clojure-1.10.3.855-1.2 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:10687 Final 1 1 2024-06-17T21:45:33Z current 2024-06-17T21:45:33Z 2024-06-17T21:45:33Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z clojure-1.10.3.855-1.2 on GA media These are all security issues fixed in the clojure-1.10.3.855-1.2 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-10687 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) E-Mail link for openSUSE-SU-2024:10687 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2020-13956/ SUSE CVE CVE-2020-13956 page https://www.suse.com/security/cve/CVE-2021-26291/ SUSE CVE CVE-2021-26291 page openSUSE Tumbleweed clojure-1.10.3.855-1.2 clojure-1.10.3.855-1.2 as a component of openSUSE Tumbleweed Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution. CVE-2020-13956 openSUSE Tumbleweed:clojure-1.10.3.855-1.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-13956.html CVE-2020-13956 https://bugzilla.suse.com/1177488 SUSE Bug 1177488 Apache Maven will follow repositories that are defined in a dependency's Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html CVE-2021-26291 openSUSE Tumbleweed:clojure-1.10.3.855-1.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-26291.html CVE-2021-26291 https://bugzilla.suse.com/1188529 SUSE Bug 1188529