SUSE Security Update: Security update for cobbler
______________________________________________________________________________

Announcement ID:    SUSE-SU-2018:1736-1
Rating:             moderate
References:         #1074594 #1075014 #1081714 #1090205 
Cross-References:   CVE-2017-1000469
Affected Products:
                    SUSE OpenStack Cloud 8
                    SUSE Manager Tools 12
                    SUSE Manager Server 3.0
                    HPE Helion OpenStack 8
______________________________________________________________________________

   An update that solves one vulnerability and has three fixes
   is now available.

Description:

   This update for cobbler fixes the following issues:

   The following security issue has been fixed:

   - CVE-2017-1000469: Escape shell parameters provided by the user for the
     reposync action. (bsc#1074594)

   Additionally, the following non-security issues have been fixed:

   - Fix signature for SLES15. (bsc#1075014)
   - Detect if there is already another instance of "cobbler sync" running
     and exit with failure if so. (bsc#1081714)
   - Add SLES 15 distro profile. (bsc#1090205)
   - Require tftp(server) instead of atftp.


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE OpenStack Cloud 8:

      zypper in -t patch SUSE-OpenStack-Cloud-8-2018-1177=1

   - SUSE Manager Tools 12:

      zypper in -t patch SUSE-SLE-Manager-Tools-12-2018-1177=1

   - SUSE Manager Server 3.0:

      zypper in -t patch SUSE-SUSE-Manager-Server-3.0-2018-1177=1

   - HPE Helion OpenStack 8:

      zypper in -t patch HPE-Helion-OpenStack-8-2018-1177=1



Package List:

   - SUSE OpenStack Cloud 8 (noarch):

      cobbler-2.6.6-49.9.1

   - SUSE Manager Tools 12 (noarch):

      koan-2.6.6-49.9.1

   - SUSE Manager Server 3.0 (noarch):

      cobbler-2.6.6-49.9.1

   - HPE Helion OpenStack 8 (noarch):

      cobbler-2.6.6-49.9.1


References:

   https://www.suse.com/security/cve/CVE-2017-1000469.html
   https://bugzilla.suse.com/1074594
   https://bugzilla.suse.com/1075014
   https://bugzilla.suse.com/1081714
   https://bugzilla.suse.com/1090205