-SLE-Module-Development-Tools-OBS-15-2020-87,SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2020-87 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20200087-1/ Link for SUSE-SU-2020:0087-1 https://lists.suse.com/pipermail/sle-security-updates/2020-January/006333.html E-Mail link for SUSE-SU-2020:0087-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1135114 SUSE Bug 1135114 https://bugzilla.suse.com/1154804 SUSE Bug 1154804 https://bugzilla.suse.com/1154805 SUSE Bug 1154805 https://bugzilla.suse.com/1155198 SUSE Bug 1155198 https://bugzilla.suse.com/1155205 SUSE Bug 1155205 https://bugzilla.suse.com/1155298 SUSE Bug 1155298 https://bugzilla.suse.com/1155678 SUSE Bug 1155678 https://bugzilla.suse.com/1155819 SUSE Bug 1155819 https://bugzilla.suse.com/1156158 SUSE Bug 1156158 https://bugzilla.suse.com/1157377 SUSE Bug 1157377 https://bugzilla.suse.com/1158763 SUSE Bug 1158763 https://www.suse.com/security/cve/CVE-2019-18900/ SUSE CVE CVE-2019-18900 page Container suse/sle15:15.0 Image SLES15-Azure-BYOS Image SLES15-EC2-CHOST-HVM-BYOS Image SLES15-EC2-HVM-BYOS Image SLES15-GCE-BYOS Image SLES15-OCI-BYOS Image SLES15-SAP-Azure Image SLES15-SAP-Azure-BYOS Image SLES15-SAP-Azure-LI-BYOS-Production Image SLES15-SAP-Azure-VLI-BYOS-Production Image SLES15-SAP-EC2-HVM Image SLES15-SAP-EC2-HVM-BYOS Image SLES15-SAP-GCE Image SLES15-SAP-GCE-BYOS Image SLES15-SAP-OCI-BYOS SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise Module for Development Tools 15 libsolv-tools-0.7.10-3.22.1 libzypp-17.19.0-3.34.1 zypper-1.14.33-3.29.1 python-solv-0.7.10-3.22.1 libsolv-demo-0.7.10-3.22.1 libsolv-devel-0.7.10-3.22.1 libzypp-devel-17.19.0-3.34.1 libzypp-devel-doc-17.19.0-3.34.1 perl-solv-0.7.10-3.22.1 python3-solv-0.7.10-3.22.1 ruby-solv-0.7.10-3.22.1 zypper-aptitude-1.14.33-3.29.1 zypper-log-1.14.33-3.29.1 zypper-needs-restarting-1.14.33-3.29.1 libsolv-tools-0.7.10-3.22.1 as a component of Container suse/sle15:15.0 libzypp-17.19.0-3.34.1 as a component of Container suse/sle15:15.0 zypper-1.14.33-3.29.1 as a component of Container suse/sle15:15.0 libsolv-tools-0.7.10-3.22.1 as a component of Image SLES15-Azure-BYOS libzypp-17.19.0-3.34.1 as a component of Image SLES15-Azure-BYOS python-solv-0.7.10-3.22.1 as a component of Image SLES15-Azure-BYOS zypper-1.14.33-3.29.1 as a component of Image SLES15-Azure-BYOS libsolv-tools-0.7.10-3.22.1 as a component of Image SLES15-EC2-CHOST-HVM-BYOS libzypp-17.19.0-3.34.1 as a component of Image SLES15-EC2-CHOST-HVM-BYOS zypper-1.14.33-3.29.1 as a component of Image SLES15-EC2-CHOST-HVM-BYOS libsolv-tools-0.7.10-3.22.1 as a component of Image SLES15-EC2-HVM-BYOS libzypp-17.19.0-3.34.1 as a component of Image SLES15-EC2-HVM-BYOS python-solv-0.7.10-3.22.1 as a component of Image SLES15-EC2-HVM-BYOS zypper-1.14.33-3.29.1 as a component of Image SLES15-EC2-HVM-BYOS libsolv-tools-0.7.10-3.22.1 as a component of Image SLES15-GCE-BYOS libzypp-17.19.0-3.34.1 as a component of Image SLES15-GCE-BYOS python-solv-0.7.10-3.22.1 as a component of Image SLES15-GCE-BYOS zypper-1.14.33-3.29.1 as a component of Image SLES15-GCE-BYOS libsolv-tools-0.7.10-3.22.1 as a component of Image SLES15-OCI-BYOS libzypp-17.19.0-3.34.1 as a component of Image SLES15-OCI-BYOS python-solv-0.7.10-3.22.1 as a component of Image SLES15-OCI-BYOS zypper-1.14.33-3.29.1 as a component of Image SLES15-OCI-BYOS libsolv-tools-0.7.10-3.22.1 as a component of Image SLES15-SAP-Azure libzypp-17.19.0-3.34.1 as a component of Image SLES15-SAP-Azure python-solv-0.7.10-3.22.1 as a component of Image SLES15-SAP-Azure zypper-1.14.33-3.29.1 as a component of Image SLES15-SAP-Azure libsolv-tools-0.7.10-3.22.1 as a component of Image SLES15-SAP-Azure-BYOS libzypp-17.19.0-3.34.1 as a component of Image SLES15-SAP-Azure-BYOS python-solv-0.7.10-3.22.1 as a component of Image SLES15-SAP-Azure-BYOS zypper-1.14.33-3.29.1 as a component of Image SLES15-SAP-Azure-BYOS libsolv-tools-0.7.10-3.22.1 as a component of Image SLES15-SAP-Azure-LI-BYOS-Production libzypp-17.19.0-3.34.1 as a component of Image SLES15-SAP-Azure-LI-BYOS-Production python-solv-0.7.10-3.22.1 as a component of Image SLES15-SAP-Azure-LI-BYOS-Production zypper-1.14.33-3.29.1 as a component of Image SLES15-SAP-Azure-LI-BYOS-Production libsolv-tools-0.7.10-3.22.1 as a component of Image SLES15-SAP-Azure-VLI-BYOS-Production libzypp-17.19.0-3.34.1 as a component of Image SLES15-SAP-Azure-VLI-BYOS-Production python-solv-0.7.10-3.22.1 as a component of Image SLES15-SAP-Azure-VLI-BYOS-Production zypper-1.14.33-3.29.1 as a component of Image SLES15-SAP-Azure-VLI-BYOS-Production libsolv-tools-0.7.10-3.22.1 as a component of Image SLES15-SAP-EC2-HVM libzypp-17.19.0-3.34.1 as a component of Image SLES15-SAP-EC2-HVM python-solv-0.7.10-3.22.1 as a component of Image SLES15-SAP-EC2-HVM zypper-1.14.33-3.29.1 as a component of Image SLES15-SAP-EC2-HVM libsolv-tools-0.7.10-3.22.1 as a component of Image SLES15-SAP-EC2-HVM-BYOS libzypp-17.19.0-3.34.1 as a component of Image SLES15-SAP-EC2-HVM-BYOS python-solv-0.7.10-3.22.1 as a component of Image SLES15-SAP-EC2-HVM-BYOS zypper-1.14.33-3.29.1 as a component of Image SLES15-SAP-EC2-HVM-BYOS libsolv-tools-0.7.10-3.22.1 as a component of Image SLES15-SAP-GCE libzypp-17.19.0-3.34.1 as a component of Image SLES15-SAP-GCE python-solv-0.7.10-3.22.1 as a component of Image SLES15-SAP-GCE zypper-1.14.33-3.29.1 as a component of Image SLES15-SAP-GCE libsolv-tools-0.7.10-3.22.1 as a component of Image SLES15-SAP-GCE-BYOS libzypp-17.19.0-3.34.1 as a component of Image SLES15-SAP-GCE-BYOS python-solv-0.7.10-3.22.1 as a component of Image SLES15-SAP-GCE-BYOS zypper-1.14.33-3.29.1 as a component of Image SLES15-SAP-GCE-BYOS libsolv-tools-0.7.10-3.22.1 as a component of Image SLES15-SAP-OCI-BYOS libzypp-17.19.0-3.34.1 as a component of Image SLES15-SAP-OCI-BYOS python-solv-0.7.10-3.22.1 as a component of Image SLES15-SAP-OCI-BYOS zypper-1.14.33-3.29.1 as a component of Image SLES15-SAP-OCI-BYOS libsolv-devel-0.7.10-3.22.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 libsolv-tools-0.7.10-3.22.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 libzypp-17.19.0-3.34.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 libzypp-devel-17.19.0-3.34.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 python-solv-0.7.10-3.22.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 zypper-1.14.33-3.29.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 zypper-log-1.14.33-3.29.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 perl-solv-0.7.10-3.22.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 python3-solv-0.7.10-3.22.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 ruby-solv-0.7.10-3.22.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 : Incorrect Default Permissions vulnerability in libzypp of SUSE CaaS Platform 3.0, SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allowed local attackers to read a cookie store used by libzypp, exposing private cookies. This issue affects: SUSE CaaS Platform 3.0 libzypp versions prior to 16.21.2-27.68.1. SUSE Linux Enterprise Server 12 libzypp versions prior to 16.21.2-2.45.1. SUSE Linux Enterprise Server 15 17.19.0-3.34.1. CVE-2019-18900 Container suse/sle15:15.0:libsolv-tools-0.7.10-3.22.1 Container suse/sle15:15.0:libzypp-17.19.0-3.34.1 Container suse/sle15:15.0:zypper-1.14.33-3.29.1 Image SLES15-Azure-BYOS:libsolv-tools-0.7.10-3.22.1 Image SLES15-Azure-BYOS:libzypp-17.19.0-3.34.1 Image SLES15-Azure-BYOS:python-solv-0.7.10-3.22.1 Image SLES15-Azure-BYOS:zypper-1.14.33-3.29.1 Image SLES15-EC2-CHOST-HVM-BYOS:libsolv-tools-0.7.10-3.22.1 Image SLES15-EC2-CHOST-HVM-BYOS:libzypp-17.19.0-3.34.1 Image SLES15-EC2-CHOST-HVM-BYOS:zypper-1.14.33-3.29.1 Image SLES15-EC2-HVM-BYOS:libsolv-tools-0.7.10-3.22.1 Image SLES15-EC2-HVM-BYOS:libzypp-17.19.0-3.34.1 Image SLES15-EC2-HVM-BYOS:python-solv-0.7.10-3.22.1 Image SLES15-EC2-HVM-BYOS:zypper-1.14.33-3.29.1 Image SLES15-GCE-BYOS:libsolv-tools-0.7.10-3.22.1 Image SLES15-GCE-BYOS:libzypp-17.19.0-3.34.1 Image SLES15-GCE-BYOS:python-solv-0.7.10-3.22.1 Image SLES15-GCE-BYOS:zypper-1.14.33-3.29.1 Image SLES15-OCI-BYOS:libsolv-tools-0.7.10-3.22.1 Image SLES15-OCI-BYOS:libzypp-17.19.0-3.34.1 Image SLES15-OCI-BYOS:python-solv-0.7.10-3.22.1 Image SLES15-OCI-BYOS:zypper-1.14.33-3.29.1 Image SLES15-SAP-Azure-BYOS:libsolv-tools-0.7.10-3.22.1 Image SLES15-SAP-Azure-BYOS:libzypp-17.19.0-3.34.1 Image SLES15-SAP-Azure-BYOS:python-solv-0.7.10-3.22.1 Image SLES15-SAP-Azure-BYOS:zypper-1.14.33-3.29.1 Image SLES15-SAP-Azure-LI-BYOS-Production:libsolv-tools-0.7.10-3.22.1 Image SLES15-SAP-Azure-LI-BYOS-Production:libzypp-17.19.0-3.34.1 Image SLES15-SAP-Azure-LI-BYOS-Production:python-solv-0.7.10-3.22.1 Image SLES15-SAP-Azure-LI-BYOS-Production:zypper-1.14.33-3.29.1 Image SLES15-SAP-Azure-VLI-BYOS-Production:libsolv-tools-0.7.10-3.22.1 Image SLES15-SAP-Azure-VLI-BYOS-Production:libzypp-17.19.0-3.34.1 Image SLES15-SAP-Azure-VLI-BYOS-Production:python-solv-0.7.10-3.22.1 Image SLES15-SAP-Azure-VLI-BYOS-Production:zypper-1.14.33-3.29.1 Image SLES15-SAP-Azure:libsolv-tools-0.7.10-3.22.1 Image SLES15-SAP-Azure:libzypp-17.19.0-3.34.1 Image SLES15-SAP-Azure:python-solv-0.7.10-3.22.1 Image SLES15-SAP-Azure:zypper-1.14.33-3.29.1 Image SLES15-SAP-EC2-HVM-BYOS:libsolv-tools-0.7.10-3.22.1 Image SLES15-SAP-EC2-HVM-BYOS:libzypp-17.19.0-3.34.1 Image SLES15-SAP-EC2-HVM-BYOS:python-solv-0.7.10-3.22.1 Image SLES15-SAP-EC2-HVM-BYOS:zypper-1.14.33-3.29.1 Image SLES15-SAP-EC2-HVM:libsolv-tools-0.7.10-3.22.1 Image SLES15-SAP-EC2-HVM:libzypp-17.19.0-3.34.1 Image SLES15-SAP-EC2-HVM:python-solv-0.7.10-3.22.1 Image SLES15-SAP-EC2-HVM:zypper-1.14.33-3.29.1 Image SLES15-SAP-GCE-BYOS:libsolv-tools-0.7.10-3.22.1 Image SLES15-SAP-GCE-BYOS:libzypp-17.19.0-3.34.1 Image SLES15-SAP-GCE-BYOS:python-solv-0.7.10-3.22.1 Image SLES15-SAP-GCE-BYOS:zypper-1.14.33-3.29.1 Image SLES15-SAP-GCE:libsolv-tools-0.7.10-3.22.1 Image SLES15-SAP-GCE:libzypp-17.19.0-3.34.1 Image SLES15-SAP-GCE:python-solv-0.7.10-3.22.1 Image SLES15-SAP-GCE:zypper-1.14.33-3.29.1 Image SLES15-SAP-OCI-BYOS:libsolv-tools-0.7.10-3.22.1 Image SLES15-SAP-OCI-BYOS:libzypp-17.19.0-3.34.1 Image SLES15-SAP-OCI-BYOS:python-solv-0.7.10-3.22.1 Image SLES15-SAP-OCI-BYOS:zypper-1.14.33-3.29.1 SUSE Linux Enterprise Module for Basesystem 15:libsolv-devel-0.7.10-3.22.1 SUSE Linux Enterprise Module for Basesystem 15:libsolv-tools-0.7.10-3.22.1 SUSE Linux Enterprise Module for Basesystem 15:libzypp-17.19.0-3.34.1 SUSE Linux Enterprise Module for Basesystem 15:libzypp-devel-17.19.0-3.34.1 SUSE Linux Enterprise Module for Basesystem 15:python-solv-0.7.10-3.22.1 SUSE Linux Enterprise Module for Basesystem 15:zypper-1.14.33-3.29.1 SUSE Linux Enterprise Module for Basesystem 15:zypper-log-1.14.33-3.29.1 SUSE Linux Enterprise Module for Development Tools 15:perl-solv-0.7.10-3.22.1 SUSE Linux Enterprise Module for Development Tools 15:python3-solv-0.7.10-3.22.1 SUSE Linux Enterprise Module for Development Tools 15:ruby-solv-0.7.10-3.22.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200087-1/ https://www.suse.com/security/cve/CVE-2019-18900.html CVE-2019-18900 https://bugzilla.suse.com/1158763 SUSE Bug 1158763