Security Beta update for SUSE Manager Client Tools SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:1545-1 Final 1 1 2022-05-05T10:11:10Z current 2022-05-05T10:11:10Z 2022-05-05T10:11:10Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security Beta update for SUSE Manager Client Tools This update fixes the following issues: golang-github-prometheus-alertmanager: - CVE-2022-21698: Denial of service using InstrumentHandlerCounter * Update vendor tarball with prometheus/client_golang 1.11.1 (bsc#1196338, jsc#SLE-24077) - Update to version 0.23.0: * amtool: Detect version drift and warn users (#2672) * Add ability to skip TLS verification for amtool (#2663) * Fix empty isEqual in amtool. (#2668) * Fix main tests (#2670) * cli: add new template render command (#2538) * OpsGenie: refer to alert instead of incident (#2609) * Docs: target_match and source_match are DEPRECATED (#2665) * Fix test not waiting for cluster member to be ready - Added hardening to systemd service(s) (bsc#1181400). golang-github-prometheus-prometheus: - Build firewalld-prometheus-config only for SUSE Linux Enterprise 15, 15.1 and 15.2, and require firewalld for it - Firewalld-prometheus-config needs to be a Recommends, not a Requires, as prometheus does not require it to run - Create firewalld-prometheus-config subpackage (bsc#1197042) - CVE-2022-21698: Denial of service using InstrumentHandlerCounter. * Update vendor tarball with prometheus/client_golang 1.12.1 (bsc#1196338) mgr-cfg: - Version 4.3.6-1 * Fix the condition for preventing building python 2 subpackage for SLE15 (bsc#1197579) mgr-osad: - Version 4.3.6-1 * Fix the condition for preventing building python 2 subpackage for SLE15 mgr-push: - Version 4.3.4-1 * Fix the condition for preventing building python 2 subpackage for SLE15 mgr-virtualization: - Version 4.3.5-1 * Fix the condition for preventing building python 2 subpackage for SLE15 rhnlib: - Version 4.3.4-1 * Fix the condition for preventing building python 2 subpackage for SLE15 salt: - Prevent data pollution between actions proceesed at the same time (bsc#1197637) - Fix regression preventing bootstrapping new clients caused by redundant dependency on psutil (bsc#1197533) - Fixes for Python 3.10 - Fix salt-ssh opts poisoning (bsc#1197637) - Fix multiple security issues for salt (bsc#1197417): * CVE-2022-22935: Sign authentication replies to prevent MiTM. * CVE-2022-22934: Sign pillar data to prevent MiTM attacks. * CVE-2022-22936: Prevent job and fileserver replays. * CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth. spacecmd: - Version 4.3.10-1 * parse boolean parameters correctly (bsc#1197689) * Add parameter to set containerized proxy SSH port spacewalk-client-tools: - Version 4.3.9-1 * Fix the condition for preventing building python 2 subpackage for SLE15 spacewalk-koan: - Version 4.3.5-1 * Fix the condition for preventing building python 2 subpackage for SLE15 spacewalk-oscap: - Version 4.3.5-1 * Fix the condition for preventing building python 2 subpackage for SLE15 suseRegisterInfo: - Version 4.3.3-1 * Fix the condition for preventing building python 2 subpackage for SLE15 uyuni-common-libs: - Version 4.3.4-1 * implement more decompression algorithms for reposync (bsc#1196704) uyuni-proxy-systemd-services: - Version 4.3.2-1 * Harmonize systemd services names and container names * Adapted to work on Enterprise Linux. * Add package to SLE and Client tools (jsc#SLE-24145) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-1545,SUSE-SLE-Manager-Tools-15-BETA-2022-1545 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20221545-1/ Link for SUSE-SU-2022:1545-1 https://lists.suse.com/pipermail/sle-security-updates/2022-May/010947.html E-Mail link for SUSE-SU-2022:1545-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1181400 SUSE Bug 1181400 https://bugzilla.suse.com/1196338 SUSE Bug 1196338 https://bugzilla.suse.com/1196704 SUSE Bug 1196704 https://bugzilla.suse.com/1197042 SUSE Bug 1197042 https://bugzilla.suse.com/1197417 SUSE Bug 1197417 https://bugzilla.suse.com/1197533 SUSE Bug 1197533 https://bugzilla.suse.com/1197579 SUSE Bug 1197579 https://bugzilla.suse.com/1197637 SUSE Bug 1197637 https://bugzilla.suse.com/1197689 SUSE Bug 1197689 https://www.suse.com/security/cve/CVE-2022-21698/ SUSE CVE CVE-2022-21698 page https://www.suse.com/security/cve/CVE-2022-22934/ SUSE CVE CVE-2022-22934 page https://www.suse.com/security/cve/CVE-2022-22935/ SUSE CVE CVE-2022-22935 page https://www.suse.com/security/cve/CVE-2022-22936/ SUSE CVE CVE-2022-22936 page https://www.suse.com/security/cve/CVE-2022-22941/ SUSE CVE CVE-2022-22941 page firewalld-prometheus-config-0.1-159000.6.30.4 golang-github-prometheus-alertmanager-0.23.0-159000.6.9.3 golang-github-prometheus-prometheus-2.32.1-159000.6.30.4 mgr-cfg-4.3.6-159000.4.26.1 mgr-cfg-actions-4.3.6-159000.4.26.1 mgr-cfg-client-4.3.6-159000.4.26.1 mgr-cfg-management-4.3.6-159000.4.26.1 mgr-osa-dispatcher-4.3.6-159000.4.27.2 mgr-osad-4.3.6-159000.4.27.2 mgr-push-4.3.4-159000.4.18.2 mgr-virtualization-host-4.3.5-159000.4.18.2 python2-uyuni-common-libs-4.3.4-159000.3.30.2 python3-mgr-cfg-4.3.6-159000.4.26.1 python3-mgr-cfg-actions-4.3.6-159000.4.26.1 python3-mgr-cfg-client-4.3.6-159000.4.26.1 python3-mgr-cfg-management-4.3.6-159000.4.26.1 python3-mgr-osa-common-4.3.6-159000.4.27.2 python3-mgr-osa-dispatcher-4.3.6-159000.4.27.2 python3-mgr-osad-4.3.6-159000.4.27.2 python3-mgr-push-4.3.4-159000.4.18.2 python3-mgr-virtualization-common-4.3.5-159000.4.18.2 python3-mgr-virtualization-host-4.3.5-159000.4.18.2 python3-rhnlib-4.3.4-159000.6.27.2 python3-salt-3004-159000.8.56.1 python3-spacewalk-check-4.3.9-159000.6.45.2 python3-spacewalk-client-setup-4.3.9-159000.6.45.2 python3-spacewalk-client-tools-4.3.9-159000.6.45.2 python3-spacewalk-koan-4.3.5-159000.6.18.1 python3-spacewalk-oscap-4.3.5-159000.6.18.2 python3-suseRegisterInfo-4.3.3-159000.6.21.2 python3-uyuni-common-libs-4.3.4-159000.3.30.2 salt-3004-159000.8.56.1 salt-api-3004-159000.8.56.1 salt-bash-completion-3004-159000.8.56.1 salt-cloud-3004-159000.8.56.1 salt-doc-3004-159000.8.56.1 salt-fish-completion-3004-159000.8.56.1 salt-master-3004-159000.8.56.1 salt-minion-3004-159000.8.56.1 salt-proxy-3004-159000.8.56.1 salt-ssh-3004-159000.8.56.1 salt-standalone-formulas-configuration-3004-159000.8.56.1 salt-syndic-3004-159000.8.56.1 salt-transactional-update-3004-159000.8.56.1 salt-zsh-completion-3004-159000.8.56.1 spacecmd-4.3.10-159000.6.39.2 spacewalk-check-4.3.9-159000.6.45.2 spacewalk-client-setup-4.3.9-159000.6.45.2 spacewalk-client-tools-4.3.9-159000.6.45.2 spacewalk-koan-4.3.5-159000.6.18.1 spacewalk-oscap-4.3.5-159000.6.18.2 suseRegisterInfo-4.3.3-159000.6.21.2 uyuni-proxy-systemd-services-4.3.2-159000.3.6.1 client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of `promhttp.InstrumentHandler*` middleware except `RequestsInFlight`; not filter any specific methods (e.g GET) before middleware; pass metric with `method` label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknown `method`. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing the `method` label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods. CVE-2022-21698 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221545-1/ https://www.suse.com/security/cve/CVE-2022-21698.html CVE-2022-21698 https://bugzilla.suse.com/1196338 SUSE Bug 1196338 An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data. CVE-2022-22934 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221545-1/ https://www.suse.com/security/cve/CVE-2022-22934.html CVE-2022-22934 https://bugzilla.suse.com/1197417 SUSE Bug 1197417 https://bugzilla.suse.com/1197765 SUSE Bug 1197765 An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to force a minion process to stop by impersonating a master. CVE-2022-22935 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221545-1/ https://www.suse.com/security/cve/CVE-2022-22935.html CVE-2022-22935 https://bugzilla.suse.com/1197417 SUSE Bug 1197417 https://bugzilla.suse.com/1197765 SUSE Bug 1197765 An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Job publishes and file server replies are susceptible to replay attacks, which can result in an attacker replaying job publishes causing minions to run old jobs. File server replies can also be re-played. A sufficient craft attacker could gain root access on minion under certain scenarios. CVE-2022-22936 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221545-1/ https://www.suse.com/security/cve/CVE-2022-22936.html CVE-2022-22936 https://bugzilla.suse.com/1197417 SUSE Bug 1197417 https://bugzilla.suse.com/1197765 SUSE Bug 1197765 An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisher_acl, if a user configured in the publisher_acl targets any minion connected to the Syndic, the Salt Master incorrectly interpreted no valid targets as valid, allowing configured users to target any of the minions connected to the syndic with their configured commands. This requires a syndic master combined with publisher_acl configured on the Master-of-Masters, allowing users specified in the publisher_acl to bypass permissions, publishing authorized commands to any configured minion. CVE-2022-22941 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221545-1/ https://www.suse.com/security/cve/CVE-2022-22941.html CVE-2022-22941 https://bugzilla.suse.com/1197417 SUSE Bug 1197417 https://bugzilla.suse.com/1197765 SUSE Bug 1197765