An update that fixes two vulnerabilities is now available.
Description:
This update for barrier fixes the following issues:
Updated to version 2.4.0:
Barrier now supports client identity verification (fixes CVE-2021-42072,
CVE-2021-42073).
Previously a malicious client could connect to Barrier server without any
authentication and send application-level messages. This made the attack
surface of Barrier significantly larger. Additionally, in case the
malicious client got possession of a valid screen name by brute forcing or
other means it could modify the clipboard contents of the server. To
support seamless upgrades from older versions of Barrier this is currently
disabled by default. The feature can be enabled in the settings dialog. If
enabled, older clients of Barrier will be rejected. Barrier now uses
SHA256 fingerprints for establishing security of encrypted SSL
connections. After upgrading client to new version the existing server
fingerprint will need to be approved again. Client and server will show
both SHA1 and SHA256 server fingerprints to allow interoperability with
older versions of Barrier.
Bugfixes:
Features:
submitted upstream at https://github.com/symless/synergy-core/pull/6261
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or “zypper patch”.
Alternatively you can run the command listed for your product:
openSUSE Backports SLE-15-SP3:
zypper in -t patch openSUSE-2021-1595=1
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
openSUSE Backports SLE | 15-SP3 | aarch64 | - opensuse backports sle | < 15-SP3 (aarch64 i586 ppc64le x86_64): | - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le x86_64):.aarch64.rpm |
openSUSE Backports SLE | 15-SP3 | i586 | - opensuse backports sle | < 15-SP3 (aarch64 i586 ppc64le x86_64): | - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le x86_64):.i586.rpm |
openSUSE Backports SLE | 15-SP3 | ppc64le | - opensuse backports sle | < 15-SP3 (aarch64 i586 ppc64le x86_64): | - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le x86_64):.ppc64le.rpm |
openSUSE Backports SLE | 15-SP3 | x86_64 | - opensuse backports sle | < 15-SP3 (aarch64 i586 ppc64le x86_64): | - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le x86_64):.x86_64.rpm |