Security update for SUSE Manager Server 4.0 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:2114-1 Final 1 1 2021-06-21T17:32:37Z current 2021-06-21T17:32:37Z 2021-06-21T17:32:37Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for SUSE Manager Server 4.0 This update fixes the following issues: cobbler: - Make 'fence_ipmitool' a wrapper for 'fence_ipmilan' using always lanplus (bsc#1184361) - Remove unused template for fence_ipmitool. - Prevent some race conditions when writing tftpboot files and the destination directory is not existing (bsc#1186124) - Fix trail stripping in case of using UTF symbols (bsc#1184561) grafana-formula: - Fix Grafana dashboards requiring single series (bsc#1184471) patterns-suse-manager: - Add require for py27-compat-salt (salt 3002 does not provide python2-salt anymore) prometheus-exporters-formula: - Move exporters configurations to dedicated group `prometheus_exporters` - Add formula data schema migration script - This version changes the formula data schema and is not backwards compatible. Downgrading from this version will require reconfiguring the formula for all your minions. - Add Ubuntu support for Prometheus exporters' reverse proxy pxe-default-image-sle15: - Adapt rpm-properties.xml for containment-rpm-pxe v0.2.1 and newer py26-compat-salt: - Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607) spacewalk-backend: - Maintainer field in debian packages are only recommended (bsc#1186508) - Switch to www group for satellite logs (bsc#1185097) spacewalk-java: - Change Prometheus exporters formula data schema to make it more generic and extendable - Adapt logging for testing accessability of URLs (bsc#1182817) - Fix problem reading product_tree.json from wrong location in offline setups (bsc#1184283) - For a SUSE system get metadata and package from same source (bsc#1184475) - Check if the directory exists prior to modular data cleanup (bsc#1184311) - Assign right base product for res8 (bsc#1184005) - Fix check for for mirrorlist URLs when refreshing products (bsc#1184861) spacewalk-utils: - Bugfix for ubuntu-18.04 repo urls: multiverse, restricted and backports - Add multiverse, restricted and backports to Ubuntu 16.04, 18.04 and 20.04 spacewalk-web: - Update the WebUI version to 4.0.14 susemanager: - Add python3-pycryptodome to Ubuntu 18 and 20 bootstrap repos (bsc#1186346) - Require gio-branding-SLE for SLE15 but not for openSUSE Leap 15 - Add python3-distro to RES8, SLE15 and Ubuntu20.04 bootstrap repositories to fix bootstrapping issues (bsc#1184332) susemanager-doc-indexes: - Update for Disconnected Setup chapter in Administration Guide susemanager-docs_en: - Update for Disconnected Setup chapter in Administration Guide susemanager-sls: - Do not install python2-salt on Salt 3002.2 Docker build hosts (bsc#1185506) - Fix insecure JMX configuration (bsc#1184617) - Avoid conflicts with running ioloop on mgr_events engine (bsc#1172711) tika-core: - New upstream version 1.26. Fixes: * Infinite loop in the MP3Parser (bsc#1184892, CVE-2021-28657) * Out of memory error while loading a file in PDFBox before 2.0.23. * Infinite loop while loading a file in PDFBox before 2.0.23. * System.exit vulnerability in Tika's OneNote Parser; out of memory errors and/or infinite loops in Tika's ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser and ImageParser. * Excessive memory usage (DoS) vulnerability in Apache Tika's PSDParser * Infinite Loop (DoS) vulnerability in Apache Tika's PSDParser How to apply this update: 1. Log in as root user to the SUSE Manager server. 2. Stop the Spacewalk service: `spacewalk-service stop` 3. Apply the patch using either zypper patch or YaST Online Update. 4. Upgrade the database schema: `spacewalk-schema-upgrade` 5. Start the Spacewalk service: `spacewalk-service start` The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2021-2114,SUSE-SLE-Module-SUSE-Manager-Server-4.0-2021-2114 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20212114-1/ Link for SUSE-SU-2021:2114-1 https://lists.suse.com/pipermail/sle-security-updates/2021-June/009062.html E-Mail link for SUSE-SU-2021:2114-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1172711 SUSE Bug 1172711 https://bugzilla.suse.com/1182817 SUSE Bug 1182817 https://bugzilla.suse.com/1184005 SUSE Bug 1184005 https://bugzilla.suse.com/1184283 SUSE Bug 1184283 https://bugzilla.suse.com/1184311 SUSE Bug 1184311 https://bugzilla.suse.com/1184332 SUSE Bug 1184332 https://bugzilla.suse.com/1184361 SUSE Bug 1184361 https://bugzilla.suse.com/1184471 SUSE Bug 1184471 https://bugzilla.suse.com/1184475 SUSE Bug 1184475 https://bugzilla.suse.com/1184561 SUSE Bug 1184561 https://bugzilla.suse.com/1184617 SUSE Bug 1184617 https://bugzilla.suse.com/1184861 SUSE Bug 1184861 https://bugzilla.suse.com/1184892 SUSE Bug 1184892 https://bugzilla.suse.com/1185097 SUSE Bug 1185097 https://bugzilla.suse.com/1185281 SUSE Bug 1185281 https://bugzilla.suse.com/1185506 SUSE Bug 1185506 https://bugzilla.suse.com/1186124 SUSE Bug 1186124 https://bugzilla.suse.com/1186346 SUSE Bug 1186346 https://bugzilla.suse.com/1186508 SUSE Bug 1186508 https://www.suse.com/security/cve/CVE-2021-28657/ SUSE CVE CVE-2021-28657 page https://www.suse.com/security/cve/CVE-2021-31607/ SUSE CVE CVE-2021-31607 page SUSE Manager Server Module 4.0 cobbler-3.0.0+git20190806.32c4bae0-7.22.3 cobbler-tests-3.0.0+git20190806.32c4bae0-7.22.3 cobbler-web-3.0.0+git20190806.32c4bae0-7.22.3 grafana-formula-0.2.3-4.16.3 patterns-suma_proxy-4.0-9.19.3 patterns-suma_retail-4.0-9.19.3 patterns-suma_server-4.0-9.19.3 prometheus-exporters-formula-0.7.6-3.19.3 py26-compat-salt-2016.11.10-10.28.3 py27-compat-salt-3000.3-4.3.3 python3-spacewalk-backend-libs-4.0.38-3.47.4 spacewalk-backend-4.0.38-3.47.4 spacewalk-backend-app-4.0.38-3.47.4 spacewalk-backend-applet-4.0.38-3.47.4 spacewalk-backend-cdn-4.0.38-3.47.4 spacewalk-backend-config-files-4.0.38-3.47.4 spacewalk-backend-config-files-common-4.0.38-3.47.4 spacewalk-backend-config-files-tool-4.0.38-3.47.4 spacewalk-backend-iss-4.0.38-3.47.4 spacewalk-backend-iss-export-4.0.38-3.47.4 spacewalk-backend-libs-4.0.38-3.47.4 spacewalk-backend-package-push-server-4.0.38-3.47.4 spacewalk-backend-server-4.0.38-3.47.4 spacewalk-backend-sql-4.0.38-3.47.4 spacewalk-backend-sql-oracle-4.0.38-3.47.4 spacewalk-backend-sql-postgresql-4.0.38-3.47.4 spacewalk-backend-tools-4.0.38-3.47.4 spacewalk-backend-xml-export-libs-4.0.38-3.47.4 spacewalk-backend-xmlrpc-4.0.38-3.47.4 spacewalk-base-4.0.28-3.45.1 spacewalk-base-minimal-4.0.28-3.45.1 spacewalk-base-minimal-config-4.0.28-3.45.1 spacewalk-dobby-4.0.28-3.45.1 spacewalk-html-4.0.28-3.45.1 spacewalk-java-4.0.44-3.57.5 spacewalk-java-apidoc-sources-4.0.44-3.57.5 spacewalk-java-config-4.0.44-3.57.5 spacewalk-java-lib-4.0.44-3.57.5 spacewalk-java-postgresql-4.0.44-3.57.5 spacewalk-taskomatic-4.0.44-3.57.5 spacewalk-utils-4.0.21-3.30.3 susemanager-4.0.34-3.52.3 susemanager-doc-indexes-4.0-10.36.4 susemanager-docs_en-4.0-10.36.3 susemanager-docs_en-pdf-4.0-10.36.3 susemanager-sls-4.0.35-3.48.3 susemanager-tools-4.0.34-3.52.3 susemanager-web-libs-4.0.28-3.45.1 tika-core-1.26-3.6.3 pxe-default-image-sle15-4.0.1-20210621145802 cobbler-3.0.0+git20190806.32c4bae0-7.22.3 as a component of SUSE Manager Server Module 4.0 grafana-formula-0.2.3-4.16.3 as a component of SUSE Manager Server Module 4.0 patterns-suma_retail-4.0-9.19.3 as a component of SUSE Manager Server Module 4.0 patterns-suma_server-4.0-9.19.3 as a component of SUSE Manager Server Module 4.0 prometheus-exporters-formula-0.7.6-3.19.3 as a component of SUSE Manager Server Module 4.0 pxe-default-image-sle15-4.0.1-20210621145802 as a component of SUSE Manager Server Module 4.0 py26-compat-salt-2016.11.10-10.28.3 as a component of SUSE Manager Server Module 4.0 py27-compat-salt-3000.3-4.3.3 as a component of SUSE Manager Server Module 4.0 python3-spacewalk-backend-libs-4.0.38-3.47.4 as a component of SUSE Manager Server Module 4.0 spacewalk-backend-4.0.38-3.47.4 as a component of SUSE Manager Server Module 4.0 spacewalk-backend-app-4.0.38-3.47.4 as a component of SUSE Manager Server Module 4.0 spacewalk-backend-applet-4.0.38-3.47.4 as a component of SUSE Manager Server Module 4.0 spacewalk-backend-config-files-4.0.38-3.47.4 as a component of SUSE Manager Server Module 4.0 spacewalk-backend-config-files-common-4.0.38-3.47.4 as a component of SUSE Manager Server Module 4.0 spacewalk-backend-config-files-tool-4.0.38-3.47.4 as a component of SUSE Manager Server Module 4.0 spacewalk-backend-iss-4.0.38-3.47.4 as a component of SUSE Manager Server Module 4.0 spacewalk-backend-iss-export-4.0.38-3.47.4 as a component of SUSE Manager Server Module 4.0 spacewalk-backend-package-push-server-4.0.38-3.47.4 as a component of SUSE Manager Server Module 4.0 spacewalk-backend-server-4.0.38-3.47.4 as a component of SUSE Manager Server Module 4.0 spacewalk-backend-sql-4.0.38-3.47.4 as a component of SUSE Manager Server Module 4.0 spacewalk-backend-sql-postgresql-4.0.38-3.47.4 as a component of SUSE Manager Server Module 4.0 spacewalk-backend-tools-4.0.38-3.47.4 as a component of SUSE Manager Server Module 4.0 spacewalk-backend-xml-export-libs-4.0.38-3.47.4 as a component of SUSE Manager Server Module 4.0 spacewalk-backend-xmlrpc-4.0.38-3.47.4 as a component of SUSE Manager Server Module 4.0 spacewalk-base-4.0.28-3.45.1 as a component of SUSE Manager Server Module 4.0 spacewalk-base-minimal-4.0.28-3.45.1 as a component of SUSE Manager Server Module 4.0 spacewalk-base-minimal-config-4.0.28-3.45.1 as a component of SUSE Manager Server Module 4.0 spacewalk-html-4.0.28-3.45.1 as a component of SUSE Manager Server Module 4.0 spacewalk-java-4.0.44-3.57.5 as a component of SUSE Manager Server Module 4.0 spacewalk-java-config-4.0.44-3.57.5 as a component of SUSE Manager Server Module 4.0 spacewalk-java-lib-4.0.44-3.57.5 as a component of SUSE Manager Server Module 4.0 spacewalk-java-postgresql-4.0.44-3.57.5 as a component of SUSE Manager Server Module 4.0 spacewalk-taskomatic-4.0.44-3.57.5 as a component of SUSE Manager Server Module 4.0 spacewalk-utils-4.0.21-3.30.3 as a component of SUSE Manager Server Module 4.0 susemanager-4.0.34-3.52.3 as a component of SUSE Manager Server Module 4.0 susemanager-doc-indexes-4.0-10.36.4 as a component of SUSE Manager Server Module 4.0 susemanager-docs_en-4.0-10.36.3 as a component of SUSE Manager Server Module 4.0 susemanager-docs_en-pdf-4.0-10.36.3 as a component of SUSE Manager Server Module 4.0 susemanager-sls-4.0.35-3.48.3 as a component of SUSE Manager Server Module 4.0 susemanager-tools-4.0.34-3.52.3 as a component of SUSE Manager Server Module 4.0 susemanager-web-libs-4.0.28-3.45.1 as a component of SUSE Manager Server Module 4.0 tika-core-1.26-3.6.3 as a component of SUSE Manager Server Module 4.0 A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or later. CVE-2021-28657 SUSE Manager Server Module 4.0:cobbler-3.0.0+git20190806.32c4bae0-7.22.3 SUSE Manager Server Module 4.0:grafana-formula-0.2.3-4.16.3 SUSE Manager Server Module 4.0:patterns-suma_retail-4.0-9.19.3 SUSE Manager Server Module 4.0:patterns-suma_server-4.0-9.19.3 SUSE Manager Server Module 4.0:prometheus-exporters-formula-0.7.6-3.19.3 SUSE Manager Server Module 4.0:pxe-default-image-sle15-4.0.1-20210621145802 SUSE Manager Server Module 4.0:py26-compat-salt-2016.11.10-10.28.3 SUSE Manager Server Module 4.0:py27-compat-salt-3000.3-4.3.3 SUSE Manager Server Module 4.0:python3-spacewalk-backend-libs-4.0.38-3.47.4 SUSE Manager Server Module 4.0:spacewalk-backend-4.0.38-3.47.4 SUSE Manager Server Module 4.0:spacewalk-backend-app-4.0.38-3.47.4 SUSE Manager Server Module 4.0:spacewalk-backend-applet-4.0.38-3.47.4 SUSE Manager Server Module 4.0:spacewalk-backend-config-files-4.0.38-3.47.4 SUSE Manager Server Module 4.0:spacewalk-backend-config-files-common-4.0.38-3.47.4 SUSE Manager Server Module 4.0:spacewalk-backend-config-files-tool-4.0.38-3.47.4 SUSE Manager Server Module 4.0:spacewalk-backend-iss-4.0.38-3.47.4 SUSE Manager Server Module 4.0:spacewalk-backend-iss-export-4.0.38-3.47.4 SUSE Manager Server Module 4.0:spacewalk-backend-package-push-server-4.0.38-3.47.4 SUSE Manager Server Module 4.0:spacewalk-backend-server-4.0.38-3.47.4 SUSE Manager Server Module 4.0:spacewalk-backend-sql-4.0.38-3.47.4 SUSE Manager Server Module 4.0:spacewalk-backend-sql-postgresql-4.0.38-3.47.4 SUSE Manager Server Module 4.0:spacewalk-backend-tools-4.0.38-3.47.4 SUSE Manager Server Module 4.0:spacewalk-backend-xml-export-libs-4.0.38-3.47.4 SUSE Manager Server Module 4.0:spacewalk-backend-xmlrpc-4.0.38-3.47.4 SUSE Manager Server Module 4.0:spacewalk-base-4.0.28-3.45.1 SUSE Manager Server Module 4.0:spacewalk-base-minimal-4.0.28-3.45.1 SUSE Manager Server Module 4.0:spacewalk-base-minimal-config-4.0.28-3.45.1 SUSE Manager Server Module 4.0:spacewalk-html-4.0.28-3.45.1 SUSE Manager Server Module 4.0:spacewalk-java-4.0.44-3.57.5 SUSE Manager Server Module 4.0:spacewalk-java-config-4.0.44-3.57.5 SUSE Manager Server Module 4.0:spacewalk-java-lib-4.0.44-3.57.5 SUSE Manager Server Module 4.0:spacewalk-java-postgresql-4.0.44-3.57.5 SUSE Manager Server Module 4.0:spacewalk-taskomatic-4.0.44-3.57.5 SUSE Manager Server Module 4.0:spacewalk-utils-4.0.21-3.30.3 SUSE Manager Server Module 4.0:susemanager-4.0.34-3.52.3 SUSE Manager Server Module 4.0:susemanager-doc-indexes-4.0-10.36.4 SUSE Manager Server Module 4.0:susemanager-docs_en-4.0-10.36.3 SUSE Manager Server Module 4.0:susemanager-docs_en-pdf-4.0-10.36.3 SUSE Manager Server Module 4.0:susemanager-sls-4.0.35-3.48.3 SUSE Manager Server Module 4.0:susemanager-tools-4.0.34-3.52.3 SUSE Manager Server Module 4.0:susemanager-web-libs-4.0.28-3.45.1 SUSE Manager Server Module 4.0:tika-core-1.26-3.6.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20212114-1/ https://www.suse.com/security/cve/CVE-2021-28657.html CVE-2021-28657 https://bugzilla.suse.com/1184892 SUSE Bug 1184892 In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely). CVE-2021-31607 SUSE Manager Server Module 4.0:cobbler-3.0.0+git20190806.32c4bae0-7.22.3 SUSE Manager Server Module 4.0:grafana-formula-0.2.3-4.16.3 SUSE Manager Server Module 4.0:patterns-suma_retail-4.0-9.19.3 SUSE Manager Server Module 4.0:patterns-suma_server-4.0-9.19.3 SUSE Manager Server Module 4.0:prometheus-exporters-formula-0.7.6-3.19.3 SUSE Manager Server Module 4.0:pxe-default-image-sle15-4.0.1-20210621145802 SUSE Manager Server Module 4.0:py26-compat-salt-2016.11.10-10.28.3 SUSE Manager Server Module 4.0:py27-compat-salt-3000.3-4.3.3 SUSE Manager Server Module 4.0:python3-spacewalk-backend-libs-4.0.38-3.47.4 SUSE Manager Server Module 4.0:spacewalk-backend-4.0.38-3.47.4 SUSE Manager Server Module 4.0:spacewalk-backend-app-4.0.38-3.47.4 SUSE Manager Server Module 4.0:spacewalk-backend-applet-4.0.38-3.47.4 SUSE Manager Server Module 4.0:spacewalk-backend-config-files-4.0.38-3.47.4 SUSE Manager Server Module 4.0:spacewalk-backend-config-files-common-4.0.38-3.47.4 SUSE Manager Server Module 4.0:spacewalk-backend-config-files-tool-4.0.38-3.47.4 SUSE Manager Server Module 4.0:spacewalk-backend-iss-4.0.38-3.47.4 SUSE Manager Server Module 4.0:spacewalk-backend-iss-export-4.0.38-3.47.4 SUSE Manager Server Module 4.0:spacewalk-backend-package-push-server-4.0.38-3.47.4 SUSE Manager Server Module 4.0:spacewalk-backend-server-4.0.38-3.47.4 SUSE Manager Server Module 4.0:spacewalk-backend-sql-4.0.38-3.47.4 SUSE Manager Server Module 4.0:spacewalk-backend-sql-postgresql-4.0.38-3.47.4 SUSE Manager Server Module 4.0:spacewalk-backend-tools-4.0.38-3.47.4 SUSE Manager Server Module 4.0:spacewalk-backend-xml-export-libs-4.0.38-3.47.4 SUSE Manager Server Module 4.0:spacewalk-backend-xmlrpc-4.0.38-3.47.4 SUSE Manager Server Module 4.0:spacewalk-base-4.0.28-3.45.1 SUSE Manager Server Module 4.0:spacewalk-base-minimal-4.0.28-3.45.1 SUSE Manager Server Module 4.0:spacewalk-base-minimal-config-4.0.28-3.45.1 SUSE Manager Server Module 4.0:spacewalk-html-4.0.28-3.45.1 SUSE Manager Server Module 4.0:spacewalk-java-4.0.44-3.57.5 SUSE Manager Server Module 4.0:spacewalk-java-config-4.0.44-3.57.5 SUSE Manager Server Module 4.0:spacewalk-java-lib-4.0.44-3.57.5 SUSE Manager Server Module 4.0:spacewalk-java-postgresql-4.0.44-3.57.5 SUSE Manager Server Module 4.0:spacewalk-taskomatic-4.0.44-3.57.5 SUSE Manager Server Module 4.0:spacewalk-utils-4.0.21-3.30.3 SUSE Manager Server Module 4.0:susemanager-4.0.34-3.52.3 SUSE Manager Server Module 4.0:susemanager-doc-indexes-4.0-10.36.4 SUSE Manager Server Module 4.0:susemanager-docs_en-4.0-10.36.3 SUSE Manager Server Module 4.0:susemanager-docs_en-pdf-4.0-10.36.3 SUSE Manager Server Module 4.0:susemanager-sls-4.0.35-3.48.3 SUSE Manager Server Module 4.0:susemanager-tools-4.0.34-3.52.3 SUSE Manager Server Module 4.0:susemanager-web-libs-4.0.28-3.45.1 SUSE Manager Server Module 4.0:tika-core-1.26-3.6.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20212114-1/ https://www.suse.com/security/cve/CVE-2021-31607.html CVE-2021-31607 https://bugzilla.suse.com/1185281 SUSE Bug 1185281 https://bugzilla.suse.com/1210934 SUSE Bug 1210934