An update that solves two vulnerabilities and has 6 fixes
is now available.
Description:
This update for multipath-tools fixes the following issues:
- CVE-2022-41973: Fixed a symlink attack in multipathd. (bsc#1202739)
- CVE-2022-41974: Fixed an authorization bypass issue in multipathd.
(bsc#1202739)
- Avoid linking to libreadline to avoid licensing issue (bsc#1202616)
- libmultipath: fix find_multipaths_timeout for unknown hardware
(bsc#1201483)
- multipath-tools: fix โmultipath -llโ for Native NVME Multipath devices
(bsc#1201483)
- multipathd: donโt switch to DAEMON_IDLE during startup (bsc#1199346,
bsc#1197570)
- multipathd: avoid delays during uevent processing (bsc#1199347)
- multipathd: Donโt keep starting TUR threads, if they always hang.
(bsc#1199345)
- Fix busy loop with delayed_reconfigure (bsc#1199342)
- multipath.conf: add support for โprotocolโ subsection in โoverridesโ
section to set certain config options by protocol.
- Removed the previously deprecated options getuid_callout, config_dir,
multipath_dir, pg_timeout
- Add disclaimer about vendor support
- Change built-in defaults for NVMe: group by prio, and immediate failback
- Fixes for minor issues reported by coverity
- Fix for memory leak with uid_attrs
- Updates for built in hardware db
- Logging improvements
- multipathd: use remove_map_callback for delayed reconfigure
- Fix handling of path addition in read-only arrays on NVMe
- Updates of built-in hardware database
- libmultipath: only warn once about unsupported dev_loss_tmo
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or โzypper patchโ.
Alternatively you can run the command listed for your product:
-
openSUSE Leap 15.4:
zypper in -t patch openSUSE-SLE-15.4-2022-3711=1
-
SUSE Linux Enterprise Module for Basesystem 15-SP4:
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-3711=1
-
SUSE Linux Enterprise Micro 5.3:
zypper in -t patch SUSE-SLE-Micro-5.3-2022-3711=1