Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2020:1296-1

Опубликовано: 18 мая 2020
Источник: suse-cvrf

Описание

Security update for autoyast2

This update for autoyast2 to version 4.1.15 fixes the following issues:

Security issue fixed:

  • CVE-2019-18905: Removed all '--gpg-auto-import-keys' options from zypper commands (bsc#1140711).

Non-security issue fixed:

  • Fix desktop files updating some icons and groups (bsc#1168123).
  • Restored some missing icons (bsc#1168123, bsc#1109310 and bsc#1168281).
  • Service for init scripts: Try to start 'network-online.target' before starting the autoyast init scripts in order to get a working network (bsc#1164105).
  • Always re-probe storage after pre-scripts (bsc#1170082, bsc#1133045).

Список пакетов

Image SLES15-SP1-Azure-BYOS
autoyast2-installation-4.1.15-3.13.1
Image SLES15-SP1-Azure-HPC-BYOS
autoyast2-installation-4.1.15-3.13.1
Image SLES15-SP1-EC2-HPC-HVM-BYOS
autoyast2-installation-4.1.15-3.13.1
Image SLES15-SP1-EC2-HVM-BYOS
autoyast2-installation-4.1.15-3.13.1
Image SLES15-SP1-GCE-BYOS
autoyast2-installation-4.1.15-3.13.1
Image SLES15-SP1-Manager-4-0-Azure-BYOS-Proxy
autoyast2-installation-4.1.15-3.13.1
Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server
autoyast2-installation-4.1.15-3.13.1
Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Proxy
autoyast2-installation-4.1.15-3.13.1
Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server
autoyast2-installation-4.1.15-3.13.1
Image SLES15-SP1-Manager-4-0-GCE-BYOS-Proxy
autoyast2-installation-4.1.15-3.13.1
Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server
autoyast2-installation-4.1.15-3.13.1
Image SLES15-SP1-OCI-BYOS
autoyast2-installation-4.1.15-3.13.1
Image SLES15-SP1-SAP-Azure
autoyast2-installation-4.1.15-3.13.1
Image SLES15-SP1-SAP-Azure-BYOS
autoyast2-installation-4.1.15-3.13.1
Image SLES15-SP1-SAP-Azure-LI-BYOS-Production
autoyast2-4.1.15-3.13.1
autoyast2-installation-4.1.15-3.13.1
Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production
autoyast2-4.1.15-3.13.1
autoyast2-installation-4.1.15-3.13.1
Image SLES15-SP1-SAP-EC2-HVM
autoyast2-installation-4.1.15-3.13.1
Image SLES15-SP1-SAP-EC2-HVM-BYOS
autoyast2-installation-4.1.15-3.13.1
Image SLES15-SP1-SAP-GCE
autoyast2-installation-4.1.15-3.13.1
Image SLES15-SP1-SAP-GCE-BYOS
autoyast2-installation-4.1.15-3.13.1
Image SLES15-SP1-SAP-OCI-BYOS
autoyast2-installation-4.1.15-3.13.1
Image SLES15-SP1-SAPCAL-Azure
autoyast2-installation-4.1.15-3.13.1
Image SLES15-SP1-SAPCAL-EC2-HVM
autoyast2-installation-4.1.15-3.13.1
Image SLES15-SP1-SAPCAL-GCE
autoyast2-installation-4.1.15-3.13.1
SUSE Linux Enterprise Module for Basesystem 15 SP1
autoyast2-4.1.15-3.13.1
autoyast2-installation-4.1.15-3.13.1

Ссылки

Описание

A Insufficient Verification of Data Authenticity vulnerability in autoyast2 of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows remote attackers to MITM connections when deprecated and unused functionality of autoyast is used to create images. This issue affects: SUSE Linux Enterprise Server 12 autoyast2 version 4.1.9-3.9.1 and prior versions. SUSE Linux Enterprise Server 15 autoyast2 version 4.0.70-3.20.1 and prior versions.

Затронутые продукты
Image SLES15-SP1-Azure-BYOS:autoyast2-installation-4.1.15-3.13.1
Image SLES15-SP1-Azure-HPC-BYOS:autoyast2-installation-4.1.15-3.13.1
Image SLES15-SP1-EC2-HPC-HVM-BYOS:autoyast2-installation-4.1.15-3.13.1
Image SLES15-SP1-EC2-HVM-BYOS:autoyast2-installation-4.1.15-3.13.1
Ссылки