SUSE-SU-2022:3004-1

Опубликовано: 02 сент. 2022

Источник: suse-cvrf

Описание

Security update for curl

This update for curl fixes the following issues:

CVE-2022-35252: Fixed a potential injection of control characters into cookies, which could be exploited by sister sites to cause a denial of service (bsc#1202593).

Список пакетов

Container bci/bci-init:15.3

libcurl4-7.66.0-150200.4.39.1

Container bci/node:12

libcurl4-7.66.0-150200.4.39.1

Container bci/python:3

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Container ses/7.1/ceph/grafana:latest

libcurl4-7.66.0-150200.4.39.1

Container ses/7.1/ceph/haproxy:latest

libcurl4-7.66.0-150200.4.39.1

Container ses/7.1/ceph/keepalived:latest

libcurl4-7.66.0-150200.4.39.1

Container ses/7.1/ceph/prometheus-alertmanager:latest

libcurl4-7.66.0-150200.4.39.1

Container ses/7.1/ceph/prometheus-node-exporter:latest

libcurl4-7.66.0-150200.4.39.1

Container ses/7.1/ceph/prometheus-server:latest

libcurl4-7.66.0-150200.4.39.1

Container ses/7.1/ceph/prometheus-snmp_notifier:latest

libcurl4-7.66.0-150200.4.39.1

Container ses/7.1/cephcsi/cephcsi:latest

libcurl4-7.66.0-150200.4.39.1

Container ses/7.1/cephcsi/csi-attacher:v4.1.0

libcurl4-7.66.0-150200.4.39.1

Container ses/7.1/cephcsi/csi-node-driver-registrar:v2.7.0

libcurl4-7.66.0-150200.4.39.1

Container ses/7.1/cephcsi/csi-provisioner:v3.4.0

libcurl4-7.66.0-150200.4.39.1

Container ses/7.1/cephcsi/csi-resizer:v1.7.0

libcurl4-7.66.0-150200.4.39.1

Container ses/7.1/cephcsi/csi-snapshotter:v6.2.1

libcurl4-7.66.0-150200.4.39.1

Container ses/7.1/rook/ceph:latest

libcurl4-7.66.0-150200.4.39.1

Container suse/ltss/sle15.3/bci-base:latest

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Container suse/sle-micro-rancher/5.2:latest

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Container suse/sle-micro/5.1/toolbox:latest

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Container suse/sle-micro/5.2/toolbox:latest

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Container suse/sle15:15.2

libcurl4-7.66.0-150200.4.39.1

Container suse/sle15:15.3

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Container trento/trento-db:latest

libcurl4-7.66.0-150200.4.39.1

Container trento/trento-runner:latest

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP2-BYOS-Azure

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP2-BYOS-EC2-HVM

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP2-BYOS-GCE

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP2-HPC-BYOS-Azure

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP2-HPC-BYOS-EC2-HVM

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP2-SAP-Azure

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP2-SAP-Azure-LI-BYOS-Production

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP2-SAP-BYOS-Azure

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP2-SAP-BYOS-EC2-HVM

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP2-SAP-BYOS-GCE

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP2-SAP-EC2-HVM

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP2-SAP-GCE

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP3-BYOS-Azure

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP3-BYOS-EC2-HVM

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP3-BYOS-GCE

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP3-CHOST-BYOS-Aliyun

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP3-CHOST-BYOS-Azure

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP3-CHOST-BYOS-EC2

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP3-CHOST-BYOS-GCE

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP3-CHOST-BYOS-SAP-CCloud

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP3-HPC-BYOS-Azure

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP3-HPC-BYOS-EC2-HVM

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP3-HPC-BYOS-GCE

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP3-Manager-4-2-Proxy-BYOS-Azure

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP3-Manager-4-2-Proxy-BYOS-EC2-HVM

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP3-Manager-4-2-Proxy-BYOS-GCE

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP3-Micro-5-1-BYOS-Azure

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP3-Micro-5-1-BYOS-EC2-HVM

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP3-Micro-5-1-BYOS-GCE

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP3-Micro-5-2-BYOS-Azure

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP3-Micro-5-2-BYOS-EC2-HVM

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP3-Micro-5-2-BYOS-GCE

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP3-SAP-Azure-LI-BYOS-Production

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP3-SAP-BYOS-Azure

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP3-SAP-BYOS-EC2-HVM

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP3-SAP-BYOS-GCE

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Image SLES15-SP3-SAPCAL-Azure

curl-7.66.0-150200.4.39.1

libcurl-devel-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

libcurl4-32bit-7.66.0-150200.4.39.1

Image SLES15-SP3-SAPCAL-EC2-HVM

curl-7.66.0-150200.4.39.1

libcurl-devel-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

libcurl4-32bit-7.66.0-150200.4.39.1

Image SLES15-SP3-SAPCAL-GCE

curl-7.66.0-150200.4.39.1

libcurl-devel-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

libcurl4-32bit-7.66.0-150200.4.39.1

SUSE Linux Enterprise Micro 5.1

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

SUSE Linux Enterprise Micro 5.2

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

SUSE Linux Enterprise Module for Basesystem 15 SP3

curl-7.66.0-150200.4.39.1

libcurl-devel-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

libcurl4-32bit-7.66.0-150200.4.39.1

openSUSE Leap 15.3

curl-7.66.0-150200.4.39.1

libcurl-devel-7.66.0-150200.4.39.1

libcurl-devel-32bit-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

libcurl4-32bit-7.66.0-150200.4.39.1

openSUSE Leap Micro 5.2

curl-7.66.0-150200.4.39.1

libcurl4-7.66.0-150200.4.39.1

Ссылки

https://www.suse.com/support/update/announcement/2022/suse-su-20223004-1/
Link for SUSE-SU-2022:3004-1
https://lists.suse.com/pipermail/sle-security-updates/2022-September/012067.html
E-Mail link for SUSE-SU-2022:3004-1
https://www.suse.com/support/security/rating/
SUSE Security Ratings
https://bugzilla.suse.com/1202593
SUSE Bug 1202593
https://www.suse.com/security/cve/CVE-2022-35252/
SUSE CVE CVE-2022-35252 page

Описание

When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.

Затронутые продукты

Container bci/bci-init:15.3:libcurl4-7.66.0-150200.4.39.1

Container bci/node:12:libcurl4-7.66.0-150200.4.39.1

Container bci/python:3:curl-7.66.0-150200.4.39.1

Container bci/python:3:libcurl4-7.66.0-150200.4.39.1

Ссылки

https://www.suse.com/security/cve/CVE-2022-35252.html
CVE-2022-35252
https://bugzilla.suse.com/1202593
SUSE Bug 1202593

SUSE-SU-2022:3004-1

Описание

Список пакетов

Container bci/bci-init:15.3

Container bci/node:12

Container bci/python:3

Container ses/7.1/ceph/grafana:latest

Container ses/7.1/ceph/haproxy:latest

Container ses/7.1/ceph/keepalived:latest

Container ses/7.1/ceph/prometheus-alertmanager:latest

Container ses/7.1/ceph/prometheus-node-exporter:latest

Container ses/7.1/ceph/prometheus-server:latest

Container ses/7.1/ceph/prometheus-snmp_notifier:latest

Container ses/7.1/cephcsi/cephcsi:latest

Container ses/7.1/cephcsi/csi-attacher:v4.1.0

Container ses/7.1/cephcsi/csi-node-driver-registrar:v2.7.0

Container ses/7.1/cephcsi/csi-provisioner:v3.4.0

Container ses/7.1/cephcsi/csi-resizer:v1.7.0

Container ses/7.1/cephcsi/csi-snapshotter:v6.2.1

Container ses/7.1/rook/ceph:latest

Container suse/ltss/sle15.3/bci-base:latest

Container suse/sle-micro-rancher/5.2:latest

Container suse/sle-micro/5.1/toolbox:latest

Container suse/sle-micro/5.2/toolbox:latest

Container suse/sle15:15.2

Container suse/sle15:15.3

Container trento/trento-db:latest

Container trento/trento-runner:latest

Image SLES15-SP2-BYOS-Azure

Image SLES15-SP2-BYOS-EC2-HVM

Image SLES15-SP2-BYOS-GCE

Image SLES15-SP2-HPC-BYOS-Azure

Image SLES15-SP2-HPC-BYOS-EC2-HVM

Image SLES15-SP2-SAP-Azure

Image SLES15-SP2-SAP-Azure-LI-BYOS-Production

Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production

Image SLES15-SP2-SAP-BYOS-Azure

Image SLES15-SP2-SAP-BYOS-EC2-HVM

Image SLES15-SP2-SAP-BYOS-GCE

Image SLES15-SP2-SAP-EC2-HVM

Image SLES15-SP2-SAP-GCE

Image SLES15-SP3-BYOS-Azure

Image SLES15-SP3-BYOS-EC2-HVM

Image SLES15-SP3-BYOS-GCE

Image SLES15-SP3-CHOST-BYOS-Aliyun

Image SLES15-SP3-CHOST-BYOS-Azure

Image SLES15-SP3-CHOST-BYOS-EC2

Image SLES15-SP3-CHOST-BYOS-GCE

Image SLES15-SP3-CHOST-BYOS-SAP-CCloud

Image SLES15-SP3-HPC-BYOS-Azure

Image SLES15-SP3-HPC-BYOS-EC2-HVM

Image SLES15-SP3-HPC-BYOS-GCE

Image SLES15-SP3-Manager-4-2-Proxy-BYOS-Azure

Image SLES15-SP3-Manager-4-2-Proxy-BYOS-EC2-HVM

Image SLES15-SP3-Manager-4-2-Proxy-BYOS-GCE

Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure

Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM

Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE

Image SLES15-SP3-Micro-5-1-BYOS-Azure

Image SLES15-SP3-Micro-5-1-BYOS-EC2-HVM

Image SLES15-SP3-Micro-5-1-BYOS-GCE

Image SLES15-SP3-Micro-5-2-BYOS-Azure

Image SLES15-SP3-Micro-5-2-BYOS-EC2-HVM

Image SLES15-SP3-Micro-5-2-BYOS-GCE

Image SLES15-SP3-SAP-Azure-LI-BYOS-Production

Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production

Image SLES15-SP3-SAP-BYOS-Azure

Image SLES15-SP3-SAP-BYOS-EC2-HVM

Image SLES15-SP3-SAP-BYOS-GCE

Image SLES15-SP3-SAPCAL-Azure

Image SLES15-SP3-SAPCAL-EC2-HVM

Image SLES15-SP3-SAPCAL-GCE

SUSE Linux Enterprise Micro 5.1

SUSE Linux Enterprise Micro 5.2

SUSE Linux Enterprise Module for Basesystem 15 SP3

openSUSE Leap 15.3

openSUSE Leap Micro 5.2

Ссылки

Уязвимость: CVE-2022-35252

Описание