Security update for hdf5

Announcement ID:	SUSE-SU-2024:2105-1
Rating:	important
References:	bsc#1133222 bsc#1224158
Cross-References:	CVE-2017-17507 CVE-2018-11205 CVE-2024-29158 CVE-2024-29161 CVE-2024-29166 CVE-2024-32608 CVE-2024-32610 CVE-2024-32614 CVE-2024-32619 CVE-2024-32620 CVE-2024-33873 CVE-2024-33874 CVE-2024-33875
CVSS scores:	CVE-2017-17507 ( SUSE ): 4.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L CVE-2017-17507 ( NVD ): 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-11205 ( SUSE ): 5.1 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L CVE-2018-11205 ( NVD ): 8.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H CVE-2024-29158 ( SUSE ): 5.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H CVE-2024-29161 ( SUSE ): 5.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H CVE-2024-29166 ( SUSE ): 5.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H CVE-2024-32608 ( SUSE ): 5.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H CVE-2024-32610 ( SUSE ): 5.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H CVE-2024-32614 ( SUSE ): 5.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H CVE-2024-32619 ( SUSE ): 5.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H CVE-2024-32620 ( SUSE ): 5.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H CVE-2024-33873 ( SUSE ): 5.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H CVE-2024-33874 ( SUSE ): 5.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H CVE-2024-33875 ( SUSE ): 5.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Affected Products:	HPC Module 12 SUSE Linux Enterprise High Performance Computing 12 SP2 SUSE Linux Enterprise High Performance Computing 12 SP3 SUSE Linux Enterprise High Performance Computing 12 SP4 SUSE Linux Enterprise High Performance Computing 12 SP5 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5

An update that solves 13 vulnerabilities can now be installed.

Description:

This update for hdf5 fixes the following issues:

• Fix various security issues in hdf5 (bsc#1224158):

CVE-2024-29158, CVE-2024-29161, CVE-2024-29166, CVE-2024-32608, CVE-2024-32610, CVE-2024-32614, CVE-2024-32619, CVE-2024-32620, CVE-2024-33873, CVE-2024-33874, CVE-2024-33875

• Additionally, these fixes resolve crashes triggered by the reproducers for CVE-2017-17507, CVE-2018-11205. These crashes appear to be unrelated to the original problems.
• set higher constraints for succesful mpich tests (bsc#1133222)

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• HPC Module 12
  zypper in -t patch SUSE-SLE-Module-HPC-12-2024-2105=1

Package List:

• HPC Module 12 (noarch)
  • hdf5-gnu-mvapich2-hpc-devel-1.10.11-3.24.1
  • hdf5-gnu-openmpi1-hpc-devel-1.10.11-3.24.1
  • hdf5-gnu-hpc-devel-1.10.11-3.24.1
• HPC Module 12 (aarch64 x86_64)
  • hdf5_1_10_11-gnu-openmpi1-hpc-debuginfo-1.10.11-3.24.1
  • libhdf5_1_10_11-gnu-openmpi1-hpc-1.10.11-3.24.1
  • hdf5_1_10_11-gnu-hpc-1.10.11-3.24.1
  • libhdf5_hl_cpp-gnu-hpc-1.10.11-3.24.1
  • libhdf5_hl_fortran-gnu-openmpi1-hpc-1.10.11-3.24.1
  • libhdf5hl_fortran_1_10_11-gnu-mvapich2-hpc-1.10.11-3.24.1
  • libhdf5_hl_fortran-gnu-mvapich2-hpc-1.10.11-3.24.1
  • hdf5_1_10_11-gnu-mvapich2-hpc-module-1.10.11-3.24.1
  • hdf5_1_10_11-gnu-hpc-debuginfo-1.10.11-3.24.1
  • hdf5_1_10_11-gnu-openmpi1-hpc-devel-1.10.11-3.24.1
  • libhdf5_cpp_1_10_11-gnu-openmpi1-hpc-1.10.11-3.24.1
  • libhdf5_cpp-gnu-hpc-1.10.11-3.24.1
  • hdf5_1_10_11-gnu-hpc-devel-1.10.11-3.24.1
  • libhdf5_hl_cpp_1_10_11-gnu-hpc-debuginfo-1.10.11-3.24.1
  • libhdf5_hl_1_10_11-gnu-hpc-debuginfo-1.10.11-3.24.1
  • libhdf5hl_fortran_1_10_11-gnu-openmpi1-hpc-debuginfo-1.10.11-3.24.1
  • libhdf5_fortran_1_10_11-gnu-openmpi1-hpc-debuginfo-1.10.11-3.24.1
  • libhdf5_hl_fortran-gnu-hpc-1.10.11-3.24.1
  • libhdf5_fortran-gnu-mvapich2-hpc-1.10.11-3.24.1
  • hdf5_1_10_11-gnu-hpc-debugsource-1.10.11-3.24.1
  • hdf5_1_10_11-gnu-hpc-module-1.10.11-3.24.1
  • libhdf5_hl-gnu-hpc-1.10.11-3.24.1
  • libhdf5_cpp_1_10_11-gnu-hpc-1.10.11-3.24.1
  • libhdf5_hl_1_10_11-gnu-mvapich2-hpc-debuginfo-1.10.11-3.24.1
  • libhdf5_hl_1_10_11-gnu-openmpi1-hpc-debuginfo-1.10.11-3.24.1
  • libhdf5hl_fortran_1_10_11-gnu-openmpi1-hpc-1.10.11-3.24.1
  • hdf5_1_10_11-gnu-hpc-devel-static-1.10.11-3.24.1
  • libhdf5_hl_1_10_11-gnu-hpc-1.10.11-3.24.1
  • libhdf5_1_10_11-gnu-hpc-debuginfo-1.10.11-3.24.1
  • libhdf5-gnu-mvapich2-hpc-1.10.11-3.24.1
  • libhdf5_hl_1_10_11-gnu-openmpi1-hpc-1.10.11-3.24.1
  • hdf5_1_10_11-gnu-mvapich2-hpc-debugsource-1.10.11-3.24.1
  • libhdf5_hl_cpp_1_10_11-gnu-hpc-1.10.11-3.24.1
  • libhdf5_hl_cpp_1_10_11-gnu-mvapich2-hpc-1.10.11-3.24.1
  • hdf5_1_10_11-gnu-mvapich2-hpc-devel-static-1.10.11-3.24.1
  • libhdf5_fortran_1_10_11-gnu-hpc-1.10.11-3.24.1
  • libhdf5_fortran_1_10_11-gnu-openmpi1-hpc-1.10.11-3.24.1
  • libhdf5_fortran_1_10_11-gnu-mvapich2-hpc-debuginfo-1.10.11-3.24.1
  • libhdf5_fortran_1_10_11-gnu-hpc-debuginfo-1.10.11-3.24.1
  • libhdf5hl_fortran_1_10_11-gnu-mvapich2-hpc-debuginfo-1.10.11-3.24.1
  • libhdf5hl_fortran_1_10_11-gnu-hpc-1.10.11-3.24.1
  • libhdf5_fortran_1_10_11-gnu-mvapich2-hpc-1.10.11-3.24.1
  • libhdf5_1_10_11-gnu-mvapich2-hpc-1.10.11-3.24.1
  • libhdf5_hl_1_10_11-gnu-mvapich2-hpc-1.10.11-3.24.1
  • libhdf5_hl-gnu-openmpi1-hpc-1.10.11-3.24.1
  • libhdf5_fortran-gnu-hpc-1.10.11-3.24.1
  • libhdf5_fortran-gnu-openmpi1-hpc-1.10.11-3.24.1
  • hdf5_1_10_11-gnu-openmpi1-hpc-module-1.10.11-3.24.1
  • hdf5_1_10_11-gnu-openmpi1-hpc-1.10.11-3.24.1
  • hdf5_1_10_11-gnu-openmpi1-hpc-debugsource-1.10.11-3.24.1
  • hdf5_1_10_11-gnu-mvapich2-hpc-devel-1.10.11-3.24.1
  • libhdf5_1_10_11-gnu-hpc-1.10.11-3.24.1
  • libhdf5-gnu-openmpi1-hpc-1.10.11-3.24.1
  • libhdf5_1_10_11-gnu-mvapich2-hpc-debuginfo-1.10.11-3.24.1
  • libhdf5_1_10_11-gnu-openmpi1-hpc-debuginfo-1.10.11-3.24.1
  • hdf5_1_10_11-gnu-mvapich2-hpc-1.10.11-3.24.1
  • libhdf5_hl-gnu-mvapich2-hpc-1.10.11-3.24.1
  • libhdf5_hl_cpp_1_10_11-gnu-openmpi1-hpc-1.10.11-3.24.1
  • hdf5_1_10_11-gnu-openmpi1-hpc-devel-static-1.10.11-3.24.1
  • libhdf5_cpp_1_10_11-gnu-hpc-debuginfo-1.10.11-3.24.1
  • libhdf5-gnu-hpc-1.10.11-3.24.1
  • hdf5_1_10_11-gnu-mvapich2-hpc-debuginfo-1.10.11-3.24.1
  • libhdf5_cpp_1_10_11-gnu-mvapich2-hpc-1.10.11-3.24.1
  • libhdf5hl_fortran_1_10_11-gnu-hpc-debuginfo-1.10.11-3.24.1

References:

• https://www.suse.com/security/cve/CVE-2017-17507.html
• https://www.suse.com/security/cve/CVE-2018-11205.html
• https://www.suse.com/security/cve/CVE-2024-29158.html
• https://www.suse.com/security/cve/CVE-2024-29161.html
• https://www.suse.com/security/cve/CVE-2024-29166.html
• https://www.suse.com/security/cve/CVE-2024-32608.html
• https://www.suse.com/security/cve/CVE-2024-32610.html
• https://www.suse.com/security/cve/CVE-2024-32614.html
• https://www.suse.com/security/cve/CVE-2024-32619.html
• https://www.suse.com/security/cve/CVE-2024-32620.html
• https://www.suse.com/security/cve/CVE-2024-33873.html
• https://www.suse.com/security/cve/CVE-2024-33874.html
• https://www.suse.com/security/cve/CVE-2024-33875.html
• https://bugzilla.suse.com/show_bug.cgi?id=1133222
• https://bugzilla.suse.com/show_bug.cgi?id=1224158