Security update for libzypp, zypper SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:3367-1 Final 1 1 2020-11-18T13:25:54Z current 2020-11-18T13:25:54Z 2020-11-18T13:25:54Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libzypp, zypper This update for libzypp, zypper fixes the following issues: libzypp fixes the following security issue: - CVE-2019-18900: Fixed assert cookie file that was world readable (bsc#1158763). zypper was updated to fix the following issues: - Fixed an issue, where zypper crashed when the system language is set to Spanish and the user tried to patch their system with 'zypper patch --category security' (bsc#1178038) - Fixed a typo in man page (bsc#1169947) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-3367,SUSE-OpenStack-Cloud-7-2020-3367,SUSE-SLE-SAP-12-SP2-2020-3367,SUSE-SLE-SERVER-12-SP2-2020-3367,SUSE-SLE-SERVER-12-SP2-BCL-2020-3367 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20203367-1/ Link for SUSE-SU-2020:3367-1 https://lists.suse.com/pipermail/sle-security-updates/2020-November/007791.html E-Mail link for SUSE-SU-2020:3367-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1158763 SUSE Bug 1158763 https://bugzilla.suse.com/1169947 SUSE Bug 1169947 https://bugzilla.suse.com/1178038 SUSE Bug 1178038 https://www.suse.com/security/cve/CVE-2019-18900/ SUSE CVE CVE-2019-18900 page SUSE Linux Enterprise Server 12 SP2-BCL SUSE Linux Enterprise Server 12 SP2-LTSS SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE OpenStack Cloud 7 libzypp-16.21.2-27.70.1 libzypp-devel-16.21.2-27.70.1 libzypp-devel-doc-16.21.2-27.70.1 zypper-1.13.57-18.46.3 zypper-aptitude-1.13.57-18.46.3 zypper-log-1.13.57-18.46.3 libzypp-16.21.2-27.70.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL libzypp-devel-16.21.2-27.70.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL zypper-1.13.57-18.46.3 as a component of SUSE Linux Enterprise Server 12 SP2-BCL zypper-log-1.13.57-18.46.3 as a component of SUSE Linux Enterprise Server 12 SP2-BCL libzypp-16.21.2-27.70.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS libzypp-devel-16.21.2-27.70.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS zypper-1.13.57-18.46.3 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS zypper-log-1.13.57-18.46.3 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS libzypp-16.21.2-27.70.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libzypp-devel-16.21.2-27.70.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 zypper-1.13.57-18.46.3 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 zypper-log-1.13.57-18.46.3 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libzypp-16.21.2-27.70.1 as a component of SUSE OpenStack Cloud 7 libzypp-devel-16.21.2-27.70.1 as a component of SUSE OpenStack Cloud 7 zypper-1.13.57-18.46.3 as a component of SUSE OpenStack Cloud 7 zypper-log-1.13.57-18.46.3 as a component of SUSE OpenStack Cloud 7 : Incorrect Default Permissions vulnerability in libzypp of SUSE CaaS Platform 3.0, SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allowed local attackers to read a cookie store used by libzypp, exposing private cookies. This issue affects: SUSE CaaS Platform 3.0 libzypp versions prior to 16.21.2-27.68.1. SUSE Linux Enterprise Server 12 libzypp versions prior to 16.21.2-2.45.1. SUSE Linux Enterprise Server 15 17.19.0-3.34.1. CVE-2019-18900 SUSE Linux Enterprise Server 12 SP2-BCL:libzypp-16.21.2-27.70.1 SUSE Linux Enterprise Server 12 SP2-BCL:libzypp-devel-16.21.2-27.70.1 SUSE Linux Enterprise Server 12 SP2-BCL:zypper-1.13.57-18.46.3 SUSE Linux Enterprise Server 12 SP2-BCL:zypper-log-1.13.57-18.46.3 SUSE Linux Enterprise Server 12 SP2-LTSS:libzypp-16.21.2-27.70.1 SUSE Linux Enterprise Server 12 SP2-LTSS:libzypp-devel-16.21.2-27.70.1 SUSE Linux Enterprise Server 12 SP2-LTSS:zypper-1.13.57-18.46.3 SUSE Linux Enterprise Server 12 SP2-LTSS:zypper-log-1.13.57-18.46.3 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libzypp-16.21.2-27.70.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libzypp-devel-16.21.2-27.70.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:zypper-1.13.57-18.46.3 SUSE Linux Enterprise Server for SAP Applications 12 SP2:zypper-log-1.13.57-18.46.3 SUSE OpenStack Cloud 7:libzypp-16.21.2-27.70.1 SUSE OpenStack Cloud 7:libzypp-devel-16.21.2-27.70.1 SUSE OpenStack Cloud 7:zypper-1.13.57-18.46.3 SUSE OpenStack Cloud 7:zypper-log-1.13.57-18.46.3 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20203367-1/ https://www.suse.com/security/cve/CVE-2019-18900.html CVE-2019-18900 https://bugzilla.suse.com/1158763 SUSE Bug 1158763