SUSE-RU-2024:0042-1: Recommended update for libzypp, zypper
This update for libzypp, zypper fixes the following issues: Expand RepoVars in URLs downloading a .repo file (bsc#1212160) CheckAccessDeleted: fix 'running in container' filter (bsc#1218291) Open rpmdb just once during execution of %posttrans scripts (bsc#1216412) tools/DownloadFiles: use standard zypp progress bar Fix ProgressBar's calculation of the printed tag position Fix usage of deprecated CURL features Stop using boost version 1 timer library (bsc#1215294) Fix search/info commands ignoring --ignore-unknown (bsc#1217593) Make sure reboot-needed is remembered until next boot (bsc#1217873)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/libzyppto a version that resolves this vulnerability.Fixed in 17.31.27-150100.3.125.1 - Upgrade
Upgrade
suse/libzypp-debuginfoto a version that resolves this vulnerability.Fixed in 17.31.27-150100.3.125.1 - Upgrade
Upgrade
suse/libzypp-develto a version that resolves this vulnerability.Fixed in 17.31.27-150100.3.125.1 - Upgrade
Upgrade
suse/libzypp-debugsourceto a version that resolves this vulnerability.Fixed in 17.31.27-150100.3.125.1 - Upgrade
Upgrade
suse/zypper-debugsourceto a version that resolves this vulnerability.Fixed in 1.14.68-150100.3.93.2 - Upgrade
Upgrade
suse/zypperto a version that resolves this vulnerability.Fixed in 1.14.68-150100.3.93.2 - Upgrade
Upgrade
suse/zypper-debuginfoto a version that resolves this vulnerability.Fixed in 1.14.68-150100.3.93.2 - Upgrade
Upgrade
suse/zypper-needs-restartingto a version that resolves this vulnerability.Fixed in 1.14.68-150100.3.93.2 - Upgrade
Upgrade
suse/zypper-logto a version that resolves this vulnerability.Fixed in 1.14.68-150100.3.93.2 - Upgrade
Upgrade
SUSE SLE Installer 15 SP1to a version that resolves this vulnerability.Patch SUSE-SLE-INSTALLER-15-SP1-2024-42=1 - Upgrade
Upgrade
SUSE SLE Product HPC 15 SP1 LTSSto a version that resolves this vulnerability.Patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2024-42=1 - Upgrade
Upgrade
SUSE SLE Product SLES 15 SP1 LTSSto a version that resolves this vulnerability.Patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2024-42=1 - Upgrade
Upgrade
SUSE SLE Product SLES SAP 15 SP1to a version that resolves this vulnerability.Patch SUSE-SLE-Product-SLES_SAP-15-SP1-2024-42=1
Event History
Frequently Asked Questions
Which packages are included in this recommended update?
The update covers libzypp and zypper, along with their debuginfo, debugsource, development, and zypper-needs-restarting packages listed in the advisory.
What operational issues does this update address?
It fixes repository-variable expansion in URLs used to download .repo files, container filtering in CheckAccessDeleted, and search/info handling of --ignore-unknown. It also ensures reboot-needed remains recorded until the next boot and improves rpm database handling during %posttrans scripts.
Does the advisory identify a security vulnerability, exploit method, or workaround?
No. The provided advisory describes a recommended update with functional fixes and does not provide an exploit scenario, affected configuration details, or mitigations other than applying the update.