SUSE-SU-2024:4365-1

Details

Description of the patch:

This update for libsoup fixes the following issues:

CVE-2024-52530: Fixed HTTP request smuggling via stripping null bytes from the ends of header names (bsc#1233285)
CVE-2024-52531: Fixed buffer overflow via UTF-8 conversion in soup_header_parse_param_list_strict (bsc#1233292)
CVE-2024-52532: Fixed infinite loop while reading websocket data (bsc#1233287)

Other fixes:

websocket-test: disconnect error copy after the test ends (glgo#GNOME/libsoup#391).
fix an intermittent test failure (glgo#GNOME/soup#399).
updated to version 2.68.4.

Affected Packages

libsoup-2_4-1

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP2SUSE Linux Enterprise High Performance Computing 15 SP2-LTSSSUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

Fixed in:

2.68.4-150200.4.3.1

libsoup-devel

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP2SUSE Linux Enterprise High Performance Computing 15 SP2-LTSSSUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

Fixed in:

2.68.4-150200.4.3.1

libsoup-lang

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP2SUSE Linux Enterprise High Performance Computing 15 SP2-LTSSSUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

Fixed in:

2.68.4-150200.4.3.1

typelib-1_0-Soup-2_4

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP2SUSE Linux Enterprise High Performance Computing 15 SP2-LTSSSUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

Fixed in:

2.68.4-150200.4.3.1

References

ADVISORY

https://bugzilla.suse.com/1233285

ADVISORY

https://bugzilla.suse.com/1233287

ADVISORY

https://bugzilla.suse.com/1233292

ADVISORY

https://lists.suse.com/pipermail/sle-security-updates/2024-December/020027.html

ADVISORY