Security update for corosync
Announcement ID: | SUSE-SU-2018:1130-1 |
---|---|
Rating: | important |
References: | |
Cross-References: | |
CVSS scores: |
|
Affected Products: |
|
An update that solves one vulnerability and has three security fixes can now be installed.
Description:
This update for corosync provides the following fixes:
- CVE-2018-1084: Integer overflow in totemcrypto:authenticate_nss_2_3() could lead to command execution (bsc#1089346)
- Providing an empty uid or gid results in coroparse adding uid 0. (bsc#1066585)
- Fix a problem that was causing corosync memory to increase on ring breakup. (bsc#1083030)
- Fix a problem with configuration file incompatibilities that was causing corosync to not work after upgrading from SLE-11-SP4-HA to SLE-12/15-HA. (bsc#1083561)
Patch Instructions:
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
-
SUSE Linux Enterprise High Availability Extension 12 SP2
zypper in -t patch SUSE-SLE-HA-12-SP2-2018-775=1
-
SUSE Linux Enterprise Server for SAP Applications 12 SP2
zypper in -t patch SUSE-SLE-HA-12-SP2-2018-775=1
Package List:
-
SUSE Linux Enterprise High Availability Extension 12 SP2 (ppc64le s390x x86_64)
- libcorosync4-debuginfo-2.3.5-6.23.1
- corosync-2.3.5-6.23.1
- corosync-debuginfo-2.3.5-6.23.1
- libcorosync4-2.3.5-6.23.1
- corosync-debugsource-2.3.5-6.23.1
-
SUSE Linux Enterprise Server for SAP Applications 12 SP2 (ppc64le x86_64)
- libcorosync4-debuginfo-2.3.5-6.23.1
- corosync-2.3.5-6.23.1
- corosync-debuginfo-2.3.5-6.23.1
- libcorosync4-2.3.5-6.23.1
- corosync-debugsource-2.3.5-6.23.1