Security update for SUSE Manager 3.2 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:2648-1 Final 1 1 2020-09-16T12:23:03Z current 2020-09-16T12:23:03Z 2020-09-16T12:23:03Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for SUSE Manager 3.2 This update for SUSE Manager 3.2 fixes the following issues: salt-netapi-client: - Refresh authentication module list to newer Salt versions spacewalk-admin: - Use the Salt API in authenticated and encrypted form (bsc#1175884, CVE-2020-8028) spacewalk-java: - Use the Salt API in authenticated and encrypted form (bsc#1175884, CVE-2020-8028) spacewalk-setup: - Use the Salt API in authenticated and encrypted form (bsc#1175884, CVE-2020-8028) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-2648,SUSE-SUSE-Manager-Server-3.2-2020-2648 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20202648-1/ Link for SUSE-SU-2020:2648-1 https://lists.suse.com/pipermail/sle-security-updates/2020-September/007433.html E-Mail link for SUSE-SU-2020:2648-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1175884 SUSE Bug 1175884 https://www.suse.com/security/cve/CVE-2020-8028/ SUSE CVE CVE-2020-8028 page SUSE Manager Server 3.2 salt-netapi-client-0.16.0-4.14.1 spacewalk-admin-2.8.4.7-3.15.1 spacewalk-java-2.8.78.30-3.53.1 spacewalk-java-apidoc-sources-2.8.78.30-3.53.1 spacewalk-java-config-2.8.78.30-3.53.1 spacewalk-java-lib-2.8.78.30-3.53.1 spacewalk-java-oracle-2.8.78.30-3.53.1 spacewalk-java-postgresql-2.8.78.30-3.53.1 spacewalk-setup-2.8.7.11-3.28.1 spacewalk-taskomatic-2.8.78.30-3.53.1 salt-netapi-client-0.16.0-4.14.1 as a component of SUSE Manager Server 3.2 spacewalk-admin-2.8.4.7-3.15.1 as a component of SUSE Manager Server 3.2 spacewalk-java-2.8.78.30-3.53.1 as a component of SUSE Manager Server 3.2 spacewalk-java-config-2.8.78.30-3.53.1 as a component of SUSE Manager Server 3.2 spacewalk-java-lib-2.8.78.30-3.53.1 as a component of SUSE Manager Server 3.2 spacewalk-java-oracle-2.8.78.30-3.53.1 as a component of SUSE Manager Server 3.2 spacewalk-java-postgresql-2.8.78.30-3.53.1 as a component of SUSE Manager Server 3.2 spacewalk-setup-2.8.7.11-3.28.1 as a component of SUSE Manager Server 3.2 spacewalk-taskomatic-2.8.78.30-3.53.1 as a component of SUSE Manager Server 3.2 A Improper Access Control vulnerability in the configuration of salt of SUSE Linux Enterprise Module for SUSE Manager Server 4.1, SUSE Manager Proxy 4.0, SUSE Manager Retail Branch Server 4.0, SUSE Manager Server 3.2, SUSE Manager Server 4.0 allows local users to escalate to root on every system managed by SUSE manager. On the managing node itself code can be executed as user salt, potentially allowing for escalation to root there. This issue affects: SUSE Linux Enterprise Module for SUSE Manager Server 4.1 google-gson versions prior to 2.8.5-3.4.3, httpcomponents-client-4.5.6-3.4.2, httpcomponents-. SUSE Manager Proxy 4.0 release-notes-susemanager-proxy versions prior to 4.0.9-0.16.38.1. SUSE Manager Retail Branch Server 4.0 release-notes-susemanager-proxy versions prior to 4.0.9-0.16.38.1. SUSE Manager Server 3.2 salt-netapi-client versions prior to 0.16.0-4.14.1, spacewalk-. SUSE Manager Server 4.0 release-notes-susemanager versions prior to 4.0.9-3.54.1. CVE-2020-8028 SUSE Manager Server 3.2:salt-netapi-client-0.16.0-4.14.1 SUSE Manager Server 3.2:spacewalk-admin-2.8.4.7-3.15.1 SUSE Manager Server 3.2:spacewalk-java-2.8.78.30-3.53.1 SUSE Manager Server 3.2:spacewalk-java-config-2.8.78.30-3.53.1 SUSE Manager Server 3.2:spacewalk-java-lib-2.8.78.30-3.53.1 SUSE Manager Server 3.2:spacewalk-java-oracle-2.8.78.30-3.53.1 SUSE Manager Server 3.2:spacewalk-java-postgresql-2.8.78.30-3.53.1 SUSE Manager Server 3.2:spacewalk-setup-2.8.7.11-3.28.1 SUSE Manager Server 3.2:spacewalk-taskomatic-2.8.78.30-3.53.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20202648-1/ https://www.suse.com/security/cve/CVE-2020-8028.html CVE-2020-8028 https://bugzilla.suse.com/1175884 SUSE Bug 1175884