Recommended update for SUSE Manager 4.1.15 Release Notes SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:2143-1 Final 1 1 2022-06-20T14:10:44Z current 2022-06-20T14:10:44Z 2022-06-20T14:10:44Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Recommended update for SUSE Manager 4.1.15 Release Notes This update for SUSE Manager 4.1.15 Release Notes provides the following additions: Release notes for SUSE Manager: - Update to 4.1.15 * Salt has been upgraded to 3004 version * Grafana has been upgraded to 8.3.5 * Postgres exporter has been upgraded to 0.10.0 * Alertmanager has been upgraded to 0.23.0 * Node exporter has been upgraded 1.3.0 * CVEs fixed: CVE-2022-21724, CVE-2022-21952, CVE-2022-31248, CVE-2022-26520 * Bugs mentioned: bsc#1182742, bsc#1189501, bsc#1190535, bsc#1192850, bsc#1193032 bsc#1193238, bsc#1193707, bsc#1194262, bsc#1194447, bsc#1194594 bsc#1194909, bsc#1195561, bsc#1196338, bsc#1196407, bsc#1196702 bsc#1196704, bsc#1197356, bsc#1197429, bsc#1197438, bsc#1197488 bsc#1198221, bsc#1198356, bsc#1198686, bsc#1198914, bsc#1199036 bsc#1199142, bsc#1199149, bsc#1199512, bsc#1199528, bsc#1199629 bsc#1199677, bsc#1199888 Release notes for SUSE Manager proxy: - Update to 4.1.15 * Salt has been upgraded to 3004 version * Bugs mentioned: bsc#1190535, bsc#1193238, bsc#1194447, bsc#1194594, bsc#1194909 bsc#1196338, bsc#1196704, bsc#1199142, bsc#1199528 The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-2143,SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-2143,SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-2143,SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-2143 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20222143-1/ Link for SUSE-SU-2022:2143-1 https://lists.suse.com/pipermail/sle-security-updates/2022-June/011318.html E-Mail link for SUSE-SU-2022:2143-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1182742 SUSE Bug 1182742 https://bugzilla.suse.com/1189501 SUSE Bug 1189501 https://bugzilla.suse.com/1190535 SUSE Bug 1190535 https://bugzilla.suse.com/1192850 SUSE Bug 1192850 https://bugzilla.suse.com/1193032 SUSE Bug 1193032 https://bugzilla.suse.com/1193238 SUSE Bug 1193238 https://bugzilla.suse.com/1193707 SUSE Bug 1193707 https://bugzilla.suse.com/1194262 SUSE Bug 1194262 https://bugzilla.suse.com/1194447 SUSE Bug 1194447 https://bugzilla.suse.com/1194594 SUSE Bug 1194594 https://bugzilla.suse.com/1194909 SUSE Bug 1194909 https://bugzilla.suse.com/1195561 SUSE Bug 1195561 https://bugzilla.suse.com/1196338 SUSE Bug 1196338 https://bugzilla.suse.com/1196407 SUSE Bug 1196407 https://bugzilla.suse.com/1196702 SUSE Bug 1196702 https://bugzilla.suse.com/1196704 SUSE Bug 1196704 https://bugzilla.suse.com/1197356 SUSE Bug 1197356 https://bugzilla.suse.com/1197429 SUSE Bug 1197429 https://bugzilla.suse.com/1197438 SUSE Bug 1197438 https://bugzilla.suse.com/1197488 SUSE Bug 1197488 https://bugzilla.suse.com/1198221 SUSE Bug 1198221 https://bugzilla.suse.com/1198356 SUSE Bug 1198356 https://bugzilla.suse.com/1198686 SUSE Bug 1198686 https://bugzilla.suse.com/1198914 SUSE Bug 1198914 https://bugzilla.suse.com/1199036 SUSE Bug 1199036 https://bugzilla.suse.com/1199142 SUSE Bug 1199142 https://bugzilla.suse.com/1199149 SUSE Bug 1199149 https://bugzilla.suse.com/1199512 SUSE Bug 1199512 https://bugzilla.suse.com/1199528 SUSE Bug 1199528 https://bugzilla.suse.com/1199629 SUSE Bug 1199629 https://bugzilla.suse.com/1199677 SUSE Bug 1199677 https://bugzilla.suse.com/1199888 SUSE Bug 1199888 https://www.suse.com/security/cve/CVE-2022-21724/ SUSE CVE CVE-2022-21724 page https://www.suse.com/security/cve/CVE-2022-21952/ SUSE CVE CVE-2022-21952 page https://www.suse.com/security/cve/CVE-2022-26520/ SUSE CVE CVE-2022-26520 page https://www.suse.com/security/cve/CVE-2022-31248/ SUSE CVE CVE-2022-31248 page SUSE Manager Proxy 4.1 SUSE Manager Retail Branch Server 4.1 SUSE Manager Server 4.1 release-notes-susemanager-4.1.15-150200.3.80.1 release-notes-susemanager-proxy-4.1.15-150200.3.56.1 release-notes-susemanager-proxy-4.1.15-150200.3.56.1 as a component of SUSE Manager Proxy 4.1 release-notes-susemanager-proxy-4.1.15-150200.3.56.1 as a component of SUSE Manager Retail Branch Server 4.1 release-notes-susemanager-4.1.15-150200.3.80.1 as a component of SUSE Manager Server 4.1 pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the postgresql library will be attacked when attacker control the jdbc url or properties. pgjdbc instantiates plugin instances based on class names provided via `authenticationPluginClassName`, `sslhostnameverifier`, `socketFactory`, `sslfactory`, `sslpasswordcallback` connection properties. However, the driver did not verify if the class implements the expected interface before instantiating the class. This can lead to code execution loaded via arbitrary classes. Users using plugins are advised to upgrade. There are no known workarounds for this issue. CVE-2022-21724 SUSE Manager Proxy 4.1:release-notes-susemanager-proxy-4.1.15-150200.3.56.1 SUSE Manager Retail Branch Server 4.1:release-notes-susemanager-proxy-4.1.15-150200.3.56.1 SUSE Manager Server 4.1:release-notes-susemanager-4.1.15-150200.3.80.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222143-1/ https://www.suse.com/security/cve/CVE-2022-21724.html CVE-2022-21724 https://bugzilla.suse.com/1195561 SUSE Bug 1195561 https://bugzilla.suse.com/1204789 SUSE Bug 1204789 A Missing Authentication for Critical Function vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to easily exhaust available disk resources leading to DoS. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46. SUSE Manager Server 4.2 spacewalk-java versions prior to 4.2.37. CVE-2022-21952 SUSE Manager Proxy 4.1:release-notes-susemanager-proxy-4.1.15-150200.3.56.1 SUSE Manager Retail Branch Server 4.1:release-notes-susemanager-proxy-4.1.15-150200.3.56.1 SUSE Manager Server 4.1:release-notes-susemanager-4.1.15-150200.3.80.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222143-1/ https://www.suse.com/security/cve/CVE-2022-21952.html CVE-2022-21952 https://bugzilla.suse.com/1199512 SUSE Bug 1199512 ** DISPUTED ** In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties. CVE-2022-26520 SUSE Manager Proxy 4.1:release-notes-susemanager-proxy-4.1.15-150200.3.56.1 SUSE Manager Retail Branch Server 4.1:release-notes-susemanager-proxy-4.1.15-150200.3.56.1 SUSE Manager Server 4.1:release-notes-susemanager-4.1.15-150200.3.80.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222143-1/ https://www.suse.com/security/cve/CVE-2022-26520.html CVE-2022-26520 https://bugzilla.suse.com/1197356 SUSE Bug 1197356 A Observable Response Discrepancy vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to discover valid usernames. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46-1. SUSE Manager Server 4.2 spacewalk-java versions prior to 4.2.37-1. CVE-2022-31248 SUSE Manager Proxy 4.1:release-notes-susemanager-proxy-4.1.15-150200.3.56.1 SUSE Manager Retail Branch Server 4.1:release-notes-susemanager-proxy-4.1.15-150200.3.56.1 SUSE Manager Server 4.1:release-notes-susemanager-4.1.15-150200.3.80.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222143-1/ https://www.suse.com/security/cve/CVE-2022-31248.html CVE-2022-31248 https://bugzilla.suse.com/1199629 SUSE Bug 1199629