OpenSSL, Squid, Dracut Update in Tumbleweed

Five openSUSE Tumbleweed snapshots have been released since last Friday.

The snapshots had a small amount of packages in each release.

The 20220629 snapshot updated OpenSSL to version 1.1.1p. This newer version fixed CVE-2022-2068 affecting the c_rehash script, which was not properly sanitizing the shell metacharacters to prevent command injection. The script, which is distributed by some operating systems in a manner where it is automatically executed, could give an attacker execute arbitrary commands with the privileges of the script. Another package updated in the snapshot was perl-JSON 4.07, which provided some backport updates from 4.10 version. New memory device types, processor upgrades, slot types, processor characteristics and more came in the update of dmidecode 3.4. There were also several table engine updates in the snapshot like ibus-table 1.16.9, ibus-table-chinese 1.8.8 and more.

A single package was updated in snapshot 20220628. The update of mpg123 1.30.0 has a new network backend using external tools/libraries to support HTTPS and the terminal control keys are now case-sensitive.

Two Python Package Index updates were released in 20220626. Missing constructors for UUID for each Bluetooth service were added in the python-qt5 5.15.7 update. The package is a comprehensive set of Python bindings for Qt v5. The other PyPI package update was python-rsa 4.8, which switched to Poetry for dependency and release management and made decryption 2-4x faster by using the Chinese Remainder Theorem when decrypting with a private key.

Text editor vim fixed an invalid memory access when using an expression on the command line in the 8.2.5154 update and some fixes related valgrind became available in the 20220625 snapshot. Caching proxy squid fixed some parser regressions and improved the handling of Gopher responses in version 5.6. The updated open-source printing package cups-filters 1.28.15 had improvements to identify old LaserJets more precisely and switch to Poppler when appropriate. The 5.18.6 Linux Kernel came in the snapshot as well and had several ALSA System on Chip enhancements and fixes. The kernel also had a couple KVM for arm64 changes and handled some GNU Compiler Collection 12 warnings.

Snapshot 20220624 brought an updated dracut version, which stopped leaking shell options and put in a temporary workaround for openSUSE appliance builder kiwi. The gstreamer 1.20.3 made some WebRTC and performance improvements; it also fixed scrambled video playback with hardware-accelerated VA-API decoders on certain Intel hardware. The D-Bus interface for user account query and manipulation, accountsservice, updated from version 0.6.55 to 22.08.8. Other packages to update in the snapshot were Imath 3.1.5, KDE’s amarok and more.