DSA-2019-049: RSA Identity Governance and Lifecycle Security Update for SUSE Linux Enterprise Server Vulnerabilities

Document created by RSA Product Team Employee on Mar 26, 2019Last modified by RSA Link Admin on Jun 10, 2019
Version 8Show Document
  • View in full screen mode
Dell EMC Identifier:DSA-2019-049
CVE Identifier:See Advisory
Severity:Critical
Severity Rating:See NVD (http://nvd.nist.gov/home.cfm) for individual scores for each CVE
Affected Products:
  • RSA Identity Governance and Lifecycle (Hardware Appliance and Virtual Application deployments only)
  • RSA Via Lifecycle and Governance Lifecycle (Hardware Appliance deployments only)
  • RSA IMG Lifecycle (Hardware Appliance deployments only)

 

Note: The latest patches affect the hardware Appliance and Virtual Application deployments with an RSA supplied SUSE Linux Enterprise Server 11 SP4 or SUSE Linux Enterprise Server 12 SP3 operating system. For those customers currently using SUSE Linux Enterprise Server 11 SP3 the updater will update you to SUSE Linux Enterprise Server 11 SP4 with all the latest patches.  For those customers currently using SUSE Linux Enterprise Server 12 SP2 the updater will update you to SUSE Linux Enterprise Server 12 SP3 with all the latest patches.

 

Unaffected Products:

RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, and RSA IMG:
Software-only systems or any deployment where RSA did not supply the operating system.

Summary:The embedded operating system components in RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, and RSA IMG require a security update to address various vulnerabilities.
Details:

RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, and RSA IMG have been updated to address the security vulnerabilities below.

Note: For more information about any of the Common Vulnerabilities and Exposures (CVEs) mentioned here consult the National Vulnerability Database (NVD) at http://nvd.nist.gov/home.cfm.  To search for a CVE, use the database's search utility at http://web.nvd.nist.gov/view/vuln/search.

  

SUSE Linux Enterprise Server 11 SP4 OS Updates

CVE-2013-0788

CVE-2013-0793

CVE-2013-0794

CVE-2013-0795

CVE-2013-0796

CVE-2013-0800

CVE-2013-0801

CVE-2013-1669

CVE-2013-1670

CVE-2013-1674

CVE-2013-1675

CVE-2013-1676

CVE-2013-1677

CVE-2013-1678

CVE-2013-1679

CVE-2013-1680

CVE-2013-1681

CVE-2013-1682

CVE-2013-1684

CVE-2013-1685

CVE-2013-1686

CVE-2013-1687

CVE-2013-1690

CVE-2013-1692

CVE-2013-1693

CVE-2013-1694

CVE-2013-1697

CVE-2013-1701

CVE-2013-1705

CVE-2013-1709

CVE-2013-1710

CVE-2013-1713

CVE-2013-1714

CVE-2013-1717

CVE-2013-1718

CVE-2013-1722

CVE-2013-1725

CVE-2013-1730

CVE-2013-1732

CVE-2013-1735

CVE-2013-1736

CVE-2013-1737

CVE-2013-5590

CVE-2013-5591

CVE-2013-5592

CVE-2013-5595

CVE-2013-5597

CVE-2013-5599

CVE-2013-5600

CVE-2013-5601

CVE-2013-5602

CVE-2013-5604

CVE-2013-5609

CVE-2013-5610

CVE-2013-5613

CVE-2013-5615

CVE-2013-5616

CVE-2013-5618

CVE-2013-6629

CVE-2013-6630

CVE-2013-6671

CVE-2013-6673

CVE-2014-1477

CVE-2014-1478

CVE-2014-1479

CVE-2014-1481

CVE-2014-1482

CVE-2014-1486

CVE-2014-1487

CVE-2014-1490

CVE-2014-1491

CVE-2014-1493

CVE-2014-1494

CVE-2014-1497

CVE-2014-1505

CVE-2014-1508

CVE-2014-1509

CVE-2014-1510

CVE-2014-1511

CVE-2014-1512

CVE-2014-1513

CVE-2014-1514

CVE-2014-1518

CVE-2014-1523

CVE-2014-1524

CVE-2014-1529

CVE-2014-1530

CVE-2014-1531

CVE-2014-1532

CVE-2014-1533

CVE-2014-1534

CVE-2014-1536

CVE-2014-1537

CVE-2014-1538

CVE-2014-1541

CVE-2014-1544

CVE-2014-1547

CVE-2014-1548

CVE-2014-1553

CVE-2014-1554

CVE-2014-1555

CVE-2014-1556

CVE-2014-1557

CVE-2014-1562

CVE-2014-1567

CVE-2014-1574

CVE-2014-1575

CVE-2014-1576

CVE-2014-1577

CVE-2014-1578

CVE-2014-1581

CVE-2014-1583

CVE-2014-1585

CVE-2014-1586

CVE-2014-1587

CVE-2014-1588

CVE-2014-1590

CVE-2014-1592

CVE-2014-1593

CVE-2014-1594

CVE-2014-8634

CVE-2014-8635

CVE-2014-8638

CVE-2014-8639

CVE-2014-8641

CVE-2015-0797

CVE-2015-0801

CVE-2015-0807

CVE-2015-0813

CVE-2015-0814

CVE-2015-0815

CVE-2015-0816

CVE-2015-0817

CVE-2015-0818

CVE-2015-0822

CVE-2015-0827

CVE-2015-0831

CVE-2015-0835

CVE-2015-0836

CVE-2015-2708

CVE-2015-2709

CVE-2015-2710

CVE-2015-2713

CVE-2015-2716

CVE-2015-2721

CVE-2015-2722

CVE-2015-2724

CVE-2015-2725

CVE-2015-2726

CVE-2015-2728

CVE-2015-2730

CVE-2015-2733

CVE-2015-2734

CVE-2015-2735

CVE-2015-2736

CVE-2015-2737

CVE-2015-2738

CVE-2015-2739

CVE-2015-2740

CVE-2015-2743

CVE-2015-4473

CVE-2015-4474

CVE-2015-4475

CVE-2015-4478

CVE-2015-4479

CVE-2015-4484

CVE-2015-4485

CVE-2015-4486

CVE-2015-4487

CVE-2015-4488

CVE-2015-4489

CVE-2015-4492

CVE-2015-4495

CVE-2015-4497

CVE-2015-4498

CVE-2015-4500

CVE-2015-4501

CVE-2015-4506

CVE-2015-4509

CVE-2015-4511

CVE-2015-4513

CVE-2015-4517

CVE-2015-4519

CVE-2015-4520

CVE-2015-4521

CVE-2015-4522

CVE-2015-7174

CVE-2015-7175

CVE-2015-7176

CVE-2015-7177

CVE-2015-7180

CVE-2015-7188

CVE-2015-7189

CVE-2015-7193

CVE-2015-7194

CVE-2015-7196

CVE-2015-7197

CVE-2015-7198

CVE-2015-7199

CVE-2015-7200

CVE-2015-7201

CVE-2015-7202

CVE-2015-7205

CVE-2015-7210

CVE-2015-7212

CVE-2015-7213

CVE-2015-7214

CVE-2015-7222

CVE-2016-1523

CVE-2016-1930

CVE-2016-1931

CVE-2016-1935

CVE-2016-1952

CVE-2016-1953

CVE-2016-1954

CVE-2016-1957

CVE-2016-1958

CVE-2016-1960

CVE-2016-1961

CVE-2016-1962

CVE-2016-1964

CVE-2016-1965

CVE-2016-1966

CVE-2016-1974

CVE-2016-1977

CVE-2016-2790

CVE-2016-2791

CVE-2016-2792

CVE-2016-2793

CVE-2016-2794

CVE-2016-2795

CVE-2016-2796

CVE-2016-2797

CVE-2016-2798

CVE-2016-2799

CVE-2016-2800

CVE-2016-2801

CVE-2016-2802

CVE-2016-2805

CVE-2016-2807

CVE-2016-2808

CVE-2016-2814

CVE-2016-2815

CVE-2016-2818

CVE-2016-2819

CVE-2016-2821

CVE-2016-2822

CVE-2016-2824

CVE-2016-2828

CVE-2016-2830

CVE-2016-2831

CVE-2016-2835

CVE-2016-2836

CVE-2016-2837

CVE-2016-2838

CVE-2016-2839

CVE-2016-5250

CVE-2016-5252

CVE-2016-5254

CVE-2016-5257

CVE-2016-5258

CVE-2016-5259

CVE-2016-5261

CVE-2016-5262

CVE-2016-5263

CVE-2016-5264

CVE-2016-5265

CVE-2016-5270

CVE-2016-5272

CVE-2016-5274

CVE-2016-5276

CVE-2016-5277

CVE-2016-5278

CVE-2016-5280

CVE-2016-5281

CVE-2016-5284

CVE-2016-5290

CVE-2016-5291

CVE-2016-5296

CVE-2016-5297

CVE-2016-6354

CVE-2016-9064

CVE-2016-9066

CVE-2016-9079

CVE-2016-9893

CVE-2016-9895

CVE-2016-9897

CVE-2016-9898

CVE-2016-9899

CVE-2016-9900

CVE-2016-9901

CVE-2016-9902

CVE-2016-9904

CVE-2016-9905

CVE-2017-5373

CVE-2017-5375

CVE-2017-5376

CVE-2017-5378

CVE-2017-5380

CVE-2017-5383

CVE-2017-5386

CVE-2017-5390

CVE-2017-5396

CVE-2017-5398

CVE-2017-5400

CVE-2017-5401

CVE-2017-5402

CVE-2017-5404

CVE-2017-5405

CVE-2017-5407

CVE-2017-5408

CVE-2017-5409

CVE-2017-5410

CVE-2017-5429

CVE-2017-5430

CVE-2017-5432

CVE-2017-5433

CVE-2017-5434

CVE-2017-5435

CVE-2017-5436

CVE-2017-5437

CVE-2017-5438

CVE-2017-5439

CVE-2017-5440

CVE-2017-5441

CVE-2017-5442

CVE-2017-5443

CVE-2017-5444

CVE-2017-5445

CVE-2017-5446

CVE-2017-5447

CVE-2017-5448

CVE-2017-5449

CVE-2017-5451

CVE-2017-5454

CVE-2017-5455

CVE-2017-5456

CVE-2017-5459

CVE-2017-5460

CVE-2017-5461

CVE-2017-5462

CVE-2017-5464

CVE-2017-5465

CVE-2017-5466

CVE-2017-5467

CVE-2017-5469

CVE-2017-5470

CVE-2017-5472

CVE-2017-7749

CVE-2017-7750

CVE-2017-7751

CVE-2017-7752

CVE-2017-7753

CVE-2017-7754

CVE-2017-7755

CVE-2017-7756

CVE-2017-7757

CVE-2017-7758

CVE-2017-7761

CVE-2017-7763

CVE-2017-7764

CVE-2017-7765

CVE-2017-7768

CVE-2017-7778

CVE-2017-7779

CVE-2017-7782

CVE-2017-7784

CVE-2017-7785

CVE-2017-7786

CVE-2017-7787

CVE-2017-7791

CVE-2017-7792

CVE-2017-7793

CVE-2017-7798

CVE-2017-7800

CVE-2017-7801

CVE-2017-7802

CVE-2017-7803

CVE-2017-7804

CVE-2017-7807

CVE-2017-7810

CVE-2017-7814

CVE-2017-7818

CVE-2017-7819

CVE-2017-7823

CVE-2017-7824

CVE-2017-7825

CVE-2017-7826

CVE-2017-7828

CVE-2017-7830

CVE-2018-0734

CVE-2018-5089

CVE-2018-5091

CVE-2018-5095

CVE-2018-5096

CVE-2018-5097

CVE-2018-5098

CVE-2018-5099

CVE-2018-5102

CVE-2018-5103

CVE-2018-5104

CVE-2018-5117

CVE-2018-5156

CVE-2018-5188

CVE-2018-5407

CVE-2018-10906

CVE-2018-12359

CVE-2018-12360

CVE-2018-12362

CVE-2018-12363

CVE-2018-12364

CVE-2018-12365

CVE-2018-12366

CVE-2018-12368

CVE-2018-20685

CVE-2018-1000845

CVE-2019-6109

CVE-2019-6110

CVE-2019-6111

CVE-2019-6446

 

SUSE Linux Enterprise Server 12 SP3 OS Updates

CVE-2015-3239

CVE-2017-16541

CVE-2018-1120

CVE-2018-4437

CVE-2018-4438

CVE-2018-4441

CVE-2018-4442

CVE-2018-4443

CVE-2018-4464

CVE-2018-5089

CVE-2018-5091

CVE-2018-5095

CVE-2018-5096

CVE-2018-5097

CVE-2018-5098

CVE-2018-5099

CVE-2018-5102

CVE-2018-5103

CVE-2018-5104

CVE-2018-5117

CVE-2018-5125

CVE-2018-5127

CVE-2018-5129

CVE-2018-5130

CVE-2018-5131

CVE-2018-5144

CVE-2018-5145

CVE-2018-5147

CVE-2018-5148

CVE-2018-5150

CVE-2018-5154

CVE-2018-5155

CVE-2018-5156

CVE-2018-5157

CVE-2018-5158

CVE-2018-5159

CVE-2018-5168

CVE-2018-5174

CVE-2018-5178

CVE-2018-5183

CVE-2018-5188

CVE-2018-5383

CVE-2018-6126

CVE-2018-9568

CVE-2018-12359

CVE-2018-12360

CVE-2018-12362

CVE-2018-12363

CVE-2018-12364

CVE-2018-12365

CVE-2018-12366

CVE-2018-12368

CVE-2018-12376

CVE-2018-12377

CVE-2018-12378

CVE-2018-12379

CVE-2018-12381

CVE-2018-12383

CVE-2018-12385

CVE-2018-12386

CVE-2018-12387

CVE-2018-12389

CVE-2018-12390

CVE-2018-12392

CVE-2018-12393

CVE-2018-12395

CVE-2018-12396

CVE-2018-12397

CVE-2018-12405

CVE-2018-14647

CVE-2018-16862

CVE-2018-16884

CVE-2018-16890

CVE-2018-17466

CVE-2018-18492

CVE-2018-18493

CVE-2018-18494

CVE-2018-18498

CVE-2018-18500

CVE-2018-18501

CVE-2018-18505

CVE-2018-19407

CVE-2018-19824

CVE-2018-19985

CVE-2018-20169

CVE-2018-20406

CVE-2018-1000845

CVE-2019-3459

CVE-2019-3460

CVE-2019-3560

CVE-2019-3822

CVE-2019-3823

CVE-2019-5010

CVE-2019-6116

CVE-2019-6212

CVE-2019-6215

CVE-2019-6216

CVE-2019-6217

CVE-2019-6226

CVE-2019-6227

CVE-2019-6229

CVE-2019-6233

CVE-2019-6234

CVE-2019-6454

CVE-2019-6974

CVE-2019-7221

CVE-2019-7222

 

 

 

Recommendation:

The Appliance Updater tool's March 2019 releases will resolve these issues and ensures that the embedded OS components are kept current with security updates and patches.

 

RSA recommends all appliance customers who are on SUSE Linux Enterprise Server 11 SP3/SP4 or 12 SP2/SP3 to run the appliance updater as latest patches will be applied to the current installation.

 

This Appliance Updater supports the RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, or RSA IMG products which use an RSA supplied SUSE Linux Enterprise Server 12 SP2/SP3 or SUSE Linux Enterprise Server 11 SP3/SP4 operating system.

 

Customers can obtain the documentation and software by downloading them from the Downloads area on RSA Identity Governance and Lifecycle space of RSA Link.

 

 

For additional documentation, downloads and more, visit the RSA Identity Governance & Lifecycle page on RSA Link.

Severity Rating:For an explanation of Severity Ratings, refer to the Security Advisories Severity Rating knowledge base article. RSA recommends all customers take into account both the base score and any relevant temporal and environmental scores which may impact the potential severity associated with particular security vulnerability.
EOPS Policy:RSA has a defined End of Primary Support policy associated with all major versions. Please refer to the Product Version Life Cycle for additional details.
Legal Information:

Read and use the information in this RSA Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this advisory, contact RSA Customer Support. RSA Security LLC and its affiliates, including without limitation, its ultimate parent company, Dell Technologies, distribute RSA Security Advisories in order to bring to the attention of users of the affected RSA products, important security information.

 

RSA recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided "as is" without warranty of any kind. RSA disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement.

 

In no event shall RSA, its affiliates or its suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if RSA, its affiliates or its suppliers have been advised of the possibility of such damages. Some jurisdictions do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply.

Attachments

    Outcomes