Security update for cryptctl
Announcement ID: | SUSE-SU-2021:2137-1 |
---|---|
Rating: | important |
References: | |
Cross-References: | |
CVSS scores: |
|
Affected Products: |
|
An update that solves one vulnerability can now be installed.
Description:
This update for cryptctl fixes the following issues:
Update to version 2.4:
- CVE-2019-18906: Client side password hashing was equivalent to clear text password storage (bsc#1186226)
- First step to use plain text password instead of hashed password.
- Move repository into the SUSE github organization
- in RPC server, if client comes from localhost, remember its ipv4 localhost address instead of ipv6 address
- tell a record to clear expired pending commands upon saving a command result; introduce pending commands RPC test case
- avoid hard coding 127.0.0.1 in host ID of alive message test; let system administrator mount and unmount disks by issuing these two commands on key server.
Patch Instructions:
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
-
SUSE Linux Enterprise Server for SAP Applications 12 SP3
zypper in -t patch SUSE-SLE-SAP-12-SP3-2021-2137=1
-
SUSE Linux Enterprise Server for SAP Applications 12 SP4
zypper in -t patch SUSE-SLE-SAP-12-SP4-2021-2137=1
-
SUSE Linux Enterprise Server for SAP Applications 12 SP5
zypper in -t patch SUSE-SLE-SERVER-12-SP5-2021-2137=1 SUSE-SLE-SAP-12-SP5-2021-2137=1
-
SUSE Linux Enterprise Server 12 SP5
zypper in -t patch SUSE-SLE-SERVER-12-SP5-2021-2137=1
-
SUSE Linux Enterprise High Performance Computing 12 SP5
zypper in -t patch SUSE-SLE-SERVER-12-SP5-2021-2137=1
Package List:
-
SUSE Linux Enterprise Server for SAP Applications 12 SP3 (ppc64le x86_64)
- cryptctl-2.4-2.10.1
- cryptctl-debuginfo-2.4-2.10.1
-
SUSE Linux Enterprise Server for SAP Applications 12 SP4 (ppc64le x86_64)
- cryptctl-2.4-2.10.1
- cryptctl-debuginfo-2.4-2.10.1
-
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (ppc64le x86_64)
- cryptctl-2.4-2.10.1
- cryptctl-debuginfo-2.4-2.10.1
-
SUSE Linux Enterprise Server 12 SP5 (ppc64le x86_64)
- cryptctl-2.4-2.10.1
- cryptctl-debuginfo-2.4-2.10.1
-
SUSE Linux Enterprise High Performance Computing 12 SP5 (x86_64)
- cryptctl-2.4-2.10.1
- cryptctl-debuginfo-2.4-2.10.1