Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

SUSE: 2019:1790-1 Moderate: Session Fixation In SUSE Manager Server 3.2

suse
Calendar Grey July 9, 2019
Dist Suse Esm H88
Red Hat has issued a critical patch for Red Hat Satellite Server 6.7, remedying a session hijacking flaw.
An update that solves one vulnerability and has one errata is now available

Summary

This update fixes the following issues: release-notes-susemanager: - Fix invalid characters in ncurses mode (bsc#1102770) spacewalk-backend: - Fix for CVE-2019-10136. An attacker with a valid, but expired, authenticated set of headers could move some digits around, artificially extending the session validity without modifying the checksum. (bsc#1136480) spacewalk-web: - Change WebUI string version to 3.2.9 Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Manager Server 3.2: zypper in -t patch SUSE-SUSE-Manager-Server-3.2-2019-1790=1 - SUSE Manager Proxy 3.2: zypper in -t patch SUSE-SUSE-Manager-Proxy-3.2-2019-1790=1 Package List:

Topics%20covered

Topics Covered

security advisory moderate session fixation SUSE Manager SUSE Manager Proxy

References

#1102770 #1136480

Cross- CVE-2019-10136

Affected Products:

SUSE Manager Server 3.2

SUSE Manager Proxy 3.2

https://www.suse.com/security/cve/CVE-2019-10136.html

https://bugzilla.suse.com/1102770

https://bugzilla.suse.com/1136480

Announcement ID: SUSE-SU-2019:1790-1
Rating: moderate

Topics%20covered

Topics Covered

security advisory moderate session fixation SUSE Manager SUSE Manager Proxy

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here