Security update for SUSE Manager Proxy 3.0 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:1346-1 Final 1 1 2017-05-18T22:20:37Z current 2017-05-18T22:20:37Z 2017-05-18T22:20:37Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for SUSE Manager Proxy 3.0 The following security issue in spacewalk-backend has been fixed: - Non admin or disabled user cannot make changes to a system anymore using spacewalk-channel. (bsc#1026633, CVE-2017-7470) Additionally, the following non-security issues have been fixed: rhnlib: - Support all TLS versions in rpclib. (bsc#1025312) spacewalk-backend: - Do not fail with traceback when media.1 does not exist. (bsc#1032256) - Create scap files dir beforehand. (bsc#1029755) - Fix error if SPACEWALK_DEBUG_NO_REPORTS env variable is not present. - Don't skip 'rhnErrataPackage' cleanup during an errata update. (bsc#1023233) - Add support for running spacewalk-debug without creating reports. (bsc#1024714) - Set scap store dir mod to 775 and group owner to susemanager. - Incomplete_package_import: do import rhnPackageFile as it breaks some package installations. - Added traceback printing to the exception block. - Change postgresql starting commands. spacewalk-certs-tools: - Always restart the minion regardless of its current state. (bsc#1034956) - Correctly honor disabling of SSL in bootstrap script. (bsc#1033383) - Add curl dependency and move mgr-proxy-ssh* to spacewalk-proxy package. - Exit for non-traditional bootstrap scripts. (bsc#1020904) - Rename mgr-ssh-proxy-force-cmd -> mgr-proxy-ssh-force-cmd. - Add mgr-proxy-ssh-force-cmd, mgr-proxy-ssh-push-init to rpm. - Add option to configure only sshd. - Restrictive ssh options for user mgrsshtunnel. spacewalk-client-tools: - Fix reboot message to use correct product name. (bsc#1031667) spacewalk-proxy: - Add curl dependency and move mgr-proxy-ssh* to spacewalk-proxy package. - Lower the use-file-instead-of-memory treshold. (bsc#1030342) spacewalk-proxy-installer: - Do not start firewall on proxy during configuration if not already active. (bsc#1031338) - Salt minions get repodata via a different URL; reflect by additional squid rule. (bsc#1027873) - Only warn if parent ssh-push pub key could not be retrieved. - Generate and auth ssh push keys for user mgrsshtunnel. - Authorize parent salt-ssh key on proxy. - Generate proxy ssh-push key and authorize the previous proxy in the chain. - Generate own ssh-push key for proxy and authorize parent. spacewalk-web: - Remote Commands: Allow Web Socket to be opened on non-standard port. - Improve remote cmd ui err handling. - Show message when waiting for ssh minions times out. - Fix remote cmd ui js err and timed out message. - Remote cmd UI changes for salt-ssh minions. - Fix broken help link for taskstatus. (bsc#1017422) - Add js utility function to create Date objects in different timezones. - Show proxy path in bootstrap UI. - Clear proxy selection when clicking clear fields button. - Check if proxy hostname is FQDN not name in UI. - Show warn in bootstrap UI if proxy hostname is not a FQDN. susemanager-sls: - Add certificate state for CAASP. - Add certificate state for SLES for SAP. (bsc#1031659) - Pre-create empty top.sls with no-op. (bsc#1017754) - Add xccdf result xslt. - Fix mainframesysinfo module to use /proc/sysinfo on SLES11. (bsc#1025758) - Set scap store dir mod to 775 and group owner to susemanager. - Store uploaded scap files. - Set minion own key owner to bootstrap ssh_push_sudo_user. - Runner to generate ssh key and execute cmd via proxies. - Change ssh bootstrap state to generate and auth keys for salt-ssh push with tunnel. - Authorize parent salt-ssh key on proxy. How to apply this update: 1. Log in as root user to the SUSE Manager proxy. 2. Stop the proxy service: spacewalk-proxy stop 3. Apply the patch using either zypper patch or YaST Online Update. 4. Start the Spacewalk service: spacewalk-proxy start The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SUSE-Manager-Proxy-3.0-2017-827 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20171346-1/ Link for SUSE-SU-2017:1346-1 https://lists.suse.com/pipermail/sle-security-updates/2017-May/002897.html E-Mail link for SUSE-SU-2017:1346-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1017422 SUSE Bug 1017422 https://bugzilla.suse.com/1017754 SUSE Bug 1017754 https://bugzilla.suse.com/1020904 SUSE Bug 1020904 https://bugzilla.suse.com/1023233 SUSE Bug 1023233 https://bugzilla.suse.com/1024714 SUSE Bug 1024714 https://bugzilla.suse.com/1025312 SUSE Bug 1025312 https://bugzilla.suse.com/1025758 SUSE Bug 1025758 https://bugzilla.suse.com/1026633 SUSE Bug 1026633 https://bugzilla.suse.com/1027873 SUSE Bug 1027873 https://bugzilla.suse.com/1029755 SUSE Bug 1029755 https://bugzilla.suse.com/1030342 SUSE Bug 1030342 https://bugzilla.suse.com/1031338 SUSE Bug 1031338 https://bugzilla.suse.com/1031659 SUSE Bug 1031659 https://bugzilla.suse.com/1031667 SUSE Bug 1031667 https://bugzilla.suse.com/1032256 SUSE Bug 1032256 https://bugzilla.suse.com/1033383 SUSE Bug 1033383 https://bugzilla.suse.com/1034956 SUSE Bug 1034956 https://www.suse.com/security/cve/CVE-2017-7470/ SUSE CVE CVE-2017-7470 page SUSE Manager Proxy 3.0 rhnlib-2.5.84.4-6.1 spacewalk-backend-2.5.24.9-22.1 spacewalk-backend-libs-2.5.24.9-22.1 spacewalk-base-minimal-2.5.7.15-21.1 spacewalk-base-minimal-config-2.5.7.15-21.1 spacewalk-certs-tools-2.5.1.8-17.1 spacewalk-check-2.5.13.8-17.2 spacewalk-client-setup-2.5.13.8-17.2 spacewalk-client-tools-2.5.13.8-17.2 spacewalk-proxy-broker-2.5.1.7-15.1 spacewalk-proxy-common-2.5.1.7-15.1 spacewalk-proxy-installer-2.5.2.5-6.1 spacewalk-proxy-management-2.5.1.7-15.1 spacewalk-proxy-package-manager-2.5.1.7-15.1 spacewalk-proxy-redirect-2.5.1.7-15.1 spacewalk-proxy-salt-2.5.1.7-15.1 susemanager-sls-0.1.20-23.1 rhnlib-2.5.84.4-6.1 as a component of SUSE Manager Proxy 3.0 spacewalk-backend-2.5.24.9-22.1 as a component of SUSE Manager Proxy 3.0 spacewalk-backend-libs-2.5.24.9-22.1 as a component of SUSE Manager Proxy 3.0 spacewalk-base-minimal-2.5.7.15-21.1 as a component of SUSE Manager Proxy 3.0 spacewalk-base-minimal-config-2.5.7.15-21.1 as a component of SUSE Manager Proxy 3.0 spacewalk-certs-tools-2.5.1.8-17.1 as a component of SUSE Manager Proxy 3.0 spacewalk-check-2.5.13.8-17.2 as a component of SUSE Manager Proxy 3.0 spacewalk-client-setup-2.5.13.8-17.2 as a component of SUSE Manager Proxy 3.0 spacewalk-client-tools-2.5.13.8-17.2 as a component of SUSE Manager Proxy 3.0 spacewalk-proxy-broker-2.5.1.7-15.1 as a component of SUSE Manager Proxy 3.0 spacewalk-proxy-common-2.5.1.7-15.1 as a component of SUSE Manager Proxy 3.0 spacewalk-proxy-installer-2.5.2.5-6.1 as a component of SUSE Manager Proxy 3.0 spacewalk-proxy-management-2.5.1.7-15.1 as a component of SUSE Manager Proxy 3.0 spacewalk-proxy-package-manager-2.5.1.7-15.1 as a component of SUSE Manager Proxy 3.0 spacewalk-proxy-redirect-2.5.1.7-15.1 as a component of SUSE Manager Proxy 3.0 spacewalk-proxy-salt-2.5.1.7-15.1 as a component of SUSE Manager Proxy 3.0 susemanager-sls-0.1.20-23.1 as a component of SUSE Manager Proxy 3.0 It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks due to an incorrect authorization check in backend/server/rhnChannel.py. CVE-2017-7470 SUSE Manager Proxy 3.0:rhnlib-2.5.84.4-6.1 SUSE Manager Proxy 3.0:spacewalk-backend-2.5.24.9-22.1 SUSE Manager Proxy 3.0:spacewalk-backend-libs-2.5.24.9-22.1 SUSE Manager Proxy 3.0:spacewalk-base-minimal-2.5.7.15-21.1 SUSE Manager Proxy 3.0:spacewalk-base-minimal-config-2.5.7.15-21.1 SUSE Manager Proxy 3.0:spacewalk-certs-tools-2.5.1.8-17.1 SUSE Manager Proxy 3.0:spacewalk-check-2.5.13.8-17.2 SUSE Manager Proxy 3.0:spacewalk-client-setup-2.5.13.8-17.2 SUSE Manager Proxy 3.0:spacewalk-client-tools-2.5.13.8-17.2 SUSE Manager Proxy 3.0:spacewalk-proxy-broker-2.5.1.7-15.1 SUSE Manager Proxy 3.0:spacewalk-proxy-common-2.5.1.7-15.1 SUSE Manager Proxy 3.0:spacewalk-proxy-installer-2.5.2.5-6.1 SUSE Manager Proxy 3.0:spacewalk-proxy-management-2.5.1.7-15.1 SUSE Manager Proxy 3.0:spacewalk-proxy-package-manager-2.5.1.7-15.1 SUSE Manager Proxy 3.0:spacewalk-proxy-redirect-2.5.1.7-15.1 SUSE Manager Proxy 3.0:spacewalk-proxy-salt-2.5.1.7-15.1 SUSE Manager Proxy 3.0:susemanager-sls-0.1.20-23.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171346-1/ https://www.suse.com/security/cve/CVE-2017-7470.html CVE-2017-7470 https://bugzilla.suse.com/1026633 SUSE Bug 1026633 https://bugzilla.suse.com/1057882 SUSE Bug 1057882