Security update for syslog-ng SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:1221-1 Final 1 1 2020-05-07T15:12:42Z current 2020-05-07T15:12:42Z 2020-05-07T15:12:42Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for syslog-ng This update for syslog-ng fixes the following issues: - CVE-2020-8019: Fixed a local privilege escalation during package update (bsc#1169385). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES12-SP4-SAP-Azure-LI-BYOS-Production-2020-1221,Image SLES12-SP5-SAP-Azure-LI-BYOS-Production-2020-1221,SUSE-2020-1221,SUSE-SLE-Module-Legacy-12-2020-1221,SUSE-SLE-SAP-12-SP1-2020-1221 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20201221-1/ Link for SUSE-SU-2020:1221-1 https://lists.suse.com/pipermail/sle-security-updates/2020-May/006804.html E-Mail link for SUSE-SU-2020:1221-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1169385 SUSE Bug 1169385 https://www.suse.com/security/cve/CVE-2020-8019/ SUSE CVE CVE-2020-8019 page Image SLES12-SP4-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-LI-BYOS-Production SUSE Linux Enterprise Module for Legacy 12 SUSE Linux Enterprise Server for SAP Applications 12 SP1 syslog-ng-3.6.4-12.8.1 syslog-ng-geoip-3.6.4-12.8.1 syslog-ng-json-3.6.4-12.8.1 syslog-ng-smtp-3.6.4-12.8.1 syslog-ng-sql-3.6.4-12.8.1 syslog-ng-3.6.4-12.8.1 as a component of Image SLES12-SP4-SAP-Azure-LI-BYOS-Production syslog-ng-3.6.4-12.8.1 as a component of Image SLES12-SP5-SAP-Azure-LI-BYOS-Production syslog-ng-3.6.4-12.8.1 as a component of SUSE Linux Enterprise Module for Legacy 12 syslog-ng-3.6.4-12.8.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of syslog-ng of SUSE Linux Enterprise Debuginfo 11-SP3, SUSE Linux Enterprise Debuginfo 11-SP4, SUSE Linux Enterprise Module for Legacy Software 12, SUSE Linux Enterprise Point of Sale 11-SP3, SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Linux Enterprise Server for SAP 12-SP1; openSUSE Backports SLE-15-SP1, openSUSE Leap 15.1 allowed local attackers controlling the user news to escalate their privileges to root. This issue affects: SUSE Linux Enterprise Debuginfo 11-SP3 syslog-ng versions prior to 2.0.9-27.34.40.5.1. SUSE Linux Enterprise Debuginfo 11-SP4 syslog-ng versions prior to 2.0.9-27.34.40.5.1. SUSE Linux Enterprise Module for Legacy Software 12 syslog-ng versions prior to 3.6.4-12.8.1. SUSE Linux Enterprise Point of Sale 11-SP3 syslog-ng versions prior to 2.0.9-27.34.40.5.1. SUSE Linux Enterprise Server 11-SP4-LTSS syslog-ng versions prior to 2.0.9-27.34.40.5.1. SUSE Linux Enterprise Server for SAP 12-SP1 syslog-ng versions prior to 3.6.4-12.8.1. openSUSE Backports SLE-15-SP1 syslog-ng versions prior to 3.19.1-bp151.4.6.1. openSUSE Leap 15.1 syslog-ng versions prior to 3.19.1-lp151.3.6.1. CVE-2020-8019 Image SLES12-SP4-SAP-Azure-LI-BYOS-Production:syslog-ng-3.6.4-12.8.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:syslog-ng-3.6.4-12.8.1 SUSE Linux Enterprise Module for Legacy 12:syslog-ng-3.6.4-12.8.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:syslog-ng-3.6.4-12.8.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201221-1/ https://www.suse.com/security/cve/CVE-2020-8019.html CVE-2020-8019 https://bugzilla.suse.com/1169385 SUSE Bug 1169385