Security update for vsftpd SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:3458-1 Final 1 1 2022-09-28T15:13:09Z current 2022-09-28T15:13:09Z 2022-09-28T15:13:09Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for vsftpd This update for vsftpd fixes the following issues: - CVE-2021-3618: Enforced security checks against ALPACA attack (PM-3322, jsc#SLE-23895, bsc#1187686, bsc#1187678). - Added hardening to systemd services (bsc#1181400). Bugfixes: - Fixed a seccomp failure in FIPS mode when SSL was enabled (bsc#1052900). - Allowed wait4() to be called so that the broker can wait for its child processes (bsc#1021387). - Fixed hang when using seccomp and syslog (bsc#971784). - Allowed sendto() syscall when /dev/log support is enabled (bsc#786024). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-3458,SUSE-SLE-Product-HPC-15-2022-3458,SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-3458,SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-3458,SUSE-SLE-Product-SLES-15-2022-3458,SUSE-SLE-Product-SLES-15-SP1-BCL-2022-3458,SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-3458,SUSE-SLE-Product-SLES_SAP-15-2022-3458,SUSE-SLE-Product-SLES_SAP-15-SP1-2022-3458,SUSE-Storage-6-2022-3458 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20223458-1/ Link for SUSE-SU-2022:3458-1 https://lists.suse.com/pipermail/sle-security-updates/2022-September/012444.html E-Mail link for SUSE-SU-2022:3458-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1021387 SUSE Bug 1021387 https://bugzilla.suse.com/1052900 SUSE Bug 1052900 https://bugzilla.suse.com/1181400 SUSE Bug 1181400 https://bugzilla.suse.com/1187678 SUSE Bug 1187678 https://bugzilla.suse.com/1187686 SUSE Bug 1187686 https://bugzilla.suse.com/786024 SUSE Bug 786024 https://bugzilla.suse.com/971784 SUSE Bug 971784 https://www.suse.com/security/cve/CVE-2021-3618/ SUSE CVE CVE-2021-3618 page SUSE Enterprise Storage 6 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS SUSE Linux Enterprise High Performance Computing 15-ESPOS SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise Server 15 SP1-BCL SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server for SAP Applications 15 SUSE Linux Enterprise Server for SAP Applications 15 SP1 vsftpd-3.0.5-150000.7.19.1 vsftpd-3.0.5-150000.7.19.1 as a component of SUSE Enterprise Storage 6 vsftpd-3.0.5-150000.7.19.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS vsftpd-3.0.5-150000.7.19.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS vsftpd-3.0.5-150000.7.19.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS vsftpd-3.0.5-150000.7.19.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS vsftpd-3.0.5-150000.7.19.1 as a component of SUSE Linux Enterprise Server 15 SP1-BCL vsftpd-3.0.5-150000.7.19.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS vsftpd-3.0.5-150000.7.19.1 as a component of SUSE Linux Enterprise Server 15-LTSS vsftpd-3.0.5-150000.7.19.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 vsftpd-3.0.5-150000.7.19.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer. CVE-2021-3618 SUSE Enterprise Storage 6:vsftpd-3.0.5-150000.7.19.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:vsftpd-3.0.5-150000.7.19.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:vsftpd-3.0.5-150000.7.19.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:vsftpd-3.0.5-150000.7.19.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:vsftpd-3.0.5-150000.7.19.1 SUSE Linux Enterprise Server 15 SP1-BCL:vsftpd-3.0.5-150000.7.19.1 SUSE Linux Enterprise Server 15 SP1-LTSS:vsftpd-3.0.5-150000.7.19.1 SUSE Linux Enterprise Server 15-LTSS:vsftpd-3.0.5-150000.7.19.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:vsftpd-3.0.5-150000.7.19.1 SUSE Linux Enterprise Server for SAP Applications 15:vsftpd-3.0.5-150000.7.19.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223458-1/ https://www.suse.com/security/cve/CVE-2021-3618.html CVE-2021-3618 https://bugzilla.suse.com/1187678 SUSE Bug 1187678