Security update for SUSE Manager Client Tools SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:2317-1 Final 1 1 2019-09-06T07:15:46Z current 2019-09-06T07:15:46Z 2019-09-06T07:15:46Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for SUSE Manager Client Tools This update fixes the following issues: golang-github-prometheus-prometheus: - Add support for Uyuni/SUSE Manager service discovery + Added 0003-Add-Uyuni-service-discovery - Readded _service file removed in error. - Update to 2.11.1 + Bug Fix: * Fix potential panic when prometheus is watching multiple zookeeper paths. - Update to 2.11.0 + Bug Fix: * resolve race condition in maxGauge. * Fix ZooKeeper connection leak. * Improved atomicity of .tmp block replacement during compaction for usual case. * Fix 'unknown series references' after clean shutdown. * Re-calculate block size when calling block.Delete. * Fix unsafe snapshots with head block. * prometheus_tsdb_compactions_failed_total is now incremented on any compaction failure. + Changes: * Remove max_retries from queue_config (it has been unused since rewriting remote-write to utilize the write-ahead-log) * The meta file BlockStats no longer holds size information. This is now dynamically calculated and kept in memory. It also includes the meta file size which was not included before * Renamed metric from prometheus_tsdb_wal_reader_corruption_errors to prometheus_tsdb_wal_reader_corruption_errors_total + Features: * Add option to use Alertmanager API v2. * Added humanizePercentage function for templates. * Include InitContainers in Kubernetes Service Discovery. * Provide option to compress WAL records using Snappy. + Enhancements: * Create new clean segment when starting the WAL. * Reduce allocations in PromQL aggregations. * Add storage warnings to LabelValues and LabelNames API results. * Add prometheus_http_requests_total metric. * Enable openbsd/arm build. * Remote-write allocation improvements. * Query performance improvement: Efficient iteration and search in HashForLabels and HashWithoutLabels. * Allow injection of arbitrary headers in promtool. * Allow passing external_labels in alert unit tests groups. * Allows globs for rules when unit testing. * Improved postings intersection matching. * Reduced disk usage for WAL for small setups. * Optimize queries using regexp for set lookups. - Rebase patch002-Default-settings.patch - Update to 2.10.0: + Bug Fixes: * TSDB: Don't panic when running out of disk space and recover nicely from the condition * TSDB: Correctly handle empty labels. * TSDB: Don't crash on an unknown tombstone reference. * Storage/remote: Remove queue-manager specific metrics if queue no longer exists. * PromQL: Correctly display {__name__='a'}. * Discovery/kubernetes: Use service rather than ingress as the name for the service workqueue. * Discovery/azure: Don't panic on a VM with a public IP. * Web: Fixed Content-Type for js and css instead of using /etc/mime.types. * API: Encode alert values as string to correctly represent Inf/NaN. + Features: * Template expansion: Make external labels available as $externalLabels in alert and console template expansion. * TSDB: Add prometheus_tsdb_wal_segment_current metric for the WAL segment index that TSDB is currently writing to. tsdb * Scrape: Add scrape_series_added per-scrape metric. #5546 + Enhancements * Discovery/kubernetes: Add labels __meta_kubernetes_endpoint_node_name and __meta_kubernetes_endpoint_hostname. * Discovery/azure: Add label __meta_azure_machine_public_ip. * TSDB: Simplify mergedPostings.Seek, resulting in better performance if there are many posting lists. tsdb * Log filesystem type on startup. * Cmd/promtool: Use POST requests for Query and QueryRange. client_golang * Web: Sort alerts by group name. * Console templates: Add convenience variables $rawParams, $params, $path. - Upadte to 2.9.2 + Bug Fixes: * Make sure subquery range is taken into account for selection * Exhaust every request body before closing it * Cmd/promtool: return errors from rule evaluations * Remote Storage: string interner should not panic in release * Fix memory allocation regression in mergedPostings.Seek tsdb - Update to 2.9.1 + Bug Fixes: * Discovery/kubernetes: fix missing label sanitization * Remote_write: Prevent reshard concurrent with calling stop - Update to 2.9.0 + Feature: * Add honor_timestamps scrape option. + Enhancements: * Update Consul to support catalog.ServiceMultipleTags. * Discovery/kubernetes: add present labels for labels/annotations. * OpenStack SD: Add ProjectID and UserID meta labels. * Add GODEBUG and retention to the runtime page. * Add support for POSTing to /series endpoint. * Support PUT methods for Lifecycle and Admin APIs. * Scrape: Add global jitter for HA server. * Check for cancellation on every step of a range evaluation. * String interning for labels & values in the remote_write path. * Don't lose the scrape cache on a failed scrape. * Reload cert files from disk automatically. common * Use fixed length millisecond timestamp format for logs. common * Performance improvements for postings. Bug Fixes: * Remote Write: fix checkpoint reading. * Check if label value is valid when unmarshaling external labels from YAML. * Promparse: sort all labels when parsing. * Reload rules: copy state on both name and labels. * Exponentation operator to drop metric name in result of operation. * Config: resolve more file paths. * Promtool: resolve relative paths in alert test files. * Set TLSHandshakeTimeout in HTTP transport. common * Use fsync to be more resilient to machine crashes. * Keep series that are still in WAL in checkpoints. - Update to 2.8.1 + Bug Fixes * Display the job labels in /targets which was removed accidentally - Update to 2.8.0 + Change: * This release uses Write-Ahead Logging (WAL) for the remote_write API. This currently causes a slight increase in memory usage, which will be addressed in future releases. * Default time retention is used only when no size based retention is specified. These are flags where time retention is specified by the flag --storage.tsdb.retention and size retention by --storage.tsdb.retention.size. * prometheus_tsdb_storage_blocks_bytes_total is now prometheus_tsdb_storage_blocks_bytes. + Feature: * (EXPERIMENTAL) Time overlapping blocks are now allowed; vertical compaction and vertical query merge. It is an optional feature which is controlled by the --storage.tsdb.allow-overlapping-blocks flag, disabled by default. + Enhancements: * Use the WAL for remote_write API. * Query performance improvements. * UI enhancements with upgrade to Bootstrap 4. * Reduce time that Alertmanagers are in flux when reloaded. * Limit number of metrics displayed on UI to 10000. * (1) Remember All/Unhealthy choice on target-overview when reloading page. (2) Resize text-input area on Graph page on mouseclick. * In histogram_quantile merge buckets with equivalent le values. * Show list of offending labels in the error message in many-to-many scenarios. * Show Storage Retention criteria in effect on /status page. + Bug Fixes: + Fix sorting of rule groups. + Fix support for password_file and bearer_token_file in Kubernetes SD. + Scrape: catch errors when creating HTTP clients + Adds new metrics: prometheus_target_scrape_pools_total prometheus_target_scrape_pools_failed_total prometheus_target_scrape_pool_reloads_total prometheus_target_scrape_pool_reloads_failed_total + Fix panic when aggregator param is not a literal. mgr-cfg: - Ensure bytes type when using hashlib to avoid traceback (bsc#1138822) mgr-daemon: - Fix systemd timer configuration on SLE12 (bsc#1142038) mgr-osad: - Fix obsolete for old osad packages, to allow installing mgr-osad even by using osad at yum/zyppper install (bsc#1139453) - Ensure bytes type when using hashlib to avoid traceback (bsc#1138822) mgr-virtualization: - Fix missing python 3 ugettext (bsc#1138494) - Fix package dependencies to prevent file conflict (bsc#1143856) rhnlib: - Add SNI support for clients - Fix initialize ssl connection (bsc#1144155) - Fix bootstrapping SLE11SP4 trad client with SSL enabled (bsc#1148177) spacecmd: - Bugfix: referenced variable before assignment. - Bugfix: 'dict' object has no attribute 'iteritems' (bsc#1135881) - Add unit tests for custominfo, snippet, scap, ssm, cryptokey and distribution - Fix missing runtime dependencies that made spacecmd return old versions of packages in some cases, even if newer ones were available (bsc#1148311) spacewalk-backend: - Do not overwrite comps and module data with older versions - Fix issue with 'dists' keyword in url hostname - Import packages from all collections of a patch not just first one - Ensure bytes type when using hashlib to avoid traceback on XMLRPC call to 'registration.register_osad' (bsc#1138822) - Do not duplicate 'http://' protocol when using proxies with 'deb' repositories (bsc#1138313) - Fix reposync when dealing with RedHat CDN (bsc#1138358) - Fix for CVE-2019-10136. An attacker with a valid, but expired, authenticated set of headers could move some digits around, artificially extending the session validity without modifying the checksum. (bsc#1136480) - Prevent FileNotFoundError: repomd.xml.key traceback (bsc#1137940) - Add journalctl output to spacewalk-debug tarballs - Prevent unnecessary triggering of channel-repodata tasks when GPG signing is disabled (bsc#1137715) - Fix spacewalk-repo-sync for Ubuntu repositories in mirror case (bsc#1136029) - Add support for ULN repositories on new Zypper based reposync. - Don't skip Deb package tags on package import (bsc#1130040) - For backend-libs subpackages, exclude files for the server (already part of spacewalk-backend) to avoid conflicts (bsc#1148125) - prevent duplicate key violates on repo-sync with long changelog entries (bsc#1144889) spacewalk-remote-utils: - Add RHEL8 The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2019-2317,SUSE-SLE-Manager-Tools-15-2019-2317,SUSE-SLE-Module-Development-Tools-OBS-15-2019-2317,SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2019-2317 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20192317-1/ Link for SUSE-SU-2019:2317-1 https://lists.suse.com/pipermail/sle-security-updates/2019-September/005887.html E-Mail link for SUSE-SU-2019:2317-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1130040 SUSE Bug 1130040 https://bugzilla.suse.com/1135881 SUSE Bug 1135881 https://bugzilla.suse.com/1136029 SUSE Bug 1136029 https://bugzilla.suse.com/1136480 SUSE Bug 1136480 https://bugzilla.suse.com/1137715 SUSE Bug 1137715 https://bugzilla.suse.com/1137940 SUSE Bug 1137940 https://bugzilla.suse.com/1138313 SUSE Bug 1138313 https://bugzilla.suse.com/1138358 SUSE Bug 1138358 https://bugzilla.suse.com/1138494 SUSE Bug 1138494 https://bugzilla.suse.com/1138822 SUSE Bug 1138822 https://bugzilla.suse.com/1139453 SUSE Bug 1139453 https://bugzilla.suse.com/1142038 SUSE Bug 1142038 https://bugzilla.suse.com/1143856 SUSE Bug 1143856 https://bugzilla.suse.com/1144155 SUSE Bug 1144155 https://bugzilla.suse.com/1144889 SUSE Bug 1144889 https://bugzilla.suse.com/1148125 SUSE Bug 1148125 https://bugzilla.suse.com/1148177 SUSE Bug 1148177 https://bugzilla.suse.com/1148311 SUSE Bug 1148311 https://www.suse.com/security/cve/CVE-2019-10136/ SUSE CVE CVE-2019-10136 page SUSE Manager Tools 15 golang-github-prometheus-alertmanager-0.16.2-3.3.1 golang-github-prometheus-prometheus-2.11.1-3.6.2 mgr-cfg-4.0.9-1.6.5 mgr-cfg-actions-4.0.9-1.6.5 mgr-cfg-client-4.0.9-1.6.5 mgr-cfg-management-4.0.9-1.6.5 mgr-daemon-4.0.7-1.8.1 mgr-osa-dispatcher-4.0.9-1.6.2 mgr-osad-4.0.9-1.6.2 mgr-virtualization-host-4.0.8-1.8.4 python2-mgr-cfg-4.0.9-1.6.5 python2-mgr-cfg-actions-4.0.9-1.6.5 python2-mgr-cfg-client-4.0.9-1.6.5 python2-mgr-cfg-management-4.0.9-1.6.5 python2-mgr-osa-common-4.0.9-1.6.2 python2-mgr-osa-dispatcher-4.0.9-1.6.2 python2-mgr-osad-4.0.9-1.6.2 python2-mgr-virtualization-common-4.0.8-1.8.4 python2-mgr-virtualization-host-4.0.8-1.8.4 python2-rhnlib-4.0.11-3.10.1 python3-mgr-cfg-4.0.9-1.6.5 python3-mgr-cfg-actions-4.0.9-1.6.5 python3-mgr-cfg-client-4.0.9-1.6.5 python3-mgr-cfg-management-4.0.9-1.6.5 python3-mgr-osa-common-4.0.9-1.6.2 python3-mgr-osa-dispatcher-4.0.9-1.6.2 python3-mgr-osad-4.0.9-1.6.2 python3-mgr-virtualization-common-4.0.8-1.8.4 python3-mgr-virtualization-host-4.0.8-1.8.4 python3-rhnlib-4.0.11-3.10.1 python3-spacewalk-backend-libs-4.0.25-3.23.1 spacecmd-4.0.14-3.26.1 spacewalk-backend-4.0.25-3.23.1 spacewalk-backend-app-4.0.25-3.23.1 spacewalk-backend-applet-4.0.25-3.23.1 spacewalk-backend-cdn-4.0.25-3.23.1 spacewalk-backend-config-files-4.0.25-3.23.1 spacewalk-backend-config-files-common-4.0.25-3.23.1 spacewalk-backend-config-files-tool-4.0.25-3.23.1 spacewalk-backend-iss-4.0.25-3.23.1 spacewalk-backend-iss-export-4.0.25-3.23.1 spacewalk-backend-libs-4.0.25-3.23.1 spacewalk-backend-package-push-server-4.0.25-3.23.1 spacewalk-backend-server-4.0.25-3.23.1 spacewalk-backend-sql-4.0.25-3.23.1 spacewalk-backend-sql-oracle-4.0.25-3.23.1 spacewalk-backend-sql-postgresql-4.0.25-3.23.1 spacewalk-backend-tools-4.0.25-3.23.1 spacewalk-backend-xml-export-libs-4.0.25-3.23.1 spacewalk-backend-xmlrpc-4.0.25-3.23.1 spacewalk-remote-utils-4.0.5-3.9.2 golang-github-prometheus-alertmanager-0.16.2-3.3.1 as a component of SUSE Manager Tools 15 golang-github-prometheus-prometheus-2.11.1-3.6.2 as a component of SUSE Manager Tools 15 mgr-cfg-4.0.9-1.6.5 as a component of SUSE Manager Tools 15 mgr-cfg-actions-4.0.9-1.6.5 as a component of SUSE Manager Tools 15 mgr-cfg-client-4.0.9-1.6.5 as a component of SUSE Manager Tools 15 mgr-cfg-management-4.0.9-1.6.5 as a component of SUSE Manager Tools 15 mgr-daemon-4.0.7-1.8.1 as a component of SUSE Manager Tools 15 mgr-osad-4.0.9-1.6.2 as a component of SUSE Manager Tools 15 mgr-virtualization-host-4.0.8-1.8.4 as a component of SUSE Manager Tools 15 python3-mgr-cfg-4.0.9-1.6.5 as a component of SUSE Manager Tools 15 python3-mgr-cfg-actions-4.0.9-1.6.5 as a component of SUSE Manager Tools 15 python3-mgr-cfg-client-4.0.9-1.6.5 as a component of SUSE Manager Tools 15 python3-mgr-cfg-management-4.0.9-1.6.5 as a component of SUSE Manager Tools 15 python3-mgr-osa-common-4.0.9-1.6.2 as a component of SUSE Manager Tools 15 python3-mgr-osad-4.0.9-1.6.2 as a component of SUSE Manager Tools 15 python3-mgr-virtualization-common-4.0.8-1.8.4 as a component of SUSE Manager Tools 15 python3-mgr-virtualization-host-4.0.8-1.8.4 as a component of SUSE Manager Tools 15 python3-rhnlib-4.0.11-3.10.1 as a component of SUSE Manager Tools 15 python3-spacewalk-backend-libs-4.0.25-3.23.1 as a component of SUSE Manager Tools 15 spacecmd-4.0.14-3.26.1 as a component of SUSE Manager Tools 15 spacewalk-remote-utils-4.0.5-3.9.2 as a component of SUSE Manager Tools 15 It was found that Spacewalk, all versions through 2.9, did not safely compute client token checksums. An attacker with a valid, but expired, authenticated set of headers could move some digits around, artificially extending the session validity without modifying the checksum. CVE-2019-10136 SUSE Manager Tools 15:golang-github-prometheus-alertmanager-0.16.2-3.3.1 SUSE Manager Tools 15:golang-github-prometheus-prometheus-2.11.1-3.6.2 SUSE Manager Tools 15:mgr-cfg-4.0.9-1.6.5 SUSE Manager Tools 15:mgr-cfg-actions-4.0.9-1.6.5 SUSE Manager Tools 15:mgr-cfg-client-4.0.9-1.6.5 SUSE Manager Tools 15:mgr-cfg-management-4.0.9-1.6.5 SUSE Manager Tools 15:mgr-daemon-4.0.7-1.8.1 SUSE Manager Tools 15:mgr-osad-4.0.9-1.6.2 SUSE Manager Tools 15:mgr-virtualization-host-4.0.8-1.8.4 SUSE Manager Tools 15:python3-mgr-cfg-4.0.9-1.6.5 SUSE Manager Tools 15:python3-mgr-cfg-actions-4.0.9-1.6.5 SUSE Manager Tools 15:python3-mgr-cfg-client-4.0.9-1.6.5 SUSE Manager Tools 15:python3-mgr-cfg-management-4.0.9-1.6.5 SUSE Manager Tools 15:python3-mgr-osa-common-4.0.9-1.6.2 SUSE Manager Tools 15:python3-mgr-osad-4.0.9-1.6.2 SUSE Manager Tools 15:python3-mgr-virtualization-common-4.0.8-1.8.4 SUSE Manager Tools 15:python3-mgr-virtualization-host-4.0.8-1.8.4 SUSE Manager Tools 15:python3-rhnlib-4.0.11-3.10.1 SUSE Manager Tools 15:python3-spacewalk-backend-libs-4.0.25-3.23.1 SUSE Manager Tools 15:spacecmd-4.0.14-3.26.1 SUSE Manager Tools 15:spacewalk-remote-utils-4.0.5-3.9.2 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20192317-1/ https://www.suse.com/security/cve/CVE-2019-10136.html CVE-2019-10136 https://bugzilla.suse.com/1136480 SUSE Bug 1136480