Login
Newsletter
Werbung

Sicherheit: Zwei Probleme in jakarta-commons-fileupload
Aktuelle Meldungen Distributionen
Name: Zwei Probleme in jakarta-commons-fileupload
ID: SUSE-SU-2023:0730-1
Distribution: SUSE
Plattformen: SUSE CaaS Platform 4.0, openSUSE Leap 15.4, SUSE Linux Enterprise Server for SAP Applications 15 SP1, SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1, SUSE Linux Enterprise High Performance Computing 15 SP1, SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1, SUSE Linux Enterprise Server 15 SP1
Datum: Di, 14. März 2023, 22:01
Referenzen: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3092
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24998
Applikationen: jakarta-commons-fileupload

Originalnachricht

--===============1592544253821787512==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit



# Security update for jakarta-commons-fileupload

Announcement ID: SUSE-SU-2023:0730-1
Rating: important
References:

* #1208513
* #986359


Cross-References:

* CVE-2016-3092
* CVE-2023-24998


CVSS scores:

* CVE-2016-3092 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2023-24998 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2023-24998 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H


Affected Products:

* openSUSE Leap 15.4
* SUSE CaaS Platform 4.0
* SUSE Linux Enterprise High Performance Computing 15 SP1
* SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1
* SUSE Linux Enterprise Server 15 SP1
* SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1
* SUSE Linux Enterprise Server for SAP Applications 15 SP1



An update that solves two vulnerabilities can now be installed.

## Description:

This update for jakarta-commons-fileupload fixes the following issues:

* CVE-2016-3092: Fixed a usage of vulnerable FileUpload package can result in
denial of service (bsc#986359).
* CVE-2023-24998: Fixed a FileUpload deny of service with excessive parts
(bsc#1208513).

## Patch Instructions:

To install this SUSE Important update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

* openSUSE Leap 15.4
zypper in -t patch openSUSE-SLE-15.4-2023-730=1

* SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1
zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2023-730=1

* SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1
zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2023-730=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP1
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2023-730=1

* SUSE CaaS Platform 4.0
To install this update, use the SUSE CaaS Platform 'skuba' tool. It
will inform
you if it detects new updates and let you then trigger updating of the complete
cluster in a controlled way.

## Package List:

* openSUSE Leap 15.4 (noarch)
* jakarta-commons-fileupload-1.1.1-150000.4.8.1
* jakarta-commons-fileupload-javadoc-1.1.1-150000.4.8.1
* SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1
(noarch)
* jakarta-commons-fileupload-1.1.1-150000.4.8.1
* SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (noarch)
* jakarta-commons-fileupload-1.1.1-150000.4.8.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP1 (noarch)
* jakarta-commons-fileupload-1.1.1-150000.4.8.1
* SUSE CaaS Platform 4.0 (noarch)
* jakarta-commons-fileupload-1.1.1-150000.4.8.1

## References:

* https://www.suse.com/security/cve/CVE-2016-3092.html
* https://www.suse.com/security/cve/CVE-2023-24998.html
* https://bugzilla.suse.com/show_bug.cgi?id=1208513
* https://bugzilla.suse.com/show_bug.cgi?id=986359


--===============1592544253821787512==
Content-Type: text/html; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit





<div class="container">
<h1>Security update for jakarta-commons-fileupload</h1>

<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-SU-2023:0730-1</td>
</tr>

<tr>
<th>Rating:</th>
<td>important</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>

<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1208513">#1208513</a>
</li>

<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=986359">#986359</a>
</li>

</ul>
</td>
</tr>

<tr>
<th>
Cross-References:
</th>
<td>
<ul>

<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2016-3092.html">CVE-2016-3092</a>
</li>

<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2023-24998.html">CVE-2023-24998</a>
</li>

</ul>
</td>
</tr>
<tr>
<th>CVSS scores:</th>
<td>
<ul class="list-group">

<li class="list-group-item">
<span
class="cvss-reference">CVE-2016-3092</span>
<span class="cvss-source">
(

NVD

):
</span>
<span
class="cvss-score">7.5</span>
<span
class="cvss-vector">CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>

<li class="list-group-item">
<span
class="cvss-reference">CVE-2023-24998</span>
<span class="cvss-source">
(

SUSE

):
</span>
<span
class="cvss-score">7.5</span>
<span
class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>

<li class="list-group-item">
<span
class="cvss-reference">CVE-2023-24998</span>
<span class="cvss-source">
(

NVD

):
</span>
<span
class="cvss-score">7.5</span>
<span
class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>

</ul>
</td>
</tr>

<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">

<li class="list-group-item">openSUSE Leap
15.4</li>

<li class="list-group-item">SUSE CaaS
Platform 4.0</li>

<li class="list-group-item">SUSE Linux
Enterprise High Performance Computing 15 SP1</li>

<li class="list-group-item">SUSE Linux
Enterprise High Performance Computing 15 SP1 LTSS 15-SP1</li>

<li class="list-group-item">SUSE Linux
Enterprise Server 15 SP1</li>

<li class="list-group-item">SUSE Linux
Enterprise Server 15 SP1 LTSS 15-SP1</li>

<li class="list-group-item">SUSE Linux
Enterprise Server for SAP Applications 15 SP1</li>

</ul>
</td>
</tr>
</tbody>
</table>

<p>An update that solves two vulnerabilities can now be
installed.</p>

<h2>Description:</h2>
<p>This update for jakarta-commons-fileupload fixes the following
issues:</p>
<ul>
<li>CVE-2016-3092: Fixed a usage of vulnerable FileUpload package can
result in denial of service (bsc#986359). </li>
<li>CVE-2023-24998: Fixed a FileUpload deny of service with excessive
parts (bsc#1208513).</li>
</ul>



<h2>Patch Instructions:</h2>
<p>
To install this SUSE Important update use the SUSE recommended
installation methods like YaST online_update or "zypper
patch".<br/>

Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">

<li class="list-group-item">
openSUSE Leap 15.4


<br/>
<code>zypper in -t patch
openSUSE-SLE-15.4-2023-730=1</code>



</li>

<li class="list-group-item">
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
15-SP1


<br/>
<code>zypper in -t patch
SUSE-SLE-Product-HPC-15-SP1-LTSS-2023-730=1</code>



</li>

<li class="list-group-item">
SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1


<br/>
<code>zypper in -t patch
SUSE-SLE-Product-SLES-15-SP1-LTSS-2023-730=1</code>



</li>

<li class="list-group-item">
SUSE Linux Enterprise Server for SAP Applications 15 SP1


<br/>
<code>zypper in -t patch
SUSE-SLE-Product-SLES_SAP-15-SP1-2023-730=1</code>



</li>

<li class="list-group-item">
SUSE CaaS Platform 4.0

<br/>
<span>
To install this update, use the SUSE CaaS Platform
'skuba' tool. It will
inform you if it detects new updates and let you then
trigger updating of
the complete cluster in a controlled way.
</span>

</li>

</ul>

<h2>Package List:</h2>
<ul>


<li>
openSUSE Leap 15.4 (noarch)
<ul>


<li>jakarta-commons-fileupload-1.1.1-150000.4.8.1</li>


<li>jakarta-commons-fileupload-javadoc-1.1.1-150000.4.8.1</li>

</ul>
</li>



<li>
SUSE Linux Enterprise High Performance Computing 15 SP1
LTSS 15-SP1 (noarch)
<ul>


<li>jakarta-commons-fileupload-1.1.1-150000.4.8.1</li>

</ul>
</li>



<li>
SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (noarch)
<ul>


<li>jakarta-commons-fileupload-1.1.1-150000.4.8.1</li>

</ul>
</li>



<li>
SUSE Linux Enterprise Server for SAP Applications 15 SP1
(noarch)
<ul>


<li>jakarta-commons-fileupload-1.1.1-150000.4.8.1</li>

</ul>
</li>



<li>
SUSE CaaS Platform 4.0 (noarch)
<ul>


<li>jakarta-commons-fileupload-1.1.1-150000.4.8.1</li>

</ul>
</li>


</ul>


<h2>References:</h2>
<ul>


<li>
<a href="https://www.suse.com/security/cve/CVE-2016-3092.html">https://www.suse.com/security/cve/CVE-2016-3092.html</a>
</li>



<li>
<a href="https://www.suse.com/security/cve/CVE-2023-24998.html">https://www.suse.com/security/cve/CVE-2023-24998.html</a>
</li>



<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1208513">https://bugzilla.suse.com/show_bug.cgi?id=1208513</a>
</li>



<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=986359">https://bugzilla.suse.com/show_bug.cgi?id=986359</a>
</li>


</ul>

</div>

--===============1592544253821787512==--
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung