Security update for syslog-ng SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:14369-1 Final 1 1 2020-05-14T12:00:42Z current 2020-05-14T12:00:42Z 2020-05-14T12:00:42Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for syslog-ng This update for syslog-ng fixes the following issues: - CVE-2020-8019: Fixed a local privilege escalation during package update (bsc#1169385). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sleposp3-syslog-ng-14369,slessp4-syslog-ng-14369 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-202014369-1/ Link for SUSE-SU-2020:14369-1 https://lists.suse.com/pipermail/sle-security-updates/2020-May/006818.html E-Mail link for SUSE-SU-2020:14369-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1169385 SUSE Bug 1169385 https://www.suse.com/security/cve/CVE-2020-8019/ SUSE CVE CVE-2020-8019 page SUSE Linux Enterprise Point of Sale 11 SP3 SUSE Linux Enterprise Server 11 SP4-LTSS syslog-ng-2.0.9-27.34.40.5.1 syslog-ng-2.0.9-27.34.40.5.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 syslog-ng-2.0.9-27.34.40.5.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of syslog-ng of SUSE Linux Enterprise Debuginfo 11-SP3, SUSE Linux Enterprise Debuginfo 11-SP4, SUSE Linux Enterprise Module for Legacy Software 12, SUSE Linux Enterprise Point of Sale 11-SP3, SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Linux Enterprise Server for SAP 12-SP1; openSUSE Backports SLE-15-SP1, openSUSE Leap 15.1 allowed local attackers controlling the user news to escalate their privileges to root. This issue affects: SUSE Linux Enterprise Debuginfo 11-SP3 syslog-ng versions prior to 2.0.9-27.34.40.5.1. SUSE Linux Enterprise Debuginfo 11-SP4 syslog-ng versions prior to 2.0.9-27.34.40.5.1. SUSE Linux Enterprise Module for Legacy Software 12 syslog-ng versions prior to 3.6.4-12.8.1. SUSE Linux Enterprise Point of Sale 11-SP3 syslog-ng versions prior to 2.0.9-27.34.40.5.1. SUSE Linux Enterprise Server 11-SP4-LTSS syslog-ng versions prior to 2.0.9-27.34.40.5.1. SUSE Linux Enterprise Server for SAP 12-SP1 syslog-ng versions prior to 3.6.4-12.8.1. openSUSE Backports SLE-15-SP1 syslog-ng versions prior to 3.19.1-bp151.4.6.1. openSUSE Leap 15.1 syslog-ng versions prior to 3.19.1-lp151.3.6.1. CVE-2020-8019 SUSE Linux Enterprise Point of Sale 11 SP3:syslog-ng-2.0.9-27.34.40.5.1 SUSE Linux Enterprise Server 11 SP4-LTSS:syslog-ng-2.0.9-27.34.40.5.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-202014369-1/ https://www.suse.com/security/cve/CVE-2020-8019.html CVE-2020-8019 https://bugzilla.suse.com/1169385 SUSE Bug 1169385