SUSE-SU-2022:1157-2

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2022/suse-su-20221157-2/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2022:1157-2.json
JSON Data
https://api.osv.dev/v1/vulns/SUSE-SU-2022:1157-2
Published
2022-07-14T09:34:28Z
Modified
2022-07-14T09:34:28Z
Summary
Security update for libsolv, libzypp, zypper
Details

This update for libsolv, libzypp, zypper fixes the following issues:

Security relevant fix:

  • Harden package signature checks (bsc#1184501).

libsolv update to 0.7.22:

  • reworked choice rule generation to cover more usecases
  • support SOLVABLE_PREREQ_IGNOREINST in the ordering code (bsc#1196514)
  • support parsing of Debian's Multi-Arch indicator
  • fix segfault on conflict resolution when using bindings
  • fix split provides not working if the update includes a forbidden vendor change
  • support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
  • support zstd compressed control files in debian packages
  • add an ifdef allowing to rename Solvable dependency members ('requires' is a keyword in C++20)
  • support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata
  • support queying of the custom vendor check function new function: pool_get_custom_vendorcheck
  • support solv files with an idarray block
  • allow accessing the toolversion at runtime

libzypp update to 17.30.0:

  • ZConfig: Update solver settings if target changes (bsc#1196368)
  • Fix possible hang in singletrans mode (bsc#1197134)
  • Do 2 retries if mount is still busy.
  • Fix package signature check (bsc#1184501) Pay attention that header and payload are secured by a valid signature and report more detailed which signature is missing.
  • Retry umount if device is busy (bsc#1196061, closes #381) A previously released ISO image may need a bit more time to release it's loop device. So we wait a bit and retry.
  • Fix serializing/deserializing type mismatch in zypp-rpm protocol (bsc#1196925)
  • Fix handling of ISO media in releaseAll (bsc#1196061)
  • Hint on common ptf resolver conflicts (bsc#1194848)
  • Hint on ptf<>patch resolver conflicts (bsc#1194848)

zypper update to 1.14.52:

  • info: print the packages upstream URL if available (fixes #426)
  • info: Fix SEGV with not installed PTFs (bsc#1196317)
  • Don't prevent less restrictive umasks (bsc#1195999)
References

Affected packages

SUSE:Linux Enterprise Micro 5.2 / libsolv

Package

Name
libsolv
Purl
pkg:rpm/suse/libsolv&distro=SUSE%20Linux%20Enterprise%20Micro%205.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.7.22-150200.12.1

Ecosystem specific 

{
    "binaries":  [
        {
            "libsolv-tools":  "0.7.22-150200.12.1",
            "libzypp":  "17.30.0-150200.36.1",
            "zypper":  "1.14.52-150200.30.2",
            "zypper-needs-restarting":  "1.14.52-150200.30.2"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2022:1157-2.json"

SUSE:Linux Enterprise Micro 5.2 / libzypp

Package

Name
libzypp
Purl
pkg:rpm/suse/libzypp&distro=SUSE%20Linux%20Enterprise%20Micro%205.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
17.30.0-150200.36.1

Ecosystem specific 

{
    "binaries":  [
        {
            "libsolv-tools":  "0.7.22-150200.12.1",
            "libzypp":  "17.30.0-150200.36.1",
            "zypper":  "1.14.52-150200.30.2",
            "zypper-needs-restarting":  "1.14.52-150200.30.2"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2022:1157-2.json"

SUSE:Linux Enterprise Micro 5.2 / zypper

Package

Name
zypper
Purl
pkg:rpm/suse/zypper&distro=SUSE%20Linux%20Enterprise%20Micro%205.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.14.52-150200.30.2

Ecosystem specific 

{
    "binaries":  [
        {
            "libsolv-tools":  "0.7.22-150200.12.1",
            "libzypp":  "17.30.0-150200.36.1",
            "zypper":  "1.14.52-150200.30.2",
            "zypper-needs-restarting":  "1.14.52-150200.30.2"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2022:1157-2.json"