openSUSE Security Update: Security update for cobbler
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2018:1770-1
Rating:             moderate
References:         #1074594 #1075014 #1081714 #1090205 
Cross-References:   CVE-2017-1000469
Affected Products:
                    openSUSE Leap 42.3
______________________________________________________________________________

   An update that solves one vulnerability and has three fixes
   is now available.

Description:

   This update for cobbler fixes the following issues:

   The following security issue has been fixed:

   - CVE-2017-1000469: Escape shell parameters provided by the user for the
     reposync action. (bsc#1074594)

   Additionally, the following non-security issues have been fixed:

   - Fix signature for SLES15. (bsc#1075014)
   - Detect if there is already another instance of "cobbler sync" running
     and exit with failure if so. (bsc#1081714)
   - Add SLES 15 distro profile. (bsc#1090205)
   - Require tftp(server) instead of atftp.

   This update was imported from the SUSE:SLE-12:Update update project.


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Leap 42.3:

      zypper in -t patch openSUSE-2018-655=1



Package List:

   - openSUSE Leap 42.3 (noarch):

      cobbler-2.6.6-14.1
      cobbler-tests-2.6.6-14.1
      cobbler-web-2.6.6-14.1
      koan-2.6.6-14.1


References:

   https://www.suse.com/security/cve/CVE-2017-1000469.html
   https://bugzilla.suse.com/1074594
   https://bugzilla.suse.com/1075014
   https://bugzilla.suse.com/1081714
   https://bugzilla.suse.com/1090205

--