openSUSE-SU-2024:0371-1: important: Security update for icinga2
openSUSE-SU-2024:0372-1: important: Security update for icinga2
openSUSE-SU-2024:0370-1: critical: Security update for cobbler
openSUSE-SU-2024:14513-1: moderate: govulncheck-vulndb-0.0.20241119T173509-1.1 on GA media
openSUSE-SU-2024:14511-1: moderate: chromedriver-131.0.6778.69-1.1 on GA media
openSUSE-SU-2024:14512-1: moderate: cobbler-3.3.7-1.1 on GA media
openSUSE-SU-2024:0371-1: important: Security update for icinga2
openSUSE Security Update: Security update for icinga2
_______________________________
Announcement ID: openSUSE-SU-2024:0371-1
Rating: important
References: #1233310
Cross-References: CVE-2024-49369
CVSS scores:
CVE-2024-49369 (SUSE): 10 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected Products:
openSUSE Backports SLE-15-SP5
_______________________________
An update that fixes one vulnerability is now available.
Description:
This update for icinga2 fixes the following issues:
Update to 2.13.10:
- CVE-2024-49369: Fix TLS certificate validation bypass (bsc#1233310).
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP5:
zypper in -t patch openSUSE-2024-371=1
Package List:
- openSUSE Backports SLE-15-SP5 (aarch64 i586 ppc64le x86_64):
icinga2-2.13.10-bp155.3.3.1
icinga2-bin-2.13.10-bp155.3.3.1
icinga2-common-2.13.10-bp155.3.3.1
icinga2-doc-2.13.10-bp155.3.3.1
icinga2-ido-mysql-2.13.10-bp155.3.3.1
icinga2-ido-pgsql-2.13.10-bp155.3.3.1
nano-icinga2-2.13.10-bp155.3.3.1
vim-icinga2-2.13.10-bp155.3.3.1
References:
https://www.suse.com/security/cve/CVE-2024-49369.html
https://bugzilla.suse.com/1233310
openSUSE-SU-2024:0372-1: important: Security update for icinga2
openSUSE Security Update: Security update for icinga2
_______________________________
Announcement ID: openSUSE-SU-2024:0372-1
Rating: important
References: #1233310
Cross-References: CVE-2024-49369
CVSS scores:
CVE-2024-49369 (SUSE): 10 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected Products:
openSUSE Backports SLE-15-SP6
_______________________________
An update that fixes one vulnerability is now available.
Description:
This update for icinga2 fixes the following issues:
Update to 2.13.10:
- CVE-2024-49369: Fix TLS certificate validation bypass (bsc#1233310).
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP6:
zypper in -t patch openSUSE-2024-372=1
Package List:
- openSUSE Backports SLE-15-SP6 (aarch64 i586 ppc64le x86_64):
icinga2-2.13.10-bp156.4.3.1
icinga2-bin-2.13.10-bp156.4.3.1
icinga2-common-2.13.10-bp156.4.3.1
icinga2-doc-2.13.10-bp156.4.3.1
icinga2-ido-mysql-2.13.10-bp156.4.3.1
icinga2-ido-pgsql-2.13.10-bp156.4.3.1
nano-icinga2-2.13.10-bp156.4.3.1
vim-icinga2-2.13.10-bp156.4.3.1
References:
https://www.suse.com/security/cve/CVE-2024-49369.html
https://bugzilla.suse.com/1233310
openSUSE-SU-2024:0370-1: critical: Security update for cobbler
openSUSE Security Update: Security update for cobbler
_______________________________
Announcement ID: openSUSE-SU-2024:0370-1
Rating: critical
References: #1231332
Cross-References: CVE-2024-47533
CVSS scores:
CVE-2024-47533 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products:
openSUSE Backports SLE-15-SP6
_______________________________
An update that fixes one vulnerability is now available.
Description:
This update for cobbler fixes the following issues:
Update to 3.3.7
* Security: Fix issue that allowed anyone to connect to the API as admin
(CVE-2024-47533, boo#1231332)
* bind - Fix bug that prevents cname entries from being generated
successfully
* Fix build on RHEL9 based distributions (fence-agents-all split)
* Fix for Windows systems
* Docs: Add missing dependencies for source installation
* Fix issue that prevented systems from being synced when the profile was
edited
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP6:
zypper in -t patch openSUSE-2024-370=1
Package List:
- openSUSE Backports SLE-15-SP6 (noarch):
cobbler-3.3.7-bp156.2.6.1
cobbler-tests-3.3.7-bp156.2.6.1
cobbler-tests-containers-3.3.7-bp156.2.6.1
References:
https://www.suse.com/security/cve/CVE-2024-47533.html
https://bugzilla.suse.com/1231332
openSUSE-SU-2024:14513-1: moderate: govulncheck-vulndb-0.0.20241119T173509-1.1 on GA media
# govulncheck-vulndb-0.0.20241119T173509-1.1 on GA media
Announcement ID: openSUSE-SU-2024:14513-1
Rating: moderate
Cross-References:
* CVE-2020-8911
* CVE-2023-0109
* CVE-2024-0793
* CVE-2024-24425
* CVE-2024-24426
* CVE-2024-44625
* CVE-2024-52010
* CVE-2024-52308
* CVE-2024-52522
* CVE-2024-9526
CVSS scores:
* CVE-2024-0793 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Affected Products:
* openSUSE Tumbleweed
An update that solves 10 vulnerabilities can now be installed.
## Description:
These are all security issues fixed in the govulncheck-vulndb-0.0.20241119T173509-1.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* govulncheck-vulndb 0.0.20241119T173509-1.1
## References:
* https://www.suse.com/security/cve/CVE-2020-8911.html
* https://www.suse.com/security/cve/CVE-2023-0109.html
* https://www.suse.com/security/cve/CVE-2024-0793.html
* https://www.suse.com/security/cve/CVE-2024-24425.html
* https://www.suse.com/security/cve/CVE-2024-24426.html
* https://www.suse.com/security/cve/CVE-2024-44625.html
* https://www.suse.com/security/cve/CVE-2024-52010.html
* https://www.suse.com/security/cve/CVE-2024-52308.html
* https://www.suse.com/security/cve/CVE-2024-52522.html
* https://www.suse.com/security/cve/CVE-2024-9526.html
openSUSE-SU-2024:14511-1: moderate: chromedriver-131.0.6778.69-1.1 on GA media
# chromedriver-131.0.6778.69-1.1 on GA media
Announcement ID: openSUSE-SU-2024:14511-1
Rating: moderate
Cross-References:
* CVE-2024-11110
* CVE-2024-11111
* CVE-2024-11112
* CVE-2024-11113
* CVE-2024-11114
* CVE-2024-11115
* CVE-2024-11116
* CVE-2024-11117
Affected Products:
* openSUSE Tumbleweed
An update that solves 8 vulnerabilities can now be installed.
## Description:
These are all security issues fixed in the chromedriver-131.0.6778.69-1.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* chromedriver 131.0.6778.69-1.1
* chromium 131.0.6778.69-1.1
## References:
* https://www.suse.com/security/cve/CVE-2024-11110.html
* https://www.suse.com/security/cve/CVE-2024-11111.html
* https://www.suse.com/security/cve/CVE-2024-11112.html
* https://www.suse.com/security/cve/CVE-2024-11113.html
* https://www.suse.com/security/cve/CVE-2024-11114.html
* https://www.suse.com/security/cve/CVE-2024-11115.html
* https://www.suse.com/security/cve/CVE-2024-11116.html
* https://www.suse.com/security/cve/CVE-2024-11117.html
openSUSE-SU-2024:14512-1: moderate: cobbler-3.3.7-1.1 on GA media
# cobbler-3.3.7-1.1 on GA media
Announcement ID: openSUSE-SU-2024:14512-1
Rating: moderate
Cross-References:
* CVE-2024-47533
CVSS scores:
* CVE-2024-47533 ( SUSE ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products:
* openSUSE Tumbleweed
An update that solves one vulnerability can now be installed.
## Description:
These are all security issues fixed in the cobbler-3.3.7-1.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* cobbler 3.3.7-1.1
* cobbler-tests 3.3.7-1.1
* cobbler-tests-containers 3.3.7-1.1
## References:
* https://www.suse.com/security/cve/CVE-2024-47533.html
