- 000release-packages:SUSE-MicroOS-release
-
n/a
- aaa_base
-
- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
* respect /etc/update-alternatives/java when setting JAVA_HOME
(bsc#1215434,bsc#1107342)
- blog
-
- Add patch blog.dif
* Fix big endian cast problems to be able to read commands
and ansers (blogctl) as well as passphrases (blogd)
- ca-certificates-mozilla
-
- Updated to 2.62 state of Mozilla SSL root CAs (bsc#1214248)
Added:
- Atos TrustedRoot Root CA ECC G2 2020
- Atos TrustedRoot Root CA ECC TLS 2021
- Atos TrustedRoot Root CA RSA G2 2020
- Atos TrustedRoot Root CA RSA TLS 2021
- BJCA Global Root CA1
- BJCA Global Root CA2
- LAWtrust Root CA2 (4096)
- Sectigo Public Email Protection Root E46
- Sectigo Public Email Protection Root R46
- Sectigo Public Server Authentication Root E46
- Sectigo Public Server Authentication Root R46
- SSL.com Client ECC Root CA 2022
- SSL.com Client RSA Root CA 2022
- SSL.com TLS ECC Root CA 2022
- SSL.com TLS RSA Root CA 2022
Removed CAs:
- Chambers of Commerce Root
- E-Tugra Certification Authority
- E-Tugra Global Root CA ECC v3
- E-Tugra Global Root CA RSA v3
- Hongkong Post Root CA 1
- cloud-netconfig
-
- Update to version 1.8:
+ Fix Azure metadata check (bsc#1214715)
+ Fix cleanup on ifdown
- containerd
-
- Update to containerd v1.7.7. Upstream release notes:
<https://github.com/containerd/containerd/releases/tag/v1.7.7>
- Add patch to fix build on SLE-12:
+ 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
<https://github.com/containerd/containerd/releases/tag/v1.7.6> bsc#1215323
- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
Kubernetes packages
- curl
-
- Security fix: [bsc#1215889, CVE-2023-38546]
* Cookie injection with none file
* Add curl-CVE-2023-38546.patch
- docker
-
- update to Docker 24.0.5-ce. See upstream changelong online at
<https://docs.docker.com/engine/release-notes/24.0/#2405>. bsc#1213229
- Update to Docker 24.0.4-ce. See upstream changelog online at
<https://docs.docker.com/engine/release-notes/24.0/#2404>. bsc#1213500
- Update to Docker 24.0.3-ce. See upstream changelog online at
<https://docs.docker.com/engine/release-notes/24.0/#2403>. bsc#1213120
- Rebase patches:
* cli-0001-docs-include-required-tools-in-source-tree.patch
- Recommend docker-rootless-extras instead of Require(ing) it, given
it's an additional functionality and not inherently required for
docker to function.
- Add docker-rootless-extras subpackage
(https://docs.docker.com/engine/security/rootless)
- Update to Docker 24.0.2-ce. See upstream changelog online at
<https://docs.docker.com/engine/release-notes/24.0/#2402>. bsc#1212368
* Includes the upstreamed fix for the mount table pollution issue.
bsc#1210797
- Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as
being provided by this package.
- Rebase patches:
* 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
* 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
* 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
* 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
* cli-0001-docs-include-required-tools-in-source-tree.patch
- dracut
-
- Update to version 049.1+suse.255.g19bd61fd:
* fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
- gawk
-
- format-tree-positional-arg.patch: Validate index into argument list
(CVE-2023-4156, bsc#1214025)
- glibc
-
- dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to
page size (bsc#1215891, BZ #28676)
- gai-merge-continue-actions.patch: Simplify allocations and fix merge and
continue actions (CVE-2023-4813, bsc#1215286, BZ #28931)
- gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243)
- nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache
invalidation if epoll is used (bsc#1212910, BZ #29415)
- nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses
in files database (bsc#1212819, BZ #25457)
- remove-excessive-p-align-check.patch: elf: Remove excessive p_align
check on PT_LOAD segments (bsc#1211829, BZ #28688)
- segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829,
BZ #28676)
- ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the
first segment (BZ #30452)
- hwinfo
-
- merge gh#openSUSE/hwinfo#132
- avoid linking problems with libsamba (bsc#1212756)
- 21.85
- merge gh#openSUSE/hwinfo#127
- create xen usb controller device if necessary (bsc#1204294)
- 21.84
- merge gh#openSUSE/hwinfo#115
- improve treatment of NVME devices (bsc#1200975)
- fix compiler warnings
- 21.83
- kernel-default
-
- nvme-fc: Prevent null pointer dereference in
nvme_fc_io_getuuid() (bsc#1214842).
- commit b96c59b
- ubi: Refuse attaching if mtd's erasesize is 0 (CVE-2023-31085
bsc#1210778).
- commit cf2c572
- bpf: propagate precision in ALU/ALU64 operations (git-fixes).
- commit 3cd9fd7
- USB: ene_usb6250: Allocate enough memory for full object
(bsc#1216051 CVE-2023-45862).
- commit 850ea88
- bpf: Fix incorrect verifier pruning due to missing register
precision taints (bsc#1215518 CVE-2023-2163).
- commit 37a3998
- netfilter: nf_tables: skip bound chain on rule flush
(CVE-2023-3777 bsc#1215095).
- commit 5558be6
- xen/events: replace evtchn_rwlock with RCU (bsc#1215745,
xsa-441, cve-2023-34324).
- commit 4227b23
- KVM: x86: fix sending PV IPI (git-fixes, bsc#1210853,
bsc#1216134).
- commit 8704b8e
- netfilter: nfnetlink_osf: avoid OOB read (bsc#1216046
CVE-2023-39189).
- commit c154d64
- btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() (bsc#1212051 CVE-2023-3111).
- commit 2048118
- Update
patches.suse/ipv6-sr-fix-out-of-bounds-read-when-setting-HMAC-dat.patch
(bsc#1211592 CVE-2023-2860).
- commit 267cf38
- net: xfrm: Fix xfrm_address_filter OOB read (CVE-2023-39194
bsc#1215861).
- commit 1bf7dab
- netfilter: xt_sctp: validate the flag_info count (CVE-2023-39193
bsc#1215860).
- commit 6fc23b4
- netfilter: xt_u32: validate user space input (CVE-2023-39192
bsc#1215858).
- commit 5f8a021
- ipv4: fix null-deref in ipv4_link_failure (CVE-2023-42754
bsc#1215467).
- commit ecc7c7a
- btrfs: fix root ref counts in error handling in
btrfs_get_root_ref (bsc#1214351 CVE-2023-4389).
- commit 14e72e8
- Revert rwsem backport (bsc#1207270 jsc#PED-4567)
The rwsem backport enabled database software to run on largest VMs in
Azure (M416v2, M832v2). It is reportedly no longer needed:
- Delete patches.suse/lockdep-Add-preemption-enabled-disabled-assertion-AP.patch.
- Delete patches.suse/locking-Add-missing-__sched-attributes.patch.
- Delete patches.suse/locking-Remove-rcu_read_-un-lock-for-preempt_-dis-en.patch.
- Delete patches.suse/locking-rwsem-Add-__always_inline-annotation-to-__do.patch.
- Delete patches.suse/locking-rwsem-Allow-slowpath-writer-to-ignore-handof.patch.
- Delete patches.suse/locking-rwsem-Always-try-to-wake-waiters-in-out_nolo.patch.
- Delete patches.suse/locking-rwsem-Better-collate-rwsem_read_trylock.patch.
- Delete patches.suse/locking-rwsem-Conditionally-wake-waiters-in-reader-w.patch.
- Delete patches.suse/locking-rwsem-Disable-preemption-for-spinning-region.patch.
- Delete patches.suse/locking-rwsem-Disable-preemption-in-all-down_read-an.patch.
- Delete patches.suse/locking-rwsem-Disable-preemption-in-all-down_write-a.patch.
- Delete patches.suse/locking-rwsem-Disable-preemption-while-trying-for-rw.patch.
- Delete patches.suse/locking-rwsem-Enable-reader-optimistic-lock-stealing.patch.
- Delete patches.suse/locking-rwsem-Fix-comment-typo.patch.
- Delete patches.suse/locking-rwsem-Fix-comments-about-reader-optimistic-l.patch.
- Delete patches.suse/locking-rwsem-Fold-__down_-read-write.patch.
- Delete patches.suse/locking-rwsem-Introduce-rwsem_write_trylock.patch.
- Delete patches.suse/locking-rwsem-Make-handoff-bit-handling-more-consist.patch.
- Delete patches.suse/locking-rwsem-No-need-to-check-for-handoff-bit-if-wa.patch.
- Delete patches.suse/locking-rwsem-Optimize-down_read_trylock-under-highl.patch.
- Delete patches.suse/locking-rwsem-Pass-the-current-atomic-count-to-rwsem.patch.
- Delete patches.suse/locking-rwsem-Prevent-non-first-waiter-from-spinning.patch.
- Delete patches.suse/locking-rwsem-Prevent-potential-lock-starvation.patch.
- Delete patches.suse/locking-rwsem-Remove-an-unused-parameter-of-rwsem_wa.patch.
- Delete patches.suse/locking-rwsem-Remove-reader-optimistic-spinning.patch.
- Delete patches.suse/rwsem-Implement-down_read_interruptible.patch.
- Delete patches.suse/rwsem-Implement-down_read_killable_nested.patch.
- blacklist.conf: add a rwsem patch that causes lockups
Restore the patch disabling optimistic spinning for readers:
- locking/rwsem: Disable reader optimistic spinning (bnc#1176588).
Add down_read_interruptible and down_read_killable_nested, which were
exported symbols added by the patchset being reverted, to kabi/severities.
- commit ae06a1f
- netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro
for ip_set_hash_netportnet.c (CVE-2023-42753 bsc#1215150).
- commit c0f449e
- tcp: Reduce chance of collisions in inet6_hashfn()
(CVE-2023-1206 bsc#1212703).
- commit fdc3ce8
- scsi: qedf: Add synchronization between I/O completions and
abort (bsc#1210658).
- commit 9be81b4
- Refresh
patches.suse/net-sched-cbq-dont-intepret-cls-results-when-asked-t.patch.
- commit dc11875
- net: sched: sch_qfq: Fix UAF in qfq_dequeue() (CVE-2023-4921
bsc#1215275).
- commit b3e4331
- bnx2x: new flag for track HW resource allocation (bsc#1202845
bsc#1215322).
- commit 9c9c729
- x86/srso: Fix srso_show_state() side effect (git-fixes).
- commit a76a23f
- x86/srso: Fix SBPB enablement for spec_rstack_overflow=off (git-fixes).
- commit 184fe4b
- x86/srso: Don't probe microcode in a guest (git-fixes).
- commit 1dd85db
- x86/srso: Set CPUID feature bits independently of bug or mitigation status (git-fixes).
- commit 4dac766
- Update
patches.suse/net-sched-cbq-dont-intepret-cls-results-when-asked-t.patch.
(bsc#1207036 CVE-2023-23454)
Fold downstream fixup of caa4b35b4317d5147b3ab0fbdc9c075c7d2e9c12.
- commit bd0b138
- netfilter: nft_set_pipapo: fix improper element removal
(bsc#1213812 CVE-2023-4004).
- commit 593f458
- af_unix: Fix null-ptr-deref in unix_stream_sendpage()
(CVE-2023-4622 bsc#1215117).
- commit bd1d942
- net/sched: sch_hfsc: Ensure inner classes have fsc curve
(CVE-2023-4623 bsc#1215115).
- commit 0cd315e
- cec-api: prevent leaking memory through hole in structure
(CVE-2020-36766 bsc#1215299).
- commit d226bc0
- x86/pkeys: Revert a5eff7259790 ("x86/pkeys: Add PKRU value to init_fpstate") (bsc#1215356).
- commit 012d8e6
- 9p/xen : Fix use after free bug in xen_9pfs_front_remove due
to race condition (bsc#1215206, CVE-2023-1859).
- commit fe5b126
- sctp: leave the err path free in sctp_stream_init to
sctp_stream_free (CVE-2023-2177 bsc#1210643).
- commit 2ef1e9d
- netfilter: nftables: exthdr: fix 4-byte stack OOB write
(CVE-2023-4881 bsc#1215221).
- commit 780699b
- Delete patches.suse/genksyms-add-override-flag.diff.
The override flag is no longer used in kernel-binary.
- commit 79d5655
- rpm/kernel-binary.spec.in: Drop use of KBUILD_OVERRIDE=1
Genksyms has functionality to specify an override for each type in
a symtypes reference file. This override is then used instead of an
actual type and allows to preserve modversions (CRCs) of symbols that
reference the type. It is kind of an alternative to doing kABI fix-ups
with '#ifndef __GENKSYMS__'. The functionality is hidden behind the
genksyms --preserve option which primarily tells the tool to strictly
verify modversions against a given reference file or fail.
Downstream patch patches.suse/genksyms-add-override-flag.diff which is
present in various kernel-source branches separates the override logic.
It allows it to be enabled with a new --override flag and used without
specifying the --preserve option. Setting KBUILD_OVERRIDE=1 in the spec
file is then a way how the build is told that --override should be
passed to all invocations of genksyms. This was needed for SUSE kernels
because their build doesn't use --preserve but instead resulting CRCs
are later checked by scripts/kabi.pl.
However, this override functionality was not utilized much in practice
and the only use currently to be found is in SLE11-SP1-LTSS. It means
that no one should miss this option and KBUILD_OVERRIDE=1 together with
patches.suse/genksyms-add-override-flag.diff can be removed.
Notes for maintainers merging this commit to their branches:
* Downstream patch patches.suse/genksyms-add-override-flag.diff can be
dropped after merging this commit.
* Branch SLE11-SP1-LTSS uses the mentioned override functionality and
this commit should not be merged to it, or needs to be reverted
afterwards.
- commit 4aa02b8
- Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
(bsc#1214233 CVE-2023-40283).
- commit 11dc4cc
- Refresh patches.suse/powerpc-Move-DMA64_PROPNAME-define-to-a-header.patch.
- commit d263157
- x86/speculation: Mark all Skylake CPUs as vulnerable to GDS (git-fixes).
- commit a3ff58c
- drm/vmwgfx: Test shader type against SVGA3d_SHADERTYPE_MIN (bsc#1203517 CVE-2022-36402)
- commit 5b2dbae
- cifs: Fix UAF in cifs_demultiplex_thread() (bsc#1208995
CVE-2023-1192).
- commit 87f52bf
- powerpc/rtas: remove ibm_suspend_me_token (bsc#1023051).
- commit 4f01e57
- Do not add and remove genksyms ifdefs
- Refresh patches.kabi/lockdown-kABI-workaround-for-lockdown_reason-changes.patch.
- Refresh patches.suse/lockdown-also-lock-down-previous-kgdb-use.patch.
- commit e497b88
- powerpc/rtas: move syscall filter setup into separate function
(bsc#1023051).
- commit a36442d
- rpm/mkspec-dtb: support for nested subdirs
Commit 724ba6751532 ("ARM: dts: Move .dts files to vendor
sub-directories") moved the dts to nested subdirs, add a support for
that. That is, generate a %dir entry in %files for them.
- commit 6484eda
- x86/speculation: Add cpu_show_gds() prototype (git-fixes).
- commit 5d94fff
- x86: Move gds_ucode_mitigated() declaration to header (git-fixes).
- commit 5ab0096
- blacklist.conf: Blacklist redundant docu patch
- commit 1c6d737
- Sort recent hw security-related patches
Move them to the sorted section and adjust patches accordingly.
- Refresh patches.suse/kvm-add-gds_no-support-to-kvm.patch.
- Refresh
patches.suse/x86-speculation-add-force-option-to-gds-mitigation.patch.
- Refresh
patches.suse/x86-speculation-add-gather-data-sampling-mitigation.patch.
- Refresh
patches.suse/x86-speculation-add-kconfig-option-for-gds.patch.
- Refresh
patches.suse/x86-srso-add-a-speculative-ras-overflow-mitigation.patch.
- Refresh patches.suse/x86-srso-add-srso_no-support.patch.
- commit 5c87dd7
- Input: cyttsp4_core - change del_timer_sync() to
timer_shutdown_sync() (bsc#1213971 CVE-2023-4134).
- commit 3ffe891
- powerpc/rtas: block error injection when locked down
(bsc#1023051).
Refresh patches.kabi/lockdown-kABI-workaround-for-lockdown_reason-changes.patch
- commit 3bd253d
- powerpc/rtas: mandate RTAS syscall filtering (bsc#1023051).
- commit 3251f7a
- powerpc: Move DMA64_PROPNAME define to a header (bsc#1214297
ltc#197503).
- commit c36e5b8
- x86/CPU/AMD: Fix the DIV(0) initial fix attempt (bsc#1213927, CVE-2023-20588).
- commit 48fc5d8
- x86/CPU/AMD: Do not leak quotient data after a division by 0 (bsc#1213927, CVE-2023-20588).
- commit 5e5738e
- old-flavors: Drop 2.6 kernels.
2.6 based kernels are EOL, upgrading from them is no longer suported.
- commit 7bb5087
- net: vmxnet3: fix possible NULL pointer dereference in
vmxnet3_rq_cleanup() (bsc#1214451 CVE-2023-4459).
- commit 1ac9015
- net: nfc: Fix use-after-free caused by nfc_llcp_find_local
(bsc#1213601 CVE-2023-3863).
- nfc: llcp: simplify llcp_sock_connect() error paths (bsc#1213601
CVE-2023-3863).
- nfc: llcp: nullify llcp_sock->dev on connect() error paths
(bsc#1213601 CVE-2023-3863).
- commit 9d4529d
- kabi/severities: Ignore newly added SRSO mitigation functions
- commit 95ed32f
- x86/srso: Correct the mitigation status when SMT is disabled (git-fixes).
- commit 309af7f
- x86/srso: Explain the untraining sequences a bit more (git-fixes).
- commit fa09ab7
- x86/cpu/kvm: Provide UNTRAIN_RET_VM (git-fixes).
- commit 5038558
- x86/cpu: Cleanup the untrain mess (git-fixes).
- commit eda7e6d
- x86/cpu: Rename srso_(.*)_alias to srso_alias_\1 (git-fixes).
- commit 6e5dea6
- xfrm: add NULL check in xfrm_update_ae_params (bsc#1213666
CVE-2023-3772).
- commit fdc40c6
- x86/cpu: Rename original retbleed methods (git-fixes).
- commit 554babe
- x86/srso: Disable the mitigation on unaffected configurations (git-fixes).
- commit a99796e
- x86/retpoline: Don't clobber RFLAGS during srso_safe_ret() (git-fixes).
- commit 2b91cd9
- Update config files. Drop the dpt_i2o kernel module.
For: jsc#PED-4579, CVE-2023-2007
- commit 6a43698
- fs: jfs: fix possible NULL pointer dereference in dbFree() (bsc#1214348 CVE-2023-4385).
- commit ee83171
- xfs: fix sb write verify for lazysbcount (bsc#1214275).
- commit 37c728c
- xfs: update superblock counters correctly for !lazysbcount
(bsc#1214275).
- commit 2b6e01d
- xfs: gut error handling in xfs_trans_unreserve_and_mod_sb()
(bsc#1214275).
- commit e55f7c6
- mkspec: Allow unsupported KMPs (bsc#1214386)
- commit 55d8b82
- pseries/iommu/ddw: Fix kdump to work in absence of
ibm,dma-window (bsc#1214297 ltc#197503).
- commit ea499bc
- check-for-config-changes: ignore BUILTIN_RETURN_ADDRESS_STRIPS_PAC (bsc#1214380).
gcc7 on SLE 15 does not support this while later gcc does.
- commit 5b41c27
- net: vmxnet3: fix possible use-after-free bugs in
vmxnet3_rq_alloc_rx_buf() (bsc#1214350 CVE-2023-4387).
- commit 0fa208f
- e1000: Remove unnecessary use of kmap_atomic() (jsc#PED-5738).
- commit dfa3fd7
- intel/e1000:fix repeated words in comments (jsc#PED-5738).
- commit e5d93d0
- e1000: Fix typos in comments (jsc#PED-5738).
- commit 64fd6bc
- e1000: switch to napi_consume_skb() (jsc#PED-5738).
- commit 1ad8d9c
- intel: remove checker warning (jsc#PED-5738).
- commit c3ad152
- net: e1000: remove repeated words for e1000_hw.c (jsc#PED-5738).
- commit ace3bf9
- net: e1000: remove repeated word "slot" for e1000_main.c
(jsc#PED-5738).
- commit cfd4849
- e1000: Fix fall-through warnings for Clang (jsc#PED-5738).
- commit 7817f78
- e1000: drop unneeded assignment in e1000_set_itr()
(jsc#PED-5738).
- commit d2ba4db
- io_uring: Acquire completion_lock around io_get_deferred_req
(bsc#1213272 CVE-2023-21400).
- commit 84db304
- kernel-binary: Common dependencies cleanup
Common dependencies are copied to a subpackage, there is no need for
copying defines or build dependencies there.
- commit 254b03c
- kernel-binary: Drop code for kerntypes support
Kerntypes was a SUSE-specific feature dropped before SLE 12.
- commit 2c37773
- md/raid0: Fix performance regression for large sequential writes
(bsc#1213916).
- md/raid0: Factor out helper for mapping and submitting a bio
(bsc#1213916).
- commit b0544bd
- media: usb: siano: Fix warning due to null work_func_t function
pointer (bsc#1213969 CVE-2023-4132).
- commit c44d7c3
- media: usb: siano: Fix use after free bugs caused by
do_submit_urb (bsc#1213969 CVE-2023-4132).
- commit a27f430
- net/sched: cls_route: No longer copy tcf_result on update to
avoid use-after-free (bsc#1214149 CVE-2023-4128).
- net/sched: cls_fw: No longer copy tcf_result on update to
avoid use-after-free (bsc#1214149 CVE-2023-4128).
- net/sched: cls_u32: No longer copy tcf_result on update to
avoid use-after-free (bsc#1214149 CVE-2023-4128).
- commit ea3bad4
- exfat: check if filename entries exceeds max filename length
(bsc#1214120 CVE-2023-4273).
- commit d8c4244
- series.conf: resort
- commit b2ee92a
- netfilter: nf_tables: disallow rule addition to bound chain
via NFTA_RULE_CHAIN_ID (CVE-2023-4147 bsc#1213968).
- commit 1258138
- cxgb4: fix use after free bugs caused by circular dependency
problem (bsc#1213970 CVE-2023-4133).
- timers: Provide timer_shutdown[_sync]() (bsc#1213970).
- timers: Add shutdown mechanism to the internal functions
(bsc#1213970).
- timers: Split [try_to_]del_timer[_sync]() to prepare for
shutdown mode (bsc#1213970).
- timers: Silently ignore timers with a NULL function
(bsc#1213970).
- timers: Rename del_timer() to timer_delete() (bsc#1213970).
- timers: Rename del_timer_sync() to timer_delete_sync()
(bsc#1213970).
- timers: Use del_timer_sync() even on UP (bsc#1213970).
- timers: Update kernel-doc for various functions (bsc#1213970).
- timers: Replace BUG_ON()s (bsc#1213970).
- clocksource/drivers/sp804: Do not use timer namespace for
timer_shutdown() function (bsc#1213970).
- clocksource/drivers/arm_arch_timer: Do not use timer namespace
for timer_shutdown() function (bsc#1213970).
- ARM: spear: Do not use timer namespace for timer_shutdown()
function (bsc#1213970).
- commit 6a1c404
- xen/netback: Fix buffer overrun triggered by unusual packet
(CVE-2023-34319, XSA-432, bsc#1213546).
- commit 3617080
- x86/srso: Tie SBPB bit setting to microcode patch detection (bsc#1213287, CVE-2023-20569).
- commit 3f35ab4
- net: tun_chr_open(): set sk_uid from current_fsuid()
(CVE-2023-4194 bsc#1214019).
- commit 25c979d
- net: tap_open(): set sk_uid from current_fsuid() (CVE-2023-4194
bsc#1214019).
- commit b03d1d8
- x86/microcode/AMD: Make stub function static inline
(bsc#1213868).
- Refresh patches.suse/x86-cpu-amd-add-a-zenbleed-fix.patch.
- commit f587833
- mm: Move mm_cachep initialization to mm_init() (bsc#1206418, CVE-2022-40982).
- commit 487512d
- bpf: add missing header file include (bsc#1211738
CVE-2023-0459).
- commit 0e6ab49
- locking/rwsem: Add __always_inline annotation to
__down_read_common() and inlined callers (bsc#1207270
jsc#PED-4567).
- commit 9e46337
- locking/rwsem: Disable preemption in all down_write*() and
up_write() code paths (bsc#1207270 jsc#PED-4567).
- commit e8b39d0
- locking/rwsem: Disable preemption in all down_read*() and
up_read() code paths (bsc#1207270 jsc#PED-4567).
- commit f20a53f
- locking/rwsem: Prevent non-first waiter from spinning in
down_write() slowpath (bsc#1207270 jsc#PED-4567).
- commit 9c40fdf
- locking/rwsem: Disable preemption while trying for rwsem lock
(bsc#1207270 jsc#PED-4567).
- commit d6741e8
- locking/rwsem: Allow slowpath writer to ignore handoff bit if
not set by first waiter (bsc#1207270 jsc#PED-4567).
- commit 22681e5
- locking/rwsem: Always try to wake waiters in out_nolock path
(bsc#1207270 jsc#PED-4567).
- commit 2dd13e8
- locking/rwsem: Conditionally wake waiters in reader/writer
slowpaths (bsc#1207270 jsc#PED-4567).
- commit c20a7d3
- locking/rwsem: No need to check for handoff bit if wait queue
empty (bsc#1207270 jsc#PED-4567).
- commit 7d6a2e9
- locking: Add missing __sched attributes (bsc#1207270
jsc#PED-4567).
- commit 0f7a2d1
- locking/rwsem: Optimize down_read_trylock() under highly
contended case (bsc#1207270 jsc#PED-4567).
- commit 46658e6
- locking/rwsem: Make handoff bit handling more consistent
(bsc#1207270 jsc#PED-4567).
- commit e47427d
- locking/rwsem: Fix comments about reader optimistic lock
stealing conditions (bsc#1207270 jsc#PED-4567).
- commit 4a0d7cf
- locking: Remove rcu_read_{,un}lock() for preempt_{dis,en}able()
(bsc#1207270 jsc#PED-4567).
- commit ee007db
- lockdep: Add preemption enabled/disabled assertion APIs
(bsc#1207270 jsc#PED-4567).
- commit 1386d93
- locking/rwsem: Disable preemption for spinning region
(bsc#1207270 jsc#PED-4567).
- commit 0fad749
- locking/rwsem: Remove an unused parameter of rwsem_wake()
(bsc#1207270 jsc#PED-4567).
- commit b255b46
- locking/rwsem: Fix comment typo (bsc#1207270 jsc#PED-4567).
- commit 0ac673a
- locking/rwsem: Remove reader optimistic spinning (bsc#1207270
jsc#PED-4567).
- commit 4b129c1
- locking/rwsem: Enable reader optimistic lock stealing
(bsc#1207270 jsc#PED-4567).
- commit 7c0e82a
- locking/rwsem: Prevent potential lock starvation (bsc#1207270
jsc#PED-4567).
- commit 00b076e
- locking/rwsem: Pass the current atomic count to
rwsem_down_read_slowpath() (bsc#1207270 jsc#PED-4567).
- commit 1d2b5fa
- locking/rwsem: Fold __down_{read,write}*() (bsc#1207270
jsc#PED-4567).
- commit fd0b8b5
- locking/rwsem: Introduce rwsem_write_trylock() (bsc#1207270
jsc#PED-4567).
- commit daa9d5f
- locking/rwsem: Better collate rwsem_read_trylock() (bsc#1207270
jsc#PED-4567).
- commit 23252c2
- rwsem: Implement down_read_interruptible (bsc#1207270
jsc#PED-4567).
- commit 07e26fd
- rwsem: Implement down_read_killable_nested (bsc#1207270
jsc#PED-4567).
- commit 42f4ca4
- locking/rwsem: Prepare for a rwsem backport
The rwsem backport will enable the kernel to run on large VMs in Azure
(M416v2, M832v2). The rwsem code is going to be updated with newest
features one of which disables optimistic spinning for readers.
- blacklist.conf: Remove an entry that is part of the backported
patch set.
- Delete
patches.suse/locking-rwsem-Disable-reader-optimistic-spinning.patch.
- commit d354394
- ipv6: rpl: Fix Route of Death (CVE-2023-2156 bsc#1211131).
- commit 5601bfa
- x86/srso: Add IBPB on VMEXIT (bsc#1213287, CVE-2023-20569).
- commit f2c709c
- x86/srso: Add IBPB (bsc#1213287, CVE-2023-20569).
- commit ef6bc71
- x86/srso: Add SRSO_NO support (bsc#1213287, CVE-2023-20569).
- commit a905016
- x86/cpu, kvm: Add support for CPUID_80000021_EAX (bsc#1213287, CVE-2023-20569).
- Refresh patches.suse/x86-cpufeatures-add-kabi-padding.patch.
- commit f39cd8f
- x86/srso: Add IBPB_BRTYPE support (bsc#1213287, CVE-2023-20569).
- commit 5d6a6a0
- x86: Sanitize linker script (bsc#1213287, CVE-2023-20569).
- commit 8ff4f99
- x86/retbleed: Add __x86_return_thunk alignment checks (bsc#1213287, CVE-2023-20569).
- commit e623809
- x86/srso: Add a Speculative RAS Overflow mitigation (bsc#1213287, CVE-2023-20569).
- commit 707be59
- kernel-binary.spec.in: Remove superfluous %% in Supplements
Fixes: 02b7735e0caf ("rpm/kernel-binary.spec.in: Add Enhances and Supplements tags to in-tree KMPs")
- commit 264db74
- net/sched: sch_qfq: account for stab overhead in qfq_enqueue
(CVE-2023-3611 bsc#1213585).
- net/sched: sch_qfq: refactor parsing of netlink parameters
(bsc#1213585).
- blacklist follow-up commit 158810b261d0 ("net/sched: sch_qfq: reintroduce
lmax bound check for MTU") as unlike the original upstream commit, our
backport does not remove the check
- commit 609da2e
- net/sched: cls_u32: Fix reference counter leak leading to
overflow (CVE-2023-3609 bsc#1213586).
- commit b22e9b9
- net/sched: cls_fw: Fix improper refcount update leads to
use-after-free (CVE-2023-3776 bsc#1213588).
- commit b7fc513
- vc_screen: don't clobber return value in vcs_read (bsc#1213167
CVE-2023-3567).
- vc_screen: modify vcs_size() handling in vcs_read() (bsc#1213167
CVE-2023-3567).
- vc_screen: move load of struct vc_data pointer in vcs_read()
to avoid UAF (bsc#1213167 CVE-2023-3567).
- commit da930b7
- block, bfq: Fix division by zero error on zero wsum
(bsc#1213653).
- commit 67879a5
- x86/xen: Fix secondary processors' FPU initialization (bsc#1206418, CVE-2022-40982).
- commit 8a9c409
- x86/fpu: Move FPU initialization into arch_cpu_finalize_init() (bsc#1206418, CVE-2022-40982).
- commit d9e45bd
- x86/fpu: Mark init functions __init (bsc#1206418, CVE-2022-40982).
- commit 613212d
- x86/fpu: Remove cpuinfo argument from init functions (bsc#1206418).
- commit 82c61db
- init, x86: Move mem_encrypt_init() into arch_cpu_finalize_init() (bsc#1206418).
- commit 6fb5f8f
- init: Invoke arch_cpu_finalize_init() earlier (bsc#1206418).
- commit 8ef61c6
- init: Remove check_bugs() leftovers (bsc#1206418).
- commit a639423
- ARM: cpu: Switch to arch_cpu_finalize_init() (bsc#1206418).
- commit cbb96e9
- x86/cpu: Switch to arch_cpu_finalize_init() (bsc#1206418).
- commit 7fa4777
- x86/mm: Initialize text poking earlier (bsc#1206418, CVE-2022-40982).
- Refresh patches.suse/init-provide-arch_cpu_finalize_init.patch.
- commit 9784a5e
- init: Provide arch_cpu_finalize_init() (bsc#1206418).
- commit f81d332
- x86/mm: fix poking_init() for Xen PV guests (bsc#1206418, CVE-2022-40982).
- commit b12d1bf
- x86/mm: Use mm_alloc() in poking_init() (bsc#1206418, CVE-2022-40982).
- commit 9a1d45f
- net: tun: fix bugs for oversize packet when napi frags enabled
(bsc#1213543 CVE-2023-3812).
- commit 5e9be17
- netfilter: nf_tables: do not ignore genmask when looking up
chain by id (CVE-2023-31248 bsc#1213061).
- commit 414921d
- netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
(CVE-2023-35001 bsc#1213059).
- commit b0acbe2
- uaccess: Add speculation barrier to copy_from_user()
(bsc#1211738 CVE-2023-0459).
- commit 93eec59
- netfilter: nf_tables: incorrect error path handling with
NFT_MSG_NEWRULE (CVE-2023-3390 CVE-2023-3117 bsc#1212846
bsc#1213245).
- commit 176a7df
- KVM: Add GDS_NO support to KVM (bsc#1206418, CVE-2022-40982).
- commit 6550823
- x86/speculation: Add Kconfig option for GDS (bsc#1206418, CVE-2022-40982).
- commit eb94624
- x86/speculation: Add force option to GDS mitigation (bsc#1206418, CVE-2022-40982).
- commit 79691d3
- x86/speculation: Add Gather Data Sampling mitigation (bsc#1206418, CVE-2022-40982).
- commit 74a70bc
- ocfs2: fix defrag path triggering jbd2 ASSERT (bsc#1199304).
- ocfs2: fix a deadlock when commit trans (bsc#1199304).
- jbd2: export jbd2_journal_[grab|put]_journal_head (bsc#1199304).
- ocfs2: fix race between searching chunks and release
journal_head from buffer_head (bsc#1199304).
- commit f86bdfe
- Refresh
patches.suse/keys-Fix-linking-a-duplicate-key-to-a-keyring-s-asso.patch.
- commit d8b8cf8
- x86/cpu/amd: Add a Zenbleed fix (bsc#1213286, CVE-2023-20593).
- commit c2a9155
- x86/cpu/amd: Move the errata checking functionality up (bsc#1213286, CVE-2023-20593).
- commit d7a9bc3
- rpm: Update dependency to match current kmod.
- commit d687dc3
- keys: Do not cache key in task struct if key is requested from
kernel thread (bsc#1213354).
- commit 0121b9a
- net: mana: Add support for vlan tagging (bsc#1212301).
- commit 613e87e
- fs: hfsplus: fix UAF issue in hfsplus_put_super (bsc#1211867, CVE-2023-2985).
- commit e01b911
- rpm/check-for-config-changes: ignore also RISCV_ISA_* and DYNAMIC_SIGFRAME
They depend on CONFIG_TOOLCHAIN_HAS_*.
- commit 1007103
- ubi: Fix failure attaching when vid_hdr offset equals to
(sub)page size (bsc#1210584).
- ubi: ensure that VID header offset + VID header size <= alloc,
size (bsc#1210584).
- commit 8f5f025
- Remove more packaging cruft for SLE < 12 SP3
- commit a16781c
- Get module prefix from kmod (bsc#1212835).
- commit f6691b0
- rpm/check-for-config-changes: ignore also PAHOLE_HAS_*
We now also have options like CONFIG_PAHOLE_HAS_LANG_EXCLUDE.
- commit 86b52c1
- usrmerge: Adjust module path in the kernel sources (bsc#1212835).
With the module path adjustment applied as source patch only
ALP/Tumbleweed kernel built on SLE/Leap needs the path changed back to
non-usrmerged.
- commit dd9a820
- krb5
-
- Ensure array count consistency in kadm5 RPC; (bsc#1214054);
(CVE-2023-36054);
- Added patches:
* 0011-Ensure-array-count-consistency-in-kadm5-RPC.patch
- cryptsetup
-
- luksFormat: Handle system with low memory and no swap space [bsc#1211079]
* Check for physical memory available also in PBKDF benchmark.
* Try to avoid OOM killer on low-memory systems without swap.
* Use only half of detected free memory on systems without swap.
* Add patches:
- cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
- cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
- cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch
- lvm2
-
- blkdeactivate calls wrong mountpoint cmd (bsc#1214071)
+ bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch
- libeconf
-
- Additional info for version 0.5.2:
* Fixed a stack-buffer-overflow vulnerability in "econf_writeFile"
function. (CVE-2023-30078, CVE-2023-32181, bsc#1211078)
* Fixed a stack-buffer-overflow vulnerability in "read_file"
function. (CVE-2023-30079, CVE-2023-22652, bsc#1211078)
- Update to version 0.5.2:
* Fixed build for aarch64 and gcc13.
* Making the output verbose when a test fails.
* Fixed a stack-buffer-overflow vulnerability in "econf_writeFile"
function.
* Fixed a stack-buffer-overflow vulnerability in "read_file"
function.
* Added new feature: econf_set_conf_dirs (const char **dir_postfix_list)
Sets a list of directory structures (with order) which describes
the directories in which the files have to be parsed.
E.G. with the given list: {"/conf.d/", ".d/", "/", NULL} files in following
directories will be parsed:
"<default_dirs>/<project_name>.<suffix>.d/"
"<default_dirs>/<project_name>/conf.d/"
"<default_dirs>/<project_name>.d/"
"<default_dirs>/<project_name>/"
The entry "<default_dirs>/<project_name>.<suffix>.d/" will be added
automatically.
* General code cleanup.
- Update to version 0.5.1:
* Reading files in /usr/_vendor_/_example_._suffix_.d/* regardless
there is a /etc/_example_._suffix_ file. (#175)
- Update to version 0.5.0:
* API calls econf_read*WithCallback supporting a general (void *)
argument for user defined data with which the callback function is
called.
* Tagged following functions deprecated:
econf_requireOwner, econf_requireGroup, econf_requirePermissions,
econf_followSymlinks, econf_reset_security_settings
Use one of the econf_read*WithCallback functions instead.
- Update to version 0.4.9:
* libeconf.h: added missing sys/types.h header (#171)
* new API calls: econf_readFileWithCallback,
econf_readDirsWithCallback, econf_readDirsHistoryWithCallback (#172)
* Checking NULL comment parameter in the parsing functions.
- Update to version 0.4.8+git20221114.7ff7704:
* Parsing files which are containing keys only (#170)
All delimiters are allowed now : "", " =", " ", "=". But the
user should use "" in order to be distinct.
* /usr/etc/shells.d/<file_name> will not be parsed if
/etc/shells.d/<file_name> is defined too.
* Lto build fixed (#168)
* New calls: econf_comment_tag, econf_delimiter_tag, econf_set_comment_tag,
econf_set_delimiter_tag
* Checking UID,GroupID, permissions,... of the parsed files (#165)
New calls: econf_requireOwner, econf_requireGroup, econf_requirePermissions,
econf_followSymlinks
* Ignoring Group without brackets; Do not hold brackets in the internal data structure. (#164)
* Error handling improved for nums and booleans (#163)
- Update to version 0.4.6+git20220427.3016f4e:
* econftool:
* * Parsing error: Reporting file and line nr.
* * --delimeters=spaces Taking all kind of spaces for delimiter
* libeconf:
Fixed bsc#1198165: Parsing files correctly which have space characters
AND none space characters as delimiters.
- Update to version 0.4.5+git20220406.c9658f2:
* econftool:
* * New call "syntax" for checking the configuration files only.
Returns an error string with line number if an error occurs.
* * New options "--comment" and "--delimeters"
* * Parsing one file only if needed.
- freetype2
-
- Added patch:
* CVE-2023-2004.patch
+ fixes bsc#1210419, CVE-2023-2004: Integer overflow
- liblognorm
-
- Upgrade to liblognorm v2.0.6 (jsc#PED-4883)
* 2018-11-02: nitfixes: issues deteced by CodeFactor.com
* 2018-11-01: more cleanup of shell scripting
* 2018-10-31: cleanup shell scripting
* 2018-10-26: implement Checkpoint LEA transfer format
* 2018-10-31: fix mising shebangs in test scripts
* 2018-10-30: fix some bash style nits
* 2018-07-15: fix very theoretic misadressing (gcc-8 warning)
* 2018-06-26: string parser: add "lazy" matching mode
* 2018-05-30: Update lognormalizer.c
* 2018-05-30: Update lognormalizer.c to support case fallthrough
* 2018-05-30: Update README
* 2018-05-10: Fix for #229 (cisco-interface-spec at end of line)
* 2018-03-21: Suppress invalid param error for name to fix #270
- Upgrade to liblognorm v2.0.5
* 2018-04-25: fix potential NULL pointer addressing
* 2018-04-07: Add test for nested user types
* 2018-04-07: Fix use after free with nested user types (#235)
* 2018-04-25: build system: fix gcc warning
* 2018-04-25: make "make check" "succeed" on solaris 10
* 2018-04-16: fix build warnings with some newer compilers
* 2018-04-16: remove dead code
* 2018-04-16: fix potential memory leaks during config processing
* 2018-04-16: fix memory leak during config processing
* 2018-04-16: csv encoder: fix format error when processing arrays
* 2018-03-29: Explicitly list supported whitespace characters
* 2018-03-28: "fix" return type of unused dummy function
- replaces liblognorm-2.0.4-no-return-in-nonvoid-function.patch
* 2018-03-21: Suppress invalid param error for name to fix #270
* 2018-03-19: fix header guard
* 2018-03-06: Correct CLI options in the docs
* 2018-01-13: AIX port : added compatibility and modified lognormalizer for AIX.
* 2017-11-29: codestyle: correct line length to 120
* 2017-11-29: codestyle: set max line length to 120
* 2017-11-25: fix some very bad line length violations
* 2017-11-25: travis: temporarily permit longer line length
* 2017-10-19: make build with gcc7
* 2017-10-05: es_str2cstr leak in string-to v1 parse
- nghttp2
-
- security update
- added patches
fix CVE-2023-44487 [bsc#1216123], HTTP/2 Rapid Reset Attack
+ nghttp2-CVE-2023-44487.patch
- Fixes memory leak that happens when PUSH_PROMISE or HEADERS frame cannot be
sent, and nghttp2_on_stream_close_callback fails with a fatal error.
[CVE-2023-35945 bsc#1215713]
+ nghttp2-CVE-2023-35945.patch
- openssl-1_1
-
- Displays "fips" in the version string (bsc#1215215)
* Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch
- Security fix: (bsc#1213853, CVE-2023-3817)
* Fix excessive time spent checking DH q parameter value
(bsc#1213853, CVE-2023-3817). The function DH_check() performs
various checks on DH parameters. After fixing CVE-2023-3446 it
was discovered that a large q parameter value can also trigger
an overly long computation during some of these checks. A
correct q value, if present, cannot be larger than the modulus
p parameter, thus it is unnecessary to perform these checks if
q is larger than p. If DH_check() is called with such q parameter
value, DH_CHECK_INVALID_Q_VALUE return flag is set and the
computationally intensive checks are skipped.
* Add openssl-1_1-CVE-2023-3817.patch
- Dont pass zero length input to EVP_Cipher because assembler
optimized AES cannot handle zero size. [bsc#1213517]
* Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch
- parted
-
- fix null pointer dereference (bsc#1193412)
- add: parted-fix-check-diskp-in-do_name.patch
- update mkpart options in manpage (bsc#1182142)
- add: parted-mkpart-manpage.patch
- pcre2
-
- Security fix: [bsc#1213514, CVE-2022-41409]
* Integer overflow vulnerability in pcre2test before 10.41
allows attackers to cause a denial of service or other
unspecified impacts via negative input.
* Add pcre2-CVE-2022-41409.patch
- procps
-
- Add patch CVE-2023-4016.patch
* CVE-2023-4016: ps buffer overflow (bsc#1214290)
- python3
-
- Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing
gh#python/cpython#108310, backport from upstream patch
gh#python/cpython#108315
(bsc#1214692, CVE-2023-40217)
- libtirpc
-
- update to 1.3.4 (bsc#1199467)
* binddynport.c honor ip_local_reserved_ports
- replaces: binddynport-honor-ip_local_reserved_ports.patch
* gss-api: expose gss major/minor error in authgss_refresh()
* rpcb_clnt.c: Eliminate double frees in delete_cache()
* rpcb_clnt.c: memory leak in destroy_addr
* portmapper: allow TCP-only portmapper
* getnetconfigent: avoid potential DoS issue by removing unnecessary sleep
* clnt_raw.c: fix a possible null pointer dereference
* bindresvport.c: fix a potential resource leakage
- update to 1.3.3 (bsc#1201680, CVE-2021-46828):
* Fix DoS vulnerability in libtirpc
- replaces: 0001-Fix-DoS-vulnerability-in-libtirpc.patch
* _rpc_dtablesize: use portable system call
* libtirpc: Fix use-after-free accessing the error number
* Fix potential memory leak of parms.r_addr
- replaces 0001-fix-parms.r_addr-memory-leak.patch
* rpcb_clnt.c add mechanism to try v2 protocol first
- preplaces: 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch
* Eliminate deadlocks in connects with an MT environment
* clnt_dg_freeres() uncleared set active state may deadlock
* thread safe clnt destruction
* SUNRPC: mutexed access blacklist_read state variable
* SUNRPC: MT-safe overhaul of address cache management in rpcb_clnt.c
- drop 0001-Fix-DoS-vulnerability-in-libtirpc.patch (upstream)
- update to 1.3.2:
* Replace the final SunRPC licenses with BSD licenses
* blacklist: Add a few more well known ports
* libtirpc: disallow calling auth_refresh from clnt_call with RPCSEC_GSS
- Update to libtirpc 1.3.1
* Remove AUTH_DES interfaces from auth_des.h
The unsupported AUTH_DES authentication has be
compiled out since commit d918e41d889 (Wed Oct 9 2019)
replaced by API routines that return errors.
* svc_dg: Free xp_netid during destroy
* Fix memory management issues of fd locks
* libtirpc: replace array with list for per-fd locks
* __svc_vc_dodestroy: fix double free of xp_ltaddr.buf
* __rpc_dtbsize: rlim_cur instead of rlim_max
* pkg-config: use the correct replacements for libdir/includedir
Patches replaced by update:
binddynport-honor-ip_local_reserved_ports.patch (bsc#1199467)
0001-Fix-DoS-vulnerability-in-libtirpc.patch (bsc#1201680)
0001-fix-parms.r_addr-memory-leak.patch (bsc#1198752)
0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch
(bsc#1196647), (bsc#1200800), (bsc#1198176)
* replaces /etc/netconfig-try-2-first by the environment variable
RPCB_V2FIRST
- libxml2
-
- Security update:
* [CVE-2023-39615, bsc#1214768] Crafted xml can cause global
buffer overflow
- Added file libxml2-CVE-2023-39615.patch
- libyajl
-
- add libyajl-CVE-2023-33460.patch (CVE-2023-33460, bsc#1212928)
- zlib
-
- Fix CVE-2023-45853, integer overflow and resultant heap-based buffer
overflow in zipOpenNewFileInZip4_6, bsc#1216378
* CVE-2023-45853.patch
- libzypp
-
- Fixup changes for 17.31.16. Remove faulty reference to a bug
actually fixed in 2019.
- version 17.31.20 (22)
- Fix zypp-tui/output/Out.h to build with clang.
- Fix zypp/Arch.h for clang (fixes #478)
Clang seems to have issues with picking the overload in
std::men_fn if there is a static overload of a member function.
We need to explicitely specify the correct type of the function
pointer. To make sure this would not break compiling a
application with clang that builds against libzypp this patch
works around the problem.
- version 17.31.19 (22)
- SINGLE_RPMTRANS: Respect ZYPP_READONLY_HACK when checking the
zypp-rpm lock (fixes openSUSE/openSUSE-repos#29)
- version 17.31.18 (22)
- Fix wrong filesize exceeded dl abort in zyppng::Downloader
(bsc#1213673)
In some cases when downloading very small files we can run into
issues when the URL is protected by credentials.
- version 17.31.17 (22)
- Fix negative ZYPP_LOCK_TIMEOUT not waiting forever (bsc#1213231)
- Don't cleanup orphaned dirs if read-only mode was promised
(bsc#1210740)
- version 17.31.16 (22)
- Fix build against protobuf >= 22 (fixes #465, closes #466)
Port away from protobuf_generate_cpp. Upstream protobuf does not
export protobuf_generate_cpp by default anymore.
Use protobuf_generate instead, which is also available on older
versions.
- Remove SUSE < SLE11 constructs (fixes #464).
- version 17.31.15 (22)
- shadow
-
- bsc#1214806 (CVE-2023-4641):
Fix potential password leak
- Add shadow-CVE-2023-4641.patch
- bsc#1213189: Change lock mechanism to file locking to prevent
lock files after power interruptions
- Add shadow-4.8.1-lock-mechanism.patch
- bsc#1206627: Add --prefix support to passwd, chpasswd and chage
Needed for YaST
- Add shadow-4.8.1-add-prefix-passwd-chpasswd-chage.patch
- perl-Bootloader
-
- merge gh#openSUSE/perl-bootloader#157
- bootloader_entry script can have an optional 'force-default'
argument (bsc#1215064)
- skip warning about unsupported options when in compat mode
- 0.945
- python-pyasn1
-
- To avoid users of this package having to recompile bytecode
files, change the mtime of any __init__.py. (bsc#1207805)
- salt
-
- Fix inconsistency in reported version by egg-info metadata (bsc#1215489)
- Added:
* write-salt-version-before-building-when-using-with-s.patch
- Revert usage of long running REQ channel to prevent possible
missing responses on requests and dublicated responses
(bsc#1213960, bsc#1213630, bsc#1213257)
- Fix gitfs cachedir basename to avoid hash collisions
(bsc#1193948, bsc#1214797, CVE-2023-20898)
- Added:
* revert-usage-of-long-running-req-channel-bsc-1213960.patch
* fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch
- Make sure configured user is properly set by Salt (bsc#1210994)
- Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897)
- Fix broken tests to make them running in the testsuite
- Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794)
- Create minion_id with reproducible mtime
- Fix detection of Salt codename by "salt_version" execution module
- Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844)
- Fix the regression of user.present state when group is unset (bsc#1212855)
- Fix zypper repositories always being reconfigured
- Fix utf8 handling in 'pass' renderer and make it more robust
- Added:
* fix-regression-multiple-values-for-keyword-argument-.patch
* fix-tests-to-make-them-running-with-salt-testsuite.patch
* mark-salt-3006-as-released-586.patch
* make-sure-configured-user-is-properly-set-by-salt-bs.patch
* zypper-pkgrepo-alreadyconfigured-585.patch
* prevent-possible-exceptions-on-salt.utils.user.get_g.patch
* fix-the-regression-of-user.present-state-when-group-.patch
* do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch
* fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch
- python-urllib3
-
- Add CVE-2023-43804.patch (bsc#1215968, CVE-2023-43804)
gh#urllib3/urllib3#3139
* Added the Cookie header to the list of headers to strip from
requests when redirecting to a different host. As before,
different headers can be set via Retry.remove_headers_on_redirect.
- rsync
-
- Drop rsync-fix-external-compression.patch, rsync-iconv-segfault.patch
- Fix --delay-updates never updates after interruption [bsc#1204538]
* Added patch rsync-fix-delay-updates-never-updates-after-interruption.patch
- rsyslog
-
- fix segfaults in modExit() of imklog.c (bsc#1211757)
* add 0001-imklog-fix-invalid-memory-adressing-could-cause-abor.patch
- fix removal of imfile state files (bsc#1213212)
* add 0001-fixing-the-deleteStateOnFileDelete-option.patch
- runc
-
- Update to runc v1.1.9. Upstream changelog is available from
<https://github.com/opencontainers/runc/releases/tag/v1.1.9>.
- Update to runc v1.1.8. Upstream changelog is available from
<https://github.com/opencontainers/runc/releases/tag/v1.1.8>.
- supportutils
-
- Changes in version 3.1.26
+ powerpc plugin to collect the slots and active memory (bsc#1210950)
+ A Cleartext Storage of Sensitive Information vulnerability CVE-2022-45154
+ supportconfig: collect BPF information (pr#154)
+ Added additional iscsi information (pr#155)
- Added run time detection (bsc#1213127)
- ha_info sle15 uses /var/log/pacemaker/ (pq#153)
- Changes for supportutils version 3.1.25
+ Removed iSCSI passwords CVE-2022-45154 (bsc#1207598)
+ powerpc: Collect lsslot,amsstat, and opal elogs (pr#149)
+ powerpc: collect invscout logs (pr#150)
+ powerpc: collect RMC status logs (pr#151)
+ Added missing nvme nbft commands (bsc#1211599)
+ Fixed invalid nvme commands (bsc#1211598)
+ Added missing podman information (PED-1703, bsc#1181477)
+ Removed dependency on sysfstools
+ Check for systool use (bsc#1210015)
+ Added selinux checking (bsc#1209979)
+ Updated SLES_VER matrix
- Fixed missing status detail for apparmor (bsc#1196933)
- Corrected invalid argument list in docker.txt (bsc#1206608)
- Applies limit equally to sar data and text files (bsc#1207543)
- Collects hwinfo hardware logs (bsc#1208928)
- Collects lparnumascore logs (issue#148)
- Add dependency to `numactl` on ppc64le and `s390x`, this enforces
that `numactl --hardware` data is provided in supportconfigs
- Changes to supportconfig.rc version 3.1.11-35
+ Corrected _sanitize_file to include iscsi.conf and others (bsc#1206402)
- Changes to supportconfig version 3.1.11-46.4
+ Added plymouth_info
- Changes to getappcore version 1.53.02
+ The location of chkbin was updated earlier. This documents that
change (bsc#1205533, bsc#1204942)
- suse-build-key
-
- add and run a import-suse-build-key scripts, this will be ran
after installation with libzypp based installers. (jsc#PED-2777)
- suse-module-tools
-
- Update to version 15.3.17:
* blacklist RNDIS modules (bsc#1205767, jsc#PED-5731, CVE-2023-23559)
* modprobe.conf: Blacklist cls_tcindex module (bsc#1210335, CVE-2023-1829)
- Update to version 15.3.16:
* modprobe.conf: s390x: remove softdep on fbcon (boo#1207853)
- vim
-
- Updated to version 9.0 with patch level 1894, fixes the following security problems
* Fixing bsc#1214922 (CVE-2023-4738) - VUL-0: CVE-2023-4738: vim: heap-buffer-overflow in vim_regsub_both
* Fixing bsc#1214924 (CVE-2023-4735) - VUL-0: CVE-2023-4735: vim: OOB Write ops.c
* Fixing bsc#1214925 (CVE-2023-4734) - VUL-0: CVE-2023-4734: vim: segmentation fault in function f_fullcommand
* Fixing bsc#1215004 (CVE-2023-4733) - VUL-0: CVE-2023-4733: vim: use-after-free in function buflist_altfpos
* Fixing bsc#1215006 (CVE-2023-4752) - VUL-0: CVE-2023-4752: vim: Heap Use After Free in function ins_compl_get_exp
* Fixing bsc#1215033 (CVE-2023-4781) - VUL-0: CVE-2023-4781: vim: heap-buffer-overflow in function vim_regsub_both
- drop patches: disable-unreliable-tests.patch
ignore-flaky-test-failure.patch
vim-8.1.0297-dump3.patch
- droped %check - most of tests didn't work correctly in OBS
and maitenace burden of this was getting too big
- for the complete list of changes see
https://github.com/vim/vim/compare/v9.0.1632...v9.0.1894
- Use app icon generated from vimlogo.eps in source tarball; add
higher res icons of sizes 128, 256, and 512px as png sources.
Our current icons deviate from upstream flatpaks for example.
- Updated to version 9.0 with patch level 1632
- for the complete list of changes see
https://github.com/vim/vim/compare/v9.0.1443...v9.0.1632
- xen
-
- bsc#1215744 - VUL-0: CVE-2023-34323: xen: xenstored: A
transaction conflict can crash C Xenstored (XSA-440)
xsa440.patch
- bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU
TLB flushing (XSA-442)
xsa442.patch
- bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple
vulnerabilities in libfsimage disk handling (XSA-443)
xsa443-01.patch
xsa443-02.patch
xsa443-03.patch
xsa443-04.patch
xsa443-05.patch
xsa443-06.patch
xsa443-07.patch
xsa443-08.patch
xsa443-09.patch
xsa443-10.patch
xsa443-11.patch
- bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD:
Debug Mask handling (XSA-444)
xsa444-1.patch
xsa444-2.patch
- bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional
execution leak via division by zero (XSA-439)
xsa439-01.patch
xsa439-02.patch
xsa439-03.patch
xsa439-04.patch
xsa439-05.patch
xsa439-06.patch
xsa439-07.patch
xsa439-08.patch
xsa439-09.patch
- bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow
reference dropped too early for 64-bit PV guests (XSA-438)
xsa438.patch
- bsc#1213616 - VUL-0: CVE-2023-20593: xen: x86/AMD: Zenbleed
(XSA-433)
64e5b4ac-x86-AMD-extend-Zenbleed-check.patch
- Handle potential unaligned access to bitmap in
libxc-sr-restore-hvm-legacy-superpage.patch
If setting BITS_PER_LONG at once, the initial bit must be aligned
- Update to Xen 4.14.6 bug fix release (bsc#1027519)
xen-4.14.6-testing-src.tar.bz2
* No upstream changelog found in sources or webpage
- bsc#1214082 - VUL-0: CVE-2023-20569: xen: x86/AMD: Speculative
Return Stack Overflow (XSA-434)
- bsc#1214083 - VUL-0: CVE-2022-40982: xen: x86/Intel: Gather Data
Sampling (XSA-435)
- Dropped patches contained in new tarball
62a1e594-x86-clean-up-_get_page_type.patch
62a1e5b0-x86-ABAC-race-in-_get_page_type.patch
62a1e5d2-x86-introduce-_PAGE_-for-mem-types.patch
62a1e5f0-x86-dont-change-cacheability-of-directmap.patch
62a1e60e-x86-split-cache_flush-out-of-cache_writeback.patch
62a1e62b-x86-AMD-work-around-CLFLUSH-ordering.patch
62a1e649-x86-track-and-flush-non-coherent.patch
62ab0fab-x86-spec-ctrl-VERW-flushing-runtime-cond.patch
62ab0fac-x86-spec-ctrl-enum-for-MMIO-Stale-Data.patch
62ab0fad-x86-spec-ctrl-add-unpriv-mmio.patch
62bdd840-x86-spec-ctrl-only-adjust-idle-with-legacy-IBRS.patch
62bdd841-x86-spec-ctrl-knobs-for-STIBP-and-PSFD.patch
62cc31ee-cmdline-extend-parse_boolean.patch
62cc31ef-x86-spec-ctrl-fine-grained-cmdline-subopts.patch
62cd91d0-x86-spec-ctrl-rework-context-switching.patch
62cd91d1-x86-spec-ctrl-rename-SCF_ist_wrmsr.patch
62cd91d2-x86-spec-ctrl-rename-opt_ibpb.patch
62cd91d3-x86-spec-ctrl-rework-SPEC_CTRL_ENTRY_FROM_INTR_IST.patch
62cd91d4-x86-spec-ctrl-IBPB-on-entry.patch
62cd91d5-x86-cpuid-BTC_NO-enum.patch
62cd91d6-x86-spec-ctrl-enable-Zen2-chickenbit.patch
62cd91d7-x86-spec-ctrl-mitigate-Branch-Type-Confusion.patch
62dfe40a-x86-mm-gpt-TLB-flush-condition.patch
62f27ebd-x86-expose-more-MSR_ARCH_CAPS-to-hwdom.patch
62f51e16-x86-spec-ctrl-enum-PBRSB_NO.patch
62f523da-AMD-setup_force_cpu_cap-BSP-only.patch
63455f82-Arm-P2M-prevent-adding-mapping-when-dying.patch
63455fa8-Arm-P2M-preempt-when-freeing-intermediate.patch
63455fc3-x86-p2m_teardown-allow-skip-root-pt-removal.patch
63455fe4-x86-HAP-monitor-table-error-handling.patch
63456000-x86-tolerate-sh_set_toplevel_shadow-failure.patch
6345601d-x86-tolerate-shadow_prealloc-failure.patch
6345603a-x86-P2M-refuse-new-alloc-for-dying.patch
63456057-x86-P2M-truly-free-paging-pool-for-dying.patch
63456075-x86-P2M-free-paging-pool-preemptively.patch
63456090-x86-p2m_teardown-preemption.patch
63456175-libxl-per-arch-extra-default-paging-memory.patch
63456177-Arm-construct-P2M-pool-for-guests.patch
6345617a-Arm-XEN_DOMCTL_shadow_op.patch
6345617c-Arm-take-P2M-pages-P2M-pool.patch
634561aa-gnttab-locking-on-transitive-copy-error-path.patch
6351095c-Arm-rework-p2m_init.patch
6351096a-Arm-P2M-populate-pages-for-GICv2-mapping.patch
63569723-x86-shadow-replace-bogus-assertions.patch
636a9130-x86-spec-ctrl-Enumeration-for-IBPB_RET.patch
636a9130-x86-spec-ctrl-Mitigate-IBPB-not-flushing-the-RSB-RAS.patch
xsa326-01.patch
xsa326-02.patch
xsa326-03.patch
xsa326-04.patch
xsa326-05.patch
xsa326-06.patch
xsa326-07.patch
xsa326-08.patch
xsa326-09.patch
xsa326-10.patch
xsa326-11.patch
xsa326-12.patch
xsa326-13.patch
xsa326-14.patch
xsa326-15.patch
xsa326-16.patch
xsa403.patch
xsa414.patch
xsa415.patch
xsa416.patch
xsa417.patch
xsa418-01.patch
xsa418-02.patch
xsa418-03.patch
xsa418-04.patch
xsa418-05.patch
xsa418-06.patch
xsa419-01.patch
xsa419-02.patch
xsa419-03.patch
xsa421-01.patch
xsa421-02.patch
xsa427.patch
xsa428-1.patch
xsa428-2.patch
xsa429.patch
xsa433.patch
- Handle potential off-by-one errors in libxc-sr-xg_sr_bitmap.patch
A bit is an index in bitmap, while bits is the allocated size
of the bitmap.
- bsc#1213616 - VUL-0: CVE-2023-20593: xen: x86/AMD: Zenbleed
(XSA-433)
xsa433.patch
- Updated fix for XSA-417 (bsc#1204489)
64ba268b-xenstore-fix-XSA-417.patch
- zypper
-
- Fix name of the bash completion script (bsc#1215007)
In 1.14.63 the location of the bash completion script was changed
to /usr/share/bash-completion/completions/. But the patch failed
to also rename the completion script. The original script name
zypper.sh is not recognized at the new location.
- Update notes about failing signature checks (bsc#1214395)
It might be a transient issue if the server is in the midst of
receiving new data. Retry after a few minutes might work.
- Improve the SIGINT handler to be signal safe (bsc#1214292)
This patch updates the SIGINT handling strategy to be signal
safe. Meaning the signal handler will do not much more than
setting a flag, which we are going to check in the normal program
flow as much as possible.
- version 1.14.64
- Changed location of bash completion script (bsc#1213854).
This changes the location of zypper.sh bash completion script
from /usr/share/bash-completion/completions/.
- version 1.14.63
- man: revised explanation of --force-resolution (bsc#1213557)
Point out that the option not only allows to remove packages but
may also violate any other active policy if there is no other way
to resolve the job.
- Print summary hint if policies were violated due to
- -force-resolution (bsc#1213557)
- BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui)
- version 1.14.62