SUSE-SU-2024:0076-1: Security update for hawk2
This update for hawk2 fixes the following issues: Fixed HttpOnly secure flag by default (bsc#1216508). Fixed CSRF in errorscontroller.rb protection (bsc#1216571). Update to version 2.6.4+git.1702030539.5fb7d91b: Fix mime type issue in MS windows (bsc#1215438) Parametrize CORS Access-Control-Allow-Origin header (bsc#1213454) Tests: upgrate tests for ruby3.2 (tumbleweed) (bsc#1215976) Upgrade for ruby3.2 (tumbleweed) (bsc#1215976) Forbid special symbols in the category (bsc#1206217) Fix the sass-rails version on ~5.0 (bsc#1208533) Don't delete the private key if the public key is missing (bsc#1207930) make-sle155-compatible.patch . No bsc, it's for backwards compatibility.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/hawk2to a version that resolves this vulnerability.Fixed in 2.6.4 - Upgrade
Upgrade
suse/hawk2-debuginfoto a version that resolves this vulnerability.Fixed in 2.6.4 - Upgrade
Upgrade
suse/hawk2-debugsourceto a version that resolves this vulnerability.Fixed in 2.6.4 - Upgrade
Upgrade
hawk2to a version that resolves this vulnerability.Fixed in 2.6.4+git.1702030539.5fb7d91b - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HA-15-SP1-2024-76=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HA-15-SP2-2024-76=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HA-15-SP3-2024-76=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HA-15-SP4-2024-76=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HA-15-SP5-2024-76=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch openSUSE-SLE-15.4-2024-76=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch openSUSE-SLE-15.5-2024-76=1
Event History
Frequently Asked Questions
Which systems are covered by this update?
The update applies to hawk2, hawk2-debuginfo, and hawk2-debugsource on openSUSE Leap 15.4 and 15.5, and on SUSE Linux Enterprise High Availability Extension 15 SP1, SP2, and SP3. Listed architectures are aarch64, ppc64le, s390x, and x86_64.
What security-related protections are changed?
The update enables the HttpOnly secure flag by default and fixes CSRF protection in errors_controller.rb. It also parameterizes the CORS Access-Control-Allow-Origin header.
What version does the update provide?
The update moves hawk2 to version 2.6.4+git.1702030539.5fb7d91b.