Security update 5.1.0 GM for Multi-Linux Manager Client Tools

Announcement ID: SUSE-SU-2025:02576-1
Release Date: 2025-07-31T10:35:21Z
Rating: important
References:
Cross-References:
CVSS scores:
  • CVE-2024-38822 ( SUSE ): 5.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
  • CVE-2024-38822 ( SUSE ): 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
  • CVE-2024-38822 ( NVD ): 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
  • CVE-2024-38823 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
  • CVE-2024-38823 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
  • CVE-2024-38823 ( NVD ): 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
  • CVE-2024-38824 ( SUSE ): 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
  • CVE-2024-38824 ( SUSE ): 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
  • CVE-2024-38824 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
  • CVE-2024-38824 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
  • CVE-2024-38825 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
  • CVE-2024-38825 ( SUSE ): 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • CVE-2024-38825 ( NVD ): 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • CVE-2025-22236 ( SUSE ): 6.1 CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L
  • CVE-2025-22236 ( SUSE ): 8.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
  • CVE-2025-22236 ( NVD ): 8.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
  • CVE-2025-22237 ( SUSE ): 8.4 CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CVE-2025-22237 ( SUSE ): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
  • CVE-2025-22237 ( NVD ): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
  • CVE-2025-22238 ( SUSE ): 6.7 CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
  • CVE-2025-22238 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
  • CVE-2025-22238 ( NVD ): 4.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N
  • CVE-2025-22239 ( SUSE ): 6.1 CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L
  • CVE-2025-22239 ( SUSE ): 8.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
  • CVE-2025-22239 ( NVD ): 8.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
  • CVE-2025-22240 ( SUSE ): 5.4 CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CVE-2025-22240 ( SUSE ): 6.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
  • CVE-2025-22240 ( NVD ): 6.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
  • CVE-2025-22241 ( SUSE ): 5.3 CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
  • CVE-2025-22241 ( SUSE ): 5.6 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
  • CVE-2025-22241 ( NVD ): 5.6 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
  • CVE-2025-22242 ( SUSE ): 6.7 CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  • CVE-2025-22242 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
  • CVE-2025-22242 ( NVD ): 5.6 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:H
  • CVE-2025-47287 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  • CVE-2025-47287 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • CVE-2025-47287 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products:
  • SUSE Multi-Linux Manager Client Tools for Debian 12

An update that solves 12 vulnerabilities, contains one feature and has 15 security fixes can now be installed.

Description:

This update fixes the following issues:

spacecmd:

  • Version update from 5.1.6-0 to 5.1.8-0 with the following key change:

  • Update translation strings

uyuni-tools:

  • Version 5.1.14-0:

  • Fix mgradm backup create handling of images and systemd files (bsc#1244563)

  • migrate existing TLS certificates from 4.3 systems (bsc#1244847)

  • Use FQDN of the source to generate certificates during migration

  • Version 5.1.13-0:

  • Update translation strings

  • Version 5.1.12-0:

  • Add the info message about End User License Agreement

  • Remove duplicate parameters in mgradm install podman --help
  • Change the first message of each tool to include the full command and parameters
  • support: don't dump files in bound folders (bsc#1243297)
  • Extract the version number from /etc/susemanager-release only if that config file exists
  • During migration, improve info about usage on ssl-password and logs (bsc#1243009)
  • Start saline containers and the other after server is running
  • Fix computed migration image name (bsc#1243725)
  • During upgrade, pgsql service needs to be started before healtcheck (bsc#1243402)
  • During migration, check if the source server is a no-containerized server (bsc#1243396)
  • During migration, check if backup is already existing (bsc#1243105)
  • Restore volumes using tar instead of podman import (bsc#1244127)
  • Fix several bugs related to saline service (bsc#1243329)
  • Purge saline and hubxmlrpc image (bsc#1243359)
  • Remove SHM size limits from all containers (bsc#1243274)
  • Fix log: pgsql version is a number
  • During upgrade, wait server is up and running (bsc#1244023)
  • Fix migration of autoinstallable distributions (bsc#1243802)
  • Check for valid CA before attempting DB upgrade

venv-salt-minion:

  • Security issues fixed:

  • CVE-2024-38822: Fixed Minion token validation (bsc#1244561)

  • CVE-2024-38823: Fixed server vulnerability to replay attacks when not using a TLS encrypted transport (bsc#1244564)
  • CVE-2024-38824: Fixed directory traversal vulnerability in recv_file method (bsc#1244565)
  • CVE-2024-38825: Fixed salt.auth.pki module authentication issue (bsc#1244566)
  • CVE-2025-22240: Fixed arbitrary directory creation or file deletion with GitFS (bsc#1244567)
  • CVE-2025-22236: Fixed Minion event bus authorization bypass (bsc#1244568)
  • CVE-2025-22241: Fixed the use of un-validated input in the VirtKey class (bsc#1244570)
  • CVE-2025-22237: Fixed exploitation of the 'on demand' pillar functionality (bsc#1244571)
  • CVE-2025-22238: Fixed the master's default cache vulnerability to a directory traversal attack (bsc#1244572)
  • CVE-2025-22239: Fixed the arbitrary event injection on the Salt Master (bsc#1244574)
  • CVE-2025-22242: Fixed a Denial of Service vulnerability through file read operation (bsc#1244575)

  • CVE-2025-47287: Fixed a Denial of Service vulnerability in Tornado logging behavior (bsc#1243268)

  • Other bugs fixed:

  • Added subsystem filter to udev.exportdb (bsc#1236621)

  • Fixed Ubuntu 24.04 test failures
  • Fixed refresh of osrelease and related grains on Python 3.10+
  • Fixed VIRTUAL_ENV variable in activate file to point to actual path
  • Fixed the bundle path in pyvenv.cfg

Special Instructions and Notes:

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE Multi-Linux Manager Client Tools for Debian 12
    zypper in -t patch SUSE-MultiLinuxManagerTools-Debian-12-2025-2576=1

Package List:

  • SUSE Multi-Linux Manager Client Tools for Debian 12 (all)
    • spacecmd-5.1.8-3.8.1
    • mgrctl-fish-completion-5.1.14-3.8.1
    • mgrctl-bash-completion-5.1.14-3.8.1
    • mgrctl-zsh-completion-5.1.14-3.8.1
  • SUSE Multi-Linux Manager Client Tools for Debian 12 (amd64 arm64)
    • venv-salt-minion-3006.0-3.8.4
    • mgrctl-5.1.14-3.8.1

References: