This update for postgresql-jdbc fixes the following issues: CVE-2024-1597: Fixed SQL Injection via line comment generation (bsc#1220644).

This update for nodejs16 fixes the following issues: Security issues fixed: CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997). CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993). CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014). CVE-2024-24758: ignore proxy-authorization header (bsc#1220017). CVE-2024-24806: fix improper domain lookup that potentially leads to SSRF attacks (bsc#1219724).

This update for nodejs18 fixes the following issues: Update to 18.19.1: (security updates) CVE-2024-21892: Code injection and privilege escalation through Linux capabilities (bsc#1219992). CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993). CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997). CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014). CVE-2024-24758: undici version 5.28.3 (bsc#1220017). CVE-2024-24806: libuv version 1.48.0 (bsc#1219724). Update to LTS version 18.19.0 deps: npm updates to 10.x esm: Leverage loaders when resolving subsequent loaders import.meta.resolve unflagged --experimental-default-type flag to flip module defaults

This update for nftables fixes the following issues: Enable python311 module (bsc#1219253).

This update for gcc12 fixes the following issues: CVE-2023-4039: Fixed incorrect stack protector for C99 VLAs on Aarch64 (bsc#1214052).

This update for samba fixes the following issues: CVE-2022-2127: Fixed issue where lmresplen was not checked properly in winbinddpamauthcrapsend (bsc#1213174). CVE-2023-34966: Fixed samba spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability (bsc#1213173). CVE-2023-34967: Fixed samba spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability (bsc#1213172). CVE-2023-34968: Fixed spotlight server-side Share Path Disclosure (bsc#1213171). Bugfixes: Fixed trust relationship failure (bsc#1213384).

This update for texlive-specs-a fixes the following issues: Replace arara.jar in arara.tar.xz with a updated log4j to silent some simple screening tools reporting vulnerable log4j version even if even log4j is not used that way (bsc#1218601)

This update for postgresql fixes the following issues: Require fillup package to properly create the config file (bsc#1219340)

This update for python-pip fixes the following issues: Removed .exe files from the RPM package, to prevent issues with security scanners (bsc#1212015).

This update for openssl-100 fixes the following issues: CVE-2022-4304: Reworked the fix for the Timing-Oracle in RSA decryption. The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case (bsc#1207534).

This update for libxml2 fixes the following issues: CVE-2024-25062: Fixed use-after-free in XMLReader (bsc#1219576).

This update for yast2-http-server fixes the following issue: bsc#1218943 followup of previous fix - fixed internal issue which caused Server modules not to be displayed at all. 4.4.3 upgrade

This update for bind fixes the following issues: Update to release 9.16.48: Feature Changes: The IP addresses for B.ROOT-SERVERS.NET have been updated to 170.247.170.2 and 2801:1b8:10::b. Security Fixes: Validating DNS messages containing a lot of DNSSEC signatures could cause excessive CPU load, leading to a denial-of-service condition. This has been fixed. (CVE-2023-50387) [bsc#1219823] Preparing an NSEC3 closest encloser proof could cause excessive CPU load, leading to a denial-of-service condition. This has been fixed. (CVE-2023-50868) [bsc#1219826] Parsing DNS messages with many different names could cause excessive CPU load. This has been fixed. (CVE-2023-4408) [bsc#1219851] Specific queries could cause named to crash with an assertion failure when nxdomain-redirect was enabled. This has been fixed. (CVE-2023-5517) [bsc#1219852] A bad interaction between DNS64 and serve-stale could cause named to crash with an assertion failure, when both of these features were enabled. This has been fixed. (CVE-2023-5679) [bsc#1219853] Query patterns that continuously triggered cache database maintenance could cause an excessive amount of memory to be allocated, exceeding max-cache-size and potentially leading to all available memory on the host running named being exhausted. This has been fixed. (CVE-2023-6516) [bsc#1219854] Removed Features: Support for using AES as the DNS COOKIE algorithm (cookie-algorithm aes;) has been deprecated and will be removed in a future release. Please use the current default, SipHash-2-4, instead.

This update for php-composer2 fixes the following issues: CVE-2024-24821: Fixed potential arbitrary code execution when Composer is invoked within a directory with tampered files (bsc#1219757).

This update for csp-billing-adapter, csp-billing-adapter-local contains the following fixes: Changes for csp-billing-adapter-local: - Update to version 0.5.0: Attempt to backup archive before saving Add getarchivelocation function Add metering archive hook implementations Changes for csp-billing-adapter: - Update to version 0.9.0: Add metering archive feature

This update for dpdk fixes the following issues: Fixed a regression caused by incomplete fix for CVE-2022-2132 (bsc#1219187).

This update for hdf5 fixes the following issues: Updated to version 1.10.11 Changed the error handling for a not found path in the find plugin process. Fixed CVE-2018-11202, a malformed file could result in chunk index memory leaks. Fixed a file space allocation bug in the parallel library for chunked datasets. Fixed an assertion failure in Parallel HDF5 when a file can't be created due to an invalid library version bounds setting. Fixed an assertion in a previous fix for CVE-2016-4332. Fixed segfault on file close in h5debug which fails with a core dump on a file that has an illegal file size in its cache image. Fixes HDFFV-11052, CVE-2020-10812. Fixed memory leaks that could occur when reading a dataset from a malformed file. Fixed a bug in H5Ocopy that could generate invalid HDF5 files Fixed potential heap buffer overflow in decoding of link info message. Fixed potential buffer overrun issues in some object header decode routines. Fixed a heap buffer overflow that occurs when reading from a dataset with a compact layout within a malformed HDF5 file. Fixed CVE-2019-8396, malformed HDF5 files where content does not match expected size. Fixed memory leak when running h5dump with proof of vulnerability file. Added option --no-compact-subset to h5diff. Fixes since 1.10.10: Fixed a memory corruption when reading from dataset using a hyperslab selection in file dataspace and a point selection memory dataspace. Fix CVE-2021-37501 Fixed an issue with variable length attributes. Fixed an issue with hyperslab selections where an incorrect combined selection was produced. Fixed an issue with attribute type conversion with compound datatypes. Modified H5Fstartswmrwrite() to preserve DAPL properties. Converted an assertion on (possibly corrupt) file contents to a normal error check. Fixed memory leak with variable-length fill value in H5Ofillconvert(). Fix h5repack to only print output when verbose option is selected. Fixes since 1.10.9: Several improvements to parallel compression feature, including: Improved support for collective I/O (for both writes and reads). Reduction of copying of application data buffers passed to H5Dwrite. Addition of support for incremental file space allocation for filtered datasets created in parallel. Addition of support for HDF5's "don't filter partial edge chunks" flag Addition of proper support for HDF5 fill values with the feature. Addition of 'H5HAVEPARALLELFILTEREDWRITES' macro to H5pubconf.h so HDF5 applications can determine at compile-time whether the feature is available. Addition of simple examples

h5repack added an optional verbose value for reporting R/W timing. Fixed a metadata cache bug when resizing a pinned/protected cache entry. Fixed a problem with the H5VERSRELEASE check in the H5checkversion function. Unified handling of collective metadata reads to correctly fix old bugs. Fixed several potential MPI deadlocks in library failure conditions. Fixed an issue with collective metadata reads being permanently disabled after a dataset chunk lookup operation.

This update for suma-amazon-adapter-config-llc, suma-amazon-adapter-config-ltd fixes the following issues: suma-amazon-adapter-config-llc was updated to version 20240112: Version 20240112: Added archive feature options suma-amazon-adapter-config-ltd was updated to version 20240112: Version 20240112:

Add archive feature options

Version 20231103:

Update license to BSD-2-Clause

This update for suma-azure-adapter-config-llc, suma-azure-adapter-config-ltd fixes the following issues: suma-azure-adapter-config-llc was updated to version 20240112: Version 20240112: Added archive feature options suma-azure-adapter-config-ltd was updated to version 20240112: Version 20240112: Add archive feature options

This update for libaom fixes the following issues: CVE-2023-6879: Fixed a heap buffer overflow when increasing the video frame resolution (bsc#1218429).

This update for openssl-3 fixes the following issues: CVE-2023-6129: Fixed vector register clobbering on PowerPC. (bsc#1218690) CVE-2023-6237: Fixed excessive time spent checking invalid RSA public keys. (bsc#1218810) CVE-2024-0727: Denial of service when processing a maliciously formatted PKCS12 file (bsc#1219243).

This update for salt fixes the following issues: Security issues fixed: CVE-2024-22231: Prevent directory traversal when creating syndic cache directory on the master (bsc#1219430) CVE-2024-22232: Prevent directory traversal attacks in the master's servefile method (bsc#1219431) Bugs fixed: Ensure that pillar refresh loads beacons from pillar without restart Fix the aptpkg.py unit test failure Prefer unittest.mock to python-mock in test suite Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) Revert changes to set Salt configured user early in the stack (bsc#1216284) Align behavior of some modules when using salt-call via symlink (bsc#1215963) Fix gitfs "env" and improve cache cleaning (bsc#1193948) Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed

This update for imb fixes the following issues: Update to version 2021.7 Change default value for memalloctype to device License update Bug fixes

Currently not provided in SUSE: IMB-MPI1-GPU benchmark: Dynamically loading from LDLIBRARYPATH cuda or level zero library.

Drop support for openmpi[123] (jsc#PED-7111)

Prepare support for openmpi5

Add build support for gcc11/12.

This update for spack fixes the following issues: spack was updated to version 0.21.1 (bsc#1219480): Version 0.21.1:

Add support for reading buildcaches created by Spack v0.22

Bugfixes:

spack graph: fix coloring with environments spack info: sort variants in --variants-by-name Spec.format: error on old style format strings

ASP-based solver:

fix infinite recursion when computing concretization errors

don't error for type mismatch on preferences

don't emit spurious debug output.

Improve the error message for deprecated preferences

Fix multi-word aliases Add a warning for unconfigured compiler environment: fix an issue with deconcretization/reconcretization of specs buildcache: don't error if a patch is missing, when installing from binaries

Version 0.21.0:

New features:

Better error messages with condition chaining: In v0.18, we added better error messages that could tell you what problem happened, but they couldn't tell you why it happened. 0.21 adds condition chaining to the solver, and Spack can now trace back through the conditions that led to an error and build a tree of causes potential causes and where they came from.

OCI build caches: You can now use an arbitrary OCI registry as a build cache:

For Dockerhub: $ spack mirror add myregistry oci://user/image

For another registry (GHCR): $ spack mirror add myregistry oci://ghcr.io/haampie/spack-test

Then set the login credentials: $ spack mirror set --push --oci-username ... --oci-password ... myregistry and push to it: $ spack buildcache push myregistry [specs...] You can optionally add a base image to get runnable images: $ spack buildcache push --base-image leap:15.5 myregistry python Pushed ... as [image]:python-3.11.2-65txfcpqbmpawclvtasuog4yzmxwaoia.spack $ docker run --rm -it [image]:python-3.11.2-65txfcpqbmpawclvtasuog4yzmxwaoia.spack This creates a container image from the Spack installations on the host system, without the need to run spack install from a Dockerfile or sif file. It also addresses the inconvenience of losing binaries of dependencies when RUN spack install fails inside docker build. Further, the container image layers and build cache tarballs are the same files. This means that spack install and docker pull use the exact same underlying binaries. If you previously used spack install inside of docker build, this feature helps you save storage by a factor two. + Multiple versions of build dependencies: Increasingly, complex package builds require multiple versions of some build dependencies. For example, Python packages frequently require very specific versions of setuptools, cython, while different physics packages require different versions of Python to build. The concretizer enforced that every solve was unified, i.e., so that there was only one version of every package. The concretizer now supports "duplicate" nodes for build dependencies, but enforces unification through transitive link and run dependencies. This will allow it to better resolve complex dependency graphs in ecosystems like Python. + Cherry-picking virtual dependencies: You can now select only a subset of virtual dependencies from a spec that may provide more. For example, to make mpich your mpi provider, you can be explicit by writing: hdf5 ^[virtuals=mpi] mpich Or, to use, e.g., intel-parallel-studio for blas along with an external lapack like openblas, you could write: strumpack ^[virtuals=mpi] intel-parallel-studio+mkl ^[virtuals=lapack] openblas The virtuals=mpi is an edge attribute, and dependency edges in Spack graphs now track which virtuals they satisfied. + The spack deconcretize command gives you control over what you want to update in an already concrete environment. As an example, with an environment built with meson, and you want to update your meson version, you can run: $spack deconcretize meson and have everything that depends on meson rebuilt the next time you run spack concretize. In the future, we'll handle this in a single command, but for now you can use this to drop bits of your lockfile and resolve your dependencies again. + UI Improvements: The spack info received a rework to make the output more appealing. It is now on par with the rest of Spack's UI. spack info now makes much better use of terminal space and shows variants, their values, and their descriptions more clearly. Conditional variants are grouped separately so you can more easily understand how packages are structured. spack checksum now allows you to filter versions from your editor, or by version range. It also notifies you about potential download URL changes. + Environments can include definitions: Spack did not previously support using include: with The definitions section of an environment, but now it does. You can use this to curate lists of specs and more easily reuse them across environments. + Aliases: You can now add aliases to Spack commands in config.yaml, e.g. this might enshrine your favorite args to spack find as spack f: config: aliases: f: find -lv

Improved autoloading of modules: In this release, you can start using hideimplicits: true instead, which exposes only explicitly installed packages to the user, while still autoloading dependencies. On top of that, you can safely use hashlength: 0, as this config now only applies to the modules exposed to the user -- you don't have to worry about file name clashes for hidden dependencies. Note: for Tcl this feature requires Modules 4.7 or higher

Other new commands and directives:

spack env activate without arguments now loads a default environment that you do not have to create. spack find -H / --hashes: a new shortcut for piping spack find output to other commands. Add spack checksum --verify, fix --add. New defaultargs context manager factors out common args for directives. spack compiler find --[no]-mixed-toolchain lets you easily mix clang and gfortran on Linux

Performance improvements:

spack external find execution is now much faster. spack location -i is now much faster on success. Drop redundant rpaths post install. ASP-based solver: avoid cycles in clingo using hidden directive. Fix multiple quadratic complexity issues in environments

Other new features of note:

archspec: update to v0.2.2, support for Sapphire Rapids, Power10, Neoverse V2. Propagate variants across nodes that don't have that variant Implement fish shell completion. Can now distinguish between source/binary mirror; don't ping mirror.spack.io as much. Improve status reporting on spack install (add [n/total] display...).

This update for python3-M2Crypto fixes the following issues: Packaging changes (bsc#1217782, bsc#1212757) Set OpenSSL 3.0 as the default openssl in Tumbleweed (bsc#1205042)

This update for perl fixes the following issues: CVE-2023-31484: Enable TLS cert verification in CPAN (bsc#1210999).

This update for java-17-openjdk fixes the following issues: Updated to version 17.0.10 (January 2024 CPU): CVE-2024-20918: Fixed an out of bounds access in the Hotspot JVM due to a missing bounds check (bsc#1218907). CVE-2024-20919: Fixed a sandbox bypass in the Hotspot JVM class file verifier (bsc#1218903). CVE-2024-20921: Fixed an incorrect optimization in the Hotspot JVM that could lead to corruption of JVM memory (bsc#1218905). CVE-2024-20932: Fixed an incorrect handling of ZIP files with duplicate entries (bsc#1218908). CVE-2024-20945: Fixed a potential private key leak through debug logs (bsc#1218909). CVE-2024-20952: Fixed an RSA padding issue and timing side-channel attack against TLS (bsc#1218911). Find the full release notes at: https://mail.openjdk.org/pipermail/jdk-updates-dev/2024-January/029089.html

This update for openconnect fixes the following issues: Update to release 9.12:

Explicitly reject overly long tun device names.

Increase maximum input size from stdin (#579). Ignore 0.0.0.0 as NBNS address (!446, vpnc-scripts#58). Fix stray (null) in URL path after Pulse authentication (4023bd95). Fix config XML parsing mistake that left GlobalProtect ESP non-working in v9.10 (!475).

Fix case sensitivity in GPST header matching (!474).

Update to release 9.10:

Fix external browser authentication with KDE plasma-nm < 5.26.

Always redirect stdout to stderr when spawning external browser. Increase default queue length to 32 packets. Fix receiving multiple packets in one TLS frame, and single packets split across multiple TLS frames, for Array. Handle idiosyncratic variation in search domain separators for all protocols Support region selection field for Pulse authentication Support modified configuration packet from Pulse 9.1R16 servers Allow hidden form fields to be populated or converted to text fields on the command line Support yet another strange way of encoding challenge-based 2FA for GlobalProtect Add --sni option (and corresponding C and Java API functions) to allow domain-fronting connections in censored/filtered network environments Parrot a GlobalProtect server's software version, if present, as the client version (!333) Fix NULL pointer dereference that has left Android builds broken since v8.20 (!389). Fix Fortinet authentication bug where repeated SVPNCOOKIE causes segfaults (#514, !418). Support F5 VPNs which encode authentication forms only in JSON, not in HTML. Support simultaneous IPv6 and Legacy IP ("dual-stack") for Fortinet . Support "FTM-push" token mode for Fortinet VPNs . Send IPv6-compatible version string in Pulse IF/T session establishment Add --no-external-auth option to not advertise external-browser authentication

Many small improvements in server response parsing, and better logging messages and documentation.

Update to release 9.01:

Add support for AnyConnect "Session Token Re-use Anchor Protocol" (STRAP)

Add support for AnyConnect "external browser" SSO mode Bugfix RSA SecurID token decryption and PIN entry forms, broken in v8.20 Support Cisco's multiple-certificate authentication Revert GlobalProtect default route handling change from v8.20 Suppo split-exclude routes for Fortinet

Add webview callback and SAML/SSO support for AnyConnect, GlobalProtect

Update to release 8.20:

Support non-AEAD ciphersuites in DTLSv1.2 with AnyConnect.

Emulated a newer version of GlobalProtect official clients, 5.1.5-8; was 4.0.2-19 Support Juniper login forms containing both password and 2FA token Explicitly disable 3DES and RC4, unless enabled with --allow-insecure-crypto Allow protocols to delay tunnel setup and shutdown (!117) Support for GlobalProtect IPv6 SIGUSR1now causes OpenConnect to log detailed connection information and statistics Allow --servercert to be specified multiple times in order to accept server certificates matching more than one possible fingerprint Demangle default routes sent as split routes by GlobalProtect Support more Juniper login forms, including some SSO forms Restore compatibility with newer Cisco servers, by no longer sending them the X-AnyConnect-Platform header Add support for PPP-based protocols, currently over TLS only. Add support for two PPP-based protocols, F5 with --protocol=f5 and Fortinet with --protocol=fortinet. Add support for Array Networks SSL VPN.

Support TLSv1.3 with TPMv2 EC and RSA keys, add test cases for swtpm and hardware TPM.

Import the latest version of the vpnc-script (bsc#1140772)

This brings a lot of improvements for non-trivial network setups, IPv6 etc

Build with --without-gnutls-version-check

Update to version 8.10:

Install bash completion script to ${datadir}/bash-completion/completions/openconnect.

Improve compatibility of csd-post.sh trojan.

Fix potential buffer overflow with GnuTLS describing local certs (CVE-2020-12823, bsc#1171862, gl#openconnect/openconnect!108).

Introduce subpackage for bash-completion

Update to 8.09:

Add bash completion support.

Give more helpful error in case of Pulse servers asking for TNCC. Sanitize non-canonical Legacy IP network addresses. Fix OpenSSL validation for trusted but invalid certificates (CVE-2020-12105 bsc#1170452). Convert tncc-wrapper.py to Python 3, and include modernized tncc-emulate.py as well. (!91) Disable Nagle's algorithm for TLS sockets, to improve interactivity when tunnel runs over TCP rather than UDP. GlobalProtect: more resilient handling of periodic HIP check and login arguments, and predictable naming of challenge forms.

Work around PKCS#11 tokens which forget to set CKFLOGINREQUIRED.

Update to 8.0.8:

Fix check of pin-sha256: public key hashes to be case sensitive

Don't give non-functioning stderr to CSD trojan scripts.

Fix crash with uninitialised OIDC token.

Update to 8.0.7:

Don't abort Pulse connection when server-provided certificate MD5 doesn't match.

Fix off-by-one in check for bad GnuTLS versions, and add build and run time checks. Don't abort connection if CSD wrapper script returns non-zero (for now). Make --passtos work for protocols that use ESP, in addition to DTLS.

Convert tncc-wrapper.py to Python 3, and include modernized tncc-emulate.py as well.

Remove tncc-wrapper.py script as it is python2 only bsc#1157446

No need to ship hipreport-android.sh as it is intented for android systems only

Update to 8.0.5:

Minor fixes to build on specific platforms

Includes fix for a buffer overflow with chunked HTTP handling (CVE-2019-16239, bsc#1151178)

Use python3 to generate the web data as now it is supported by upstream

Update to 8.0.3:

Fix Cisco DTLSv1.2 support for AES256-GCM-SHA384.

Fix recognition of OTP password fields.

Update to 8.02:

Fix GNU/Hurd build.

Discover vpnc-script in default packaged location on FreeBSD/OpenBSD. Support split-exclude routes for GlobalProtect. Fix GnuTLS builds without libtasn1. Fix DTLS support with OpenSSL 1.1.1+. Add Cisco-compatible DTLSv1.2 support.

Invoke script with reason=attempt-reconnect before doing so.

Update to 8.01:

Clear form submissions (which may include passwords) before freeing (CVE-2018-20319, bsc#1215669).

Allow form responses to be provided on command line. Add support for SSL keys stored in TPM2. Fix ESP rekey when replay protection is disabled. Drop support for GnuTLS older than 3.2.10. Fix --passwd-on-stdin for Windows to not forcibly open console. Fix portability of shell scripts in test suite. Add Google Authenticator TOTP support for Juniper. Add RFC7469 key PIN support for cert hashes. Add protocol method to securely log out the Juniper session. Relax requirements for Juniper hostname packet response to support old gateways. Add API functions to query the supported protocols. Verify ESP sequence numbers and warn even if replay protection is disabled. Add support for PAN GlobalProtect VPN protocol (--protocol=gp). Reorganize listing of command-line options, and include information on supported protocols. SIGTERM cleans up the session similarly to SIGINT. Fix memsets() arguments.

Fix OpenBSD build.

Explicitely enable all the features as needed to stop build if something is missing

This update for cpio fixes the following issues: Fixed cpio not extracting correctly when using --no-absolute-filenames option the security fix for CVE-2023-7207 (bsc#1218571, bsc#1219238)