SUSE: 2022:1545-1 important: Security Beta SUSE Manager Client Tool...

   SUSE Security Update: Security Beta update for SUSE Manager Client Tools
______________________________________________________________________________

Announcement ID:    SUSE-SU-2022:1545-1
Rating:             important
References:         #1181400 #1196338 #1196704 #1197042 #1197417 
                    #1197533 #1197579 #1197637 #1197689 SLE-24077 
                    SLE-24145 
Cross-References:   CVE-2022-21698 CVE-2022-22934 CVE-2022-22935
                    CVE-2022-22936 CVE-2022-22941
CVSS scores:
                    CVE-2022-21698 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
                    CVE-2022-21698 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
                    CVE-2022-22934 (NVD) : 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
                    CVE-2022-22934 (SUSE): 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
                    CVE-2022-22935 (NVD) : 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2022-22935 (SUSE): 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
                    CVE-2022-22936 (NVD) : 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
                    CVE-2022-22936 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
                    CVE-2022-22941 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
                    CVE-2022-22941 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products:
                    SUSE Manager Tools 15-BETA
______________________________________________________________________________

   An update that solves 5 vulnerabilities, contains two
   features and has four fixes is now available.

Description:

   This update fixes the following issues:

   golang-github-prometheus-alertmanager:

   - CVE-2022-21698: Denial of service using InstrumentHandlerCounter
     * Update vendor tarball with prometheus/client_golang 1.11.1
       (bsc#1196338, jsc#SLE-24077)
   - Update to version 0.23.0:
     * amtool: Detect version drift and warn users (#2672)
     * Add ability to skip TLS verification for amtool (#2663)
     * Fix empty isEqual in amtool. (#2668)
     * Fix main tests (#2670)
     * cli: add new template render command (#2538)
     * OpsGenie: refer to alert instead of incident (#2609)
     * Docs: target_match and source_match are DEPRECATED (#2665)
     * Fix test not waiting for cluster member to be ready
   - Added hardening to systemd service(s) (bsc#1181400).

   golang-github-prometheus-prometheus:

   - Build firewalld-prometheus-config only for SUSE Linux Enterprise 15,
     15.1 and 15.2, and require firewalld for it
   - Firewalld-prometheus-config needs to be a Recommends, not a Requires, as
     prometheus does not require it to run
   - Create firewalld-prometheus-config subpackage (bsc#1197042)
   - CVE-2022-21698: Denial of service using InstrumentHandlerCounter.
     * Update vendor tarball with prometheus/client_golang 1.12.1
       (bsc#1196338)

   mgr-cfg:

   - Version 4.3.6-1
     * Fix the condition for preventing building python 2 subpackage for
       SLE15 (bsc#1197579)

   mgr-osad:

   - Version 4.3.6-1
     * Fix the condition for preventing building python 2 subpackage for SLE15

   mgr-push:

   - Version 4.3.4-1
     * Fix the condition for preventing building python 2 subpackage for SLE15

   mgr-virtualization:

   - Version 4.3.5-1
     * Fix the condition for preventing building python 2 subpackage for SLE15

   rhnlib:

   - Version 4.3.4-1
     * Fix the condition for preventing building python 2 subpackage for SLE15

   salt:

   - Prevent data pollution between actions proceesed at the same time
     (bsc#1197637)
   - Fix regression preventing bootstrapping new clients caused by redundant
     dependency on psutil (bsc#1197533)
   - Fixes for Python 3.10
   - Fix salt-ssh opts poisoning (bsc#1197637)
   - Fix multiple security issues for salt (bsc#1197417):
     * CVE-2022-22935: Sign authentication replies to prevent MiTM.
     * CVE-2022-22934: Sign pillar data to prevent MiTM attacks.
     * CVE-2022-22936: Prevent job and fileserver replays.
     * CVE-2022-22941: Fixed targeting bug, especially visible when using
       syndic and user auth.

   spacecmd:

   - Version 4.3.10-1
     * parse boolean parameters correctly (bsc#1197689)
     * Add parameter to set containerized proxy SSH port

   spacewalk-client-tools:

   - Version 4.3.9-1
     * Fix the condition for preventing building python 2 subpackage for SLE15

   spacewalk-koan:

   - Version 4.3.5-1
     * Fix the condition for preventing building python 2 subpackage for SLE15

   spacewalk-oscap:

   - Version 4.3.5-1
     * Fix the condition for preventing building python 2 subpackage for SLE15

   suseRegisterInfo:

   - Version 4.3.3-1
     * Fix the condition for preventing building python 2 subpackage for SLE15

   uyuni-common-libs:

   - Version 4.3.4-1
     * implement more decompression algorithms for reposync (bsc#1196704)

   uyuni-proxy-systemd-services:

   - Version 4.3.2-1
     * Harmonize systemd services names and container names
     * Adapted to work on Enterprise Linux.
     * Add package to SLE and Client tools (jsc#SLE-24145)


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Manager Tools 15-BETA:

      zypper in -t patch SUSE-SLE-Manager-Tools-15-BETA-2022-1545=1



Package List:

   - SUSE Manager Tools 15-BETA (aarch64 ppc64le s390x x86_64):

      firewalld-prometheus-config-0.1-159000.6.30.4
      golang-github-prometheus-alertmanager-0.23.0-159000.6.9.3
      golang-github-prometheus-prometheus-2.32.1-159000.6.30.4
      python3-salt-3004-159000.8.56.1
      python3-uyuni-common-libs-4.3.4-159000.3.30.2
      salt-3004-159000.8.56.1
      salt-api-3004-159000.8.56.1
      salt-cloud-3004-159000.8.56.1
      salt-doc-3004-159000.8.56.1
      salt-master-3004-159000.8.56.1
      salt-minion-3004-159000.8.56.1
      salt-proxy-3004-159000.8.56.1
      salt-ssh-3004-159000.8.56.1
      salt-standalone-formulas-configuration-3004-159000.8.56.1
      salt-syndic-3004-159000.8.56.1
      salt-transactional-update-3004-159000.8.56.1

   - SUSE Manager Tools 15-BETA (noarch):

      mgr-cfg-4.3.6-159000.4.26.1
      mgr-cfg-actions-4.3.6-159000.4.26.1
      mgr-cfg-client-4.3.6-159000.4.26.1
      mgr-cfg-management-4.3.6-159000.4.26.1
      mgr-osad-4.3.6-159000.4.27.2
      mgr-push-4.3.4-159000.4.18.2
      mgr-virtualization-host-4.3.5-159000.4.18.2
      python3-mgr-cfg-4.3.6-159000.4.26.1
      python3-mgr-cfg-actions-4.3.6-159000.4.26.1
      python3-mgr-cfg-client-4.3.6-159000.4.26.1
      python3-mgr-cfg-management-4.3.6-159000.4.26.1
      python3-mgr-osa-common-4.3.6-159000.4.27.2
      python3-mgr-osad-4.3.6-159000.4.27.2
      python3-mgr-push-4.3.4-159000.4.18.2
      python3-mgr-virtualization-common-4.3.5-159000.4.18.2
      python3-mgr-virtualization-host-4.3.5-159000.4.18.2
      python3-rhnlib-4.3.4-159000.6.27.2
      python3-spacewalk-check-4.3.9-159000.6.45.2
      python3-spacewalk-client-setup-4.3.9-159000.6.45.2
      python3-spacewalk-client-tools-4.3.9-159000.6.45.2
      python3-spacewalk-koan-4.3.5-159000.6.18.1
      python3-spacewalk-oscap-4.3.5-159000.6.18.2
      python3-suseRegisterInfo-4.3.3-159000.6.21.2
      salt-bash-completion-3004-159000.8.56.1
      salt-fish-completion-3004-159000.8.56.1
      salt-zsh-completion-3004-159000.8.56.1
      spacecmd-4.3.10-159000.6.39.2
      spacewalk-check-4.3.9-159000.6.45.2
      spacewalk-client-setup-4.3.9-159000.6.45.2
      spacewalk-client-tools-4.3.9-159000.6.45.2
      spacewalk-koan-4.3.5-159000.6.18.1
      spacewalk-oscap-4.3.5-159000.6.18.2
      suseRegisterInfo-4.3.3-159000.6.21.2
      uyuni-proxy-systemd-services-4.3.2-159000.3.6.1


References:

   https://www.suse.com/security/cve/CVE-2022-21698.html
   https://www.suse.com/security/cve/CVE-2022-22934.html
   https://www.suse.com/security/cve/CVE-2022-22935.html
   https://www.suse.com/security/cve/CVE-2022-22936.html
   https://www.suse.com/security/cve/CVE-2022-22941.html
   https://bugzilla.suse.com/1181400
   https://bugzilla.suse.com/1196338
   https://bugzilla.suse.com/1196704
   https://bugzilla.suse.com/1197042
   https://bugzilla.suse.com/1197417
   https://bugzilla.suse.com/1197533
   https://bugzilla.suse.com/1197579
   https://bugzilla.suse.com/1197637
   https://bugzilla.suse.com/1197689

SUSE: 2022:1545-1 important: Security Beta SUSE Manager Client Tools

May 5, 2022
An update that solves 5 vulnerabilities, contains two features and has four fixes is now available

Summary

This update fixes the following issues: golang-github-prometheus-alertmanager: - CVE-2022-21698: Denial of service using InstrumentHandlerCounter * Update vendor tarball with prometheus/client_golang 1.11.1 (bsc#1196338, jsc#SLE-24077) - Update to version 0.23.0: * amtool: Detect version drift and warn users (#2672) * Add ability to skip TLS verification for amtool (#2663) * Fix empty isEqual in amtool. (#2668) * Fix main tests (#2670) * cli: add new template render command (#2538) * OpsGenie: refer to alert instead of incident (#2609) * Docs: target_match and source_match are DEPRECATED (#2665) * Fix test not waiting for cluster member to be ready - Added hardening to systemd service(s) (bsc#1181400). golang-github-prometheus-prometheus: - Build firewalld-prometheus-config only for SUSE Linux Enterprise 15, 15.1 and 15.2, and require firewalld for it - Firewalld-prometheus-config needs to be a Recommends, not a Requires, as prometheus does not require it to run - Create firewalld-prometheus-config subpackage (bsc#1197042) - CVE-2022-21698: Denial of service using InstrumentHandlerCounter. * Update vendor tarball with prometheus/client_golang 1.12.1 (bsc#1196338) mgr-cfg: - Version 4.3.6-1 * Fix the condition for preventing building python 2 subpackage for SLE15 (bsc#1197579) mgr-osad: - Version 4.3.6-1 * Fix the condition for preventing building python 2 subpackage for SLE15 mgr-push: - Version 4.3.4-1 * Fix the condition for preventing building python 2 subpackage for SLE15 mgr-virtualization: - Version 4.3.5-1 * Fix the condition for preventing building python 2 subpackage for SLE15 rhnlib: - Version 4.3.4-1 * Fix the condition for preventing building python 2 subpackage for SLE15 salt: - Prevent data pollution between actions proceesed at the same time (bsc#1197637) - Fix regression preventing bootstrapping new clients caused by redundant dependency on psutil (bsc#1197533) - Fixes for Python 3.10 - Fix salt-ssh opts poisoning (bsc#1197637) - Fix multiple security issues for salt (bsc#1197417): * CVE-2022-22935: Sign authentication replies to prevent MiTM. * CVE-2022-22934: Sign pillar data to prevent MiTM attacks. * CVE-2022-22936: Prevent job and fileserver replays. * CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth. spacecmd: - Version 4.3.10-1 * parse boolean parameters correctly (bsc#1197689) * Add parameter to set containerized proxy SSH port spacewalk-client-tools: - Version 4.3.9-1 * Fix the condition for preventing building python 2 subpackage for SLE15 spacewalk-koan: - Version 4.3.5-1 * Fix the condition for preventing building python 2 subpackage for SLE15 spacewalk-oscap: - Version 4.3.5-1 * Fix the condition for preventing building python 2 subpackage for SLE15 suseRegisterInfo: - Version 4.3.3-1 * Fix the condition for preventing building python 2 subpackage for SLE15 uyuni-common-libs: - Version 4.3.4-1 * implement more decompression algorithms for reposync (bsc#1196704) uyuni-proxy-systemd-services: - Version 4.3.2-1 * Harmonize systemd services names and container names * Adapted to work on Enterprise Linux. * Add package to SLE and Client tools (jsc#SLE-24145) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Manager Tools 15-BETA: zypper in -t patch SUSE-SLE-Manager-Tools-15-BETA-2022-1545=1 Package List: - SUSE Manager Tools 15-BETA (aarch64 ppc64le s390x x86_64): firewalld-prometheus-config-0.1-159000.6.30.4 golang-github-prometheus-alertmanager-0.23.0-159000.6.9.3 golang-github-prometheus-prometheus-2.32.1-159000.6.30.4 python3-salt-3004-159000.8.56.1 python3-uyuni-common-libs-4.3.4-159000.3.30.2 salt-3004-159000.8.56.1 salt-api-3004-159000.8.56.1 salt-cloud-3004-159000.8.56.1 salt-doc-3004-159000.8.56.1 salt-master-3004-159000.8.56.1 salt-minion-3004-159000.8.56.1 salt-proxy-3004-159000.8.56.1 salt-ssh-3004-159000.8.56.1 salt-standalone-formulas-configuration-3004-159000.8.56.1 salt-syndic-3004-159000.8.56.1 salt-transactional-update-3004-159000.8.56.1 - SUSE Manager Tools 15-BETA (noarch): mgr-cfg-4.3.6-159000.4.26.1 mgr-cfg-actions-4.3.6-159000.4.26.1 mgr-cfg-client-4.3.6-159000.4.26.1 mgr-cfg-management-4.3.6-159000.4.26.1 mgr-osad-4.3.6-159000.4.27.2 mgr-push-4.3.4-159000.4.18.2 mgr-virtualization-host-4.3.5-159000.4.18.2 python3-mgr-cfg-4.3.6-159000.4.26.1 python3-mgr-cfg-actions-4.3.6-159000.4.26.1 python3-mgr-cfg-client-4.3.6-159000.4.26.1 python3-mgr-cfg-management-4.3.6-159000.4.26.1 python3-mgr-osa-common-4.3.6-159000.4.27.2 python3-mgr-osad-4.3.6-159000.4.27.2 python3-mgr-push-4.3.4-159000.4.18.2 python3-mgr-virtualization-common-4.3.5-159000.4.18.2 python3-mgr-virtualization-host-4.3.5-159000.4.18.2 python3-rhnlib-4.3.4-159000.6.27.2 python3-spacewalk-check-4.3.9-159000.6.45.2 python3-spacewalk-client-setup-4.3.9-159000.6.45.2 python3-spacewalk-client-tools-4.3.9-159000.6.45.2 python3-spacewalk-koan-4.3.5-159000.6.18.1 python3-spacewalk-oscap-4.3.5-159000.6.18.2 python3-suseRegisterInfo-4.3.3-159000.6.21.2 salt-bash-completion-3004-159000.8.56.1 salt-fish-completion-3004-159000.8.56.1 salt-zsh-completion-3004-159000.8.56.1 spacecmd-4.3.10-159000.6.39.2 spacewalk-check-4.3.9-159000.6.45.2 spacewalk-client-setup-4.3.9-159000.6.45.2 spacewalk-client-tools-4.3.9-159000.6.45.2 spacewalk-koan-4.3.5-159000.6.18.1 spacewalk-oscap-4.3.5-159000.6.18.2 suseRegisterInfo-4.3.3-159000.6.21.2 uyuni-proxy-systemd-services-4.3.2-159000.3.6.1

References

#1181400 #1196338 #1196704 #1197042 #1197417

#1197533 #1197579 #1197637 #1197689 SLE-24077

SLE-24145

Cross- CVE-2022-21698 CVE-2022-22934 CVE-2022-22935

CVE-2022-22936 CVE-2022-22941

CVSS scores:

CVE-2022-21698 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2022-21698 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2022-22934 (NVD) : 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2022-22934 (SUSE): 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2022-22935 (NVD) : 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

CVE-2022-22935 (SUSE): 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2022-22936 (NVD) : 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2022-22936 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2022-22941 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2022-22941 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products:

SUSE Manager Tools 15-BETA

https://www.suse.com/security/cve/CVE-2022-21698.html

https://www.suse.com/security/cve/CVE-2022-22934.html

https://www.suse.com/security/cve/CVE-2022-22935.html

https://www.suse.com/security/cve/CVE-2022-22936.html

https://www.suse.com/security/cve/CVE-2022-22941.html

https://bugzilla.suse.com/1181400

https://bugzilla.suse.com/1196338

https://bugzilla.suse.com/1196704

https://bugzilla.suse.com/1197042

https://bugzilla.suse.com/1197417

https://bugzilla.suse.com/1197533

https://bugzilla.suse.com/1197579

https://bugzilla.suse.com/1197637

https://bugzilla.suse.com/1197689

Severity
Announcement ID: SUSE-SU-2022:1545-1
Rating: important

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.