Security update for libdb-4_8 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:4289-1 Final 1 1 2022-11-29T14:59:09Z current 2022-11-29T14:59:09Z 2022-11-29T14:59:09Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libdb-4_8 This update for libdb-4_8 fixes the following issues: - CVE-2019-2708: Fixed partial DoS due to data store execution (bsc#1174414). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES12-SP5-Azure-BYOS-2022-4289,Image SLES12-SP5-Azure-Basic-On-Demand-2022-4289,Image SLES12-SP5-Azure-HPC-BYOS-2022-4289,Image SLES12-SP5-Azure-HPC-On-Demand-2022-4289,Image SLES12-SP5-Azure-SAP-BYOS-2022-4289,Image SLES12-SP5-Azure-SAP-On-Demand-2022-4289,Image SLES12-SP5-Azure-Standard-On-Demand-2022-4289,Image SLES12-SP5-EC2-BYOS-2022-4289,Image SLES12-SP5-EC2-ECS-On-Demand-2022-4289,Image SLES12-SP5-EC2-On-Demand-2022-4289,Image SLES12-SP5-EC2-SAP-BYOS-2022-4289,Image SLES12-SP5-EC2-SAP-On-Demand-2022-4289,Image SLES12-SP5-GCE-BYOS-2022-4289,Image SLES12-SP5-GCE-On-Demand-2022-4289,Image SLES12-SP5-GCE-SAP-BYOS-2022-4289,Image SLES12-SP5-GCE-SAP-On-Demand-2022-4289,Image SLES12-SP5-SAP-Azure-LI-BYOS-Production-2022-4289,Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production-2022-4289,SUSE-2022-4289,SUSE-SLE-SDK-12-SP5-2022-4289,SUSE-SLE-SERVER-12-SP5-2022-4289 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20224289-1/ Link for SUSE-SU-2022:4289-1 https://lists.suse.com/pipermail/sle-security-updates/2022-November/013158.html E-Mail link for SUSE-SU-2022:4289-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1174414 SUSE Bug 1174414 https://www.suse.com/security/cve/CVE-2019-2708/ SUSE CVE CVE-2019-2708 page Image SLES12-SP5-Azure-BYOS Image SLES12-SP5-Azure-Basic-On-Demand Image SLES12-SP5-Azure-HPC-BYOS Image SLES12-SP5-Azure-HPC-On-Demand Image SLES12-SP5-Azure-SAP-BYOS Image SLES12-SP5-Azure-SAP-On-Demand Image SLES12-SP5-Azure-Standard-On-Demand Image SLES12-SP5-EC2-BYOS Image SLES12-SP5-EC2-ECS-On-Demand Image SLES12-SP5-EC2-On-Demand Image SLES12-SP5-EC2-SAP-BYOS Image SLES12-SP5-EC2-SAP-On-Demand Image SLES12-SP5-GCE-BYOS Image SLES12-SP5-GCE-On-Demand Image SLES12-SP5-GCE-SAP-BYOS Image SLES12-SP5-GCE-SAP-On-Demand Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 libdb-4_8-4.8.30-33.1 db48-utils-4.8.30-33.1 db48-doc-4.8.30-33.1 libdb-4_8-32bit-4.8.30-33.1 libdb-4_8-64bit-4.8.30-33.1 libdb-4_8-devel-4.8.30-33.1 libdb-4_8-devel-32bit-4.8.30-33.1 libdb-4_8-devel-64bit-4.8.30-33.1 libdb_java-4_8-4.8.30-33.1 libdb_java-4_8-devel-4.8.30-33.1 libdb-4_8-4.8.30-33.1 as a component of Image SLES12-SP5-Azure-BYOS libdb-4_8-4.8.30-33.1 as a component of Image SLES12-SP5-Azure-Basic-On-Demand libdb-4_8-4.8.30-33.1 as a component of Image SLES12-SP5-Azure-HPC-BYOS libdb-4_8-4.8.30-33.1 as a component of Image SLES12-SP5-Azure-HPC-On-Demand db48-utils-4.8.30-33.1 as a component of Image SLES12-SP5-Azure-SAP-BYOS libdb-4_8-4.8.30-33.1 as a component of Image SLES12-SP5-Azure-SAP-BYOS db48-utils-4.8.30-33.1 as a component of Image SLES12-SP5-Azure-SAP-On-Demand libdb-4_8-4.8.30-33.1 as a component of Image SLES12-SP5-Azure-SAP-On-Demand libdb-4_8-4.8.30-33.1 as a component of Image SLES12-SP5-Azure-Standard-On-Demand libdb-4_8-4.8.30-33.1 as a component of Image SLES12-SP5-EC2-BYOS libdb-4_8-4.8.30-33.1 as a component of Image SLES12-SP5-EC2-ECS-On-Demand libdb-4_8-4.8.30-33.1 as a component of Image SLES12-SP5-EC2-On-Demand db48-utils-4.8.30-33.1 as a component of Image SLES12-SP5-EC2-SAP-BYOS libdb-4_8-4.8.30-33.1 as a component of Image SLES12-SP5-EC2-SAP-BYOS db48-utils-4.8.30-33.1 as a component of Image SLES12-SP5-EC2-SAP-On-Demand libdb-4_8-4.8.30-33.1 as a component of Image SLES12-SP5-EC2-SAP-On-Demand libdb-4_8-4.8.30-33.1 as a component of Image SLES12-SP5-GCE-BYOS libdb-4_8-4.8.30-33.1 as a component of Image SLES12-SP5-GCE-On-Demand db48-utils-4.8.30-33.1 as a component of Image SLES12-SP5-GCE-SAP-BYOS libdb-4_8-4.8.30-33.1 as a component of Image SLES12-SP5-GCE-SAP-BYOS db48-utils-4.8.30-33.1 as a component of Image SLES12-SP5-GCE-SAP-On-Demand libdb-4_8-4.8.30-33.1 as a component of Image SLES12-SP5-GCE-SAP-On-Demand db48-utils-4.8.30-33.1 as a component of Image SLES12-SP5-SAP-Azure-LI-BYOS-Production libdb-4_8-4.8.30-33.1 as a component of Image SLES12-SP5-SAP-Azure-LI-BYOS-Production db48-utils-4.8.30-33.1 as a component of Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production libdb-4_8-4.8.30-33.1 as a component of Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production db48-utils-4.8.30-33.1 as a component of SUSE Linux Enterprise Server 12 SP5 libdb-4_8-4.8.30-33.1 as a component of SUSE Linux Enterprise Server 12 SP5 libdb-4_8-32bit-4.8.30-33.1 as a component of SUSE Linux Enterprise Server 12 SP5 db48-utils-4.8.30-33.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libdb-4_8-4.8.30-33.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libdb-4_8-32bit-4.8.30-33.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libdb-4_8-devel-4.8.30-33.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 Vulnerability in the Data Store component of Oracle Berkeley DB. Supported versions that are affected are Prior to 6.138, prior to 6.2.38 and prior to 18.1.32. Easily exploitable vulnerability allows low privileged attacker having Local Logon privilege with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Data Store. CVSS 3.0 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L). CVE-2019-2708 Image SLES12-SP5-Azure-BYOS:libdb-4_8-4.8.30-33.1 Image SLES12-SP5-Azure-Basic-On-Demand:libdb-4_8-4.8.30-33.1 Image SLES12-SP5-Azure-HPC-BYOS:libdb-4_8-4.8.30-33.1 Image SLES12-SP5-Azure-HPC-On-Demand:libdb-4_8-4.8.30-33.1 Image SLES12-SP5-Azure-SAP-BYOS:db48-utils-4.8.30-33.1 Image SLES12-SP5-Azure-SAP-BYOS:libdb-4_8-4.8.30-33.1 Image SLES12-SP5-Azure-SAP-On-Demand:db48-utils-4.8.30-33.1 Image SLES12-SP5-Azure-SAP-On-Demand:libdb-4_8-4.8.30-33.1 Image SLES12-SP5-Azure-Standard-On-Demand:libdb-4_8-4.8.30-33.1 Image SLES12-SP5-EC2-BYOS:libdb-4_8-4.8.30-33.1 Image SLES12-SP5-EC2-ECS-On-Demand:libdb-4_8-4.8.30-33.1 Image SLES12-SP5-EC2-On-Demand:libdb-4_8-4.8.30-33.1 Image SLES12-SP5-EC2-SAP-BYOS:db48-utils-4.8.30-33.1 Image SLES12-SP5-EC2-SAP-BYOS:libdb-4_8-4.8.30-33.1 Image SLES12-SP5-EC2-SAP-On-Demand:db48-utils-4.8.30-33.1 Image SLES12-SP5-EC2-SAP-On-Demand:libdb-4_8-4.8.30-33.1 Image SLES12-SP5-GCE-BYOS:libdb-4_8-4.8.30-33.1 Image SLES12-SP5-GCE-On-Demand:libdb-4_8-4.8.30-33.1 Image SLES12-SP5-GCE-SAP-BYOS:db48-utils-4.8.30-33.1 Image SLES12-SP5-GCE-SAP-BYOS:libdb-4_8-4.8.30-33.1 Image SLES12-SP5-GCE-SAP-On-Demand:db48-utils-4.8.30-33.1 Image SLES12-SP5-GCE-SAP-On-Demand:libdb-4_8-4.8.30-33.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:db48-utils-4.8.30-33.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:libdb-4_8-4.8.30-33.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:db48-utils-4.8.30-33.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:libdb-4_8-4.8.30-33.1 SUSE Linux Enterprise Server 12 SP5:db48-utils-4.8.30-33.1 SUSE Linux Enterprise Server 12 SP5:libdb-4_8-32bit-4.8.30-33.1 SUSE Linux Enterprise Server 12 SP5:libdb-4_8-4.8.30-33.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:db48-utils-4.8.30-33.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libdb-4_8-32bit-4.8.30-33.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libdb-4_8-4.8.30-33.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libdb-4_8-devel-4.8.30-33.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224289-1/ https://www.suse.com/security/cve/CVE-2019-2708.html CVE-2019-2708 https://bugzilla.suse.com/1174414 SUSE Bug 1174414