Security update for SUSE Manager Server 4.3 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:0373-1 Final 1 1 2023-02-10T14:19:35Z current 2023-02-10T14:19:35Z 2023-02-10T14:19:35Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for SUSE Manager Server 4.3 This update fixes the following issues: release-notes-susemanager: - Update to SUSE Manager 4.3.4 * SUSE Liberty Linux 9 support as client * SUSE Linux Enterprise Micro support as client * Indications for systems requiring reboot or with a scheduled reboot * Notification messages via email * Grafana update to 8.5.15 * Subscription warning notification * Changelogs at repositories metadata has been limited the last 20 entries * Drop legacy way to prevent disabling local repositories * CVEs fixed CVE-2022-1415 * Bugs mentioned bsc#1172110, bsc#1195979, bsc#1200801, bsc#1202150, bsc#1203478 bsc#1203532, bsc#1203826, bsc#1204032, bsc#1204126, bsc#1204186 bsc#1204235, bsc#1204270, bsc#1204330, bsc#1204712, bsc#1204715 bsc#1204879, bsc#1204932, bsc#1205012, bsc#1205040, bsc#1205207 bsc#1205255, bsc#1205350, bsc#1205489, bsc#1205523, bsc#1205644 bsc#1205663, bsc#1205749, bsc#1205754, bsc#1205890, bsc#1205919 bsc#1205943, bsc#1206055, bsc#1206160, bsc#1206168, bsc#1206186 bsc#1206249, bsc#1206276, bsc#1206294, bsc#1206336, bsc#1206375 bsc#1206470, bsc#1206613, bsc#1206666, bsc#1206799, bsc#1207136 The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container suse/manager/4.3/proxy-httpd:latest-2023-373,Image SLES15-SP4-Manager-Proxy-4-3-BYOS-2023-373,Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure-2023-373,Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2-2023-373,Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE-2023-373,Image SLES15-SP4-Manager-Server-4-3-BYOS-2023-373,Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure-2023-373,Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2-2023-373,Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE-2023-373,SUSE-2023-373,SUSE-SLE-Product-SUSE-Manager-Server-4.3-2023-373 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20230373-1/ Link for SUSE-SU-2023:0373-1 https://lists.suse.com/pipermail/sle-security-updates/2023-February/013728.html E-Mail link for SUSE-SU-2023:0373-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1172110 SUSE Bug 1172110 https://bugzilla.suse.com/1195979 SUSE Bug 1195979 https://bugzilla.suse.com/1200801 SUSE Bug 1200801 https://bugzilla.suse.com/1202150 SUSE Bug 1202150 https://bugzilla.suse.com/1203478 SUSE Bug 1203478 https://bugzilla.suse.com/1203532 SUSE Bug 1203532 https://bugzilla.suse.com/1203826 SUSE Bug 1203826 https://bugzilla.suse.com/1204032 SUSE Bug 1204032 https://bugzilla.suse.com/1204126 SUSE Bug 1204126 https://bugzilla.suse.com/1204186 SUSE Bug 1204186 https://bugzilla.suse.com/1204235 SUSE Bug 1204235 https://bugzilla.suse.com/1204270 SUSE Bug 1204270 https://bugzilla.suse.com/1204330 SUSE Bug 1204330 https://bugzilla.suse.com/1204712 SUSE Bug 1204712 https://bugzilla.suse.com/1204715 SUSE Bug 1204715 https://bugzilla.suse.com/1204879 SUSE Bug 1204879 https://bugzilla.suse.com/1204932 SUSE Bug 1204932 https://bugzilla.suse.com/1205012 SUSE Bug 1205012 https://bugzilla.suse.com/1205040 SUSE Bug 1205040 https://bugzilla.suse.com/1205207 SUSE Bug 1205207 https://bugzilla.suse.com/1205255 SUSE Bug 1205255 https://bugzilla.suse.com/1205350 SUSE Bug 1205350 https://bugzilla.suse.com/1205489 SUSE Bug 1205489 https://bugzilla.suse.com/1205523 SUSE Bug 1205523 https://bugzilla.suse.com/1205644 SUSE Bug 1205644 https://bugzilla.suse.com/1205663 SUSE Bug 1205663 https://bugzilla.suse.com/1205749 SUSE Bug 1205749 https://bugzilla.suse.com/1205754 SUSE Bug 1205754 https://bugzilla.suse.com/1205890 SUSE Bug 1205890 https://bugzilla.suse.com/1205919 SUSE Bug 1205919 https://bugzilla.suse.com/1205943 SUSE Bug 1205943 https://bugzilla.suse.com/1206055 SUSE Bug 1206055 https://bugzilla.suse.com/1206160 SUSE Bug 1206160 https://bugzilla.suse.com/1206168 SUSE Bug 1206168 https://bugzilla.suse.com/1206186 SUSE Bug 1206186 https://bugzilla.suse.com/1206249 SUSE Bug 1206249 https://bugzilla.suse.com/1206276 SUSE Bug 1206276 https://bugzilla.suse.com/1206294 SUSE Bug 1206294 https://bugzilla.suse.com/1206336 SUSE Bug 1206336 https://bugzilla.suse.com/1206375 SUSE Bug 1206375 https://bugzilla.suse.com/1206470 SUSE Bug 1206470 https://bugzilla.suse.com/1206613 SUSE Bug 1206613 https://bugzilla.suse.com/1206666 SUSE Bug 1206666 https://bugzilla.suse.com/1206799 SUSE Bug 1206799 https://bugzilla.suse.com/1207136 SUSE Bug 1207136 https://www.suse.com/security/cve/CVE-2022-1415/ SUSE CVE CVE-2022-1415 page Container suse/manager/4.3/proxy-httpd:latest Image SLES15-SP4-Manager-Proxy-4-3-BYOS Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE Image SLES15-SP4-Manager-Server-4-3-BYOS Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE SUSE Manager Server 4.3 release-notes-susemanager-proxy-4.3.4-150400.3.43.1 release-notes-susemanager-4.3.4-150400.3.43.1 release-notes-susemanager-proxy-4.3.4-150400.3.43.1 as a component of Container suse/manager/4.3/proxy-httpd:latest release-notes-susemanager-proxy-4.3.4-150400.3.43.1 as a component of Image SLES15-SP4-Manager-Proxy-4-3-BYOS release-notes-susemanager-proxy-4.3.4-150400.3.43.1 as a component of Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure release-notes-susemanager-proxy-4.3.4-150400.3.43.1 as a component of Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2 release-notes-susemanager-proxy-4.3.4-150400.3.43.1 as a component of Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE release-notes-susemanager-4.3.4-150400.3.43.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS release-notes-susemanager-4.3.4-150400.3.43.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure release-notes-susemanager-4.3.4-150400.3.43.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 release-notes-susemanager-4.3.4-150400.3.43.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE release-notes-susemanager-4.3.4-150400.3.43.1 as a component of SUSE Manager Server 4.3 A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server. CVE-2022-1415 Container suse/manager/4.3/proxy-httpd:latest:release-notes-susemanager-proxy-4.3.4-150400.3.43.1 Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure:release-notes-susemanager-proxy-4.3.4-150400.3.43.1 Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2:release-notes-susemanager-proxy-4.3.4-150400.3.43.1 Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE:release-notes-susemanager-proxy-4.3.4-150400.3.43.1 Image SLES15-SP4-Manager-Proxy-4-3-BYOS:release-notes-susemanager-proxy-4.3.4-150400.3.43.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure:release-notes-susemanager-4.3.4-150400.3.43.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2:release-notes-susemanager-4.3.4-150400.3.43.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE:release-notes-susemanager-4.3.4-150400.3.43.1 Image SLES15-SP4-Manager-Server-4-3-BYOS:release-notes-susemanager-4.3.4-150400.3.43.1 SUSE Manager Server 4.3:release-notes-susemanager-4.3.4-150400.3.43.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20230373-1/ https://www.suse.com/security/cve/CVE-2022-1415.html CVE-2022-1415 https://bugzilla.suse.com/1204879 SUSE Bug 1204879