This update for cpio fixes the following issues: CVE-2023-7207: Fixed path traversal vulnerability (bsc#1218571, bsc#1219238)

This update for wpasupplicant fixes the following issues: CVE-2023-52160: Bypassing WiFi Authentication (bsc#1219975).

This update for lifecycle-data-sle-module-hpc fixes the following issues: Add lifecycle data for slurm versions up to 23.05 (jsc#PED-7897)

This update for timezone fixes the following issues: Update to version 2024a Kazakhstan unifies on UTC+5 Palestine springs forward a week later than previously predicted in 2024 and 2025 Asia/HoChiMinh's 1955-07-01 transition occurred at 01:00 not 00:00 From 1947 through 1949, Toronto's transitions occurred at 02:00 not 00:00 In 1911 Miquelon adopted standard time on June 15, not May 15 The FROM and TO columns of Rule lines can no longer be "minimum" localtime no longer mishandle some timestamps strftime %s now uses tmgmtoff if available Ittoqqortoormiit, Greenland changes time zones on 2024-03-31 Vostok, Antarctica changed time zones on 2023-12-18 Casey, Antarctica changed time zones five times since 2020 Code and data fixes for Palestine timestamps starting in 2072 A new data file zonenow.tab for timestamps starting now Much of Greenland changed its standard time from -03 to -02 on 2023-03-25 localtime.c no longer mishandles TZif files that contain a single transition into a DST regime tzselect no longer creates temporary files tzselect no longer mishandles the following: Spaces and most other special characters in BUGEMAIL, PACKAGE, TZDIR, and VERSION. TZ strings when using mawk 1.4.3, which mishandles regular expressions of the form /X{2,}/ ISO 6709 coordinates when using an awk that lacks the GNU extension of newlines in -v option-arguments Non UTF-8 locales when using an iconv command that lacks the GNU //TRANSLIT extension zic no longer mishandles data for Palestine after the year 2075

This update for gstreamer-plugins-bad fixes the following issues: CVE-2023-44446: Fixed use-after-free remote code execution vulnerability via MXF file (bsc#1217213).

This update for giflib fixes the following issues: Update to version 5.2.2 Fixes for CVE-2023-48161 (bsc#1217390), CVE-2022-28506 (bsc#1198880)

138 Documentation for obsolete utilities still installed

139: Typo in "LZW image data" page ("1102 = 410")

140: Typo in "LZW image data" page ("LWZ")

141: Typo in "Bits and bytes" page ("filed")

Note as already fixed SF issue #143: cannot compile under mingw

144: giflib-5.2.1 cannot be build on windows and other platforms using c89

145: Remove manual pages installation for binaries that are not installed too

146: [PATCH] Limit installed man pages to binaries, move giflib to section 7

147 [PATCH] Fixes to doc/whatsinagif/ content

148: heap Out of Bound Read in gif2rgb.c:298 DumpScreen2RGB

Declared no-info on SF issue #150: There is a denial of service vulnerability in GIFLIB 5.2.1 Declared Won't-fix on SF issue 149: Out of source builds no longer possible

151: A heap-buffer-overflow in gif2rgb.c:294:45

152: Fix some typos on the html documentation and man pages

153: Fix segmentation faults due to non correct checking for args

154: Recover the giffilter manual page

155: Add gifsponge docs

157: An OutofMemory-Exception or Memory Leak in gif2rgb

158: There is a null pointer problem in gif2rgb

159 A heap-buffer-overflow in GIFLIB5.2.1 DumpScreen2RGB() in gif2rgb.c:298:45

163: detected memory leaks in openbsdreallocarray giflib/openbsd-reallocarray.c

164: detected memory leaks in GifMakeMapObject giflib/gifalloc.c

166: a read zero page leads segment fault in getarg.c and memory leaks in gif2rgb.c and gifmalloc.c

167: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function at Line 321 of gif2rgb.c

This update for python39 fixes the following issues: CVE-2023-6597: Fixed symlink bug in cleanup of tempfile.TemporaryDirectory (bsc#1219666). CVE-2023-27043: Fixed incorrect e-mqil parsing (bsc#1210638). CVE-2023-40217: Fixed a ssl.SSLSocket TLS bypass vulnerability where data is sent unencrypted (bsc#1214692). CVE-2022-25236: Fixed an expat vulnerability by supporting expat >= 2.4.4 (bsc#1212015).

This update for apache2-modauthopenidc fixes the following issues: CVE-2024-24814: Fixed a denial of service when using OIDCSessionType client-cookie and manipulating cookies (bsc#1219911).

This update for pesign fixes the following issue: Fix errors when installing pesign alone (bsc#1219198)

This update for nodejs16 fixes the following issues: Security issues fixed: CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997). CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993). CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014). CVE-2024-24758: ignore proxy-authorization header (bsc#1220017). CVE-2024-24806: fix improper domain lookup that potentially leads to SSRF attacks (bsc#1219724).

This update for nodejs14 fixes the following issues: Security issues fixed: CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997). CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993). CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014). CVE-2024-24806: fix improper domain lookup that potentially leads to SSRF attacks (bsc#1219724).

This update for nodejs12 fixes the following issues: Security issues fixed: CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997). CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993). CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014). CVE-2024-24806: fix improper domain lookup that potentially leads to SSRF attacks (bsc#1219724).

This update for Java fixes the following issues: apache-commons-codec was updated to version 1.16.1: Changes in version 1.16.1:

New features:

Added Maven property project.build.outputTimestamp for build reproducibility

Bugs fixed:

Correct error in Base64 Javadoc Added minimum Java version in changes.xml Documentation update for the org.apache.commons.codec.digest. package Precompile regular expression in UnixCrypt.crypt(byte[], String) Fixed possible IndexOutOfBoundException in PhoneticEngine.encode method Fixed possible ArrayIndexOutOfBoundsException in QuotedPrintableCodec.encodeQuotedPrintable() method Fixed possible StringIndexOutOfBoundException in MatchRatingApproachEncoder.encode() method Fixed possible ArrayIndexOutOfBoundException in RefinedSoundex.getMappingCode() Fixed possible IndexOutOfBoundsException in PercentCodec.insertAlwaysEncodeChars() method Deprecated UnixCrypt 0-argument constructor Deprecated Md5Crypt 0-argument constructor Deprecated Crypt 0-argument constructor Deprecated StringUtils 0-argument constructor Deprecated Resources 0-argument constructor Deprecated Charsets 0-argument constructor Deprecated CharEncoding 0-argument constructor

Changes in version 1.16.0:

Remove duplicated words from Javadocs

Use Standard Charset object Use String.contains() functions Avoid use toString() or substring() in favor of a simplified expression Fixed byte-skipping in Base16 decoding Fixed several typos, improve writing in some javadocs BaseNCodecOutputStream.eof() should not throw IOException. Javadoc improvements and cleanups. Deprecated BaseNCodec.isWhiteSpace(byte) and use Character.isWhitespace(int). Added support for Blake3 family of hashes Added github/codeql-action Bump actions/cache from v2 to v3.0.10 Bump actions/setup-java from v1.4.1 to 3.5.1 Bump actions/checkout from 2.3.2 to 3.1.0 Bump commons-parent from 52 to 58 Bump junit from 4.13.1 to 5.9.1 Bump Java 7 to 8. Bump japicmp-maven-plugin from 0.14.3 to 0.17.1. Bump jacoco-maven-plugin from 0.8.5 to 0.8.8 (Fixes Java 15 builds). Bump maven-surefire-plugin from 2.22.2 to 3.0.0-M7 Bump maven-javadoc-plugin from 3.2.0 to 3.4.1. Bump animal-sniffer-maven-plugin from 1.19 to 1.22. Bump maven-pmd-plugin from 3.13.0 to 3.19.0 Bump pmd from 6.47.0 to 6.52.0. Bump maven-checkstyle-plugin from 2.17 to 3.2.0 Bump checkstyle from 8.45.1 to 9.3 Bump taglist-maven-plugin from 2.4 to 3.0.0 Bump jacoco-maven-plugin from 0.8.7 to 0.8.8. apache-commons-compress was updated to version 1.26: Changes in version 1.26:

Security issues fixed:

CVE-2024-26308: Fixed allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress (bsc#1220068) CVE-2024-25710: Fixed loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress (bsc#1220070)

New Features:

Added and use ZipFile.builder(), ZipFile.Builder, and deprecate constructors Added and use SevenZFile.builder(), SevenZFile.Builder, and deprecate constructors Added and use ArchiveInputStream.getCharset() Added and use ArchiveEntry.resolveIn(Path) Added Maven property project.build.outputTimestamp for build reproducibility

Bugs fixed:

Check for invalid PAX values in TarArchiveEntry Fixed zero size headers in ArjInputStream Fixes and tests for ArInputStream Fixes for dump file parsing Improved CPIO exception detection and handling Deprecated SkipShieldingInputStream without replacement (nolonger used) Reuse commons-codec, don't duplicate class PureJavaCrc32C (removed package-private class) Reuse commons-codec, don't duplicate class XXHash32 (deprecated class) Reuse commons-io, don't duplicate class Charsets (deprecated class) Reuse commons-io, don't duplicate class IOUtils (deprecated methods) Reuse commons-io, don't duplicate class BoundedInputStream (deprecated class) Reuse commons-io, don't duplicate class FileTimes (deprecated TimeUtils methods) Reuse Arrays.equals(byte[], byte[]) and deprecate ArchiveUtils.isEqual(byte[], byte[]) Added a null-check for the class loader of OsgiUtils Added a null-check in Pack200.newInstance(String, String) Deprecated ChecksumCalculatingInputStream in favor of java.util.zip.CheckedInputStream Deprecated CRC32VerifyingInputStream.CRC32VerifyingInputStream(InputStream, long, int) FramedSnappyCompressorOutputStream produces incorrect output when writing a large buffer Fixed TAR directory entries being misinterpreted as files Deprecated unused method FileNameUtils.getBaseName(String) Deprecated unused method FileNameUtils.getExtension(String) ArchiveInputStream.BoundedInputStream.read() incorrectly adds 1 for EOF to the bytes read count Deprecated IOUtils.read(File, byte[]) Deprecated IOUtils.copyRange(InputStream, long, OutputStream, int) ZipArchiveOutputStream multi archive updates metadata in incorrect file Deprecated ByteUtils.InputStreamByteSupplier Deprecated ByteUtils.fromLittleEndian(InputStream, int) Deprecated ByteUtils.toLittleEndian(DataOutput, long, int) Reduce duplication by having ArchiveInputStream extend FilterInputStream Support preamble garbage in ZipArchiveInputStream Fixed formatting the lowest expressable DOS time Dropped reflection from ExtraFieldUtils static initialization Preserve exception causation in ExtraFieldUtils.register(Class)

Changes in version 1.25:

For the full list of changes please consult: https://commons.apache.org/proper/commons-compress/changes-report.html#a1.25.0

Changes in version 1.24:

For the full list of changes please consult: https://commons.apache.org/proper/commons-compress/changes-report.html#a1.24.0

Changes in version 1.23:

For the full list of changes please consult: https://commons.apache.org/proper/commons-compress/changes-report.html#a1.23.0

Changes in version 1.22:

For the full list of changes please consult: https://commons.apache.org/proper/commons-compress/changes-report.html#a1.22 apache-commons-io was updated to version 2.15.1: Changes in version 2.15.1:

For the full list of changes please consult: https://commons.apache.org/proper/commons-io/changes-report.html#a2.15.1

Changes in version 2.15.0:

For the full list of changes please consult: https://commons.apache.org/proper/commons-io/changes-report.html#a2.15.0

Changes in version 2.14.0:

For the full list of changes please consult: https://commons.apache.org/proper/commons-io/changes-report.html#a2.14.0 javapackages-meta: Syncing the version with javapackages-tools 6.2.0 Remove unnecessary dependencies maven was updated to version 3.9.6: Changes in version 3.9.6:

Bugs fixed:

Error message when modelVersion is 4.0 is confusing

Improvements:

Colorize transfer messages Support ${project.basedir} in file profile activation Allow to exclude plugins from validation

Tasks:

Maven Resolver Provider classes ctor change Undeprecate wrongly deprecated repository metadata Deprecated org.apache.maven.repository.internal.MavenResolverModule maven-resolver-provider: introduce NAME constants.

Dependency upgrade:

Updated to Resolver 1.9.16 Upgraded Sisu version to 0.9.0.M2 Upgraded Resolver version to 1.9.18 Upgraded to parent POM 41 Upgraded default plugin bindings maven-assembly-plugin: Explicitely require commons-io:commons-io and commons-codec:common-codes artifacts that are optional in apache-commons-compress maven-doxia was updated to version 1.12.0: Changes in version 1.12.0:

Upgraded to FOP 2.2 Fixed rendering links and paragraphs inside tables Rewrite .md and .markdown links to .html Upgraded HttpComponents: httpclient to 4.5.8 and httpcore to 4.4.11 Escape links to xml based figureGraphics image elements SECURITY: Use HTTPS to resolve dependencies in Maven Build Removed old Maven 1 and 2 info Updated commons-lang to 3.8.1 Dropped dependency to outdated Log4j Fixed Java 7 compatibility that was broken Import tests from maven-site-plugin Fixed crosslinks starting with a dot in markdown files Replace deprecated class from commons-lang Fill in some generic types maven-doxia-sitetools was updated to version 1.11.1: Changes in version 1.11.1:

Bugs fixed:

CLIRR can't find previous version

Improvements:

Removed all   in default-site-macros.vm and replace by a space Improved documentation on site.xml inheritance vs interpolation

Tasks:

Deprecated Doxia Sitetools Doc Renderer

Dependency upgrade:

Fixed javadoc issues with JDK 8 when generating documentation Wrong coordinates for jaicore: hyphen should be underscore Use latest JUnit version 4.13.2 Upgraded Plexus Utils to 3.3.0 Upgraded Plexus Interpolation to 1.26 Upgraded Maven Doxia to 1.10 Upgraded Maven Doxia to 1.11.1 maven-jar-plugin was updated to version 3.3.0: Changes in version 3.3.0:

Bugs fixed:

outputTimestamp not applied to module-info; breaks reproducible builds

Task:

Updated plugin (requires Maven 3.2.5+) Java 8 as minimum

Dependency upgrade:

Upgraded Plexus Utils to 3.3.1 Removed override for Plexus Archiver to fix order of META-INF/ and META-INF/MANIFEST.MF entries Upgraded Parent to 36 Updated Plexus Utils to 3.4.2 Upgraded Parent to 37 maven-jar-plugin was updated to version 3.6.0: Changes from version 3.6.0:

Bugs fixed:

Setting maven.javadoc.isoffline seems to have no effect javadoc site is broken for projects that contain modules Alternative doclet page points to an SEO spammy page [REGRESSION] Transitive dependencies of docletArtifact missing Unresolvable link in javadoc tag with value ResourcesBundleMojo#getAttachmentClassifier() found in ResourcesBundleMojo IOException --> NullPointerException in JavadocUtil.copyResource JavadocReportTest.testExceptions is broken javadoc creates invalid --patch-module statements javadoc plugin can not deal with transitive filename based modules

Improvements:

Clean up deprecated and unpreferred methods in JavadocUtil Cleanup dependency declarations as best possible Allow building javadoc "the old fashioned way" after Java 8

Tasks:

Dropped use of deprecated localRepository mojo parameter Make build pass with Java 20 Refresh download page

Dependency upgrade:

Updated to commons-io 2.13.0 Updated plexus-archiver from 4.7.1 to 4.8.0 Upgraded Parent to 40

Changes from version 3.5.0:

Bugs fixed:

Invalid anchors in Javadoc and plugin mojo Plugin duplicates classes in Java 8 all-classes lists javadoc site creation ignores configuration parameters

Improvements:

Deprecated parameter "stylesheet" Parse stderr output and suppress informational lines Link to Javadoc references from JDK 17 Migrate components to JSR 330, get rid of maven-artifact-transfer, update to parent 37

Tasks:

Removed remains of org.codehaus.doxia.sink.Sink

Dependency upgrades:

Upgraded plugins in ITs Upgraded to Maven 3.2.5 Updated Maven Archiver to 3.6.0 Upgraded Maven Reporting API to 3.1.1/Complete with Maven Reporting Impl 3.2.0 Upgraded commons-text to 1.10.0 Upgraded Parent to 39 Upgraded plugins and components maven-reporting-api was updated to version 3.1.1: Restore binary compat for MavenReport maven-reporting-impl was updated to version 3.2.0: Changes in version 3.2.0:

Improvement:

Render with a skin when report is run in standalone mode

Dependency upgrades:

Upgraded Maven Reporting API to 3.1.1 Upgraded plugins and components in project and ITs maven-resolver was updated to version 1.9.18: Changes in version 1.9.18:

Bugs fixed:

Sporadic AccessDeniedEx on Windows Undo FileUtils changes that altered non-Windows execution path

Improvements:

Native transport should retry on HTTP 429 (Retry-After)

Task:

Deprecated Guice modules Get rid of component name string literals, make them constants and reusable Expose configuration for inhibiting Expect-Continue handshake in 1.x Refresh download page Resolver should not override given HTTP transport default use of expect-continue handshake maven-resources-plugin was updated to version 3.3.1: Changes in version 3.3.1:

Bugs fixed:

Resource plugin's handling of symbolic links changed in 3.0.x, broke existing behavior Resource copying not using specified encoding java.nio.charset.MalformedInputException: Input length = 1 Filtering of Maven properties with long names is not working after transition from 2.6 to 3.2.0 Valid location for directory parameter is always required Symlinks cause copying resources to fail FileUtils.copyFile() fails with source file having lastModified = 0

New Features:

Added ability to flatten folder structure into target directory when copying resources

Improvements:

Make tests jar reproducible Describe from and to in "Copying xresources" info message

Task:

Dropped plexus legacy Updated to parent POM 39, reformat sources Updated plugin (requires Maven 3.2.5+) Require Java 8

Dependency upgrade:

Upgraded maven-plugin parent to 36 Upgraded Maven Filtering to 3.3.0 Upgraded plexus-utils to 3.5.1 Upgraded to maven-filtering 3.3.1 sbt: Fixed RPM package build with maven 3.9.6 and maven-resolver 1.9.18 xmvn: Modify the xmvn-install script to work with new apache-commons-compress Recompiling RPM package to resolve package building issues with maven-lib

This update for glib2 fixes the following issues: CVE-2021-28153: Fixed an issue where symlink targets would be incorrectly created as empty files (bsc#1183533).

This update for rabbitmq-c fixes the following issues: CVE-2023-35789: Fixed insecure credentials submission (bsc#1212499).

This update for bind fixes the following issues: CVE-2023-2828: Fixed denial-of-service against recursive resolvers related to cache-cleaning algorithm (bsc#1212544).

This update for openssl-100 fixes the following issues: CVE-2022-4304: Reworked the fix for the Timing-Oracle in RSA decryption. The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case (bsc#1207534).

This update for sccache fixes the following issues: CVE-2023-1521: Fixed possible code injection via LDPRELOAD to sccache server (bsc#1212407). CVE-2022-31394: Fixed a denial-of-service vulnerability via header list size (bsc#1208553).

This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 115.8.0 ESR (MFSA 2024-06) (bsc#1220048): CVE-2024-1546: Out-of-bounds memory read in networking channels CVE-2024-1547: Alert dialog could have been spoofed on another site CVE-2024-1548: Fullscreen Notification could have been hidden by select element CVE-2024-1549: Custom cursor could obscure the permission dialog CVE-2024-1550: Mouse cursor re-positioned unexpectedly could have led to unintended permission grants CVE-2024-1551: Multipart HTTP Responses would accept the Set-Cookie header in response parts CVE-2024-1552: Incorrect code generation on 32-bit ARM devices

CVE-2024-1553: Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8

Recommend libfido2-udev on codestreams that exist, in order to try to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)

This update for openssh fixes the following issues: CVE-2023-51385: Limit the use of shell metacharacters in host- and user names to avoid command injection. (bsc#1218215)

This update for docker fixes the following issues: Vendor latest buildkit v0.11 including bugfixes for the following: CVE-2024-23653: BuildKit API doesn't validate entitlement on container creation (bsc#1219438). CVE-2024-23652: Fixed arbitrary deletion of files (bsc#1219268). CVE-2024-23651: Fixed race condition in mount (bsc#1219267).

This update for mozilla-nss fixes the following issues: Update to NSS 3.90.2: CVE-2023-5388: Fixed timing attack against RSA decryption in TLS (bsc#1216198)

This update for ffmpeg contains the following fixes: Added libavresample3 and libavformat57 to subpackages for Package Hub SLE-15-SP5 (bsc#1205435) Fix RPM package build with new binutils

This update for suseconnect-ng fixes the following issues: Allow SUSEConnect on read write transactional systems (bsc#1219425)

This update for python-base contains the following fixes: Added python-xml to Package Hub SLE-15-SP4 (no source changes) (bsc#1212263, ijsc#MSC-724)

This update for dpdk fixes the following issues: Fixed a regression caused by incomplete fix for CVE-2022-2132 (bsc#1219187).

This update for openvswitch fixes the following issues: CVE-2024-22563: Fixed memory leak via the function xmalloc in /lib/util.c (bsc#1219059).

This update for libssh fixes the following issues: Update to version 0.9.8 (jsc#PED-7719): Fix CVE-2023-6004: Command injection using proxycommand (bsc#1218209) Fix CVE-2023-48795: Potential downgrade attack using strict kex (bsc#1218126) Fix CVE-2023-6918: Missing checks for return values of MD functions (bsc#1218186) Allow @ in usernames when parsing from URI composes Update to version 0.9.7: Fix CVE-2023-1667: a NULL dereference during rekeying with algorithm guessing (bsc#1211188) Fix CVE-2023-2283: a possible authorization bypass in pkiverifydatasignature under low-memory conditions (bsc#1211190) Fix several memory leaks in GSSAPI handling code Update to version 0.9.6 (bsc#1189608, CVE-2021-3634): https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.9.6 Update to 0.9.5 (bsc#1174713, CVE-2020-16135): CVE-2020-16135: Avoid null pointer dereference in sftpserver (T232) Improve handling of library initialization (T222) Fix parsing of subsecond times in SFTP (T219) Make the documentation reproducible Remove deprecated API usage in OpenSSL Fix regression of sshchannelpolltimeout() returning SSHAGAIN Define version in one place (T226) Prevent invalid free when using different C runtimes than OpenSSL (T229) Compatibility improvements to testsuite Update to version 0.9.4 https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/ Fix possible Denial of Service attack when using AES-CTR-ciphers CVE-2020-1730 (bsc#1168699) Update to version 0.9.3 Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution (bsc#1158095) SSH-01-003 Client: Missing NULL check leads to crash in erroneous state SSH-01-006 General: Various unchecked Null-derefs cause DOS SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys SSH-01-010 SSH: Deprecated hash function in fingerprinting SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access SSH-01-001 State Machine: Initial machine states should be set explicitly SSH-01-002 Kex: Differently bound macros used to iterate same array SSH-01-005 Code-Quality: Integer sign confusion during assignments SSH-01-008 SCP: Protocol Injection via unescaped File Names SSH-01-009 SSH: Update documentation which RFCs are implemented SSH-01-012 PKI: Information leak via uninitialized stack buffer Update to version 0.9.2 Fixed libssh-config.cmake Fixed issues with rsa algorithm negotiation (T191) Fixed detection of OpenSSL ed25519 support (T197) Update to version 0.9.1 Added support for Ed25519 via OpenSSL Added support for X25519 via OpenSSL Added support for localuser in Match keyword Fixed Match keyword to be case sensitive Fixed compilation with LibreSSL Fixed error report of channel open (T75) Fixed sftp documentation (T137) Fixed knownhosts parsing (T156) Fixed build issue with MinGW (T157) Fixed build with gcc 9 (T164) Fixed deprecation issues (T165)

Fixed knownhosts directory creation (T166)

Split out configuration to separate package to not mess up the library packaging and coinstallation Update to verion 0.9.0 Added support for AES-GCM Added improved rekeying support Added performance improvements Disabled blowfish support by default Fixed several ssh config parsing issues Added support for DH Group Exchange KEX Added support for Encrypt-then-MAC mode Added support for parsing server side configuration file Added support for ECDSA/Ed25519 certificates Added FIPS 140-2 compatibility Improved knownhosts parsing Improved documentation

Improved OpenSSL API usage for KEX, DH, and signatures

Add libssh client and server config files

This update for postgresql13 fixes the following issues: Upgrade to 13.14: CVE-2024-0985: Tighten security restrictions within REFRESH MATERIALIZED VIEW CONCURRENTLY (bsc#1219679).

This update for postgresql12 fixes the following issues: Upgrade to 12.18: CVE-2024-0985: Tighten security restrictions within REFRESH MATERIALIZED VIEW CONCURRENTLY (bsc#1219679).