DSA-2019-129: RSA Identity Governance and Lifecycle Security Update for SUSE Linux Enterprise Server Vulnerabilities

[#1]

Dell EMC Identifier:	DSA-2019-129
CVE Identifier:	See Advisory
Severity:	Critical
Severity Rating:	See NVD (http://nvd.nist.gov/home.cfm) for individual scores for each CVE
Affected Products:	All versions • RSA Identity Governance and Lifecycle (Hardware Appliance and Virtual Application deployments only) • RSA Via Lifecycle and Governance Lifecycle (Hardware Appliance deployments only) • RSA IMG Lifecycle (Hardware Appliance deployments only) Note: The latest patches affect the hardware Appliance and Virtual Application deployments with an RSA supplied SUSE Linux Enterprise Server 11 SP4 or SUSE Linux Enterprise Server 12 SP3 operating sys-tem. For those customers currently using SUSE Linux Enterprise Server 11 SP3 the updater will update you to SUSE Linux Enterprise Server 11 SP4 with all the latest patches. For those customers currently using SUSE Linux Enterprise Server 12 SP2 the updater will update you to SUSE Linux Enterprise Server 12 SP3 with all the latest patches. Unaffected Products: RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, and RSA IMG: Software-only systems or any deployment where RSA did not supply the operating system.
Summary:	The embedded operating system components in RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, and RSA IMG require a security update to address various vulnerabilities.
Details:	RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, and RSA IMG have been updated to address the following security vulnerabilities. SUSE Linux Enterprise Server 11 SP4 OS Updates CVE-2009-5155 CVE-2011-3640 CVE-2013-0791 CVE-2013-1620 CVE-2013-1740 CVE-2014-9710 CVE-2016-3189 CVE-2017-2579 CVE-2017-2580 CVE-2017-5837 CVE-2017-5844 CVE-2017-10989 CVE-2017-15299 CVE-2018-0495 CVE-2018-5390 CVE-2018-5740 CVE-2018-5743 CVE-2018-5745 CVE-2018-8740 CVE-2018-8897 CVE-2018-12384 CVE-2018-12404 CVE-2018-17972 CVE-2018-20836 CVE-2018-20852 CVE-2019-1559 CVE-2019-3459 CVE-2019-3460 CVE-2019-3846 CVE-2019-3896 CVE-2019-5489 CVE-2019-6465 CVE-2019-8457 CVE-2019-9169 CVE-2019-9928 CVE-2019-10160 CVE-2019-11190 CVE-2019-11459 CVE-2019-11477 CVE-2019-11478 CVE-2019-11479 CVE-2019-11486 CVE-2019-11884 CVE-2019-12450 CVE-2019-12614 CVE-2019-12735 CVE-2019-12749 CVE-2019-12900 CVE-2019-1010006 SUSE Linux Enterprise Server 12 SP3 OS Updates CVE-2009-5155 CVE-2016-3189 CVE-2016-10254 CVE-2016-10255 CVE-2017-2579 CVE-2017-2580 CVE-2017-7607 CVE-2017-7608 CVE-2017-7610 CVE-2017-7611 CVE-2017-7612 CVE-2017-7613 CVE-2017-7960 CVE-2017-7961 CVE-2017-8834 CVE-2017-8871 CVE-2018-5740 CVE-2018-5743 CVE-2018-5745 CVE-2018-6954 CVE-2018-7191 CVE-2018-8975 CVE-2018-11212 CVE-2018-16062 CVE-2018-16403 CVE-2018-16428 CVE-2018-16429 CVE-2018-16839 CVE-2018-17972 CVE-2018-18310 CVE-2018-18335 CVE-2018-18356 CVE-2018-18506 CVE-2018-18520 CVE-2018-18521 CVE-2018-19636 CVE-2018-19637 CVE-2018-19638 CVE-2018-19639 CVE-2018-19640 CVE-2018-20836 CVE-2018-20852 CVE-2019-1559 CVE-2019-2422 CVE-2019-2426 CVE-2019-2602 CVE-2019-2684 CVE-2019-2698 CVE-2019-2745 CVE-2019-2762 CVE-2019-2766 CVE-2019-2769 CVE-2019-2786 CVE-2019-2816 CVE-2019-2842 CVE-2019-3838 CVE-2019-3842 CVE-2019-3846 CVE-2019-3855 CVE-2019-3856 CVE-2019-3857 CVE-2019-3858 CVE-2019-3859 CVE-2019-3860 CVE-2019-3861 CVE-2019-3862 CVE-2019-3863 CVE-2019-5436 CVE-2019-5489 CVE-2019-5785 CVE-2019-5953 CVE-2019-6133 CVE-2019-6201 CVE-2019-6251 CVE-2019-6465 CVE-2019-7150 CVE-2019-7285 CVE-2019-7292 CVE-2019-7317 CVE-2019-7665 CVE-2019-8375 CVE-2019-8457 CVE-2019-8503 CVE-2019-8506 CVE-2019-8515 CVE-2019-8524 CVE-2019-8535 CVE-2019-8536 CVE-2019-8544 CVE-2019-8551 CVE-2019-8558 CVE-2019-8559 CVE-2019-8563 CVE-2019-8936 CVE-2019-9169 CVE-2019-9636 CVE-2019-9788 CVE-2019-9790 CVE-2019-9791 CVE-2019-9792 CVE-2019-9793 CVE-2019-9794 CVE-2019-9795 CVE-2019-9796 CVE-2019-9800 CVE-2019-9801 CVE-2019-9810 CVE-2019-9811 CVE-2019-9813 CVE-2019-9815 CVE-2019-9816 CVE-2019-9817 CVE-2019-9818 CVE-2019-9819 CVE-2019-9820 CVE-2019-9928 CVE-2019-9948 CVE-2019-10126 CVE-2019-10160 CVE-2019-10638 CVE-2019-10639 CVE-2019-11070 CVE-2019-11091 CVE-2019-11190 CVE-2019-11459 CVE-2019-11477 CVE-2019-11478 CVE-2019-11479 CVE-2019-11486 CVE-2019-11487 CVE-2019-11599 CVE-2019-11691 CVE-2019-11692 CVE-2019-11693 CVE-2019-11694 CVE-2019-11698 CVE-2019-11707 CVE-2019-11708 CVE-2019-11709 CVE-2019-11711 CVE-2019-11712 CVE-2019-11713 CVE-2019-11715 CVE-2019-11717 CVE-2019-11719 CVE-2019-11729 CVE-2019-11730 CVE-2019-11815 CVE-2019-11833 CVE-2019-11884 CVE-2019-12380 CVE-2019-12382 CVE-2019-12450 CVE-2019-12456 CVE-2019-12614 CVE-2019-12735 CVE-2019-12818 CVE-2019-12819 CVE-2019-12900 CVE-2019-13012 CVE-2019-1010006 Note - For more information about any of the Common Vulnerabilities and Exposures (CVEs) mentioned here consult the National Vulnerability Database (NVD) at http://nvd.nist.gov/home.cfm.  To search for a CVE, use the database's search utility at http://web.nvd.nist.gov/view/vuln/search.
Recommendation:	The Appliance Updater tool's August 2019 releases will resolve these issues and ensures that the embedded OS components are kept current with security updates and patches. RSA recommends all appliance customers who are on SUSE Linux Enterprise Server 11 SP3/SP4 or 12 SP2/SP3 to run the appliance updater as latest patches will be applied to the current in-stallation. This Appliance Updater supports the RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, or RSA IMG products which use an RSA supplied SUSE Linux Enterprise Server 12 SP2/SP3 or SUSE Linux Enterprise Server 11 SP3/SP4 operating system. Customers can obtain the documentation and software by downloading them from the Down-loads area on RSA Identity Governance and Lifecycle space of RSA Link. • RSA Identity Governance and Lifecycle: RSA Identity Governance and Lifecycle Appliance Updater • RSA Via L&G: RSA Via Lifecycle and Governance Appliance Updater • RSA IMG: RSA Identity Management and Governance Appliance Updater
	For additional documentation, downloads and more, visit the RSA Identity Governance & Lifecycle‌ page on RSA Link.
Severity Rating:	For an explanation of Severity Ratings, refer to Dell’s Vulnerability Disclosure Policy. RSA recommends all customers take into account both the base score and any relevant temporal and environmental scores which may impact the potential severity associated with particular security vulnerability.
EOPS Policy:	RSA has a defined End of Primary Support policy associated with all major versions. Please refer to the Product Version Life Cycle for additional details.
Legal Information:	Read and use the information in this RSA Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this advisory, contact RSA Customer Support. RSA Security LLC and its affiliates, including without limitation, its ultimate parent company, Dell Technologies, distribute RSA Security Advisories in order to bring to the attention of users of the affected RSA products, important security information. RSA recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided "as is" without warranty of any kind. RSA disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event shall RSA, its affiliates or its suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if RSA, its affiliates or its suppliers have been advised of the possibility of such damages. Some jurisdictions do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply.