SUSE Container Update Advisory: caasp/v4/389-ds
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2019:72-1
Container Tags        : caasp/v4/389-ds:1.4.0 , caasp/v4/389-ds:1.4.0-rev2 , caasp/v4/389-ds:1.4.0-rev2-build1.1 , caasp/v4/389-ds:beta
Container Release     : 1.1
Severity              : important
Type                  : security
References            : 1094814 1124847 1135123 1138459 1138939 1139083 1141093 1141853
                        CVE-2018-20852 CVE-2019-10160 CVE-2019-12900 CVE-2019-12904 CVE-2019-13050
-----------------------------------------------------------------

The container caasp/v4/389-ds was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:1971-1
Released:    Thu Jul 25 14:58:52 2019
Summary:     Security update for libgcrypt
Type:        security
Severity:    moderate
References:  1138939,CVE-2019-12904
This update for libgcrypt fixes the following issues:

Security issue fixed:

- CVE-2019-12904: Fixed a flush-and-reload side-channel attack in the AES implementation (bsc#1138939).

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2019:1994-1
Released:    Fri Jul 26 16:12:05 2019
Summary:     Recommended update for libxml2
Type:        recommended
Severity:    moderate
References:  1135123
This update for libxml2 fixes the following issues:

- Added a new configurable variable XPATH_DEFAULT_MAX_NODESET_LENGTH to avoid nodeset limit when processing large XML files. (bsc#1135123)

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:2004-1
Released:    Mon Jul 29 13:01:59 2019
Summary:     Security update for bzip2
Type:        security
Severity:    important
References:  1139083,CVE-2019-12900
This update for bzip2 fixes the following issues:

- Fixed a regression with the fix for CVE-2019-12900, which caused incompatibilities
  with files that used many selectors (bsc#1139083).

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:2006-1
Released:    Mon Jul 29 13:02:49 2019
Summary:     Security update for gpg2
Type:        security
Severity:    important
References:  1124847,1141093,CVE-2019-13050
This update for gpg2 fixes the following issues:

Security issue fixed:

- CVE-2019-13050: Fixed a denial of service attacks via big keys (bsc#1141093).

Non-security issue fixed:

- Allow coredumps in X11 desktop sessions (bsc#1124847)

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:2050-1
Released:    Tue Aug  6 09:42:37 2019
Summary:     Security update for python3
Type:        security
Severity:    important
References:  1094814,1138459,1141853,CVE-2018-20852,CVE-2019-10160
This update for python3 fixes the following issues:

Security issue fixed:

- CVE-2019-10160: Fixed a regression in urlparse() and urlsplit() introduced by the fix for CVE-2019-9636 (bsc#1138459).
- CVE-2018-20852: Fixed an information leak where cookies could be send to the wrong server because of incorrect domain validation (bsc#1141853).

Non-security issue fixed:

- Fixed an issue where the SIGINT signal was ignored or not handled (bsc#1094814).


The following package changes have been done:

- gpg2-2.2.5-4.11.1 updated
- libbz2-1-1.0.6-5.9.1 updated
- libgcrypt20-1.8.2-8.6.2 updated
- libpython3_6m1_0-3.6.8-3.23.1 updated
- libxml2-2-2.9.7-3.9.1 updated
- python3-base-3.6.8-3.23.1 updated
- python3-3.6.8-3.23.1 updated
- container:sles15-image-15.0.0-6.2.54 updated