SUSE Container Update Advisory: bci/openjdk-devel
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2024:274-1
Container Tags        : bci/openjdk-devel:17 , bci/openjdk-devel:17-15.10 , bci/openjdk-devel:latest
Container Release     : 15.10
Severity              : important
Type                  : security
References            : 1211188 1211190 1217000 1218126 1218186 1218209 1218475 CVE-2023-1667
                        CVE-2023-2283 CVE-2023-48795 CVE-2023-6004 CVE-2023-6918 CVE-2024-22365
-----------------------------------------------------------------

The container bci/openjdk-devel was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2024:136-1
Released:    Thu Jan 18 09:53:47 2024
Summary:     Security update for pam
Type:        security
Severity:    moderate
References:  1217000,1218475,CVE-2024-22365
This update for pam fixes the following issues:

- CVE-2024-22365: Fixed a local denial of service during PAM login
  due to a missing check during path manipulation (bsc#1218475).
- Check localtime_r() return value to fix crashing (bsc#1217000) 

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2024:140-1
Released:    Thu Jan 18 11:34:58 2024
Summary:     Security update for libssh
Type:        security
Severity:    important
References:  1211188,1211190,1218126,1218186,1218209,CVE-2023-1667,CVE-2023-2283,CVE-2023-48795,CVE-2023-6004,CVE-2023-6918
This update for libssh fixes the following issues:

Security fixes:

  - CVE-2023-6004: Fixed command injection using proxycommand (bsc#1218209)
  - CVE-2023-48795: Fixed potential downgrade attack using strict kex (bsc#1218126)
  - CVE-2023-6918: Fixed missing checks for return values of MD functions (bsc#1218186)
  - CVE-2023-1667: Fixed NULL dereference during rekeying with algorithm  guessing (bsc#1211188)
  - CVE-2023-2283: Fixed possible authorization bypass in pki_verify_data_signature under low-memory conditions (bsc#1211190)

Other fixes:

- Update to version 0.9.8
  - Allow @ in usernames when parsing from URI composes

- Update to version 0.9.7
  - Fix several memory leaks in GSSAPI handling code

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2024:163-1
Released:    Fri Jan 19 05:47:04 2024
Summary:     Recommended update for google-guice
Type:        recommended
Severity:    moderate
References:  
This update for google-guice fixes the following issues:

- google-guice was updated from version 4.1 to 5.1.0:
  * Changes of version 4.2:
    + Added Java 9 and JPMS support
    + Multibindings are now in the Guice core artifact.
      The multibindings artifact is empty to prevent confusion
      during upgrading and will be removed in a later release.
    + Improved the performance of guice provisioning (by about 20%)
      by changing the way errors are reported. Guice will no longer
      report multiple errors during provisioning (Guice still
      reports multiple errors during injector creation).
    + Improved error messages for a missing binding.
    + AbstractModule.configure() is non-abstract to allow modules
      with only @Provides/@ProvidesIntoSet/... methods.
    + Added a CheckedProviders class.
    + Changed the way Singletons work to not rely on ThreadLocals nor
      WeakReferences.
    + Added MapBinderBinding.getEntries(Iterable).
    + Deprecated ProvisionListener.ProvisionInvocation
      .getDependencyChain().
    + Ensure that Struts interceptors are populated even if they are
      created after the injector (Fixes #1081, #1075).
    + Added support for multibindings with annotations in the Guice
      DaggerMethodScanner.
  * Changes of version 4.2.1:
    + Added Java 10 support (updated cglib & asm).
    + Minor updates to the testlib extension.
  * Changes of version 4.2.2:
    + Added Java 11 support (updated cglib & asm)
  * Changes of version 4.2.3:
    + Added Java 14 support (updated asm).
    + Added Injector.getElements API, to expose all Element SPI
      types from the Injector.
    + Added Injector.getAllMembersInjectorInjectionPoints API,
      to expose injection points created by arbitrary members
      injection.
    + Added getAlternateKeys to Multibinder SPI types
      (MultibinderBinding, MapBinderBinding, OptionalBinderBinding),
      to explicitly list the other keys these bindings are
      available as.
    + Scan for (and bind) @Provides-like methods in a consistent
      ordering, rather than relying on the non-deterministic
      Class.getDeclaredMembers ordering.
    + Updated DaggerAdapter to work with newer dagger code.
    + Fixed a subtle bug with eager singleton evaluation.
    + Updated @RequestScope's scope annotation to the JSR330 @Scope,
      so it can be reused by non-Guice DI systems.
    + Clarified the error message when an injectable constructor is
      missing.
    + Added deprecated overloads to various Modules methods, to make
      it clearer when calling them is unnecessary.
    + Added factory methods to Modules for common Binder
      configuration methods, to make it easier to configure them.
  * Changes of version 5.0.1:
    + Added Java 15 support (updated asm and bug fixes).
    + Removed cglib as a core dependency.
    + Improved error messages.
    + Improved support for using Guice with Kotlin.
    + Added a mechanism to restrict who can bind types or
      annotations, to allow library authors to control their
      bindings.
    + Removed no-aop build variant.
    + Fixed 'illegal reflective access' warnings.
  * Changes of version 5.1.0:
    + Added support for Java 17.
- Generate the ant build system using the maven pom files.


The following package changes have been done:

- libssh-config-0.9.8-150400.3.3.1 updated
- libssh4-0.9.8-150400.3.3.1 updated
- pam-1.3.0-150000.6.66.1 updated
- google-guice-5.1.0-150200.3.7.1 updated
- container:bci-openjdk-17-15.5.17-15.3 updated