This update for google-cloud-sap-agent contain the following fixes: Update to version 3.0 (bsc#1218736, bsc#1218737) Suppress packemaker command error to debug to avoid log flooding Expand load balancing cluster discovery. Log success messages in OTEs to STDOUT instead of STDERR used by log.Print Use bash always to avoid variation of behavior across OS/Shell types Minor updates to installbackint. Backint compose step properly saves metadata. Fix issue with discovery on ASCS instances. hanadiskrestore - fix the format of disktype string for disk create API Fix issue with PCS cluster address discovery. Update transform to insight Rename HANA backup/restore OTEs to reflect they are supported for all disks and not just persistent disk Increase the timeout for HDB stop to account for busy DBs Adding project sap-ecs-testing to the list. PD Restore - Support provisioned-iops and provisioned-throughput Integration test for configure OTE Added precondition in hana pd backup for stripped LVM Add a precondition check to verify user has passed a valid snapshot name that is present in the current project Update the usage to reflect additional required param Minor path update for supportbundle OTE. Fixing bug in slow moving metrics partial collection scenarios Adding check for agent status after restart. Ensure Backint ComposeChunks has a valid bucket handle Discover whether a Netweaver instance is ABAP or Java Replace standard slices package with third party version WLM HANA metric hainsamezone now reports instance names for HA nodes in the same zone Fix data race condition for Backint Backup with new client connections Make -new-disk-name a required parameter to avoid the 63 char limit in the name length due to auto-generated names Fix command for collecting Corosync metric twonoderuntime Make snapshot name similar to disk name Bump golang.org/x/crypto from 0.15.0 to 0.17.0 Enable Discovery config flag controls submission to Data Warehouse and Cloud Logging Create new clients for each operation in Backint Add clientendpoint to Backint proto. Getting the build number into the version for display Backint config name change: serviceaccount to serviceaccountkey Add HANA HA metrics to collection definition. Fix sorting bug in a diff in appsdiscoverytest.go Add discoverHANATenantDBs to main code path Change PIPE filemode to WRONLY to allow us to detect broken pipes Deprecate sapsystemdiscovery config field in favor of enablediscovery Move the validation of whether user passed correct PD, before stopping HANA Add a placeholder for public doc link with next steps after hanapdrestore workflow has completed Fix executable path for HDB version command Add optional param new-disk-name to hanapdrestore for users that wish to override the default Sort the skipmetrics in unit test to avoid order related flakes Generalizing configure OTE Discover Netweaver kernel version Fix Sprintf call Use SAP System data to determine if HANA HA nodes share the same zone. hanapdrestore - do not delete PDs in case of failures Create discoverHANATenantDBs method to support multiple SIDs for HANA tenant DBs Send additional fields in Data Warehouse WriteInsightRequest Updating the username parameters for hana pd backup and restore Retrieve Reliability data every 2 hours instead of 24 Discover HANA version Fix import for GitHub build Add instance properties, and topology information to system data Keep the device nam and disk name same after restore Move sapdiscovery package into system package Changer the default name of the disk created by restore workflow Updates the generated protobuf go for system.proto Update generated system proto Update go.yml Add topology and instance properties info to SAP System data Add a check to verify the disk is attached to instance, fail if disk is not attached Add application and database software properties to system representation Fix race condition in heartbeat test case Add error handling to restore workflow to try and keep the HANA system in a clean state on failures Enable LogToCloud by default for both OTE and Daemon modes Bump Agent version to 3.0 Reliability OTE added to SAP Agent Declare public Get interface for SAP System discovery data Integration testing for Networkstats Package Adding project sap-ecs-testing to the list Adding one time execution for enabling/disabling of features Change to using custom retries for initial bucket connection Default collection definition to be fetched from GCS Add a 2 minute context timeout for initial bucket connection Add collectionconfigversion as a WLM system metric Make project, host param optional for hanapdbackup, in addition make user param optional for hanapdrestore Fix potential nil dereference WLM metrics collection Add force-stop-hana to restore workflow to forcefully stop HANA when the param is passed Rename the HANA PD snapshot and restore workflows Add unit tests for GetProvisionIOps and GetProvisionedThoughput Remove the TestCollect unit test which relies on nc command which can be flaky in unit tests Increase Backint timeout for PIPE files to 3 minutes Add XFS freeze and unfreeze to PD based snapshot

This update for sudo fixes the following issues: NOTE: This update has been retracted, as some logic was not changed correctly. CVE-2023-42465: Try to make sudo less vulnerable to ROWHAMMER attacks (bsc#1219026).

This update for boost-legacy fixes the following issue: Exclude boost-legacy from provide generator (bsc#1216876)

This update for python310 fixes the following issues: CVE-2023-6597: Fixed symlink bug in cleanup of tempfile.TemporaryDirectory (bsc#1219666).

This update for go1.21 fixes the following issues: Upgrade go to version 1.21.8 CVE-2023-45289: net/http, net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect (bsc#1221000) CVE-2023-45290: net/http: memory exhaustion in Request.ParseMultipartForm (bsc#1221001) CVE-2024-24783: crypto/x509: Verify panics on certificates with an unknown public key algorithm (bsc#1220999) CVE-2024-24784: net/mail: comments in display names are incorrectly handled (bsc#1221002) CVE-2024-24785: html/template: errors returned from MarshalJSON methods may break template escaping (bsc#1221003)

This update for go1.22 fixes the following issues: Upgrade go to version 1.22.1 CVE-2023-45289: net/http, net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect (bsc#1221000) CVE-2023-45290: net/http: memory exhaustion in Request.ParseMultipartForm (bsc#1221001) CVE-2024-24783: crypto/x509: Verify panics on certificates with an unknown public key algorithm (bsc#1220999) CVE-2024-24784: net/mail: comments in display names are incorrectly handled (bsc#1221002) CVE-2024-24785: html/template: errors returned from MarshalJSON methods may break template escaping (bsc#1221003)

This update for go1.20 fixes the following issues: go1.20.14 (released 2024-02-06) includes fixes to the crypto/x509 package. (bsc#1206346 go1.20 release tracking) go#64760 staticlockranking builders failing on release branches on LUCI go#65322 crypto: rollback BoringCrypto fips-20220613 update go#65379 crypto/x509: TestIssue51759 consistently failing on gotip-darwin-amd6410.15 LUCI builder

This update for timezone fixes the following issues: Update to version 2024a Kazakhstan unifies on UTC+5 Palestine springs forward a week later than previously predicted in 2024 and 2025 Asia/HoChiMinh's 1955-07-01 transition occurred at 01:00 not 00:00 From 1947 through 1949, Toronto's transitions occurred at 02:00 not 00:00 In 1911 Miquelon adopted standard time on June 15, not May 15 The FROM and TO columns of Rule lines can no longer be "minimum" localtime no longer mishandle some timestamps strftime %s now uses tmgmtoff if available Ittoqqortoormiit, Greenland changes time zones on 2024-03-31 Vostok, Antarctica changed time zones on 2023-12-18 Casey, Antarctica changed time zones five times since 2020 Code and data fixes for Palestine timestamps starting in 2072 A new data file zonenow.tab for timestamps starting now Much of Greenland changed its standard time from -03 to -02 on 2023-03-25 localtime.c no longer mishandles TZif files that contain a single transition into a DST regime tzselect no longer creates temporary files tzselect no longer mishandles the following: Spaces and most other special characters in BUGEMAIL, PACKAGE, TZDIR, and VERSION. TZ strings when using mawk 1.4.3, which mishandles regular expressions of the form /X{2,}/ ISO 6709 coordinates when using an awk that lacks the GNU extension of newlines in -v option-arguments Non UTF-8 locales when using an iconv command that lacks the GNU //TRANSLIT extension zic no longer mishandles data for Palestine after the year 2075

This update for giflib fixes the following issues: Update to version 5.2.2 Fixes for CVE-2023-48161 (bsc#1217390), CVE-2022-28506 (bsc#1198880)

138 Documentation for obsolete utilities still installed

139: Typo in "LZW image data" page ("1102 = 410")

140: Typo in "LZW image data" page ("LWZ")

141: Typo in "Bits and bytes" page ("filed")

Note as already fixed SF issue #143: cannot compile under mingw

144: giflib-5.2.1 cannot be build on windows and other platforms using c89

145: Remove manual pages installation for binaries that are not installed too

146: [PATCH] Limit installed man pages to binaries, move giflib to section 7

147 [PATCH] Fixes to doc/whatsinagif/ content

148: heap Out of Bound Read in gif2rgb.c:298 DumpScreen2RGB

Declared no-info on SF issue #150: There is a denial of service vulnerability in GIFLIB 5.2.1 Declared Won't-fix on SF issue 149: Out of source builds no longer possible

151: A heap-buffer-overflow in gif2rgb.c:294:45

152: Fix some typos on the html documentation and man pages

153: Fix segmentation faults due to non correct checking for args

154: Recover the giffilter manual page

155: Add gifsponge docs

157: An OutofMemory-Exception or Memory Leak in gif2rgb

158: There is a null pointer problem in gif2rgb

159 A heap-buffer-overflow in GIFLIB5.2.1 DumpScreen2RGB() in gif2rgb.c:298:45

163: detected memory leaks in openbsdreallocarray giflib/openbsd-reallocarray.c

164: detected memory leaks in GifMakeMapObject giflib/gifalloc.c

166: a read zero page leads segment fault in getarg.c and memory leaks in gif2rgb.c and gifmalloc.c

167: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function at Line 321 of gif2rgb.c

This update for cmake fixes the following issue: Detect PSP interpreter (jsc#PED-68)

This update for python39 fixes the following issues: CVE-2023-6597: Fixed symlink bug in cleanup of tempfile.TemporaryDirectory (bsc#1219666). CVE-2023-27043: Fixed incorrect e-mqil parsing (bsc#1210638). CVE-2023-40217: Fixed a ssl.SSLSocket TLS bypass vulnerability where data is sent unencrypted (bsc#1214692). CVE-2022-25236: Fixed an expat vulnerability by supporting expat >= 2.4.4 (bsc#1212015).

This update for python311 fixes the following issues: CVE-2023-6597: Fixed symlink bug in cleanup of tempfile.TemporaryDirectory (bsc#1219666). CVE-2023-27043: Fixed incorrect e-mqil parsing (bsc#1210638). CVE-2022-25236: Fixed an expat vulnerability by supporting expat >= 2.4.4 (bsc#1212015).

This update for python-cryptography fixes the following issues: CVE-2024-26130: Fixed NULL pointer dereference in pkcs12.serializekeyandcertificates() (bsc#1220210).

This update for rubygem-rack fixes the following issues: CVE-2024-25126: Fixed a denial-of-service vulnerability in Rack Content-Type parsing (bsc#1220239). CVE-2024-26141: Fixed a denial-of-service vulnerability in Range request header parsing (bsc#1220242). CVE-2024-26146: Fixed a denial-of-service vulnerability in Rack headers parsing routine (bsc#1220248).

This update for libssh fixes the following issues: Fix regression parsing IPv6 addresses provided as hostname (bsc#1220385)

This update for apache2-modauthopenidc fixes the following issues: CVE-2024-24814: Fixed a denial of service when using OIDCSessionType client-cookie and manipulating cookies (bsc#1219911).

This update for sendmail fixes the following issues: CVE-2023-51765: Fixed new SMTP smuggling attack. (bsc#1218351)

This update for nodejs18 fixes the following issues: Update to 18.19.1: (security updates) CVE-2024-21892: Code injection and privilege escalation through Linux capabilities (bsc#1219992). CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993). CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997). CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014). CVE-2024-24758: undici version 5.28.3 (bsc#1220017). CVE-2024-24806: libuv version 1.48.0 (bsc#1219724). Update to LTS version 18.19.0 deps: npm updates to 10.x esm: Leverage loaders when resolving subsequent loaders import.meta.resolve unflagged --experimental-default-type flag to flip module defaults

This update for go1.21 fixes the following issues: go1.21.7 (released 2024-02-06) includes fixes to the compiler, the go command, the runtime, and the crypto/x509 package. (bsc#1212475 go1.21 release tracking) go#63209 runtime: "fatal: morestack on g0" on amd64 after upgrade to Go 1.21 go#63768 runtime: pinner.Pin doesn't panic when it says it will go#64497 cmd/go: flag modcacherw does not take effect in the target package go#64761 staticlockranking builders failing on release branches on LUCI go#64935 runtime: "traceback: unexpected SPWRITE function runtime.systemstack" go#65023 x/tools/go/analysis/unitchecker,slices: TestVetStdlib failing due to vet errors in panic tests go#65053 cmd/compile: //go:build file version ignored when calling generic fn which has related type params go#65323 crypto: rollback BoringCrypto fips-20220613 update go#65351 cmd/go: go generate fails silently when run on a package in a nested workspace module go#65380 crypto/x509: TestIssue51759 consistently failing on gotip-darwin-amd6410.15 LUCI builder go#65449 runtime/trace: frame pointer unwinding crash on arm64 during async preemption

This update for libindicator7, libdbusmenu-gtk4 fixes the following issues: Add missing packages to Package Hub 15 SP5 (bsc#1219244, jsc#MSC-751)

This update for nftables fixes the following issues: Enable python311 module (bsc#1219253).

This update for gcc7 fixes the following issues: Add support for -fmin-function-alignment. [bsc#1214934] Use %{targetcpu} to determine host and build.

This update for product-builder fixes the following issue: PowerPC: no more -part partitions (bsc#1206021)

This update for freerdp fixes the following issues: CVE-2024-22211: Fixed am integer overflow in freerdpbitmapplanarcontextreset() (bsc#1219049).

This update for python311 fixes the following issues: python was updated to version 3.11.4: CVE-2023-24329: Fixed blocklist bypass via the urllib.parse component when supplying a URL that starts with blank characters (bsc#1208471). CVE-2007-4559: Fixed python tarfile module directory traversal (bsc#1203750). Fixed a security in flaw in uu.decode() that could allow for directory traversal based on the input if no outfile was specified. Do not expose the local on-disk location in directory indexes produced by http.client.SimpleHTTPRequestHandler. Bugfixes: trace.main now uses io.opencode() for files to be executed instead of raw open().

This update for gnutls fixes the following issues: CVE-2024-0567: Fixed an incorrect rejection of certificate chains with distributed trust (bsc#1218862). CVE-2024-0553: Fixed a timing attack against the RSA-PSK key exchange, which could lead to the leakage of sensitive data (bsc#1218865).

This update for rabbitmq-c fixes the following issues: CVE-2023-35789: Fixed insecure credentials submission (bsc#1212499).

This update for openssl-100 fixes the following issues: CVE-2022-4304: Reworked the fix for the Timing-Oracle in RSA decryption. The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case (bsc#1207534).

This update for rpm fixes the following issues: backport lua support for rpm.execute to ease migrating from SLE Micro 5.5 to 6.0 (bsc#1216752)

This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 115.8.0 ESR (MFSA 2024-06) (bsc#1220048): CVE-2024-1546: Out-of-bounds memory read in networking channels CVE-2024-1547: Alert dialog could have been spoofed on another site CVE-2024-1548: Fullscreen Notification could have been hidden by select element CVE-2024-1549: Custom cursor could obscure the permission dialog CVE-2024-1550: Mouse cursor re-positioned unexpectedly could have led to unintended permission grants CVE-2024-1551: Multipart HTTP Responses would accept the Set-Cookie header in response parts CVE-2024-1552: Incorrect code generation on 32-bit ARM devices

CVE-2024-1553: Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8

Recommend libfido2-udev on codestreams that exist, in order to try to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)