SUSE-SU-2023:2227-1

Опубликовано: 17 мая 2023

Источник: suse-cvrf

Описание

Security update for curl

This update for curl fixes the following issues:

CVE-2023-28320: Fixed siglongjmp race condition (bsc#1211231).
CVE-2023-28321: Fixed IDN wildcard matching (bsc#1211232).
CVE-2023-28322: Fixed POST-after-PUT confusion (bsc#1211233).

Список пакетов

Container ses/7.1/ceph/grafana:latest

libcurl4-7.66.0-150200.4.57.1

Container ses/7.1/ceph/haproxy:latest

libcurl4-7.66.0-150200.4.57.1

Container ses/7.1/ceph/keepalived:latest

libcurl4-7.66.0-150200.4.57.1

Container ses/7.1/ceph/prometheus-alertmanager:latest

libcurl4-7.66.0-150200.4.57.1

Container ses/7.1/ceph/prometheus-node-exporter:latest

libcurl4-7.66.0-150200.4.57.1

Container ses/7.1/ceph/prometheus-server:latest

libcurl4-7.66.0-150200.4.57.1

Container ses/7.1/ceph/prometheus-snmp_notifier:latest

libcurl4-7.66.0-150200.4.57.1

Container ses/7.1/cephcsi/cephcsi:latest

libcurl4-7.66.0-150200.4.57.1

Container ses/7.1/cephcsi/csi-attacher:v4.1.0

libcurl4-7.66.0-150200.4.57.1

Container ses/7.1/cephcsi/csi-node-driver-registrar:v2.7.0

libcurl4-7.66.0-150200.4.57.1

Container ses/7.1/cephcsi/csi-provisioner:v3.4.0

libcurl4-7.66.0-150200.4.57.1

Container ses/7.1/cephcsi/csi-resizer:v1.7.0

libcurl4-7.66.0-150200.4.57.1

Container ses/7.1/cephcsi/csi-snapshotter:v6.2.1

libcurl4-7.66.0-150200.4.57.1

Container ses/7.1/rook/ceph:latest

libcurl4-7.66.0-150200.4.57.1

Container suse/ltss/sle15.3/bci-base:latest

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Container suse/sle-micro-rancher/5.2:latest

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Container suse/sle-micro/5.1/toolbox:latest

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Container suse/sle-micro/5.2/toolbox:latest

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Container suse/sle15:15.2

libcurl4-7.66.0-150200.4.57.1

Container suse/sle15:15.3

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP2-BYOS-Azure

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP2-HPC-BYOS-Azure

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP2-SAP-Azure

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP2-SAP-Azure-LI-BYOS-Production

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP2-SAP-BYOS-Azure

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP2-SAP-BYOS-EC2-HVM

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP2-SAP-BYOS-GCE

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP2-SAP-EC2-HVM

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP2-SAP-GCE

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP3-BYOS-Azure

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP3-BYOS-EC2-HVM

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP3-BYOS-GCE

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP3-CHOST-BYOS-Aliyun

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP3-CHOST-BYOS-Azure

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP3-CHOST-BYOS-EC2

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP3-CHOST-BYOS-GCE

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP3-CHOST-BYOS-SAP-CCloud

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP3-HPC-BYOS-Azure

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP3-HPC-BYOS-EC2-HVM

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP3-HPC-BYOS-GCE

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP3-Manager-4-2-Proxy-BYOS-Azure

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP3-Manager-4-2-Proxy-BYOS-EC2-HVM

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP3-Manager-4-2-Proxy-BYOS-GCE

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP3-Micro-5-1-BYOS-Azure

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP3-Micro-5-1-BYOS-EC2-HVM

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP3-Micro-5-1-BYOS-GCE

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP3-Micro-5-2-BYOS-Azure

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP3-Micro-5-2-BYOS-EC2-HVM

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP3-Micro-5-2-BYOS-GCE

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP3-SAP-Azure-LI-BYOS-Production

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP3-SAP-BYOS-Azure

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP3-SAP-BYOS-EC2-HVM

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP3-SAP-BYOS-GCE

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

Image SLES15-SP3-SAPCAL-Azure

curl-7.66.0-150200.4.57.1

libcurl-devel-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

libcurl4-32bit-7.66.0-150200.4.57.1

Image SLES15-SP3-SAPCAL-EC2-HVM

curl-7.66.0-150200.4.57.1

libcurl-devel-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

libcurl4-32bit-7.66.0-150200.4.57.1

Image SLES15-SP3-SAPCAL-GCE

curl-7.66.0-150200.4.57.1

libcurl-devel-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

libcurl4-32bit-7.66.0-150200.4.57.1

SUSE Enterprise Storage 7

curl-7.66.0-150200.4.57.1

libcurl-devel-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

libcurl4-32bit-7.66.0-150200.4.57.1

SUSE Enterprise Storage 7.1

curl-7.66.0-150200.4.57.1

libcurl-devel-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

libcurl4-32bit-7.66.0-150200.4.57.1

SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS

curl-7.66.0-150200.4.57.1

libcurl-devel-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

libcurl4-32bit-7.66.0-150200.4.57.1

SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS

curl-7.66.0-150200.4.57.1

libcurl-devel-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

libcurl4-32bit-7.66.0-150200.4.57.1

SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

curl-7.66.0-150200.4.57.1

libcurl-devel-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

libcurl4-32bit-7.66.0-150200.4.57.1

SUSE Linux Enterprise Micro 5.1

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

SUSE Linux Enterprise Micro 5.2

curl-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

SUSE Linux Enterprise Real Time 15 SP3

curl-7.66.0-150200.4.57.1

libcurl-devel-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

libcurl4-32bit-7.66.0-150200.4.57.1

SUSE Linux Enterprise Server 15 SP2-LTSS

curl-7.66.0-150200.4.57.1

libcurl-devel-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

libcurl4-32bit-7.66.0-150200.4.57.1

SUSE Linux Enterprise Server 15 SP3-LTSS

curl-7.66.0-150200.4.57.1

libcurl-devel-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

libcurl4-32bit-7.66.0-150200.4.57.1

SUSE Linux Enterprise Server for SAP Applications 15 SP2

curl-7.66.0-150200.4.57.1

libcurl-devel-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

libcurl4-32bit-7.66.0-150200.4.57.1

SUSE Linux Enterprise Server for SAP Applications 15 SP3

curl-7.66.0-150200.4.57.1

libcurl-devel-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

libcurl4-32bit-7.66.0-150200.4.57.1

SUSE Manager Proxy 4.2

curl-7.66.0-150200.4.57.1

libcurl-devel-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

libcurl4-32bit-7.66.0-150200.4.57.1

SUSE Manager Server 4.2

curl-7.66.0-150200.4.57.1

libcurl-devel-7.66.0-150200.4.57.1

libcurl4-7.66.0-150200.4.57.1

libcurl4-32bit-7.66.0-150200.4.57.1

Ссылки

https://www.suse.com/support/update/announcement/2023/suse-su-20232227-1/
Link for SUSE-SU-2023:2227-1
https://lists.suse.com/pipermail/sle-updates/2023-May/029438.html
E-Mail link for SUSE-SU-2023:2227-1
https://www.suse.com/support/security/rating/
SUSE Security Ratings
https://bugzilla.suse.com/1211231
SUSE Bug 1211231
https://bugzilla.suse.com/1211232
SUSE Bug 1211232
https://bugzilla.suse.com/1211233
SUSE Bug 1211233
https://bugzilla.suse.com/1211339
SUSE Bug 1211339
https://www.suse.com/security/cve/CVE-2023-28320/
SUSE CVE CVE-2023-28320 page
https://www.suse.com/security/cve/CVE-2023-28321/
SUSE CVE CVE-2023-28321 page
https://www.suse.com/security/cve/CVE-2023-28322/
SUSE CVE CVE-2023-28322 page

Описание

A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.

Затронутые продукты

Container ses/7.1/ceph/grafana:latest:libcurl4-7.66.0-150200.4.57.1

Container ses/7.1/ceph/haproxy:latest:libcurl4-7.66.0-150200.4.57.1

Container ses/7.1/ceph/keepalived:latest:libcurl4-7.66.0-150200.4.57.1

Container ses/7.1/ceph/prometheus-alertmanager:latest:libcurl4-7.66.0-150200.4.57.1

Ссылки

https://www.suse.com/security/cve/CVE-2023-28320.html
CVE-2023-28320
https://bugzilla.suse.com/1211231
SUSE Bug 1211231
https://bugzilla.suse.com/1218210
SUSE Bug 1218210

Описание

An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`.

Затронутые продукты

Container ses/7.1/ceph/grafana:latest:libcurl4-7.66.0-150200.4.57.1

Container ses/7.1/ceph/haproxy:latest:libcurl4-7.66.0-150200.4.57.1

Container ses/7.1/ceph/keepalived:latest:libcurl4-7.66.0-150200.4.57.1

Container ses/7.1/ceph/prometheus-alertmanager:latest:libcurl4-7.66.0-150200.4.57.1

Ссылки

https://www.suse.com/security/cve/CVE-2023-28321.html
CVE-2023-28321
https://bugzilla.suse.com/1211232
SUSE Bug 1211232
https://bugzilla.suse.com/1218210
SUSE Bug 1218210

Описание

An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.

Затронутые продукты

Container ses/7.1/ceph/grafana:latest:libcurl4-7.66.0-150200.4.57.1

Container ses/7.1/ceph/haproxy:latest:libcurl4-7.66.0-150200.4.57.1

Container ses/7.1/ceph/keepalived:latest:libcurl4-7.66.0-150200.4.57.1

Container ses/7.1/ceph/prometheus-alertmanager:latest:libcurl4-7.66.0-150200.4.57.1

Ссылки

https://www.suse.com/security/cve/CVE-2023-28322.html
CVE-2023-28322
https://bugzilla.suse.com/1211233
SUSE Bug 1211233

SUSE-SU-2023:2227-1

Описание

Список пакетов

Container ses/7.1/ceph/grafana:latest

Container ses/7.1/ceph/haproxy:latest

Container ses/7.1/ceph/keepalived:latest

Container ses/7.1/ceph/prometheus-alertmanager:latest

Container ses/7.1/ceph/prometheus-node-exporter:latest

Container ses/7.1/ceph/prometheus-server:latest

Container ses/7.1/ceph/prometheus-snmp_notifier:latest

Container ses/7.1/cephcsi/cephcsi:latest

Container ses/7.1/cephcsi/csi-attacher:v4.1.0

Container ses/7.1/cephcsi/csi-node-driver-registrar:v2.7.0

Container ses/7.1/cephcsi/csi-provisioner:v3.4.0

Container ses/7.1/cephcsi/csi-resizer:v1.7.0

Container ses/7.1/cephcsi/csi-snapshotter:v6.2.1

Container ses/7.1/rook/ceph:latest

Container suse/ltss/sle15.3/bci-base:latest

Container suse/sle-micro-rancher/5.2:latest

Container suse/sle-micro/5.1/toolbox:latest

Container suse/sle-micro/5.2/toolbox:latest

Container suse/sle15:15.2

Container suse/sle15:15.3

Image SLES15-SP2-BYOS-Azure

Image SLES15-SP2-HPC-BYOS-Azure

Image SLES15-SP2-SAP-Azure

Image SLES15-SP2-SAP-Azure-LI-BYOS-Production

Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production

Image SLES15-SP2-SAP-BYOS-Azure

Image SLES15-SP2-SAP-BYOS-EC2-HVM

Image SLES15-SP2-SAP-BYOS-GCE

Image SLES15-SP2-SAP-EC2-HVM

Image SLES15-SP2-SAP-GCE

Image SLES15-SP3-BYOS-Azure

Image SLES15-SP3-BYOS-EC2-HVM

Image SLES15-SP3-BYOS-GCE

Image SLES15-SP3-CHOST-BYOS-Aliyun

Image SLES15-SP3-CHOST-BYOS-Azure

Image SLES15-SP3-CHOST-BYOS-EC2

Image SLES15-SP3-CHOST-BYOS-GCE

Image SLES15-SP3-CHOST-BYOS-SAP-CCloud

Image SLES15-SP3-HPC-BYOS-Azure

Image SLES15-SP3-HPC-BYOS-EC2-HVM

Image SLES15-SP3-HPC-BYOS-GCE

Image SLES15-SP3-Manager-4-2-Proxy-BYOS-Azure

Image SLES15-SP3-Manager-4-2-Proxy-BYOS-EC2-HVM

Image SLES15-SP3-Manager-4-2-Proxy-BYOS-GCE

Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure

Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM

Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE

Image SLES15-SP3-Micro-5-1-BYOS-Azure

Image SLES15-SP3-Micro-5-1-BYOS-EC2-HVM

Image SLES15-SP3-Micro-5-1-BYOS-GCE

Image SLES15-SP3-Micro-5-2-BYOS-Azure

Image SLES15-SP3-Micro-5-2-BYOS-EC2-HVM

Image SLES15-SP3-Micro-5-2-BYOS-GCE

Image SLES15-SP3-SAP-Azure-LI-BYOS-Production

Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production

Image SLES15-SP3-SAP-BYOS-Azure

Image SLES15-SP3-SAP-BYOS-EC2-HVM

Image SLES15-SP3-SAP-BYOS-GCE

Image SLES15-SP3-SAPCAL-Azure

Image SLES15-SP3-SAPCAL-EC2-HVM

Image SLES15-SP3-SAPCAL-GCE

SUSE Enterprise Storage 7

SUSE Enterprise Storage 7.1

SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS

SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS

SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

SUSE Linux Enterprise Micro 5.1

SUSE Linux Enterprise Micro 5.2

SUSE Linux Enterprise Real Time 15 SP3

SUSE Linux Enterprise Server 15 SP2-LTSS

SUSE Linux Enterprise Server 15 SP3-LTSS

SUSE Linux Enterprise Server for SAP Applications 15 SP2

SUSE Linux Enterprise Server for SAP Applications 15 SP3

SUSE Manager Proxy 4.2

SUSE Manager Server 4.2

Ссылки

Уязвимость: CVE-2023-28320