Security update for autoyast2 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:1296-1 Final 1 1 2020-05-18T05:42:00Z current 2020-05-18T05:42:00Z 2020-05-18T05:42:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for autoyast2 This update for autoyast2 to version 4.1.15 fixes the following issues: Security issue fixed: - CVE-2019-18905: Removed all '--gpg-auto-import-keys' options from zypper commands (bsc#1140711). Non-security issue fixed: - Fix desktop files updating some icons and groups (bsc#1168123). - Restored some missing icons (bsc#1168123, bsc#1109310 and bsc#1168281). - Service for init scripts: Try to start 'network-online.target' before starting the autoyast init scripts in order to get a working network (bsc#1164105). - Always re-probe storage after pre-scripts (bsc#1170082, bsc#1133045). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES15-SP1-Azure-BYOS-2020-1296,Image SLES15-SP1-Azure-HPC-BYOS-2020-1296,Image SLES15-SP1-EC2-HPC-HVM-BYOS-2020-1296,Image SLES15-SP1-EC2-HVM-BYOS-2020-1296,Image SLES15-SP1-GCE-BYOS-2020-1296,Image SLES15-SP1-Manager-4-0-Azure-BYOS-Proxy-2020-1296,Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server-2020-1296,Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Proxy-2020-1296,Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server-2020-1296,Image SLES15-SP1-Manager-4-0-GCE-BYOS-Proxy-2020-1296,Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server-2020-1296,Image SLES15-SP1-OCI-BYOS-2020-1296,Image SLES15-SP1-SAP-Azure-2020-1296,Image SLES15-SP1-SAP-Azure-BYOS-2020-1296,Image SLES15-SP1-SAP-Azure-LI-BYOS-Production-2020-1296,Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production-2020-1296,Image SLES15-SP1-SAP-EC2-HVM-2020-1296,Image SLES15-SP1-SAP-EC2-HVM-BYOS-2020-1296,Image SLES15-SP1-SAP-GCE-2020-1296,Image SLES15-SP1-SAP-GCE-BYOS-2020-1296,Image SLES15-SP1-SAP-OCI-BYOS-2020-1296,Image SLES15-SP1-SAPCAL-Azure-2020-1296,Image SLES15-SP1-SAPCAL-EC2-HVM-2020-1296,Image SLES15-SP1-SAPCAL-GCE-2020-1296,SUSE-2020-1296,SUSE-SLE-Module-Basesystem-15-SP1-2020-1296 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20201296-1/ Link for SUSE-SU-2020:1296-1 https://lists.suse.com/pipermail/sle-security-updates/2020-May/006831.html E-Mail link for SUSE-SU-2020:1296-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1109310 SUSE Bug 1109310 https://bugzilla.suse.com/1133045 SUSE Bug 1133045 https://bugzilla.suse.com/1140711 SUSE Bug 1140711 https://bugzilla.suse.com/1164105 SUSE Bug 1164105 https://bugzilla.suse.com/1168123 SUSE Bug 1168123 https://bugzilla.suse.com/1168281 SUSE Bug 1168281 https://bugzilla.suse.com/1170082 SUSE Bug 1170082 https://www.suse.com/security/cve/CVE-2019-18905/ SUSE CVE CVE-2019-18905 page Image SLES15-SP1-Azure-BYOS Image SLES15-SP1-Azure-HPC-BYOS Image SLES15-SP1-EC2-HPC-HVM-BYOS Image SLES15-SP1-EC2-HVM-BYOS Image SLES15-SP1-GCE-BYOS Image SLES15-SP1-Manager-4-0-Azure-BYOS-Proxy Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Proxy Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server Image SLES15-SP1-Manager-4-0-GCE-BYOS-Proxy Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server Image SLES15-SP1-OCI-BYOS Image SLES15-SP1-SAP-Azure Image SLES15-SP1-SAP-Azure-BYOS Image SLES15-SP1-SAP-Azure-LI-BYOS-Production Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production Image SLES15-SP1-SAP-EC2-HVM Image SLES15-SP1-SAP-EC2-HVM-BYOS Image SLES15-SP1-SAP-GCE Image SLES15-SP1-SAP-GCE-BYOS Image SLES15-SP1-SAP-OCI-BYOS Image SLES15-SP1-SAPCAL-Azure Image SLES15-SP1-SAPCAL-EC2-HVM Image SLES15-SP1-SAPCAL-GCE SUSE Linux Enterprise Module for Basesystem 15 SP1 autoyast2-installation-4.1.15-3.13.1 autoyast2-4.1.15-3.13.1 autoyast2-installation-4.1.15-3.13.1 as a component of Image SLES15-SP1-Azure-BYOS autoyast2-installation-4.1.15-3.13.1 as a component of Image SLES15-SP1-Azure-HPC-BYOS autoyast2-installation-4.1.15-3.13.1 as a component of Image SLES15-SP1-EC2-HPC-HVM-BYOS autoyast2-installation-4.1.15-3.13.1 as a component of Image SLES15-SP1-EC2-HVM-BYOS autoyast2-installation-4.1.15-3.13.1 as a component of Image SLES15-SP1-GCE-BYOS autoyast2-installation-4.1.15-3.13.1 as a component of Image SLES15-SP1-Manager-4-0-Azure-BYOS-Proxy autoyast2-installation-4.1.15-3.13.1 as a component of Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server autoyast2-installation-4.1.15-3.13.1 as a component of Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Proxy autoyast2-installation-4.1.15-3.13.1 as a component of Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server autoyast2-installation-4.1.15-3.13.1 as a component of Image SLES15-SP1-Manager-4-0-GCE-BYOS-Proxy autoyast2-installation-4.1.15-3.13.1 as a component of Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server autoyast2-installation-4.1.15-3.13.1 as a component of Image SLES15-SP1-OCI-BYOS autoyast2-installation-4.1.15-3.13.1 as a component of Image SLES15-SP1-SAP-Azure autoyast2-installation-4.1.15-3.13.1 as a component of Image SLES15-SP1-SAP-Azure-BYOS autoyast2-4.1.15-3.13.1 as a component of Image SLES15-SP1-SAP-Azure-LI-BYOS-Production autoyast2-installation-4.1.15-3.13.1 as a component of Image SLES15-SP1-SAP-Azure-LI-BYOS-Production autoyast2-4.1.15-3.13.1 as a component of Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production autoyast2-installation-4.1.15-3.13.1 as a component of Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production autoyast2-installation-4.1.15-3.13.1 as a component of Image SLES15-SP1-SAP-EC2-HVM autoyast2-installation-4.1.15-3.13.1 as a component of Image SLES15-SP1-SAP-EC2-HVM-BYOS autoyast2-installation-4.1.15-3.13.1 as a component of Image SLES15-SP1-SAP-GCE autoyast2-installation-4.1.15-3.13.1 as a component of Image SLES15-SP1-SAP-GCE-BYOS autoyast2-installation-4.1.15-3.13.1 as a component of Image SLES15-SP1-SAP-OCI-BYOS autoyast2-installation-4.1.15-3.13.1 as a component of Image SLES15-SP1-SAPCAL-Azure autoyast2-installation-4.1.15-3.13.1 as a component of Image SLES15-SP1-SAPCAL-EC2-HVM autoyast2-installation-4.1.15-3.13.1 as a component of Image SLES15-SP1-SAPCAL-GCE autoyast2-4.1.15-3.13.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP1 autoyast2-installation-4.1.15-3.13.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP1 A Insufficient Verification of Data Authenticity vulnerability in autoyast2 of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows remote attackers to MITM connections when deprecated and unused functionality of autoyast is used to create images. This issue affects: SUSE Linux Enterprise Server 12 autoyast2 version 4.1.9-3.9.1 and prior versions. SUSE Linux Enterprise Server 15 autoyast2 version 4.0.70-3.20.1 and prior versions. CVE-2019-18905 Image SLES15-SP1-Azure-BYOS:autoyast2-installation-4.1.15-3.13.1 Image SLES15-SP1-Azure-HPC-BYOS:autoyast2-installation-4.1.15-3.13.1 Image SLES15-SP1-EC2-HPC-HVM-BYOS:autoyast2-installation-4.1.15-3.13.1 Image SLES15-SP1-EC2-HVM-BYOS:autoyast2-installation-4.1.15-3.13.1 Image SLES15-SP1-GCE-BYOS:autoyast2-installation-4.1.15-3.13.1 Image SLES15-SP1-Manager-4-0-Azure-BYOS-Proxy:autoyast2-installation-4.1.15-3.13.1 Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server:autoyast2-installation-4.1.15-3.13.1 Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Proxy:autoyast2-installation-4.1.15-3.13.1 Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server:autoyast2-installation-4.1.15-3.13.1 Image SLES15-SP1-Manager-4-0-GCE-BYOS-Proxy:autoyast2-installation-4.1.15-3.13.1 Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server:autoyast2-installation-4.1.15-3.13.1 Image SLES15-SP1-OCI-BYOS:autoyast2-installation-4.1.15-3.13.1 Image SLES15-SP1-SAP-Azure-BYOS:autoyast2-installation-4.1.15-3.13.1 Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:autoyast2-4.1.15-3.13.1 Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:autoyast2-installation-4.1.15-3.13.1 Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:autoyast2-4.1.15-3.13.1 Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:autoyast2-installation-4.1.15-3.13.1 Image SLES15-SP1-SAP-Azure:autoyast2-installation-4.1.15-3.13.1 Image SLES15-SP1-SAP-EC2-HVM-BYOS:autoyast2-installation-4.1.15-3.13.1 Image SLES15-SP1-SAP-EC2-HVM:autoyast2-installation-4.1.15-3.13.1 Image SLES15-SP1-SAP-GCE-BYOS:autoyast2-installation-4.1.15-3.13.1 Image SLES15-SP1-SAP-GCE:autoyast2-installation-4.1.15-3.13.1 Image SLES15-SP1-SAP-OCI-BYOS:autoyast2-installation-4.1.15-3.13.1 Image SLES15-SP1-SAPCAL-Azure:autoyast2-installation-4.1.15-3.13.1 Image SLES15-SP1-SAPCAL-EC2-HVM:autoyast2-installation-4.1.15-3.13.1 Image SLES15-SP1-SAPCAL-GCE:autoyast2-installation-4.1.15-3.13.1 SUSE Linux Enterprise Module for Basesystem 15 SP1:autoyast2-4.1.15-3.13.1 SUSE Linux Enterprise Module for Basesystem 15 SP1:autoyast2-installation-4.1.15-3.13.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201296-1/ https://www.suse.com/security/cve/CVE-2019-18905.html CVE-2019-18905 https://bugzilla.suse.com/1140711 SUSE Bug 1140711