Security update for trousers SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:2798-1 Final 1 1 2022-08-12T14:27:18Z current 2022-08-12T14:27:18Z 2022-08-12T14:27:18Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for trousers This update for trousers fixes the following issues: - CVE-2020-24330: Fixed a potential tss user to root privilege escalation issue (bsc#1164472). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-2798,SUSE-SLE-Product-HPC-15-2022-2798,SUSE-SLE-Product-SLES-15-2022-2798,SUSE-SLE-Product-SLES_SAP-15-2022-2798 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20222798-1/ Link for SUSE-SU-2022:2798-1 https://lists.suse.com/pipermail/sle-security-updates/2022-August/011907.html E-Mail link for SUSE-SU-2022:2798-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1164472 SUSE Bug 1164472 https://www.suse.com/security/cve/CVE-2020-24330/ SUSE CVE CVE-2020-24330 page SUSE Linux Enterprise High Performance Computing 15-ESPOS SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server for SAP Applications 15 libtspi1-0.3.14-150000.3.3.1 libtspi1-32bit-0.3.14-150000.3.3.1 libtspi1-64bit-0.3.14-150000.3.3.1 trousers-0.3.14-150000.3.3.1 trousers-devel-0.3.14-150000.3.3.1 libtspi1-0.3.14-150000.3.3.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS trousers-0.3.14-150000.3.3.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS trousers-devel-0.3.14-150000.3.3.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS libtspi1-0.3.14-150000.3.3.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS trousers-0.3.14-150000.3.3.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS trousers-devel-0.3.14-150000.3.3.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS libtspi1-0.3.14-150000.3.3.1 as a component of SUSE Linux Enterprise Server 15-LTSS trousers-0.3.14-150000.3.3.1 as a component of SUSE Linux Enterprise Server 15-LTSS trousers-devel-0.3.14-150000.3.3.1 as a component of SUSE Linux Enterprise Server 15-LTSS libtspi1-0.3.14-150000.3.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 trousers-0.3.14-150000.3.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 trousers-devel-0.3.14-150000.3.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by the tss user, it fails to drop the root gid privilege when no longer needed. CVE-2020-24330 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libtspi1-0.3.14-150000.3.3.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:trousers-0.3.14-150000.3.3.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:trousers-devel-0.3.14-150000.3.3.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libtspi1-0.3.14-150000.3.3.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:trousers-0.3.14-150000.3.3.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:trousers-devel-0.3.14-150000.3.3.1 SUSE Linux Enterprise Server 15-LTSS:libtspi1-0.3.14-150000.3.3.1 SUSE Linux Enterprise Server 15-LTSS:trousers-0.3.14-150000.3.3.1 SUSE Linux Enterprise Server 15-LTSS:trousers-devel-0.3.14-150000.3.3.1 SUSE Linux Enterprise Server for SAP Applications 15:libtspi1-0.3.14-150000.3.3.1 SUSE Linux Enterprise Server for SAP Applications 15:trousers-0.3.14-150000.3.3.1 SUSE Linux Enterprise Server for SAP Applications 15:trousers-devel-0.3.14-150000.3.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222798-1/ https://www.suse.com/security/cve/CVE-2020-24330.html CVE-2020-24330 https://bugzilla.suse.com/1164472 SUSE Bug 1164472