Security update for postfix SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:3732-1 Final 1 1 2023-09-22T11:35:26Z current 2023-09-22T11:35:26Z 2023-09-22T11:35:26Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for postfix This update for postfix fixes the following issues: Security fixes: - CVE-2023-32182: Fixed config_postfix SUSE specific script using potentially bad /tmp file (bsc#1211196). Other fixes: - postfix: config.postfix causes too tight permission on main.cf (bsc#1215372). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-3732,SUSE-SLE-SDK-12-SP5-2023-3732,SUSE-SLE-SERVER-12-SP5-2023-3732 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20233732-1/ Link for SUSE-SU-2023:3732-1 https://lists.suse.com/pipermail/sle-security-updates/2023-September/016291.html E-Mail link for SUSE-SU-2023:3732-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1211196 SUSE Bug 1211196 https://bugzilla.suse.com/1215372 SUSE Bug 1215372 https://www.suse.com/security/cve/CVE-2023-32182/ SUSE CVE CVE-2023-32182 page SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 postfix-3.2.10-3.27.2 postfix-devel-3.2.10-3.27.2 postfix-doc-3.2.10-3.27.2 postfix-mysql-3.2.10-3.27.2 postfix-postgresql-3.2.10-3.27.2 postfix-3.2.10-3.27.2 as a component of SUSE Linux Enterprise Server 12 SP5 postfix-doc-3.2.10-3.27.2 as a component of SUSE Linux Enterprise Server 12 SP5 postfix-mysql-3.2.10-3.27.2 as a component of SUSE Linux Enterprise Server 12 SP5 postfix-3.2.10-3.27.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 postfix-doc-3.2.10-3.27.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 postfix-mysql-3.2.10-3.27.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 postfix-devel-3.2.10-3.27.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 A Improper Link Resolution Before File Access ('Link Following') vulnerability in SUSE SUSE Linux Enterprise Desktop 15 SP5 postfix, SUSE SUSE Linux Enterprise High Performance Computing 15 SP5 postfix, SUSE openSUSE Leap 15.5 postfix.This issue affects SUSE Linux Enterprise Desktop 15 SP5: before 3.7.3-150500.3.5.1; SUSE Linux Enterprise High Performance Computing 15 SP5: before 3.7.3-150500.3.5.1; openSUSE Leap 15.5 : before 3.7.3-150500.3.5.1. CVE-2023-32182 SUSE Linux Enterprise Server 12 SP5:postfix-3.2.10-3.27.2 SUSE Linux Enterprise Server 12 SP5:postfix-doc-3.2.10-3.27.2 SUSE Linux Enterprise Server 12 SP5:postfix-mysql-3.2.10-3.27.2 SUSE Linux Enterprise Server for SAP Applications 12 SP5:postfix-3.2.10-3.27.2 SUSE Linux Enterprise Server for SAP Applications 12 SP5:postfix-doc-3.2.10-3.27.2 SUSE Linux Enterprise Server for SAP Applications 12 SP5:postfix-mysql-3.2.10-3.27.2 SUSE Linux Enterprise Software Development Kit 12 SP5:postfix-devel-3.2.10-3.27.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233732-1/ https://www.suse.com/security/cve/CVE-2023-32182.html CVE-2023-32182 https://bugzilla.suse.com/1211196 SUSE Bug 1211196