SUSE Container Update Advisory: 
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2024:1619-1
Container Tags        : suse/sle-micro-rancher/5.4:latest
Container Release     : 3.2.249
Severity              : important
Type                  : security
References            : 1198101 1205588 1205855 1210382 1213945 1215098 1215099 1215100
                        1215101 1215102 1215103 1216474 1218871 1219460 1221123 1222831
                        1222992 CVE-2022-28737 CVE-2023-40546 CVE-2023-40547 CVE-2023-40548
                        CVE-2023-40549 CVE-2023-40550 CVE-2023-40551 CVE-2024-2961 
-----------------------------------------------------------------

The container  was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2024:1366-1
Released:    Mon Apr 22 11:04:32 2024
Summary:     Recommended update for openssh
Type:        recommended
Severity:    moderate
References:  1216474,1218871,1221123,1222831
This update for openssh fixes the following issues:

- Fix hostbased ssh login failing occasionally with 'signature
  unverified: incorrect signature' by fixing a typo in patch (bsc#1221123)
- Avoid closing IBM Z crypto devices nodes. (bsc#1218871)
- Allow usage of IBM Z crypto adapter cards in seccomp filters (bsc#1216474)

- Change the default value of UpdateHostKeys to Yes (unless
  VerifyHostKeyDNS is enabled).

  This makes ssh update the known_hosts stored keys with all published
  versions by the server (after it's authenticated with an existing
  key), which will allow to identify the server with a different key if
  the existing key is considered insecure at some point in the future
  (bsc#1222831).

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2024:1368-1
Released:    Mon Apr 22 11:06:29 2024
Summary:     Security update for shim
Type:        security
Severity:    important
References:  1198101,1205588,1205855,1210382,1213945,1215098,1215099,1215100,1215101,1215102,1215103,1219460,CVE-2022-28737,CVE-2023-40546,CVE-2023-40547,CVE-2023-40548,CVE-2023-40549,CVE-2023-40550,CVE-2023-40551
This update for shim fixes the following issues:

- Update shim-install to set the TPM2 SRK algorithm (bsc#1213945)
- Limit the requirement of fde-tpm-helper-macros to the distro with
  suse_version 1600 and above (bsc#1219460)

Update to version 15.8:

Security issues fixed:

- mok: fix LogError() invocation (bsc#1215099,CVE-2023-40546)
- avoid incorrectly trusting HTTP headers (bsc#1215098,CVE-2023-40547)
- Fix integer overflow on SBAT section size on 32-bit system (bsc#1215100,CVE-2023-40548)
- Authenticode: verify that the signature header is in bounds (bsc#1215101,CVE-2023-40549)
- pe: Fix an out-of-bound read in verify_buffer_sbat() (bsc#1215102,CVE-2023-40550)
- pe-relocate: Fix bounds check for MZ binaries (bsc#1215103,CVE-2023-40551)

        
The NX flag is disable which is same as the default value of shim-15.8, hence, not need to enable it by this patch now.

- Generate dbx during build so we don't include binary files in sources
- Don't require grub so shim can still be used with systemd-boot
- Update shim-install to fix boot failure of ext4 root file system
  on RAID10 (bsc#1205855)
- Adopt the macros from fde-tpm-helper-macros to update the
  signature in the sealed key after a bootloader upgrade

- Update shim-install to amend full disk encryption support
  - Adopt TPM 2.0 Key File for grub2 TPM 2.0 protector
  - Use the long name to specify the grub2 key protector
  - cryptodisk: support TPM authorized policies
  - Do not use tpm_record_pcrs unless the command is in command.lst

- Removed POST_PROCESS_PE_FLAGS=-N from the build command in shim.spec to
  enable the NX compatibility flag when using post-process-pe after
  discussed with grub2 experts in mail. It's useful for further development
  and testing. (bsc#1205588)

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2024:1375-1
Released:    Mon Apr 22 14:56:13 2024
Summary:     Security update for glibc
Type:        security
Severity:    important
References:  1222992,CVE-2024-2961
This update for glibc fixes the following issues:

- iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992)


The following package changes have been done:

- glibc-locale-base-2.31-150300.74.1 updated
- glibc-2.31-150300.74.1 updated
- openssh-clients-8.4p1-150300.3.37.1 updated
- openssh-common-8.4p1-150300.3.37.1 updated
- openssh-server-8.4p1-150300.3.37.1 updated
- openssh-8.4p1-150300.3.37.1 updated
- shim-15.8-150300.4.20.2 updated