Maintenance update for SUSE Manager 4.3.7 Release Notes SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:3136-1 Final 1 1 2023-08-02T07:16:10Z current 2023-08-02T07:16:10Z 2023-08-02T07:16:10Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Maintenance update for SUSE Manager 4.3.7 Release Notes Maintenance update for SUSE Manager 4.3.7 Release Notes: This is a codestream only update The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container suse/manager/4.3/proxy-httpd:latest-2023-3136,Image SLES15-SP4-Manager-Proxy-4-3-BYOS-2023-3136,Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure-2023-3136,Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2-2023-3136,Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE-2023-3136,Image SLES15-SP4-Manager-Server-4-3-BYOS-2023-3136,Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure-2023-3136,Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2-2023-3136,Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE-2023-3136,SUSE-2023-3136 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20233136-1/ Link for SUSE-SU-2023:3136-1 https://lists.suse.com/pipermail/sle-security-updates/2023-August/015741.html E-Mail link for SUSE-SU-2023:3136-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1175823 SUSE Bug 1175823 https://bugzilla.suse.com/1179747 SUSE Bug 1179747 https://bugzilla.suse.com/1195380 SUSE Bug 1195380 https://bugzilla.suse.com/1201337 SUSE Bug 1201337 https://bugzilla.suse.com/1204089 SUSE Bug 1204089 https://bugzilla.suse.com/1207330 SUSE Bug 1207330 https://bugzilla.suse.com/1207550 SUSE Bug 1207550 https://bugzilla.suse.com/1207691 SUSE Bug 1207691 https://bugzilla.suse.com/1207941 SUSE Bug 1207941 https://bugzilla.suse.com/1208528 SUSE Bug 1208528 https://bugzilla.suse.com/1208577 SUSE Bug 1208577 https://bugzilla.suse.com/1208612 SUSE Bug 1208612 https://bugzilla.suse.com/1208720 SUSE Bug 1208720 https://bugzilla.suse.com/1208984 SUSE Bug 1208984 https://bugzilla.suse.com/1209156 SUSE Bug 1209156 https://bugzilla.suse.com/1210011 SUSE Bug 1210011 https://bugzilla.suse.com/1210103 SUSE Bug 1210103 https://bugzilla.suse.com/1210394 SUSE Bug 1210394 https://bugzilla.suse.com/1210406 SUSE Bug 1210406 https://bugzilla.suse.com/1210456 SUSE Bug 1210456 https://bugzilla.suse.com/1210475 SUSE Bug 1210475 https://bugzilla.suse.com/1210659 SUSE Bug 1210659 https://bugzilla.suse.com/1210834 SUSE Bug 1210834 https://bugzilla.suse.com/1210957 SUSE Bug 1210957 https://bugzilla.suse.com/1210994 SUSE Bug 1210994 https://bugzilla.suse.com/1211062 SUSE Bug 1211062 https://bugzilla.suse.com/1211276 SUSE Bug 1211276 https://bugzilla.suse.com/1211330 SUSE Bug 1211330 https://bugzilla.suse.com/1211469 SUSE Bug 1211469 https://bugzilla.suse.com/1211621 SUSE Bug 1211621 https://bugzilla.suse.com/1211650 SUSE Bug 1211650 https://bugzilla.suse.com/1211713 SUSE Bug 1211713 https://bugzilla.suse.com/1211897 SUSE Bug 1211897 https://bugzilla.suse.com/1211929 SUSE Bug 1211929 https://bugzilla.suse.com/1212032 SUSE Bug 1212032 https://bugzilla.suse.com/1212550 SUSE Bug 1212550 https://bugzilla.suse.com/1212588 SUSE Bug 1212588 https://bugzilla.suse.com/1212700 SUSE Bug 1212700 https://bugzilla.suse.com/1212770 SUSE Bug 1212770 https://bugzilla.suse.com/1212771 SUSE Bug 1212771 https://bugzilla.suse.com/1213432 SUSE Bug 1213432 https://www.suse.com/security/cve/CVE-2023-2183/ SUSE CVE CVE-2023-2183 page https://www.suse.com/security/cve/CVE-2023-2801/ SUSE CVE CVE-2023-2801 page https://www.suse.com/security/cve/CVE-2023-3128/ SUSE CVE CVE-2023-3128 page Container suse/manager/4.3/proxy-httpd:latest Image SLES15-SP4-Manager-Proxy-4-3-BYOS Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE Image SLES15-SP4-Manager-Server-4-3-BYOS Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE release-notes-susemanager-proxy-4.3.7-150400.3.58.1 release-notes-susemanager-4.3.7-150400.3.72.1 release-notes-susemanager-proxy-4.3.7-150400.3.58.1 as a component of Container suse/manager/4.3/proxy-httpd:latest release-notes-susemanager-proxy-4.3.7-150400.3.58.1 as a component of Image SLES15-SP4-Manager-Proxy-4-3-BYOS release-notes-susemanager-proxy-4.3.7-150400.3.58.1 as a component of Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure release-notes-susemanager-proxy-4.3.7-150400.3.58.1 as a component of Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2 release-notes-susemanager-proxy-4.3.7-150400.3.58.1 as a component of Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE release-notes-susemanager-4.3.7-150400.3.72.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS release-notes-susemanager-4.3.7-150400.3.72.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure release-notes-susemanager-4.3.7-150400.3.72.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 release-notes-susemanager-4.3.7-150400.3.72.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function. This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server. Users may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix. CVE-2023-2183 Container suse/manager/4.3/proxy-httpd:latest:release-notes-susemanager-proxy-4.3.7-150400.3.58.1 Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure:release-notes-susemanager-proxy-4.3.7-150400.3.58.1 Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2:release-notes-susemanager-proxy-4.3.7-150400.3.58.1 Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE:release-notes-susemanager-proxy-4.3.7-150400.3.58.1 Image SLES15-SP4-Manager-Proxy-4-3-BYOS:release-notes-susemanager-proxy-4.3.7-150400.3.58.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure:release-notes-susemanager-4.3.7-150400.3.72.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2:release-notes-susemanager-4.3.7-150400.3.72.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE:release-notes-susemanager-4.3.7-150400.3.72.1 Image SLES15-SP4-Manager-Server-4-3-BYOS:release-notes-susemanager-4.3.7-150400.3.72.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233136-1/ https://www.suse.com/security/cve/CVE-2023-2183.html CVE-2023-2183 https://bugzilla.suse.com/1212100 SUSE Bug 1212100 Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance. The only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by calling the query API directly. This might enable malicious users to crash Grafana instances through that endpoint. Users may upgrade to version 9.4.12 and 9.5.3 to receive a fix. CVE-2023-2801 Container suse/manager/4.3/proxy-httpd:latest:release-notes-susemanager-proxy-4.3.7-150400.3.58.1 Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure:release-notes-susemanager-proxy-4.3.7-150400.3.58.1 Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2:release-notes-susemanager-proxy-4.3.7-150400.3.58.1 Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE:release-notes-susemanager-proxy-4.3.7-150400.3.58.1 Image SLES15-SP4-Manager-Proxy-4-3-BYOS:release-notes-susemanager-proxy-4.3.7-150400.3.58.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure:release-notes-susemanager-4.3.7-150400.3.72.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2:release-notes-susemanager-4.3.7-150400.3.72.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE:release-notes-susemanager-4.3.7-150400.3.72.1 Image SLES15-SP4-Manager-Server-4-3-BYOS:release-notes-susemanager-4.3.7-150400.3.72.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233136-1/ https://www.suse.com/security/cve/CVE-2023-2801.html CVE-2023-2801 https://bugzilla.suse.com/1212099 SUSE Bug 1212099 Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app. CVE-2023-3128 Container suse/manager/4.3/proxy-httpd:latest:release-notes-susemanager-proxy-4.3.7-150400.3.58.1 Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure:release-notes-susemanager-proxy-4.3.7-150400.3.58.1 Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2:release-notes-susemanager-proxy-4.3.7-150400.3.58.1 Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE:release-notes-susemanager-proxy-4.3.7-150400.3.58.1 Image SLES15-SP4-Manager-Proxy-4-3-BYOS:release-notes-susemanager-proxy-4.3.7-150400.3.58.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure:release-notes-susemanager-4.3.7-150400.3.72.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2:release-notes-susemanager-4.3.7-150400.3.72.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE:release-notes-susemanager-4.3.7-150400.3.72.1 Image SLES15-SP4-Manager-Server-4-3-BYOS:release-notes-susemanager-4.3.7-150400.3.72.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233136-1/ https://www.suse.com/security/cve/CVE-2023-3128.html CVE-2023-3128 https://bugzilla.suse.com/1212641 SUSE Bug 1212641