openSUSE Security Update: Security update for froxlor
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2021:0450-1
Rating:             moderate
References:         #1025193 #1082318 #846355 #958100 
Cross-References:   CVE-2016-5100
CVSS scores:
                    CVE-2016-5100 (NVD) : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products:
                    openSUSE Backports SLE-15-SP2
______________________________________________________________________________

   An update that solves one vulnerability and has three fixes
   is now available.

Description:

   This update for froxlor fixes the following issues:

   - Upstream upgrade to version 0.10.23 (boo#846355)
   - Upstream upgrade to version 0.10.22 (boo#846355)

   - BuildRequire cron as this contains now the cron directories
   - Use %license for COPYING file instead of %doc [boo#1082318]

   Upstream upgrade to version 0.9.40.1 (boo#846355)

   new features besides API that found their way in:

   - 2FA / TwoFactor Authentication for accounts
   - MySQL8 compatibility
   - new implementation of Let's Encrypt (acme.sh)
   - customizable error/access log handling for webserver (format, level,
     pipe-to-script, etc.)
   - lots and lots of bugfixes and small enhancements

   Upstream upgrade to version 0.9.39.5 (boo#846355)

   - PHP rand function for random number generation fixed in previous version
     (boo#1025193) CVE-2016-5100
   - upstream upgrade to version 0.9.39 (boo#846355)
   - Add and change of froxlor config files and manual
   - Change Requires to enable use with php7 This update was imported from
     the openSUSE:Leap:15.2:Update update project.


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Backports SLE-15-SP2:

      zypper in -t patch openSUSE-2021-450=1



Package List:

   - openSUSE Backports SLE-15-SP2 (noarch):

      froxlor-0.10.23-bp152.4.3.1


References:

   https://www.suse.com/security/cve/CVE-2016-5100.html
   https://bugzilla.suse.com/1025193
   https://bugzilla.suse.com/1082318
   https://bugzilla.suse.com/846355
   https://bugzilla.suse.com/958100