Security update for corosync
Announcement ID: | SUSE-SU-2018:1121-1 |
---|---|
Rating: | important |
References: | |
Cross-References: | |
CVSS scores: |
|
Affected Products: |
|
An update that solves one vulnerability and has two security fixes can now be installed.
Description:
This update for corosync fixes the following issue: - CVE-2018-1084: Integer overflow in totemcrypto:authenticate_nss_2_3() could lead to command execution (bsc#1089346) - Providing an empty uid or gid results in coroparse adding uid 0. (bsc#1066585) - Fix a problem with configuration file incompatibilities that was causing corosync to not work after upgrading from SLE-11-SP4-HA to SLE-12/15-HA. (bsc#1083561)
Patch Instructions:
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
-
SUSE Linux Enterprise Server for SAP Applications 12 SP3
zypper in -t patch SUSE-SLE-HA-12-SP3-2018-771=1
-
SUSE Linux Enterprise High Availability Extension 12 SP3
zypper in -t patch SUSE-SLE-HA-12-SP3-2018-771=1
-
SUSE Linux Enterprise Software Development Kit 12 SP3
zypper in -t patch SUSE-SLE-SDK-12-SP3-2018-771=1
Package List:
-
SUSE Linux Enterprise Server for SAP Applications 12 SP3 (ppc64le x86_64)
- libcorosync4-2.3.6-9.13.1
- libcorosync4-debuginfo-2.3.6-9.13.1
- corosync-debuginfo-2.3.6-9.13.1
- corosync-2.3.6-9.13.1
- corosync-debugsource-2.3.6-9.13.1
-
SUSE Linux Enterprise High Availability Extension 12 SP3 (ppc64le s390x x86_64)
- libcorosync4-2.3.6-9.13.1
- libcorosync4-debuginfo-2.3.6-9.13.1
- corosync-debuginfo-2.3.6-9.13.1
- corosync-2.3.6-9.13.1
- corosync-debugsource-2.3.6-9.13.1
-
SUSE Linux Enterprise Software Development Kit 12 SP3 (aarch64 ppc64le s390x x86_64)
- corosync-debuginfo-2.3.6-9.13.1
- libcorosync-devel-2.3.6-9.13.1
- corosync-debugsource-2.3.6-9.13.1