Security update for release-notes-susemanager, release-notes-susemanager-proxy SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:3879-1 Final 1 1 2022-11-04T14:25:43Z current 2022-11-04T14:25:43Z 2022-11-04T14:25:43Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for release-notes-susemanager, release-notes-susemanager-proxy This update for release-notes-susemanager, release-notes-susemanager-proxy fixes the following issues: Release notes for SUSE Manager: - Update to SUSE Manager 4.2.10 * Apache exporter has been upgraded to version 0.11.0 * CVEs fixed: CVE-2022-43753, CVE-2022-43754, CVE-2022-31255 * Bugs mentioned: bsc#1195624, bsc#1197724, bsc#1199726, bsc#1200596, bsc#1201059 bsc#1201788, bsc#1202167, bsc#1202729, bsc#1202785, bsc#1203283 bsc#1203406, bsc#1203422, bsc#1203564, bsc#1203599, bsc#1203611 bsc#1203898, bsc#1204146, bsc#1204203, bsc#1195624, bsc#1197724 bsc#1199726, bsc#1200596, bsc#1201059, bsc#1201788, bsc#1202167 bsc#1202729, bsc#1202785, bsc#1203283, bsc#1203406, bsc#1203422 bsc#1203564, bsc#1203599, bsc#1203611, bsc#1203898, bsc#1204146 bsc#1204716, bsc#1204741, bsc#1204543 Release notes for SUSE Manager Proxy: - Update to SUSE Manager 4.2.10 * Bugs mentioned: bsc#1201059, bsc#1201788, bsc#1203283 The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-3879,SUSE-SLE-Product-SUSE-Manager-Proxy-4.2-2022-3879,SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.2-2022-3879,SUSE-SLE-Product-SUSE-Manager-Server-4.2-2022-3879 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20223879-1/ Link for SUSE-SU-2022:3879-1 https://lists.suse.com/pipermail/sle-security-updates/2022-November/012817.html E-Mail link for SUSE-SU-2022:3879-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1195624 SUSE Bug 1195624 https://bugzilla.suse.com/1197724 SUSE Bug 1197724 https://bugzilla.suse.com/1199726 SUSE Bug 1199726 https://bugzilla.suse.com/1200596 SUSE Bug 1200596 https://bugzilla.suse.com/1201059 SUSE Bug 1201059 https://bugzilla.suse.com/1201788 SUSE Bug 1201788 https://bugzilla.suse.com/1202167 SUSE Bug 1202167 https://bugzilla.suse.com/1202729 SUSE Bug 1202729 https://bugzilla.suse.com/1202785 SUSE Bug 1202785 https://bugzilla.suse.com/1203283 SUSE Bug 1203283 https://bugzilla.suse.com/1203406 SUSE Bug 1203406 https://bugzilla.suse.com/1203422 SUSE Bug 1203422 https://bugzilla.suse.com/1203564 SUSE Bug 1203564 https://bugzilla.suse.com/1203599 SUSE Bug 1203599 https://bugzilla.suse.com/1203611 SUSE Bug 1203611 https://bugzilla.suse.com/1203898 SUSE Bug 1203898 https://bugzilla.suse.com/1204146 SUSE Bug 1204146 https://bugzilla.suse.com/1204203 SUSE Bug 1204203 https://bugzilla.suse.com/1204543 SUSE Bug 1204543 https://bugzilla.suse.com/1204716 SUSE Bug 1204716 https://bugzilla.suse.com/1204741 SUSE Bug 1204741 https://www.suse.com/security/cve/CVE-2022-31255/ SUSE CVE CVE-2022-31255 page https://www.suse.com/security/cve/CVE-2022-43753/ SUSE CVE CVE-2022-43753 page https://www.suse.com/security/cve/CVE-2022-43754/ SUSE CVE CVE-2022-43754 page SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 release-notes-susemanager-4.2.10-150300.3.57.1 release-notes-susemanager-proxy-4.2.10-150300.3.46.1 release-notes-susemanager-proxy-4.2.10-150300.3.46.1 as a component of SUSE Manager Proxy 4.2 release-notes-susemanager-proxy-4.2.10-150300.3.46.1 as a component of SUSE Manager Retail Branch Server 4.2 release-notes-susemanager-4.2.10-150300.3.57.1 as a component of SUSE Manager Server 4.2 An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in spacewalk/Uyuni of SUSE Linux Enterprise Module for SUSE Manager Server 4.2, SUSE Linux Enterprise Module for SUSE Manager Server 4.3, SUSE Manager Server 4.2 allows remote attackers to read files available to the user running the process, typically tomcat. This issue affects: SUSE Linux Enterprise Module for SUSE Manager Server 4.2 hub-xmlrpc-api-0.7-150300.3.9.2, inter-server-sync-0.2.4-150300.8.25.2, locale-formula-0.3-150300.3.3.2, py27-compat-salt-3000.3-150300.7.7.26.2, python-urlgrabber-3.10.2.1py2_3-150300.3.3.2, spacecmd-4.2.20-150300.4.30.2, spacewalk-backend-4.2.25-150300.4.32.4, spacewalk-client-tools-4.2.21-150300.4.27.3, spacewalk-java-4.2.43-150300.3.48.2, spacewalk-utils-4.2.18-150300.3.21.2, spacewalk-web-4.2.30-150300.3.30.3, susemanager-4.2.38-150300.3.44.3, susemanager-doc-indexes-4.2-150300.12.36.3, susemanager-docs_en-4.2-150300.12.36.2, susemanager-schema-4.2.25-150300.3.30.3, susemanager-sls versions prior to 4.2.28. SUSE Linux Enterprise Module for SUSE Manager Server 4.3 spacewalk-java versions prior to 4.3.39. SUSE Manager Server 4.2 release-notes-susemanager versions prior to 4.2.10. CVE-2022-31255 SUSE Manager Proxy 4.2:release-notes-susemanager-proxy-4.2.10-150300.3.46.1 SUSE Manager Retail Branch Server 4.2:release-notes-susemanager-proxy-4.2.10-150300.3.46.1 SUSE Manager Server 4.2:release-notes-susemanager-4.2.10-150300.3.57.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223879-1/ https://www.suse.com/security/cve/CVE-2022-31255.html CVE-2022-31255 https://bugzilla.suse.com/1204543 SUSE Bug 1204543 A Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in spacewalk/Uyuni of SUSE Linux Enterprise Module for SUSE Manager Server 4.2, SUSE Linux Enterprise Module for SUSE Manager Server 4.3, SUSE Manager Server 4.2 allows remote attackers to read files available to the user running the process, typically tomcat. This issue affects: SUSE Linux Enterprise Module for SUSE Manager Server 4.2 hub-xmlrpc-api-0.7-150300.3.9.2, inter-server-sync-0.2.4-150300.8.25.2, locale-formula-0.3-150300.3.3.2, py27-compat-salt-3000.3-150300.7.7.26.2, python-urlgrabber-3.10.2.1py2_3-150300.3.3.2, spacecmd-4.2.20-150300.4.30.2, spacewalk-backend-4.2.25-150300.4.32.4, spacewalk-client-tools-4.2.21-150300.4.27.3, spacewalk-java-4.2.43-150300.3.48.2, spacewalk-utils-4.2.18-150300.3.21.2, spacewalk-web-4.2.30-150300.3.30.3, susemanager-4.2.38-150300.3.44.3, susemanager-doc-indexes-4.2-150300.12.36.3, susemanager-docs_en-4.2-150300.12.36.2, susemanager-schema-4.2.25-150300.3.30.3, susemanager-sls versions prior to 4.2.28. SUSE Linux Enterprise Module for SUSE Manager Server 4.3 spacewalk-java versions prior to 4.3.39. SUSE Manager Server 4.2 release-notes-susemanager versions prior to 4.2.10. CVE-2022-43753 SUSE Manager Proxy 4.2:release-notes-susemanager-proxy-4.2.10-150300.3.46.1 SUSE Manager Retail Branch Server 4.2:release-notes-susemanager-proxy-4.2.10-150300.3.46.1 SUSE Manager Server 4.2:release-notes-susemanager-4.2.10-150300.3.57.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223879-1/ https://www.suse.com/security/cve/CVE-2022-43753.html CVE-2022-43753 https://bugzilla.suse.com/1204716 SUSE Bug 1204716 An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spacewalk/Uyuni of SUSE Linux Enterprise Module for SUSE Manager Server 4.2, SUSE Linux Enterprise Module for SUSE Manager Server 4.3, SUSE Manager Server 4.2 allows remote attackers to embed Javascript code via /rhn/audit/scap/Search.do This issue affects: SUSE Linux Enterprise Module for SUSE Manager Server 4.2 hub-xmlrpc-api-0.7-150300.3.9.2, inter-server-sync-0.2.4-150300.8.25.2, locale-formula-0.3-150300.3.3.2, py27-compat-salt-3000.3-150300.7.7.26.2, python-urlgrabber-3.10.2.1py2_3-150300.3.3.2, spacecmd-4.2.20-150300.4.30.2, spacewalk-backend-4.2.25-150300.4.32.4, spacewalk-client-tools-4.2.21-150300.4.27.3, spacewalk-java-4.2.43-150300.3.48.2, spacewalk-utils-4.2.18-150300.3.21.2, spacewalk-web-4.2.30-150300.3.30.3, susemanager-4.2.38-150300.3.44.3, susemanager-doc-indexes-4.2-150300.12.36.3, susemanager-docs_en-4.2-150300.12.36.2, susemanager-schema-4.2.25-150300.3.30.3, susemanager-sls versions prior to 4.2.28. SUSE Linux Enterprise Module for SUSE Manager Server 4.3 spacewalk-java versions prior to 4.3.39. SUSE Manager Server 4.2 release-notes-susemanager versions prior to 4.2.10. CVE-2022-43754 SUSE Manager Proxy 4.2:release-notes-susemanager-proxy-4.2.10-150300.3.46.1 SUSE Manager Retail Branch Server 4.2:release-notes-susemanager-proxy-4.2.10-150300.3.46.1 SUSE Manager Server 4.2:release-notes-susemanager-4.2.10-150300.3.57.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223879-1/ https://www.suse.com/security/cve/CVE-2022-43754.html CVE-2022-43754 https://bugzilla.suse.com/1204741 SUSE Bug 1204741