SUSE: 2019:1789-1 moderate: SUSE Manager 4.0 : Server and Proxy

    Date09 Jul 2019
    CategorySuSE
    380
    Posted ByLinuxSecurity Advisories
    An update that solves two vulnerabilities and has 7 fixes is now available.
    
       SUSE Security Update: Security update for SUSE Manager 4.0 : Server and Proxy
    ______________________________________________________________________________
    
    Announcement ID:    SUSE-SU-2019:1789-1
    Rating:             moderate
    References:         #1136476 #1136480 #1136561 #1136857 #1137955 
                        #1138313 #1138358 #1138364 #1139693 
    Cross-References:   CVE-2019-10136 CVE-2019-10137
    Affected Products:
                        SUSE Linux Enterprise Module for SUSE Manager Server 4.0
                        SUSE Linux Enterprise Module for SUSE Manager Proxy 4.0
    ______________________________________________________________________________
    
       An update that solves two vulnerabilities and has 7 fixes
       is now available.
    
    Description:
    
    
       This update fixes the following issues:
    
       spacewalk-backend:
    
       - Do not duplicate "http://" protocol when using proxies with "deb"
         repositories (bsc#1138313)
       - Fix reposync when dealing with RedHat CDN (bsc#1138358)
       - Fix for CVE-2019-10136. An attacker with a valid, but expired,
         authenticated set of headers could move some digits around, artificially
         extending the session validity without modifying the checksum.
         (bsc#1136480)
    
       spacewalk-proxy:
    
       - Fix for CVE-2019-10137. A path traversal flaw was found in the way the
         proxy processes cached client tokens. A remote, unauthenticated,
         attacker could use this flaw to test the existence of arbitrary files,
         or if they have access to the proxy's filesystem, execute arbitrary code
         in the context of the proxy. (bsc#1136476)
    
       spacewalk-web:
    
       - Change WebUI version 4.0.1
    
       susemanager-doc-indexes:
    
       - Updated wording for prometheus section
       - Jeos VM update
       - Port 8050 for graphical console display
       - Content life-cycle docs are not enough for customer to understand
         (bsc#1137955)
       - Salt boot formula fails for SLES11 SP3 terminal (bsc#1136857)
       - Certificate verify failed when using vmware esxi virtual host gatherer
         (bsc#1136561)
    
       susemanager-docs_en:
    
       - Updated wording for prometheus section
       - Jeos VM update
       - Port 8050 for graphical console display
       - Content life-cycle docs are not enough for customer to understand
         (bsc#1137955)
       - Salt boot formula fails for SLES11 SP3 terminal (bsc#1136857)
       - Certificate verify failed when using vmware esxi virtual host gatherer
         (bsc#1136561)
    
       susemanager-sync-data:
    
       - Add channel family definitions for SLES12 SP3 LTSS (bsc#1139693)
       - Add OPENSUSE to allowed channel_families to make
         openSUSE Leap product visible in the product list (bsc#1138364)
    
    
    Patch Instructions:
    
       To install this SUSE Security Update use the SUSE recommended installation methods
       like YaST online_update or "zypper patch".
    
       Alternatively you can run the command listed for your product:
    
       - SUSE Linux Enterprise Module for SUSE Manager Server 4.0:
    
          zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Server-4.0-2019-1789=1
    
       - SUSE Linux Enterprise Module for SUSE Manager Proxy 4.0:
    
          zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Proxy-4.0-2019-1789=1
    
    
    
    Package List:
    
       - SUSE Linux Enterprise Module for SUSE Manager Server 4.0 (noarch):
    
          python3-spacewalk-backend-libs-4.0.22-3.3.1
          spacewalk-backend-4.0.22-3.3.1
          spacewalk-backend-app-4.0.22-3.3.1
          spacewalk-backend-applet-4.0.22-3.3.1
          spacewalk-backend-config-files-4.0.22-3.3.1
          spacewalk-backend-config-files-common-4.0.22-3.3.1
          spacewalk-backend-config-files-tool-4.0.22-3.3.1
          spacewalk-backend-iss-4.0.22-3.3.1
          spacewalk-backend-iss-export-4.0.22-3.3.1
          spacewalk-backend-package-push-server-4.0.22-3.3.1
          spacewalk-backend-server-4.0.22-3.3.1
          spacewalk-backend-sql-4.0.22-3.3.1
          spacewalk-backend-sql-postgresql-4.0.22-3.3.1
          spacewalk-backend-tools-4.0.22-3.3.1
          spacewalk-backend-xml-export-libs-4.0.22-3.3.1
          spacewalk-backend-xmlrpc-4.0.22-3.3.1
          spacewalk-base-4.0.14-3.3.1
          spacewalk-base-minimal-4.0.14-3.3.1
          spacewalk-base-minimal-config-4.0.14-3.3.1
          spacewalk-html-4.0.14-3.3.1
          susemanager-doc-indexes-4.0-10.3.1
          susemanager-docs_en-4.0-10.3.1
          susemanager-docs_en-pdf-4.0-10.3.1
          susemanager-sync-data-4.0.12-3.3.1
          susemanager-web-libs-4.0.14-3.3.1
    
       - SUSE Linux Enterprise Module for SUSE Manager Proxy 4.0 (noarch):
    
          python3-spacewalk-backend-libs-4.0.22-3.3.1
          spacewalk-backend-4.0.22-3.3.1
          spacewalk-base-minimal-4.0.14-3.3.1
          spacewalk-base-minimal-config-4.0.14-3.3.1
          spacewalk-proxy-broker-4.0.12-3.3.1
          spacewalk-proxy-common-4.0.12-3.3.1
          spacewalk-proxy-management-4.0.12-3.3.1
          spacewalk-proxy-package-manager-4.0.12-3.3.1
          spacewalk-proxy-redirect-4.0.12-3.3.1
          spacewalk-proxy-salt-4.0.12-3.3.1
    
    
    References:
    
       https://www.suse.com/security/cve/CVE-2019-10136.html
       https://www.suse.com/security/cve/CVE-2019-10137.html
       https://bugzilla.suse.com/1136476
       https://bugzilla.suse.com/1136480
       https://bugzilla.suse.com/1136561
       https://bugzilla.suse.com/1136857
       https://bugzilla.suse.com/1137955
       https://bugzilla.suse.com/1138313
       https://bugzilla.suse.com/1138358
       https://bugzilla.suse.com/1138364
       https://bugzilla.suse.com/1139693
    
    _______________________________________________
    sle-security-updates mailing list
    This email address is being protected from spambots. You need JavaScript enabled to view it.
    http://lists.suse.com/mailman/listinfo/sle-security-updates
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"23","type":"x","order":"1","pct":53.49,"resources":[]},{"id":"88","title":"Should be more technical","votes":"5","type":"x","order":"2","pct":11.63,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"15","type":"x","order":"3","pct":34.88,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.