Security update for SUSE Manager Server 4.3 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:3885-1 Final 1 1 2023-09-28T11:52:11Z current 2023-09-28T11:52:11Z 2023-09-28T11:52:11Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for SUSE Manager Server 4.3 This update fixes the following issues: release-notes-susemanager: - Update to SUSE Manager 4.3.8 * Important Salt minion update * SUSE Manager Pay-as-you-go (PAYG) * Automated RHUI credential update * Monitoring: Prometheus upgraded to 2.45.0 * Monitoring: Apache exporter updated to version 1.0.0 * Expose lastBuildDate property (last build/promote date of an environment) through contentlifecycle API (jsc#SUMA-280) * Add saltboot redeploy and repartition based on pillars (jsc#SUMA-158) * Security CVE issues fixed: CVE-2023-29409, CVE-2023-20897, CVE-2023-20898 * Bugs mentioned bsc#1207330, bsc#1208692, bsc#1210935, bsc#1211525, bsc#1211874 bsc#1211884, bsc#1212246, bsc#1212730, bsc#1212814, bsc#1212827 bsc#1212856, bsc#1212943, bsc#1213009, bsc#1213077, bsc#1213288 bsc#1213445, bsc#1213675, bsc#1213716, bsc#1213880, bsc#1214002 bsc#1214121, bsc#1214124, bsc#1214187, bsc#1214266, bsc#1214280 bsc#1214889, bsc#1214982, bsc#1215352, bsc#1215362, bsc#1215497 bsc#1193948, bsc#1214797, bsc#1213441, bsc#1214796, bsc#1213469 bsc#1215413, bsc#1215756 The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container suse/manager/4.3/proxy-httpd:latest-2023-3885,SUSE-2023-3885,SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2023-3885,SUSE-SLE-Product-SUSE-Manager-Server-4.3-2023-3885 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20233885-1/ Link for SUSE-SU-2023:3885-1 https://lists.suse.com/pipermail/sle-security-updates/2023-September/016389.html E-Mail link for SUSE-SU-2023:3885-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1193948 SUSE Bug 1193948 https://bugzilla.suse.com/1207330 SUSE Bug 1207330 https://bugzilla.suse.com/1208692 SUSE Bug 1208692 https://bugzilla.suse.com/1210935 SUSE Bug 1210935 https://bugzilla.suse.com/1211525 SUSE Bug 1211525 https://bugzilla.suse.com/1211874 SUSE Bug 1211874 https://bugzilla.suse.com/1211884 SUSE Bug 1211884 https://bugzilla.suse.com/1212246 SUSE Bug 1212246 https://bugzilla.suse.com/1212730 SUSE Bug 1212730 https://bugzilla.suse.com/1212814 SUSE Bug 1212814 https://bugzilla.suse.com/1212827 SUSE Bug 1212827 https://bugzilla.suse.com/1212856 SUSE Bug 1212856 https://bugzilla.suse.com/1212943 SUSE Bug 1212943 https://bugzilla.suse.com/1213009 SUSE Bug 1213009 https://bugzilla.suse.com/1213077 SUSE Bug 1213077 https://bugzilla.suse.com/1213288 SUSE Bug 1213288 https://bugzilla.suse.com/1213441 SUSE Bug 1213441 https://bugzilla.suse.com/1213445 SUSE Bug 1213445 https://bugzilla.suse.com/1213469 SUSE Bug 1213469 https://bugzilla.suse.com/1213675 SUSE Bug 1213675 https://bugzilla.suse.com/1213716 SUSE Bug 1213716 https://bugzilla.suse.com/1213880 SUSE Bug 1213880 https://bugzilla.suse.com/1214002 SUSE Bug 1214002 https://bugzilla.suse.com/1214121 SUSE Bug 1214121 https://bugzilla.suse.com/1214124 SUSE Bug 1214124 https://bugzilla.suse.com/1214187 SUSE Bug 1214187 https://bugzilla.suse.com/1214266 SUSE Bug 1214266 https://bugzilla.suse.com/1214280 SUSE Bug 1214280 https://bugzilla.suse.com/1214796 SUSE Bug 1214796 https://bugzilla.suse.com/1214797 SUSE Bug 1214797 https://bugzilla.suse.com/1214889 SUSE Bug 1214889 https://bugzilla.suse.com/1214982 SUSE Bug 1214982 https://bugzilla.suse.com/1215352 SUSE Bug 1215352 https://bugzilla.suse.com/1215362 SUSE Bug 1215362 https://bugzilla.suse.com/1215413 SUSE Bug 1215413 https://bugzilla.suse.com/1215497 SUSE Bug 1215497 https://bugzilla.suse.com/1215756 SUSE Bug 1215756 https://www.suse.com/security/cve/CVE-2023-20897/ SUSE CVE CVE-2023-20897 page https://www.suse.com/security/cve/CVE-2023-20898/ SUSE CVE CVE-2023-20898 page https://www.suse.com/security/cve/CVE-2023-29409/ SUSE CVE CVE-2023-29409 page Container suse/manager/4.3/proxy-httpd:latest SUSE Manager Proxy 4.3 SUSE Manager Server 4.3 release-notes-susemanager-proxy-4.3.8-150400.3.61.2 release-notes-susemanager-4.3.8-150400.3.77.1 release-notes-susemanager-proxy-4.3.8-150400.3.61.2 as a component of Container suse/manager/4.3/proxy-httpd:latest release-notes-susemanager-proxy-4.3.8-150400.3.61.2 as a component of SUSE Manager Proxy 4.3 release-notes-susemanager-4.3.8-150400.3.77.1 as a component of SUSE Manager Server 4.3 Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted. CVE-2023-20897 Container suse/manager/4.3/proxy-httpd:latest:release-notes-susemanager-proxy-4.3.8-150400.3.61.2 SUSE Manager Proxy 4.3:release-notes-susemanager-proxy-4.3.8-150400.3.61.2 SUSE Manager Server 4.3:release-notes-susemanager-4.3.8-150400.3.77.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233885-1/ https://www.suse.com/security/cve/CVE-2023-20897.html CVE-2023-20897 https://bugzilla.suse.com/1214796 SUSE Bug 1214796 Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environments can get garbage data or the wrong data, which can lead to wrongful data disclosure, wrongful executions, data corruption and/or crash. CVE-2023-20898 Container suse/manager/4.3/proxy-httpd:latest:release-notes-susemanager-proxy-4.3.8-150400.3.61.2 SUSE Manager Proxy 4.3:release-notes-susemanager-proxy-4.3.8-150400.3.61.2 SUSE Manager Server 4.3:release-notes-susemanager-4.3.8-150400.3.77.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233885-1/ https://www.suse.com/security/cve/CVE-2023-20898.html CVE-2023-20898 https://bugzilla.suse.com/1214797 SUSE Bug 1214797 Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in circulation with keys larger than this, and all three appear to be test certificates that are not actively deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so causing breakage here in the interests of increasing the default safety of users of crypto/tls seems reasonable. CVE-2023-29409 Container suse/manager/4.3/proxy-httpd:latest:release-notes-susemanager-proxy-4.3.8-150400.3.61.2 SUSE Manager Proxy 4.3:release-notes-susemanager-proxy-4.3.8-150400.3.61.2 SUSE Manager Server 4.3:release-notes-susemanager-4.3.8-150400.3.77.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233885-1/ https://www.suse.com/security/cve/CVE-2023-29409.html CVE-2023-29409 https://bugzilla.suse.com/1213880 SUSE Bug 1213880