Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

SUSE: 2019:1789-1 Moderate: Session Issues In SUSE Manager Proxy

suse
Calendar Grey July 9, 2019
Dist Suse Esm H88
The latest SUSE Manager 4.0 update resolves multiple issues including session-related fixes and concerns with proxy security. Crucial for maintaining system integrity.
An update that solves two vulnerabilities and has 7 fixes is now available

Summary

This update fixes the following issues: spacewalk-backend: - Do not duplicate "http://" protocol when using proxies with "deb" repositories (bsc#1138313) - Fix reposync when dealing with RedHat CDN (bsc#1138358) - Fix for CVE-2019-10136. An attacker with a valid, but expired, authenticated set of headers could move some digits around, artificially extending the session validity without modifying the checksum. (bsc#1136480) spacewalk-proxy: - Fix for CVE-2019-10137. A path traversal flaw was found in the way the proxy processes cached client tokens. A remote, unauthenticated, attacker could use this flaw to test the existence of arbitrary files, or if they have access to the proxy's filesystem, execute arbitrary code in the context of the proxy. (bsc#1136476) spacewalk-web: - Change WebUI version 4.0.1

Topics%20covered

Topics Covered

security advisory moderate remote code execution session fixation path traversal SUSE Manager proxy issue

References

#1136476 #1136480 #1136561 #1136857 #1137955

#1138313 #1138358 #1138364 #1139693

Cross- CVE-2019-10136 CVE-2019-10137

Affected Products:

SUSE Linux Enterprise Module for SUSE Manager Server 4.0

SUSE Linux Enterprise Module for SUSE Manager Proxy 4.0

https://www.suse.com/security/cve/CVE-2019-10136.html

https://www.suse.com/security/cve/CVE-2019-10137.html

https://bugzilla.suse.com/1136476

https://bugzilla.suse.com/1136480

https://bugzilla.suse.com/1136561

https://bugzilla.suse.com/1136857

https://bugzilla.suse.com/1137955

https://bugzilla.suse.com/1138313

https://bugzilla.suse.com/1138358

https://bugzilla.suse.com/1138364

https://bugzilla.suse.com/1139693

Announcement ID: SUSE-SU-2019:1789-1
Rating: moderate

Topics%20covered

Topics Covered

security advisory moderate remote code execution session fixation path traversal SUSE Manager proxy issue

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here