Security update for socat SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2024:4295-1 Final 1 1 2024-12-11T14:40:58Z current 2024-12-11T14:40:58Z 2024-12-11T14:40:58Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for socat This update for socat fixes the following issues: - CVE-2024-54661: Fixed arbitrary file overwrite via predictable /tmp directory in socat readline.sh (bsc#1225462) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container suse/sles/15.7/virt-launcher:1.4.0-2024-4295,Image SLES15-SP6-CHOST-BYOS-2024-4295,Image SLES15-SP6-CHOST-BYOS-Aliyun-2024-4295,Image SLES15-SP6-CHOST-BYOS-Azure-2024-4295,Image SLES15-SP6-CHOST-BYOS-EC2-2024-4295,Image SLES15-SP6-CHOST-BYOS-GCE-2024-4295,Image SLES15-SP6-CHOST-BYOS-GDC-2024-4295,Image SLES15-SP6-CHOST-BYOS-SAP-CCloud-2024-4295,Image SLES15-SP6-SAP-Azure-LI-BYOS-2024-4295,Image SLES15-SP6-SAP-Azure-LI-BYOS-Production-2024-4295,Image SLES15-SP6-SAP-Azure-VLI-BYOS-2024-4295,Image SLES15-SP6-SAP-Azure-VLI-BYOS-Production-2024-4295,Image SLES15-SP6-SAP-BYOS-2024-4295,Image SLES15-SP6-SAP-BYOS-Azure-2024-4295,Image SLES15-SP6-SAP-BYOS-EC2-2024-4295,Image SLES15-SP6-SAP-BYOS-GCE-2024-4295,Image SLES15-SP6-SAP-Hardened-2024-4295,Image SLES15-SP6-SAP-Hardened-Azure-2024-4295,Image SLES15-SP6-SAP-Hardened-BYOS-2024-4295,Image SLES15-SP6-SAP-Hardened-BYOS-Azure-2024-4295,Image SLES15-SP6-SAP-Hardened-BYOS-EC2-2024-4295,Image SLES15-SP6-SAP-Hardened-BYOS-GCE-2024-4295,Image SLES15-SP6-SAP-Hardened-EC2-2024-4295,Image SLES15-SP6-SAP-Hardened-GCE-2024-4295,SUSE-2024-4295,SUSE-SLE-Module-Basesystem-15-SP6-2024-4295,openSUSE-SLE-15.6-2024-4295 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2024/suse-su-20244295-1/ Link for SUSE-SU-2024:4295-1 https://lists.suse.com/pipermail/sle-security-updates/2024-December/019988.html E-Mail link for SUSE-SU-2024:4295-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1225462 SUSE Bug 1225462 https://www.suse.com/security/cve/CVE-2024-54661/ SUSE CVE CVE-2024-54661 page Container suse/sles/15.7/virt-launcher:1.4.0 Image SLES15-SP6-CHOST-BYOS Image SLES15-SP6-CHOST-BYOS-Aliyun Image SLES15-SP6-CHOST-BYOS-Azure Image SLES15-SP6-CHOST-BYOS-EC2 Image SLES15-SP6-CHOST-BYOS-GCE Image SLES15-SP6-CHOST-BYOS-GDC Image SLES15-SP6-CHOST-BYOS-SAP-CCloud Image SLES15-SP6-SAP-Azure-LI-BYOS Image SLES15-SP6-SAP-Azure-LI-BYOS-Production Image SLES15-SP6-SAP-Azure-VLI-BYOS Image SLES15-SP6-SAP-Azure-VLI-BYOS-Production Image SLES15-SP6-SAP-BYOS Image SLES15-SP6-SAP-BYOS-Azure Image SLES15-SP6-SAP-BYOS-EC2 Image SLES15-SP6-SAP-BYOS-GCE Image SLES15-SP6-SAP-Hardened Image SLES15-SP6-SAP-Hardened-Azure Image SLES15-SP6-SAP-Hardened-BYOS Image SLES15-SP6-SAP-Hardened-BYOS-Azure Image SLES15-SP6-SAP-Hardened-BYOS-EC2 Image SLES15-SP6-SAP-Hardened-BYOS-GCE Image SLES15-SP6-SAP-Hardened-EC2 Image SLES15-SP6-SAP-Hardened-GCE SUSE Linux Enterprise Module for Basesystem 15 SP6 openSUSE Leap 15.6 socat-1.8.0.0-150600.20.6.1 socat-extra-1.8.0.0-150600.20.6.1 socat-1.8.0.0-150600.20.6.1 as a component of Container suse/sles/15.7/virt-launcher:1.4.0 socat-1.8.0.0-150600.20.6.1 as a component of Image SLES15-SP6-CHOST-BYOS socat-1.8.0.0-150600.20.6.1 as a component of Image SLES15-SP6-CHOST-BYOS-Aliyun socat-1.8.0.0-150600.20.6.1 as a component of Image SLES15-SP6-CHOST-BYOS-Azure socat-1.8.0.0-150600.20.6.1 as a component of Image SLES15-SP6-CHOST-BYOS-EC2 socat-1.8.0.0-150600.20.6.1 as a component of Image SLES15-SP6-CHOST-BYOS-GCE socat-1.8.0.0-150600.20.6.1 as a component of Image SLES15-SP6-CHOST-BYOS-GDC socat-1.8.0.0-150600.20.6.1 as a component of Image SLES15-SP6-CHOST-BYOS-SAP-CCloud socat-1.8.0.0-150600.20.6.1 as a component of Image SLES15-SP6-SAP-Azure-LI-BYOS socat-1.8.0.0-150600.20.6.1 as a component of Image SLES15-SP6-SAP-Azure-LI-BYOS-Production socat-1.8.0.0-150600.20.6.1 as a component of Image SLES15-SP6-SAP-Azure-VLI-BYOS socat-1.8.0.0-150600.20.6.1 as a component of Image SLES15-SP6-SAP-Azure-VLI-BYOS-Production socat-1.8.0.0-150600.20.6.1 as a component of Image SLES15-SP6-SAP-BYOS socat-1.8.0.0-150600.20.6.1 as a component of Image SLES15-SP6-SAP-BYOS-Azure socat-1.8.0.0-150600.20.6.1 as a component of Image SLES15-SP6-SAP-BYOS-EC2 socat-1.8.0.0-150600.20.6.1 as a component of Image SLES15-SP6-SAP-BYOS-GCE socat-1.8.0.0-150600.20.6.1 as a component of Image SLES15-SP6-SAP-Hardened socat-1.8.0.0-150600.20.6.1 as a component of Image SLES15-SP6-SAP-Hardened-Azure socat-1.8.0.0-150600.20.6.1 as a component of Image SLES15-SP6-SAP-Hardened-BYOS socat-1.8.0.0-150600.20.6.1 as a component of Image SLES15-SP6-SAP-Hardened-BYOS-Azure socat-1.8.0.0-150600.20.6.1 as a component of Image SLES15-SP6-SAP-Hardened-BYOS-EC2 socat-1.8.0.0-150600.20.6.1 as a component of Image SLES15-SP6-SAP-Hardened-BYOS-GCE socat-1.8.0.0-150600.20.6.1 as a component of Image SLES15-SP6-SAP-Hardened-EC2 socat-1.8.0.0-150600.20.6.1 as a component of Image SLES15-SP6-SAP-Hardened-GCE socat-1.8.0.0-150600.20.6.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP6 socat-1.8.0.0-150600.20.6.1 as a component of openSUSE Leap 15.6 readline.sh in socat before1.8.0.2 relies on the /tmp/$USER/stderr2 file. CVE-2024-54661 Container suse/sles/15.7/virt-launcher:1.4.0:socat-1.8.0.0-150600.20.6.1 Image SLES15-SP6-CHOST-BYOS-Aliyun:socat-1.8.0.0-150600.20.6.1 Image SLES15-SP6-CHOST-BYOS-Azure:socat-1.8.0.0-150600.20.6.1 Image SLES15-SP6-CHOST-BYOS-EC2:socat-1.8.0.0-150600.20.6.1 Image SLES15-SP6-CHOST-BYOS-GCE:socat-1.8.0.0-150600.20.6.1 Image SLES15-SP6-CHOST-BYOS-GDC:socat-1.8.0.0-150600.20.6.1 Image SLES15-SP6-CHOST-BYOS-SAP-CCloud:socat-1.8.0.0-150600.20.6.1 Image SLES15-SP6-CHOST-BYOS:socat-1.8.0.0-150600.20.6.1 Image SLES15-SP6-SAP-Azure-LI-BYOS-Production:socat-1.8.0.0-150600.20.6.1 Image SLES15-SP6-SAP-Azure-LI-BYOS:socat-1.8.0.0-150600.20.6.1 Image SLES15-SP6-SAP-Azure-VLI-BYOS-Production:socat-1.8.0.0-150600.20.6.1 Image SLES15-SP6-SAP-Azure-VLI-BYOS:socat-1.8.0.0-150600.20.6.1 Image SLES15-SP6-SAP-BYOS-Azure:socat-1.8.0.0-150600.20.6.1 Image SLES15-SP6-SAP-BYOS-EC2:socat-1.8.0.0-150600.20.6.1 Image SLES15-SP6-SAP-BYOS-GCE:socat-1.8.0.0-150600.20.6.1 Image SLES15-SP6-SAP-BYOS:socat-1.8.0.0-150600.20.6.1 Image SLES15-SP6-SAP-Hardened-Azure:socat-1.8.0.0-150600.20.6.1 Image SLES15-SP6-SAP-Hardened-BYOS-Azure:socat-1.8.0.0-150600.20.6.1 Image SLES15-SP6-SAP-Hardened-BYOS-EC2:socat-1.8.0.0-150600.20.6.1 Image SLES15-SP6-SAP-Hardened-BYOS-GCE:socat-1.8.0.0-150600.20.6.1 Image SLES15-SP6-SAP-Hardened-BYOS:socat-1.8.0.0-150600.20.6.1 Image SLES15-SP6-SAP-Hardened-EC2:socat-1.8.0.0-150600.20.6.1 Image SLES15-SP6-SAP-Hardened-GCE:socat-1.8.0.0-150600.20.6.1 Image SLES15-SP6-SAP-Hardened:socat-1.8.0.0-150600.20.6.1 SUSE Linux Enterprise Module for Basesystem 15 SP6:socat-1.8.0.0-150600.20.6.1 openSUSE Leap 15.6:socat-1.8.0.0-150600.20.6.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20244295-1/ https://www.suse.com/security/cve/CVE-2024-54661.html CVE-2024-54661 https://bugzilla.suse.com/1225462 SUSE Bug 1225462