Security update for SUSE Manager Server 3.1 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:0863-1 Final 1 1 2019-04-03T15:33:20Z current 2019-04-03T15:33:20Z 2019-04-03T15:33:20Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for SUSE Manager Server 3.1 This update fixes the following issues: cobbler: - Fixes case where distribution detection returns None (bsc#1130658) - SUSE texmode fix (bsc#1109316) - Fix for SUSE distribution detection in ISO building (bsc#1123991) py26-compat-salt: - Remove arch from name when pkg.list_pkgs is called with 'attr' (bsc#1114029) spacecmd: - Fix importing state channels using configchannel_import - Fix getting file info for latest revision (via configchannel_filedetails) spacewalk-branding: - Update jquery.timepicker dependency to 1.11.14 to allow parsing the time format without depending on the language. (bsc#1119081) spacewalk-java: - Fix a problem when cloning public child channels with a private base channel (bsc#1124639) - Keep assigned channels on traditional to minion migration (bsc#1122836) - Fix 'Add Selected to SSM' on System Groups -> systems page (bsc#1121856) - Disable notification types with 'java.notifications_type_disabled' in rhn.conf (bsc#1111910) - XMLRPC API: Include init.sls in channel file list (bsc#1111191) - Fix the config channels assignment via SSM (bsc#1117759) spacewalk-utils: - Create /etc/rhn with correct ownership to prevent file conflicts spacewalk-web: - Fix action scheduler time picker prefill when the server is on 'UTC/GMT' timezone (bsc#1121195) - Fix initializing of the datetime picker (bsc#1126862) - Show feedback messages after using the retry option on the notification messages page subscription-matcher: - Old style hard bundle merging fix (bsc#1114059) susemanager: - Fix creation of bootstrap repositories for SLE12 (no SP) by requiring python-setuptools only for SLE12 >= SP1 (bsc#1129765) - Add `python-setuptools` package dependency to SLES12 bootstrap repo (bsc#1119964) - Rhnlib was renamed to python2-rhnlib. Change bootstrap data accordingly. susemanager-schema: - Fix performance regression in inter-server-sync (bsc#1128781) susemanager-docs_en: - Update text and image files - 2.1 comparison: clarify profile syncing support - Adjust documentation about notification settings - Fix internal link (SMT documentation). - Remove documentation about the 'mgr-sync enable-scc' subcommand. This subcommand is no longer available. susemanager-frontend-libs: - Update jquery.timepicker to 1.11.14 (bsc#1119081) tika-core: - New upstream version (1.20). Fixes infinite loop in SQLite3Parser (CVE-2018-17197) (bsc#1121038) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2019-863,SUSE-SUSE-Manager-Proxy-3.1-2019-863,SUSE-SUSE-Manager-Server-3.1-2019-863 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20190863-1/ Link for SUSE-SU-2019:0863-1 https://lists.suse.com/pipermail/sle-security-updates/2019-April/005291.html E-Mail link for SUSE-SU-2019:0863-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1109316 SUSE Bug 1109316 https://bugzilla.suse.com/1111191 SUSE Bug 1111191 https://bugzilla.suse.com/1111910 SUSE Bug 1111910 https://bugzilla.suse.com/1114029 SUSE Bug 1114029 https://bugzilla.suse.com/1114059 SUSE Bug 1114059 https://bugzilla.suse.com/1114157 SUSE Bug 1114157 https://bugzilla.suse.com/1114169 SUSE Bug 1114169 https://bugzilla.suse.com/1117759 SUSE Bug 1117759 https://bugzilla.suse.com/1119081 SUSE Bug 1119081 https://bugzilla.suse.com/1119964 SUSE Bug 1119964 https://bugzilla.suse.com/1121038 SUSE Bug 1121038 https://bugzilla.suse.com/1121195 SUSE Bug 1121195 https://bugzilla.suse.com/1121856 SUSE Bug 1121856 https://bugzilla.suse.com/1122836 SUSE Bug 1122836 https://bugzilla.suse.com/1123991 SUSE Bug 1123991 https://bugzilla.suse.com/1124639 SUSE Bug 1124639 https://bugzilla.suse.com/1126862 SUSE Bug 1126862 https://bugzilla.suse.com/1128781 SUSE Bug 1128781 https://bugzilla.suse.com/1129765 SUSE Bug 1129765 https://bugzilla.suse.com/1130658 SUSE Bug 1130658 https://www.suse.com/security/cve/CVE-2018-10851/ SUSE CVE CVE-2018-10851 page https://www.suse.com/security/cve/CVE-2018-14626/ SUSE CVE CVE-2018-14626 page https://www.suse.com/security/cve/CVE-2018-17197/ SUSE CVE CVE-2018-17197 page SUSE Manager Proxy 3.1 SUSE Manager Server 3.1 cobbler-2.6.6-5.25.1 cobbler-tests-2.6.6-5.25.1 cobbler-web-2.6.6-5.25.1 koan-2.6.6-5.25.1 py26-compat-salt-2016.11.10-1.19.3 spacecmd-2.7.8.15-2.32.1 spacewalk-base-2.7.1.21-2.35.1 spacewalk-base-minimal-2.7.1.21-2.35.1 spacewalk-base-minimal-config-2.7.1.21-2.35.1 spacewalk-branding-2.7.2.17-2.31.3 spacewalk-branding-devel-2.7.2.17-2.31.3 spacewalk-dobby-2.7.1.21-2.35.1 spacewalk-html-2.7.1.21-2.35.1 spacewalk-java-2.7.46.19-2.41.3 spacewalk-java-apidoc-sources-2.7.46.19-2.41.3 spacewalk-java-config-2.7.46.19-2.41.3 spacewalk-java-lib-2.7.46.19-2.41.3 spacewalk-java-oracle-2.7.46.19-2.41.3 spacewalk-java-postgresql-2.7.46.19-2.41.3 spacewalk-taskomatic-2.7.46.19-2.41.3 spacewalk-utils-2.7.10.11-2.23.3 subscription-matcher-0.22-4.9.2 susemanager-3.1.19-2.34.2 susemanager-advanced-topics_en-pdf-3.1-10.29.4 susemanager-best-practices_en-pdf-3.1-10.29.4 susemanager-docs_en-3.1-10.29.4 susemanager-frontend-libs-3.1.2-3.10.1 susemanager-frontend-libs-devel-3.1.2-3.10.1 susemanager-getting-started_en-pdf-3.1-10.29.4 susemanager-jsp_en-3.1-10.29.4 susemanager-reference_en-pdf-3.1-10.29.4 susemanager-schema-3.1.21-2.36.1 susemanager-tools-3.1.19-2.34.2 tika-core-1.20-1.6.2 spacewalk-base-minimal-2.7.1.21-2.35.1 as a component of SUSE Manager Proxy 3.1 spacewalk-base-minimal-config-2.7.1.21-2.35.1 as a component of SUSE Manager Proxy 3.1 cobbler-2.6.6-5.25.1 as a component of SUSE Manager Server 3.1 py26-compat-salt-2016.11.10-1.19.3 as a component of SUSE Manager Server 3.1 spacecmd-2.7.8.15-2.32.1 as a component of SUSE Manager Server 3.1 spacewalk-base-2.7.1.21-2.35.1 as a component of SUSE Manager Server 3.1 spacewalk-base-minimal-2.7.1.21-2.35.1 as a component of SUSE Manager Server 3.1 spacewalk-base-minimal-config-2.7.1.21-2.35.1 as a component of SUSE Manager Server 3.1 spacewalk-branding-2.7.2.17-2.31.3 as a component of SUSE Manager Server 3.1 spacewalk-html-2.7.1.21-2.35.1 as a component of SUSE Manager Server 3.1 spacewalk-java-2.7.46.19-2.41.3 as a component of SUSE Manager Server 3.1 spacewalk-java-config-2.7.46.19-2.41.3 as a component of SUSE Manager Server 3.1 spacewalk-java-lib-2.7.46.19-2.41.3 as a component of SUSE Manager Server 3.1 spacewalk-java-oracle-2.7.46.19-2.41.3 as a component of SUSE Manager Server 3.1 spacewalk-java-postgresql-2.7.46.19-2.41.3 as a component of SUSE Manager Server 3.1 spacewalk-taskomatic-2.7.46.19-2.41.3 as a component of SUSE Manager Server 3.1 spacewalk-utils-2.7.10.11-2.23.3 as a component of SUSE Manager Server 3.1 subscription-matcher-0.22-4.9.2 as a component of SUSE Manager Server 3.1 susemanager-3.1.19-2.34.2 as a component of SUSE Manager Server 3.1 susemanager-advanced-topics_en-pdf-3.1-10.29.4 as a component of SUSE Manager Server 3.1 susemanager-best-practices_en-pdf-3.1-10.29.4 as a component of SUSE Manager Server 3.1 susemanager-docs_en-3.1-10.29.4 as a component of SUSE Manager Server 3.1 susemanager-frontend-libs-3.1.2-3.10.1 as a component of SUSE Manager Server 3.1 susemanager-getting-started_en-pdf-3.1-10.29.4 as a component of SUSE Manager Server 3.1 susemanager-jsp_en-3.1-10.29.4 as a component of SUSE Manager Server 3.1 susemanager-reference_en-pdf-3.1-10.29.4 as a component of SUSE Manager Server 3.1 susemanager-schema-3.1.21-2.36.1 as a component of SUSE Manager Server 3.1 susemanager-tools-3.1.19-2.34.2 as a component of SUSE Manager Server 3.1 tika-core-1.20-1.6.2 as a component of SUSE Manager Server 3.1 PowerDNS Authoritative Server 3.3.0 up to 4.1.4 excluding 4.1.5 and 4.0.6, and PowerDNS Recursor 3.2 up to 4.1.4 excluding 4.1.5 and 4.0.9, are vulnerable to a memory leak while parsing malformed records that can lead to remote denial of service. CVE-2018-10851 SUSE Manager Proxy 3.1:spacewalk-base-minimal-2.7.1.21-2.35.1 SUSE Manager Proxy 3.1:spacewalk-base-minimal-config-2.7.1.21-2.35.1 SUSE Manager Server 3.1:cobbler-2.6.6-5.25.1 SUSE Manager Server 3.1:py26-compat-salt-2016.11.10-1.19.3 SUSE Manager Server 3.1:spacecmd-2.7.8.15-2.32.1 SUSE Manager Server 3.1:spacewalk-base-2.7.1.21-2.35.1 SUSE Manager Server 3.1:spacewalk-base-minimal-2.7.1.21-2.35.1 SUSE Manager Server 3.1:spacewalk-base-minimal-config-2.7.1.21-2.35.1 SUSE Manager Server 3.1:spacewalk-branding-2.7.2.17-2.31.3 SUSE Manager Server 3.1:spacewalk-html-2.7.1.21-2.35.1 SUSE Manager Server 3.1:spacewalk-java-2.7.46.19-2.41.3 SUSE Manager Server 3.1:spacewalk-java-config-2.7.46.19-2.41.3 SUSE Manager Server 3.1:spacewalk-java-lib-2.7.46.19-2.41.3 SUSE Manager Server 3.1:spacewalk-java-oracle-2.7.46.19-2.41.3 SUSE Manager Server 3.1:spacewalk-java-postgresql-2.7.46.19-2.41.3 SUSE Manager Server 3.1:spacewalk-taskomatic-2.7.46.19-2.41.3 SUSE Manager Server 3.1:spacewalk-utils-2.7.10.11-2.23.3 SUSE Manager Server 3.1:subscription-matcher-0.22-4.9.2 SUSE Manager Server 3.1:susemanager-3.1.19-2.34.2 SUSE Manager Server 3.1:susemanager-advanced-topics_en-pdf-3.1-10.29.4 SUSE Manager Server 3.1:susemanager-best-practices_en-pdf-3.1-10.29.4 SUSE Manager Server 3.1:susemanager-docs_en-3.1-10.29.4 SUSE Manager Server 3.1:susemanager-frontend-libs-3.1.2-3.10.1 SUSE Manager Server 3.1:susemanager-getting-started_en-pdf-3.1-10.29.4 SUSE Manager Server 3.1:susemanager-jsp_en-3.1-10.29.4 SUSE Manager Server 3.1:susemanager-reference_en-pdf-3.1-10.29.4 SUSE Manager Server 3.1:susemanager-schema-3.1.21-2.36.1 SUSE Manager Server 3.1:susemanager-tools-3.1.19-2.34.2 SUSE Manager Server 3.1:tika-core-1.20-1.6.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190863-1/ https://www.suse.com/security/cve/CVE-2018-10851.html CVE-2018-10851 https://bugzilla.suse.com/1114157 SUSE Bug 1114157 https://bugzilla.suse.com/1114169 SUSE Bug 1114169 https://bugzilla.suse.com/1114170 SUSE Bug 1114170 PowerDNS Authoritative Server 4.1.0 up to 4.1.4 inclusive and PowerDNS Recursor 4.0.0 up to 4.1.4 inclusive are vulnerable to a packet cache pollution via crafted query that can lead to denial of service. CVE-2018-14626 SUSE Manager Proxy 3.1:spacewalk-base-minimal-2.7.1.21-2.35.1 SUSE Manager Proxy 3.1:spacewalk-base-minimal-config-2.7.1.21-2.35.1 SUSE Manager Server 3.1:cobbler-2.6.6-5.25.1 SUSE Manager Server 3.1:py26-compat-salt-2016.11.10-1.19.3 SUSE Manager Server 3.1:spacecmd-2.7.8.15-2.32.1 SUSE Manager Server 3.1:spacewalk-base-2.7.1.21-2.35.1 SUSE Manager Server 3.1:spacewalk-base-minimal-2.7.1.21-2.35.1 SUSE Manager Server 3.1:spacewalk-base-minimal-config-2.7.1.21-2.35.1 SUSE Manager Server 3.1:spacewalk-branding-2.7.2.17-2.31.3 SUSE Manager Server 3.1:spacewalk-html-2.7.1.21-2.35.1 SUSE Manager Server 3.1:spacewalk-java-2.7.46.19-2.41.3 SUSE Manager Server 3.1:spacewalk-java-config-2.7.46.19-2.41.3 SUSE Manager Server 3.1:spacewalk-java-lib-2.7.46.19-2.41.3 SUSE Manager Server 3.1:spacewalk-java-oracle-2.7.46.19-2.41.3 SUSE Manager Server 3.1:spacewalk-java-postgresql-2.7.46.19-2.41.3 SUSE Manager Server 3.1:spacewalk-taskomatic-2.7.46.19-2.41.3 SUSE Manager Server 3.1:spacewalk-utils-2.7.10.11-2.23.3 SUSE Manager Server 3.1:subscription-matcher-0.22-4.9.2 SUSE Manager Server 3.1:susemanager-3.1.19-2.34.2 SUSE Manager Server 3.1:susemanager-advanced-topics_en-pdf-3.1-10.29.4 SUSE Manager Server 3.1:susemanager-best-practices_en-pdf-3.1-10.29.4 SUSE Manager Server 3.1:susemanager-docs_en-3.1-10.29.4 SUSE Manager Server 3.1:susemanager-frontend-libs-3.1.2-3.10.1 SUSE Manager Server 3.1:susemanager-getting-started_en-pdf-3.1-10.29.4 SUSE Manager Server 3.1:susemanager-jsp_en-3.1-10.29.4 SUSE Manager Server 3.1:susemanager-reference_en-pdf-3.1-10.29.4 SUSE Manager Server 3.1:susemanager-schema-3.1.21-2.36.1 SUSE Manager Server 3.1:susemanager-tools-3.1.19-2.34.2 SUSE Manager Server 3.1:tika-core-1.20-1.6.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190863-1/ https://www.suse.com/security/cve/CVE-2018-14626.html CVE-2018-14626 https://bugzilla.suse.com/1114157 SUSE Bug 1114157 https://bugzilla.suse.com/1114169 SUSE Bug 1114169 https://bugzilla.suse.com/1114170 SUSE Bug 1114170 A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser in versions 1.8-1.19.1 of Apache Tika. CVE-2018-17197 SUSE Manager Proxy 3.1:spacewalk-base-minimal-2.7.1.21-2.35.1 SUSE Manager Proxy 3.1:spacewalk-base-minimal-config-2.7.1.21-2.35.1 SUSE Manager Server 3.1:cobbler-2.6.6-5.25.1 SUSE Manager Server 3.1:py26-compat-salt-2016.11.10-1.19.3 SUSE Manager Server 3.1:spacecmd-2.7.8.15-2.32.1 SUSE Manager Server 3.1:spacewalk-base-2.7.1.21-2.35.1 SUSE Manager Server 3.1:spacewalk-base-minimal-2.7.1.21-2.35.1 SUSE Manager Server 3.1:spacewalk-base-minimal-config-2.7.1.21-2.35.1 SUSE Manager Server 3.1:spacewalk-branding-2.7.2.17-2.31.3 SUSE Manager Server 3.1:spacewalk-html-2.7.1.21-2.35.1 SUSE Manager Server 3.1:spacewalk-java-2.7.46.19-2.41.3 SUSE Manager Server 3.1:spacewalk-java-config-2.7.46.19-2.41.3 SUSE Manager Server 3.1:spacewalk-java-lib-2.7.46.19-2.41.3 SUSE Manager Server 3.1:spacewalk-java-oracle-2.7.46.19-2.41.3 SUSE Manager Server 3.1:spacewalk-java-postgresql-2.7.46.19-2.41.3 SUSE Manager Server 3.1:spacewalk-taskomatic-2.7.46.19-2.41.3 SUSE Manager Server 3.1:spacewalk-utils-2.7.10.11-2.23.3 SUSE Manager Server 3.1:subscription-matcher-0.22-4.9.2 SUSE Manager Server 3.1:susemanager-3.1.19-2.34.2 SUSE Manager Server 3.1:susemanager-advanced-topics_en-pdf-3.1-10.29.4 SUSE Manager Server 3.1:susemanager-best-practices_en-pdf-3.1-10.29.4 SUSE Manager Server 3.1:susemanager-docs_en-3.1-10.29.4 SUSE Manager Server 3.1:susemanager-frontend-libs-3.1.2-3.10.1 SUSE Manager Server 3.1:susemanager-getting-started_en-pdf-3.1-10.29.4 SUSE Manager Server 3.1:susemanager-jsp_en-3.1-10.29.4 SUSE Manager Server 3.1:susemanager-reference_en-pdf-3.1-10.29.4 SUSE Manager Server 3.1:susemanager-schema-3.1.21-2.36.1 SUSE Manager Server 3.1:susemanager-tools-3.1.19-2.34.2 SUSE Manager Server 3.1:tika-core-1.20-1.6.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190863-1/ https://www.suse.com/security/cve/CVE-2018-17197.html CVE-2018-17197 https://bugzilla.suse.com/1121038 SUSE Bug 1121038