: Incorrect Default Permissions vulnerability in libzypp of SUSE CaaS Platform 3.0, SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allowed local attackers to read a cookie store used by libzypp, exposing private cookies. This issue affects: SUSE CaaS Platform 3.0 libzypp versions prior to 16.21.2-27.68.1. SUSE Linux Enterprise Server 12 libzypp versions prior to 16.21.2-2.45.1. SUSE Linux Enterprise Server 15 17.19.0-3.34.1.

This update for libzypp fixes the following issues :

Security issue fixed :

CVE-2019-18900: Fixed assert cookie file that was world readable (bsc#1158763).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libzypp, zypper fixes the following issues :

libzypp fixes the following security issue :

CVE-2019-18900: Fixed assert cookie file that was world readable (bsc#1158763).

zypper was updated to fix the following issues :

Fixed an issue, where zypper crashed when the system language is set to Spanish and the user tried to patch their system with 'zypper patch

--category security' (bsc#1178038)

Fixed a typo in man page (bsc#1169947)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there was an issue where incorrect default permissions on a HTTP cookie store could have allowed local attackers to read private credentials.

For Debian 8 'Jessie', this issue has been fixed in libzypp version 14.29.1-2+deb8u1.

We recommend that you upgrade your libzypp packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libsolv, libzypp, zypper fixes the following issues :

Security issue fixed :

  - CVE-2019-18900: Fixed assert cookie file that was world     readable (bsc#1158763).

Bug fixes

  - Fixed removing orphaned packages dropped by     to-be-installed products (bsc#1155819).

  - Adds libzypp API to mark all obsolete kernels according     to the existing purge-kernel script rules (bsc#1155198).

  - Do not enforce 'en' being in RequestedLocales If the     user decides to have a system without explicit language     support he may do so (bsc#1155678). 

  - Load only target resolvables for zypper rm     (bsc#1157377).

  - Fix broken search by filelist (bsc#1135114).

  - Replace python by a bash script in zypper-log     (fixes#304, fixes#306, bsc#1156158).

  - Do not sort out requested locales which are not     available (bsc#1155678).

  - Prevent listing duplicate matches in tables. XML result     is provided within the new list-patches-byissue element     (bsc#1154805). 

  - XML add patch issue-date and issue-list (bsc#1154805).

  - Fix zypper lp --cve/bugzilla/issue options     (bsc#1155298).

  - Always execute commit when adding/removing locales     (fixes bsc#1155205).

  - Fix description of --table-style,-s in man page     (bsc#1154804).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for libsolv, libzypp, zypper fixes the following issues :

Security issue fixed :

CVE-2019-18900: Fixed assert cookie file that was world readable (bsc#1158763).

Bug fixes Fixed removing orphaned packages dropped by to-be-installed products (bsc#1155819).

Adds libzypp API to mark all obsolete kernels according to the existing purge-kernel script rules (bsc#1155198).

Do not enforce 'en' being in RequestedLocales If the user decides to have a system without explicit language support he may do so (bsc#1155678).

Load only target resolvables for zypper rm (bsc#1157377).

Fix broken search by filelist (bsc#1135114).

Replace python by a bash script in zypper-log (fixes#304, fixes#306, bsc#1156158).

Do not sort out requested locales which are not available (bsc#1155678).

Prevent listing duplicate matches in tables. XML result is provided within the new list-patches-byissue element (bsc#1154805).

XML add patch issue-date and issue-list (bsc#1154805).

Fix zypper lp --cve/bugzilla/issue options (bsc#1155298).

Always execute commit when adding/removing locales (fixes bsc#1155205).

Fix description of --table-style,-s in man page (bsc#1154804).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
144032	SUSE SLES12 Security Update : libzypp (SUSE-SU-2020:0079-2)	Nessus	SuSE Local Security Checks	low
143855	SUSE SLES12 Security Update : libzypp, zypper (SUSE-SU-2020:3367-1)	Nessus	SuSE Local Security Checks	low
134242	Debian DLA-2132-1 : libzypp security update	Nessus	Debian Local Security Checks	low
134156	openSUSE Security Update : libsolv / libzypp / zypper (openSUSE-2020-255)	Nessus	SuSE Local Security Checks	low
133948	SUSE SLED15 / SLES15 Security Update : libsolv, libzypp, zypper (SUSE-SU-2020:0432-1)	Nessus	SuSE Local Security Checks	low
132923	SUSE SLED15 / SLES15 Security Update : libsolv, libzypp, zypper (SUSE-SU-2020:0087-1)	Nessus	SuSE Local Security Checks	low
132922	SUSE SLED12 / SLES12 Security Update : libzypp (SUSE-SU-2020:0079-1)	Nessus	SuSE Local Security Checks	low

Detections

Analytics

CVE-2019-18900

low

Tenable Plugins

low

low

low

low

low

low

low