Security update for autoyast2 SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2020:0676-1 Final 1 1 2020-05-22T16:16:13Z current 2020-05-22T16:16:13Z 2020-05-22T16:16:13Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for autoyast2 This update for autoyast2 to version 4.1.15 fixes the following issues: Security issue fixed: - CVE-2019-18905: Removed all '--gpg-auto-import-keys' options from zypper commands (bsc#1140711). Non-security issue fixed: - Fix desktop files updating some icons and groups (bsc#1168123). - Restored some missing icons (bsc#1168123, bsc#1109310 and bsc#1168281). - Service for init scripts: Try to start 'network-online.target' before starting the autoyast init scripts in order to get a working network (bsc#1164105). - Always re-probe storage after pre-scripts (bsc#1170082, bsc#1133045). This update was imported from the SUSE:SLE-15-SP1:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2020-676 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XBJUCPBSPOUJX5SNRMWLE7EDA3Y2ZTW3/ E-Mail link for openSUSE-SU-2020:0676-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1109310 SUSE Bug 1109310 https://bugzilla.suse.com/1133045 SUSE Bug 1133045 https://bugzilla.suse.com/1140711 SUSE Bug 1140711 https://bugzilla.suse.com/1164105 SUSE Bug 1164105 https://bugzilla.suse.com/1168123 SUSE Bug 1168123 https://bugzilla.suse.com/1168281 SUSE Bug 1168281 https://bugzilla.suse.com/1170082 SUSE Bug 1170082 https://www.suse.com/security/cve/CVE-2019-18905/ SUSE CVE CVE-2019-18905 page openSUSE Leap 15.1 autoyast2-4.1.15-lp151.2.12.1 autoyast2-installation-4.1.15-lp151.2.12.1 autoyast2-4.1.15-lp151.2.12.1 as a component of openSUSE Leap 15.1 autoyast2-installation-4.1.15-lp151.2.12.1 as a component of openSUSE Leap 15.1 A Insufficient Verification of Data Authenticity vulnerability in autoyast2 of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows remote attackers to MITM connections when deprecated and unused functionality of autoyast is used to create images. This issue affects: SUSE Linux Enterprise Server 12 autoyast2 version 4.1.9-3.9.1 and prior versions. SUSE Linux Enterprise Server 15 autoyast2 version 4.0.70-3.20.1 and prior versions. CVE-2019-18905 openSUSE Leap 15.1:autoyast2-4.1.15-lp151.2.12.1 openSUSE Leap 15.1:autoyast2-installation-4.1.15-lp151.2.12.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XBJUCPBSPOUJX5SNRMWLE7EDA3Y2ZTW3/ https://www.suse.com/security/cve/CVE-2019-18905.html CVE-2019-18905 https://bugzilla.suse.com/1140711 SUSE Bug 1140711