Security update for libgda SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:3016-1 Final 1 1 2022-09-05T07:58:24Z current 2022-09-05T07:58:24Z 2022-09-05T07:58:24Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libgda This update for libgda fixes the following issues: - CVE-2021-39359: Enabled TLS certificate verification (bsc#1189849). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-3016,SUSE-OpenStack-Cloud-9-2022-3016,SUSE-OpenStack-Cloud-Crowbar-9-2022-3016,SUSE-SLE-SAP-12-SP4-2022-3016,SUSE-SLE-SDK-12-SP5-2022-3016,SUSE-SLE-SERVER-12-SP2-BCL-2022-3016,SUSE-SLE-SERVER-12-SP3-BCL-2022-3016,SUSE-SLE-SERVER-12-SP4-LTSS-2022-3016,SUSE-SLE-SERVER-12-SP5-2022-3016,SUSE-SLE-WE-12-SP5-2022-3016 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20223016-1/ Link for SUSE-SU-2022:3016-1 https://lists.suse.com/pipermail/sle-security-updates/2022-September/012076.html E-Mail link for SUSE-SU-2022:3016-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1189849 SUSE Bug 1189849 https://www.suse.com/security/cve/CVE-2021-39359/ SUSE CVE CVE-2021-39359 page SUSE Linux Enterprise Server 12 SP2-BCL SUSE Linux Enterprise Server 12 SP3-BCL SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE Linux Enterprise Workstation Extension 12 SP5 SUSE OpenStack Cloud 9 SUSE OpenStack Cloud Crowbar 9 libgda-5_0-4-5.2.4-9.3.1 libgda-5_0-4-lang-5.2.4-9.3.1 libgda-5_0-bdb-5.2.4-9.3.1 libgda-5_0-devel-5.2.4-9.3.1 libgda-5_0-doc-5.2.4-9.3.1 libgda-5_0-firebird-5.2.4-9.3.1 libgda-5_0-jdbc-5.2.4-9.3.1 libgda-5_0-ldap-5.2.4-9.3.1 libgda-5_0-mdb-5.2.4-9.3.1 libgda-5_0-mysql-5.2.4-9.3.1 libgda-5_0-postgres-5.2.4-9.3.1 libgda-5_0-sqlcipher-5.2.4-9.3.1 libgda-5_0-sqlite-5.2.4-9.3.1 libgda-5_0-tools-5.2.4-9.3.1 libgda-5_0-web-5.2.4-9.3.1 libgda-report-5_0-4-5.2.4-9.3.1 libgda-tools-5.2.4-9.3.1 libgda-ui-5_0-4-5.2.4-9.3.1 libgda-ui-5_0-plugins-5.2.4-9.3.1 libgda-ui-5_0-tools-5.2.4-9.3.1 libgda-xslt-5_0-4-5.2.4-9.3.1 typelib-1_0-Gda-5_0-5.2.4-9.3.1 typelib-1_0-Gdaui-5_0-5.2.4-9.3.1 libgda-5_0-4-5.2.4-9.3.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL libgda-5_0-mysql-5.2.4-9.3.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL libgda-5_0-postgres-5.2.4-9.3.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL libgda-5_0-sqlite-5.2.4-9.3.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL libgda-ui-5_0-4-5.2.4-9.3.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL libgda-5_0-4-5.2.4-9.3.1 as a component of SUSE Linux Enterprise Server 12 SP3-BCL libgda-5_0-mysql-5.2.4-9.3.1 as a component of SUSE Linux Enterprise Server 12 SP3-BCL libgda-5_0-postgres-5.2.4-9.3.1 as a component of SUSE Linux Enterprise Server 12 SP3-BCL libgda-5_0-sqlite-5.2.4-9.3.1 as a component of SUSE Linux Enterprise Server 12 SP3-BCL libgda-ui-5_0-4-5.2.4-9.3.1 as a component of SUSE Linux Enterprise Server 12 SP3-BCL libgda-5_0-4-5.2.4-9.3.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS libgda-5_0-mysql-5.2.4-9.3.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS libgda-5_0-postgres-5.2.4-9.3.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS libgda-5_0-sqlite-5.2.4-9.3.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS libgda-ui-5_0-4-5.2.4-9.3.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS libgda-5_0-4-5.2.4-9.3.1 as a component of SUSE Linux Enterprise Server 12 SP5 libgda-5_0-mysql-5.2.4-9.3.1 as a component of SUSE Linux Enterprise Server 12 SP5 libgda-5_0-postgres-5.2.4-9.3.1 as a component of SUSE Linux Enterprise Server 12 SP5 libgda-5_0-sqlite-5.2.4-9.3.1 as a component of SUSE Linux Enterprise Server 12 SP5 libgda-ui-5_0-4-5.2.4-9.3.1 as a component of SUSE Linux Enterprise Server 12 SP5 libgda-5_0-4-5.2.4-9.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libgda-5_0-mysql-5.2.4-9.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libgda-5_0-postgres-5.2.4-9.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libgda-5_0-sqlite-5.2.4-9.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libgda-ui-5_0-4-5.2.4-9.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libgda-5_0-4-5.2.4-9.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libgda-5_0-mysql-5.2.4-9.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libgda-5_0-postgres-5.2.4-9.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libgda-5_0-sqlite-5.2.4-9.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libgda-ui-5_0-4-5.2.4-9.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libgda-5_0-devel-5.2.4-9.3.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 typelib-1_0-Gda-5_0-5.2.4-9.3.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 typelib-1_0-Gdaui-5_0-5.2.4-9.3.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libgda-5_0-4-lang-5.2.4-9.3.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 libgda-5_0-4-5.2.4-9.3.1 as a component of SUSE OpenStack Cloud 9 libgda-5_0-mysql-5.2.4-9.3.1 as a component of SUSE OpenStack Cloud 9 libgda-5_0-postgres-5.2.4-9.3.1 as a component of SUSE OpenStack Cloud 9 libgda-5_0-sqlite-5.2.4-9.3.1 as a component of SUSE OpenStack Cloud 9 libgda-ui-5_0-4-5.2.4-9.3.1 as a component of SUSE OpenStack Cloud 9 libgda-5_0-4-5.2.4-9.3.1 as a component of SUSE OpenStack Cloud Crowbar 9 libgda-5_0-mysql-5.2.4-9.3.1 as a component of SUSE OpenStack Cloud Crowbar 9 libgda-5_0-postgres-5.2.4-9.3.1 as a component of SUSE OpenStack Cloud Crowbar 9 libgda-5_0-sqlite-5.2.4-9.3.1 as a component of SUSE OpenStack Cloud Crowbar 9 libgda-ui-5_0-4-5.2.4-9.3.1 as a component of SUSE OpenStack Cloud Crowbar 9 In GNOME libgda through 6.0.0, gda-web-provider.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011. CVE-2021-39359 SUSE Linux Enterprise Server 12 SP2-BCL:libgda-5_0-4-5.2.4-9.3.1 SUSE Linux Enterprise Server 12 SP2-BCL:libgda-5_0-mysql-5.2.4-9.3.1 SUSE Linux Enterprise Server 12 SP2-BCL:libgda-5_0-postgres-5.2.4-9.3.1 SUSE Linux Enterprise Server 12 SP2-BCL:libgda-5_0-sqlite-5.2.4-9.3.1 SUSE Linux Enterprise Server 12 SP2-BCL:libgda-ui-5_0-4-5.2.4-9.3.1 SUSE Linux Enterprise Server 12 SP3-BCL:libgda-5_0-4-5.2.4-9.3.1 SUSE Linux Enterprise Server 12 SP3-BCL:libgda-5_0-mysql-5.2.4-9.3.1 SUSE Linux Enterprise Server 12 SP3-BCL:libgda-5_0-postgres-5.2.4-9.3.1 SUSE Linux Enterprise Server 12 SP3-BCL:libgda-5_0-sqlite-5.2.4-9.3.1 SUSE Linux Enterprise Server 12 SP3-BCL:libgda-ui-5_0-4-5.2.4-9.3.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libgda-5_0-4-5.2.4-9.3.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libgda-5_0-mysql-5.2.4-9.3.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libgda-5_0-postgres-5.2.4-9.3.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libgda-5_0-sqlite-5.2.4-9.3.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libgda-ui-5_0-4-5.2.4-9.3.1 SUSE Linux Enterprise Server 12 SP5:libgda-5_0-4-5.2.4-9.3.1 SUSE Linux Enterprise Server 12 SP5:libgda-5_0-mysql-5.2.4-9.3.1 SUSE Linux Enterprise Server 12 SP5:libgda-5_0-postgres-5.2.4-9.3.1 SUSE Linux Enterprise Server 12 SP5:libgda-5_0-sqlite-5.2.4-9.3.1 SUSE Linux Enterprise Server 12 SP5:libgda-ui-5_0-4-5.2.4-9.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libgda-5_0-4-5.2.4-9.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libgda-5_0-mysql-5.2.4-9.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libgda-5_0-postgres-5.2.4-9.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libgda-5_0-sqlite-5.2.4-9.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libgda-ui-5_0-4-5.2.4-9.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libgda-5_0-4-5.2.4-9.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libgda-5_0-mysql-5.2.4-9.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libgda-5_0-postgres-5.2.4-9.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libgda-5_0-sqlite-5.2.4-9.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libgda-ui-5_0-4-5.2.4-9.3.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libgda-5_0-devel-5.2.4-9.3.1 SUSE Linux Enterprise Software Development Kit 12 SP5:typelib-1_0-Gda-5_0-5.2.4-9.3.1 SUSE Linux Enterprise Software Development Kit 12 SP5:typelib-1_0-Gdaui-5_0-5.2.4-9.3.1 SUSE Linux Enterprise Workstation Extension 12 SP5:libgda-5_0-4-lang-5.2.4-9.3.1 SUSE OpenStack Cloud 9:libgda-5_0-4-5.2.4-9.3.1 SUSE OpenStack Cloud 9:libgda-5_0-mysql-5.2.4-9.3.1 SUSE OpenStack Cloud 9:libgda-5_0-postgres-5.2.4-9.3.1 SUSE OpenStack Cloud 9:libgda-5_0-sqlite-5.2.4-9.3.1 SUSE OpenStack Cloud 9:libgda-ui-5_0-4-5.2.4-9.3.1 SUSE OpenStack Cloud Crowbar 9:libgda-5_0-4-5.2.4-9.3.1 SUSE OpenStack Cloud Crowbar 9:libgda-5_0-mysql-5.2.4-9.3.1 SUSE OpenStack Cloud Crowbar 9:libgda-5_0-postgres-5.2.4-9.3.1 SUSE OpenStack Cloud Crowbar 9:libgda-5_0-sqlite-5.2.4-9.3.1 SUSE OpenStack Cloud Crowbar 9:libgda-ui-5_0-4-5.2.4-9.3.1 important 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223016-1/ https://www.suse.com/security/cve/CVE-2021-39359.html CVE-2021-39359 https://bugzilla.suse.com/1189849 SUSE Bug 1189849