Security update for SUSE Manager Server 3.2 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:2292-1 Final 1 1 2020-08-21T12:32:10Z current 2020-08-21T12:32:10Z 2020-08-21T12:32:10Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for SUSE Manager Server 3.2 This update fixes the following issues: bind-formula: - Remove wrong default for bind options preventing correct upload of bind options using XMLRPC (bsc#1150657) branch-network-formula: - Make branch formula to assign home directory to ftp and tftp users (bsc#1162391) py26-compat-salt: - Do not make py26-compat-salt to require python-tornado on SLE15 (all SPs) - Backport saltutil state module to 2016.11 codebase (bsc#1167556) - Add new custom SUSE capability for saltutil state module python-susemanager-retail: - Allow bind options to be stored to and edited by retail_yaml (bsc#1150657) release-notes-susemanager: - Update to 3.2.15 - Bugs mentioned bsc#1150657, bsc#1162391, bsc#1167556, bsc#1174965, bsc#1170331, bsc#1159184, bsc#1168227, bsc#1172831, bsc#1173073, bsc#1167871, bsc#1169109, bsc#1159202, bsc#1168227, bsc#1153578, bsc#1141663, bsc#1174768, bsc#1173946, bsc#1174167, bsc#1169865, bsc#1155794 spacewalk-backend: - Fix issues importing RPM packages with long RPM headers (bsc#1174965) - Do not make mgr-inter-sync to crash if there are non-ASCII characters on an exception message (bsc#1170331) - Validate cached package entries on ISS slave (bsc#1159184) spacewalk-client-tools: - Do not crash 'mgr-update-status' because 'long' type is not defined in Python 3 spacewalk-java: - Skip upgrades when the target has not the same amount of products as the installed set (bsc#1168227) - Upgrade jQuery and adapt the code - CVE-2020-11022 (bsc#1172831) - Prevent deadlock on suseusernotification (bsc#1173073) - Avoid multiple base channels when onboarding minions (bsc#1167871) - Hide message about changed Update Tag change (bsc#1169109) - Refresh pillar after channel change - Use 'changes' field if 'pchanges' field doesn't exist (bsc#1159202) - Skip migration targets when they do not have the same amount of products as the installed set (bsc#1168227) spacewalk-utils: - Add FQDN resolver for spacewalk-manage-channel-lifecycle (bsc#1153578) - Fixes SSL hostname matching (bsc#1141663) spacewalk-web: - Fix saving of formulas (bsc#1174768) - Upgrade jQuery and adapt the code - CVE-2020-11022 (bsc#1172831) susemanager: - Use python2-uyuni-common-libs and python3-uyuni-common-libs for bootstrap repositories (bsc#1173946) - Add 'python-singledispatch' to SLE12 (all SPs) and RES7 bootstrap repos. (bsc#1174700) - Add SLE 15 LTSS Product ID to SLE15 bootstrap repositories, as it is required to get python3-M2crypto (bsc#1174167) - Require python3-tornado only for SLE15/SLE15SP1 (bsc#1169865) - Use python3-M2Crypto for all SLE15 versions and openSUSE Leap 15.1 bootstrap repositories - Add dbus-1-glib to SLE12SP5 x86_64 to allow onboarding of AWS Cloud SLE12SP5 clients (they do not have it by defaul anymore) susemanager-frontend-libs: - Upgrade jquery to 3.5.1 - CVE-2020-11022 (bsc#1172831) susemanager-schema: - Prevent a deadlock error involving delete_server and update_needed_cache (bsc#1173073) susemanager-sls: - Avoid traceback error due lazy loading which_bin (bsc#1155794) - Using new module path for which_bin to get rid of DeprecationWarning How to apply this update: 1. Log in as root user to the SUSE Manager server. 2. Stop the Spacewalk service: spacewalk-service stop 3. Apply the patch using either zypper patch or YaST Online Update. 4. Upgrade the database schema: spacewalk-schema-upgrade 5. Start the Spacewalk service: spacewalk-service start The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-2292,SUSE-SUSE-Manager-Proxy-3.2-2020-2292,SUSE-SUSE-Manager-Server-3.2-2020-2292 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20202292-1/ Link for SUSE-SU-2020:2292-1 https://lists.suse.com/pipermail/sle-security-updates/2020-August/007286.html E-Mail link for SUSE-SU-2020:2292-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1141663 SUSE Bug 1141663 https://bugzilla.suse.com/1150657 SUSE Bug 1150657 https://bugzilla.suse.com/1153578 SUSE Bug 1153578 https://bugzilla.suse.com/1155794 SUSE Bug 1155794 https://bugzilla.suse.com/1159184 SUSE Bug 1159184 https://bugzilla.suse.com/1159202 SUSE Bug 1159202 https://bugzilla.suse.com/1162391 SUSE Bug 1162391 https://bugzilla.suse.com/1167556 SUSE Bug 1167556 https://bugzilla.suse.com/1167871 SUSE Bug 1167871 https://bugzilla.suse.com/1168227 SUSE Bug 1168227 https://bugzilla.suse.com/1169109 SUSE Bug 1169109 https://bugzilla.suse.com/1169865 SUSE Bug 1169865 https://bugzilla.suse.com/1170331 SUSE Bug 1170331 https://bugzilla.suse.com/1172831 SUSE Bug 1172831 https://bugzilla.suse.com/1173073 SUSE Bug 1173073 https://bugzilla.suse.com/1173946 SUSE Bug 1173946 https://bugzilla.suse.com/1174167 SUSE Bug 1174167 https://bugzilla.suse.com/1174700 SUSE Bug 1174700 https://bugzilla.suse.com/1174768 SUSE Bug 1174768 https://bugzilla.suse.com/1174965 SUSE Bug 1174965 https://www.suse.com/security/cve/CVE-2020-11022/ SUSE CVE CVE-2020-11022 page SUSE Manager Proxy 3.2 SUSE Manager Server 3.2 bind-formula-0.1.1584363976.36bce64-3.6.1 branch-network-formula-0.1.1584363976.36bce64-3.9.1 py26-compat-salt-2016.11.10-6.38.1 python-susemanager-retail-1.0.1584363976.36bce64-2.12.1 python2-spacewalk-check-2.8.22.8-3.15.1 python2-spacewalk-client-setup-2.8.22.8-3.15.1 python2-spacewalk-client-tools-2.8.22.8-3.15.1 python2-zypp-plugin-spacewalk-1.0.7-3.13.1 release-notes-susemanager-3.2.15-6.61.1 release-notes-susemanager-proxy-3.2.15-0.16.47.1 spacewalk-backend-2.8.57.23-3.51.1 spacewalk-backend-app-2.8.57.23-3.51.1 spacewalk-backend-applet-2.8.57.23-3.51.1 spacewalk-backend-cdn-2.8.57.23-3.51.1 spacewalk-backend-config-files-2.8.57.23-3.51.1 spacewalk-backend-config-files-common-2.8.57.23-3.51.1 spacewalk-backend-config-files-tool-2.8.57.23-3.51.1 spacewalk-backend-iss-2.8.57.23-3.51.1 spacewalk-backend-iss-export-2.8.57.23-3.51.1 spacewalk-backend-libs-2.8.57.23-3.51.1 spacewalk-backend-package-push-server-2.8.57.23-3.51.1 spacewalk-backend-server-2.8.57.23-3.51.1 spacewalk-backend-sql-2.8.57.23-3.51.1 spacewalk-backend-sql-oracle-2.8.57.23-3.51.1 spacewalk-backend-sql-postgresql-2.8.57.23-3.51.1 spacewalk-backend-tools-2.8.57.23-3.51.1 spacewalk-backend-xml-export-libs-2.8.57.23-3.51.1 spacewalk-backend-xmlrpc-2.8.57.23-3.51.1 spacewalk-base-2.8.7.24-3.48.1 spacewalk-base-minimal-2.8.7.24-3.48.1 spacewalk-base-minimal-config-2.8.7.24-3.48.1 spacewalk-check-2.8.22.8-3.15.1 spacewalk-client-setup-2.8.22.8-3.15.1 spacewalk-client-tools-2.8.22.8-3.15.1 spacewalk-dobby-2.8.7.24-3.48.1 spacewalk-html-2.8.7.24-3.48.1 spacewalk-java-2.8.78.29-3.50.1 spacewalk-java-apidoc-sources-2.8.78.29-3.50.1 spacewalk-java-config-2.8.78.29-3.50.1 spacewalk-java-lib-2.8.78.29-3.50.1 spacewalk-java-oracle-2.8.78.29-3.50.1 spacewalk-java-postgresql-2.8.78.29-3.50.1 spacewalk-proxy-installer-2.8.6.8-3.18.1 spacewalk-taskomatic-2.8.78.29-3.50.1 spacewalk-utils-2.8.18.7-3.15.1 susemanager-3.2.24-3.43.1 susemanager-frontend-libs-3.2.5-3.13.1 susemanager-frontend-libs-devel-3.2.5-3.13.1 susemanager-retail-tools-1.0.1584363976.36bce64-2.12.1 susemanager-schema-3.2.24-3.40.1 susemanager-schema-sanity-3.2.24-3.40.1 susemanager-sls-3.2.31-3.47.1 susemanager-tools-3.2.24-3.43.1 susemanager-web-libs-2.8.7.24-3.48.1 zypp-plugin-spacewalk-1.0.7-3.13.1 python2-spacewalk-check-2.8.22.8-3.15.1 as a component of SUSE Manager Proxy 3.2 python2-spacewalk-client-setup-2.8.22.8-3.15.1 as a component of SUSE Manager Proxy 3.2 python2-spacewalk-client-tools-2.8.22.8-3.15.1 as a component of SUSE Manager Proxy 3.2 python2-zypp-plugin-spacewalk-1.0.7-3.13.1 as a component of SUSE Manager Proxy 3.2 release-notes-susemanager-proxy-3.2.15-0.16.47.1 as a component of SUSE Manager Proxy 3.2 spacewalk-backend-2.8.57.23-3.51.1 as a component of SUSE Manager Proxy 3.2 spacewalk-backend-libs-2.8.57.23-3.51.1 as a component of SUSE Manager Proxy 3.2 spacewalk-base-minimal-2.8.7.24-3.48.1 as a component of SUSE Manager Proxy 3.2 spacewalk-base-minimal-config-2.8.7.24-3.48.1 as a component of SUSE Manager Proxy 3.2 spacewalk-check-2.8.22.8-3.15.1 as a component of SUSE Manager Proxy 3.2 spacewalk-client-setup-2.8.22.8-3.15.1 as a component of SUSE Manager Proxy 3.2 spacewalk-client-tools-2.8.22.8-3.15.1 as a component of SUSE Manager Proxy 3.2 spacewalk-proxy-installer-2.8.6.8-3.18.1 as a component of SUSE Manager Proxy 3.2 susemanager-web-libs-2.8.7.24-3.48.1 as a component of SUSE Manager Proxy 3.2 zypp-plugin-spacewalk-1.0.7-3.13.1 as a component of SUSE Manager Proxy 3.2 bind-formula-0.1.1584363976.36bce64-3.6.1 as a component of SUSE Manager Server 3.2 branch-network-formula-0.1.1584363976.36bce64-3.9.1 as a component of SUSE Manager Server 3.2 py26-compat-salt-2016.11.10-6.38.1 as a component of SUSE Manager Server 3.2 python-susemanager-retail-1.0.1584363976.36bce64-2.12.1 as a component of SUSE Manager Server 3.2 python2-spacewalk-client-tools-2.8.22.8-3.15.1 as a component of SUSE Manager Server 3.2 release-notes-susemanager-3.2.15-6.61.1 as a component of SUSE Manager Server 3.2 spacewalk-backend-2.8.57.23-3.51.1 as a component of SUSE Manager Server 3.2 spacewalk-backend-app-2.8.57.23-3.51.1 as a component of SUSE Manager Server 3.2 spacewalk-backend-applet-2.8.57.23-3.51.1 as a component of SUSE Manager Server 3.2 spacewalk-backend-config-files-2.8.57.23-3.51.1 as a component of SUSE Manager Server 3.2 spacewalk-backend-config-files-common-2.8.57.23-3.51.1 as a component of SUSE Manager Server 3.2 spacewalk-backend-config-files-tool-2.8.57.23-3.51.1 as a component of SUSE Manager Server 3.2 spacewalk-backend-iss-2.8.57.23-3.51.1 as a component of SUSE Manager Server 3.2 spacewalk-backend-iss-export-2.8.57.23-3.51.1 as a component of SUSE Manager Server 3.2 spacewalk-backend-libs-2.8.57.23-3.51.1 as a component of SUSE Manager Server 3.2 spacewalk-backend-package-push-server-2.8.57.23-3.51.1 as a component of SUSE Manager Server 3.2 spacewalk-backend-server-2.8.57.23-3.51.1 as a component of SUSE Manager Server 3.2 spacewalk-backend-sql-2.8.57.23-3.51.1 as a component of SUSE Manager Server 3.2 spacewalk-backend-sql-oracle-2.8.57.23-3.51.1 as a component of SUSE Manager Server 3.2 spacewalk-backend-sql-postgresql-2.8.57.23-3.51.1 as a component of SUSE Manager Server 3.2 spacewalk-backend-tools-2.8.57.23-3.51.1 as a component of SUSE Manager Server 3.2 spacewalk-backend-xml-export-libs-2.8.57.23-3.51.1 as a component of SUSE Manager Server 3.2 spacewalk-backend-xmlrpc-2.8.57.23-3.51.1 as a component of SUSE Manager Server 3.2 spacewalk-base-2.8.7.24-3.48.1 as a component of SUSE Manager Server 3.2 spacewalk-base-minimal-2.8.7.24-3.48.1 as a component of SUSE Manager Server 3.2 spacewalk-base-minimal-config-2.8.7.24-3.48.1 as a component of SUSE Manager Server 3.2 spacewalk-client-tools-2.8.22.8-3.15.1 as a component of SUSE Manager Server 3.2 spacewalk-html-2.8.7.24-3.48.1 as a component of SUSE Manager Server 3.2 spacewalk-java-2.8.78.29-3.50.1 as a component of SUSE Manager Server 3.2 spacewalk-java-config-2.8.78.29-3.50.1 as a component of SUSE Manager Server 3.2 spacewalk-java-lib-2.8.78.29-3.50.1 as a component of SUSE Manager Server 3.2 spacewalk-java-oracle-2.8.78.29-3.50.1 as a component of SUSE Manager Server 3.2 spacewalk-java-postgresql-2.8.78.29-3.50.1 as a component of SUSE Manager Server 3.2 spacewalk-taskomatic-2.8.78.29-3.50.1 as a component of SUSE Manager Server 3.2 spacewalk-utils-2.8.18.7-3.15.1 as a component of SUSE Manager Server 3.2 susemanager-3.2.24-3.43.1 as a component of SUSE Manager Server 3.2 susemanager-frontend-libs-3.2.5-3.13.1 as a component of SUSE Manager Server 3.2 susemanager-retail-tools-1.0.1584363976.36bce64-2.12.1 as a component of SUSE Manager Server 3.2 susemanager-schema-3.2.24-3.40.1 as a component of SUSE Manager Server 3.2 susemanager-sls-3.2.31-3.47.1 as a component of SUSE Manager Server 3.2 susemanager-tools-3.2.24-3.43.1 as a component of SUSE Manager Server 3.2 susemanager-web-libs-2.8.7.24-3.48.1 as a component of SUSE Manager Server 3.2 In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. CVE-2020-11022 SUSE Manager Proxy 3.2:python2-spacewalk-check-2.8.22.8-3.15.1 SUSE Manager Proxy 3.2:python2-spacewalk-client-setup-2.8.22.8-3.15.1 SUSE Manager Proxy 3.2:python2-spacewalk-client-tools-2.8.22.8-3.15.1 SUSE Manager Proxy 3.2:python2-zypp-plugin-spacewalk-1.0.7-3.13.1 SUSE Manager Proxy 3.2:release-notes-susemanager-proxy-3.2.15-0.16.47.1 SUSE Manager Proxy 3.2:spacewalk-backend-2.8.57.23-3.51.1 SUSE Manager Proxy 3.2:spacewalk-backend-libs-2.8.57.23-3.51.1 SUSE Manager Proxy 3.2:spacewalk-base-minimal-2.8.7.24-3.48.1 SUSE Manager Proxy 3.2:spacewalk-base-minimal-config-2.8.7.24-3.48.1 SUSE Manager Proxy 3.2:spacewalk-check-2.8.22.8-3.15.1 SUSE Manager Proxy 3.2:spacewalk-client-setup-2.8.22.8-3.15.1 SUSE Manager Proxy 3.2:spacewalk-client-tools-2.8.22.8-3.15.1 SUSE Manager Proxy 3.2:spacewalk-proxy-installer-2.8.6.8-3.18.1 SUSE Manager Proxy 3.2:susemanager-web-libs-2.8.7.24-3.48.1 SUSE Manager Proxy 3.2:zypp-plugin-spacewalk-1.0.7-3.13.1 SUSE Manager Server 3.2:bind-formula-0.1.1584363976.36bce64-3.6.1 SUSE Manager Server 3.2:branch-network-formula-0.1.1584363976.36bce64-3.9.1 SUSE Manager Server 3.2:py26-compat-salt-2016.11.10-6.38.1 SUSE Manager Server 3.2:python-susemanager-retail-1.0.1584363976.36bce64-2.12.1 SUSE Manager Server 3.2:python2-spacewalk-client-tools-2.8.22.8-3.15.1 SUSE Manager Server 3.2:release-notes-susemanager-3.2.15-6.61.1 SUSE Manager Server 3.2:spacewalk-backend-2.8.57.23-3.51.1 SUSE Manager Server 3.2:spacewalk-backend-app-2.8.57.23-3.51.1 SUSE Manager Server 3.2:spacewalk-backend-applet-2.8.57.23-3.51.1 SUSE Manager Server 3.2:spacewalk-backend-config-files-2.8.57.23-3.51.1 SUSE Manager Server 3.2:spacewalk-backend-config-files-common-2.8.57.23-3.51.1 SUSE Manager Server 3.2:spacewalk-backend-config-files-tool-2.8.57.23-3.51.1 SUSE Manager Server 3.2:spacewalk-backend-iss-2.8.57.23-3.51.1 SUSE Manager Server 3.2:spacewalk-backend-iss-export-2.8.57.23-3.51.1 SUSE Manager Server 3.2:spacewalk-backend-libs-2.8.57.23-3.51.1 SUSE Manager Server 3.2:spacewalk-backend-package-push-server-2.8.57.23-3.51.1 SUSE Manager Server 3.2:spacewalk-backend-server-2.8.57.23-3.51.1 SUSE Manager Server 3.2:spacewalk-backend-sql-2.8.57.23-3.51.1 SUSE Manager Server 3.2:spacewalk-backend-sql-oracle-2.8.57.23-3.51.1 SUSE Manager Server 3.2:spacewalk-backend-sql-postgresql-2.8.57.23-3.51.1 SUSE Manager Server 3.2:spacewalk-backend-tools-2.8.57.23-3.51.1 SUSE Manager Server 3.2:spacewalk-backend-xml-export-libs-2.8.57.23-3.51.1 SUSE Manager Server 3.2:spacewalk-backend-xmlrpc-2.8.57.23-3.51.1 SUSE Manager Server 3.2:spacewalk-base-2.8.7.24-3.48.1 SUSE Manager Server 3.2:spacewalk-base-minimal-2.8.7.24-3.48.1 SUSE Manager Server 3.2:spacewalk-base-minimal-config-2.8.7.24-3.48.1 SUSE Manager Server 3.2:spacewalk-client-tools-2.8.22.8-3.15.1 SUSE Manager Server 3.2:spacewalk-html-2.8.7.24-3.48.1 SUSE Manager Server 3.2:spacewalk-java-2.8.78.29-3.50.1 SUSE Manager Server 3.2:spacewalk-java-config-2.8.78.29-3.50.1 SUSE Manager Server 3.2:spacewalk-java-lib-2.8.78.29-3.50.1 SUSE Manager Server 3.2:spacewalk-java-oracle-2.8.78.29-3.50.1 SUSE Manager Server 3.2:spacewalk-java-postgresql-2.8.78.29-3.50.1 SUSE Manager Server 3.2:spacewalk-taskomatic-2.8.78.29-3.50.1 SUSE Manager Server 3.2:spacewalk-utils-2.8.18.7-3.15.1 SUSE Manager Server 3.2:susemanager-3.2.24-3.43.1 SUSE Manager Server 3.2:susemanager-frontend-libs-3.2.5-3.13.1 SUSE Manager Server 3.2:susemanager-retail-tools-1.0.1584363976.36bce64-2.12.1 SUSE Manager Server 3.2:susemanager-schema-3.2.24-3.40.1 SUSE Manager Server 3.2:susemanager-sls-3.2.31-3.47.1 SUSE Manager Server 3.2:susemanager-tools-3.2.24-3.43.1 SUSE Manager Server 3.2:susemanager-web-libs-2.8.7.24-3.48.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20202292-1/ https://www.suse.com/security/cve/CVE-2020-11022.html CVE-2020-11022 https://bugzilla.suse.com/1173090 SUSE Bug 1173090 https://bugzilla.suse.com/1178434 SUSE Bug 1178434 https://bugzilla.suse.com/1190663 SUSE Bug 1190663