openSUSE Security Update: Security update for shadowsocks-libev
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2019:2667-1
Rating:             moderate
References:         #1158251 #1158365 
Cross-References:   CVE-2019-5163 CVE-2019-5164
Affected Products:
                    openSUSE Leap 15.1
______________________________________________________________________________

   An update that fixes two vulnerabilities is now available.

Description:

   This update for shadowsocks-libev fixes the following issues:

   - Update version to 3.3.3
     * Refine the handling of suspicious connections.
     * Fix exploitable denial-of-service vulnerability exists in the UDPRelay
       functionality (boo#1158251, CVE-2019-5163)
     * Fix code execution vulnerability in the ss-manager binary
       (boo#1158365, CVE-2019-5164)
     * Refine the handling of fragment request.
     * Fix a high CPU bug introduced in 3.3.0. (#2449)
     * Enlarge the socket buffer size to 16KB.
     * Fix the empty list bug in ss-manager.
     * Fix the IPv6 address parser.
     * Fix a bug of port parser.
     * Fix a crash with MinGW.
     * Refine SIP003 plugin interface.
     * Remove connection timeout from all clients.
     * Fix the alignment bug again.
     * Fix a bug on 32-bit arch.
     * Add TCP fast open support to ss-tunnel by @PantherJohn.


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended
 installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Leap 15.1:

      zypper in -t patch openSUSE-2019-2667=1



Package List:

   - openSUSE Leap 15.1 (x86_64):

      libshadowsocks-libev2-3.3.3-lp151.2.3.1
      libshadowsocks-libev2-debuginfo-3.3.3-lp151.2.3.1
      shadowsocks-libev-3.3.3-lp151.2.3.1
      shadowsocks-libev-debuginfo-3.3.3-lp151.2.3.1
      shadowsocks-libev-debugsource-3.3.3-lp151.2.3.1
      shadowsocks-libev-devel-3.3.3-lp151.2.3.1

   - openSUSE Leap 15.1 (noarch):

      shadowsocks-libev-doc-3.3.3-lp151.2.3.1


References:

   https://www.suse.com/security/cve/CVE-2019-5163.html
   https://www.suse.com/security/cve/CVE-2019-5164.html
   https://bugzilla.suse.com/1158251
   https://bugzilla.suse.com/1158365

-- 
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org