drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Zwei Probleme in jakarta-commons-fileupload
Name: |
Zwei Probleme in jakarta-commons-fileupload |
|
ID: |
SUSE-SU-2023:0730-1 |
|
Distribution: |
SUSE |
|
Plattformen: |
SUSE CaaS Platform 4.0, openSUSE Leap 15.4, SUSE Linux Enterprise Server for SAP Applications 15 SP1, SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1, SUSE Linux Enterprise High Performance Computing 15 SP1, SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1, SUSE Linux Enterprise Server 15 SP1 |
|
Datum: |
Di, 14. März 2023, 22:01 |
|
Referenzen: |
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3092
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24998 |
|
Applikationen: |
jakarta-commons-fileupload |
|
Originalnachricht |
--===============1592544253821787512== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit
# Security update for jakarta-commons-fileupload
Announcement ID: SUSE-SU-2023:0730-1 Rating: important References:
* #1208513 * #986359
Cross-References:
* CVE-2016-3092 * CVE-2023-24998
CVSS scores:
* CVE-2016-3092 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-24998 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-24998 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products:
* openSUSE Leap 15.4 * SUSE CaaS Platform 4.0 * SUSE Linux Enterprise High Performance Computing 15 SP1 * SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 * SUSE Linux Enterprise Server 15 SP1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 * SUSE Linux Enterprise Server for SAP Applications 15 SP1
An update that solves two vulnerabilities can now be installed.
## Description:
This update for jakarta-commons-fileupload fixes the following issues:
* CVE-2016-3092: Fixed a usage of vulnerable FileUpload package can result in denial of service (bsc#986359). * CVE-2023-24998: Fixed a FileUpload deny of service with excessive parts (bsc#1208513).
## Patch Instructions:
To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product:
* openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-730=1
* SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2023-730=1
* SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2023-730=1
* SUSE Linux Enterprise Server for SAP Applications 15 SP1 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2023-730=1
* SUSE CaaS Platform 4.0 To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way.
## Package List:
* openSUSE Leap 15.4 (noarch) * jakarta-commons-fileupload-1.1.1-150000.4.8.1 * jakarta-commons-fileupload-javadoc-1.1.1-150000.4.8.1 * SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (noarch) * jakarta-commons-fileupload-1.1.1-150000.4.8.1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (noarch) * jakarta-commons-fileupload-1.1.1-150000.4.8.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 (noarch) * jakarta-commons-fileupload-1.1.1-150000.4.8.1 * SUSE CaaS Platform 4.0 (noarch) * jakarta-commons-fileupload-1.1.1-150000.4.8.1
## References:
* https://www.suse.com/security/cve/CVE-2016-3092.html * https://www.suse.com/security/cve/CVE-2023-24998.html * https://bugzilla.suse.com/show_bug.cgi?id=1208513 * https://bugzilla.suse.com/show_bug.cgi?id=986359
--===============1592544253821787512== Content-Type: text/html; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit
<div class="container"> <h1>Security update for jakarta-commons-fileupload</h1>
<table class="table table-striped table-bordered"> <tbody> <tr> <th>Announcement ID:</th> <td>SUSE-SU-2023:0730-1</td> </tr> <tr> <th>Rating:</th> <td>important</td> </tr> <tr> <th>References:</th> <td> <ul> <li style="display: inline;"> <a href="https://bugzilla.suse.com/show_bug.cgi?id=1208513">#1208513</a> </li> <li style="display: inline;"> <a href="https://bugzilla.suse.com/show_bug.cgi?id=986359">#986359</a> </li> </ul> </td> </tr> <tr> <th> Cross-References: </th> <td> <ul> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2016-3092.html">CVE-2016-3092</a> </li> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2023-24998.html">CVE-2023-24998</a> </li> </ul> </td> </tr> <tr> <th>CVSS scores:</th> <td> <ul class="list-group"> <li class="list-group-item"> <span class="cvss-reference">CVE-2016-3092</span> <span class="cvss-source"> ( NVD ): </span> <span class="cvss-score">7.5</span> <span class="cvss-vector">CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2023-24998</span> <span class="cvss-source"> ( SUSE ): </span> <span class="cvss-score">7.5</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2023-24998</span> <span class="cvss-source"> ( NVD ): </span> <span class="cvss-score">7.5</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span> </li> </ul> </td> </tr> <tr> <th>Affected Products:</th> <td> <ul class="list-group"> <li class="list-group-item">openSUSE Leap 15.4</li> <li class="list-group-item">SUSE CaaS Platform 4.0</li> <li class="list-group-item">SUSE Linux Enterprise High Performance Computing 15 SP1</li> <li class="list-group-item">SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1</li> <li class="list-group-item">SUSE Linux Enterprise Server 15 SP1</li> <li class="list-group-item">SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1</li> <li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 15 SP1</li> </ul> </td> </tr> </tbody> </table>
<p>An update that solves two vulnerabilities can now be installed.</p>
<h2>Description:</h2> <p>This update for jakarta-commons-fileupload fixes the following issues:</p> <ul> <li>CVE-2016-3092: Fixed a usage of vulnerable FileUpload package can result in denial of service (bsc#986359). </li> <li>CVE-2023-24998: Fixed a FileUpload deny of service with excessive parts (bsc#1208513).</li> </ul>
<h2>Patch Instructions:</h2> <p> To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product: </p> <ul class="list-group"> <li class="list-group-item"> openSUSE Leap 15.4 <br/> <code>zypper in -t patch openSUSE-SLE-15.4-2023-730=1</code> </li> <li class="list-group-item"> SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 <br/> <code>zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2023-730=1</code> </li> <li class="list-group-item"> SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 <br/> <code>zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2023-730=1</code> </li> <li class="list-group-item"> SUSE Linux Enterprise Server for SAP Applications 15 SP1 <br/> <code>zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2023-730=1</code> </li> <li class="list-group-item"> SUSE CaaS Platform 4.0 <br/> <span> To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. </span> </li> </ul>
<h2>Package List:</h2> <ul> <li> openSUSE Leap 15.4 (noarch) <ul> <li>jakarta-commons-fileupload-1.1.1-150000.4.8.1</li> <li>jakarta-commons-fileupload-javadoc-1.1.1-150000.4.8.1</li> </ul> </li> <li> SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (noarch) <ul> <li>jakarta-commons-fileupload-1.1.1-150000.4.8.1</li> </ul> </li> <li> SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (noarch) <ul> <li>jakarta-commons-fileupload-1.1.1-150000.4.8.1</li> </ul> </li> <li> SUSE Linux Enterprise Server for SAP Applications 15 SP1 (noarch) <ul> <li>jakarta-commons-fileupload-1.1.1-150000.4.8.1</li> </ul> </li> <li> SUSE CaaS Platform 4.0 (noarch) <ul> <li>jakarta-commons-fileupload-1.1.1-150000.4.8.1</li> </ul> </li> </ul>
<h2>References:</h2> <ul> <li> <a href="https://www.suse.com/security/cve/CVE-2016-3092.html">https://www.suse.com/security/cve/CVE-2016-3092.html</a> </li> <li> <a href="https://www.suse.com/security/cve/CVE-2023-24998.html">https://www.suse.com/security/cve/CVE-2023-24998.html</a> </li> <li> <a href="https://bugzilla.suse.com/show_bug.cgi?id=1208513">https://bugzilla.suse.com/show_bug.cgi?id=1208513</a> </li> <li> <a href="https://bugzilla.suse.com/show_bug.cgi?id=986359">https://bugzilla.suse.com/show_bug.cgi?id=986359</a> </li> </ul> </div>
--===============1592544253821787512==--
|
|
|
|