Security update for SUSE Manager 4.0 : Server and Proxy

Announcement ID: SUSE-SU-2019:1789-1
Rating: moderate
References:
Cross-References:
CVSS scores:
  • CVE-2019-10136 ( SUSE ): 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
  • CVE-2019-10136 ( NVD ): 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
  • CVE-2019-10137 ( SUSE ): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
  • CVE-2019-10137 ( NVD ): 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products:
  • SUSE Manager Proxy 4.0
  • SUSE Manager Proxy 4.0 Module 4.0
  • SUSE Manager Retail Branch Server 4.0
  • SUSE Manager Server 4.0
  • SUSE Manager Server 4.0 Module 4.0

An update that solves two vulnerabilities and has seven security fixes can now be installed.

Description:

This update fixes the following issues:

spacewalk-backend:

  • Do not duplicate "http://" protocol when using proxies with "deb" repositories (bsc#1138313)
  • Fix reposync when dealing with RedHat CDN (bsc#1138358)
  • Fix for CVE-2019-10136. An attacker with a valid, but expired, authenticated set of headers could move some digits around, artificially extending the session validity without modifying the checksum. (bsc#1136480)

spacewalk-proxy:

  • Fix for CVE-2019-10137. A path traversal flaw was found in the way the proxy processes cached client tokens. A remote, unauthenticated, attacker could use this flaw to test the existence of arbitrary files, or if they have access to the proxy's filesystem, execute arbitrary code in the context of the proxy. (bsc#1136476)

spacewalk-web:

  • Change WebUI version 4.0.1

susemanager-doc-indexes:

  • Updated wording for prometheus section
  • Jeos VM update
  • Port 8050 for graphical console display
  • Content life-cycle docs are not enough for customer to understand (bsc#1137955)
  • Salt boot formula fails for SLES11 SP3 terminal (bsc#1136857)
  • Certificate verify failed when using vmware esxi virtual host gatherer (bsc#1136561)

susemanager-docs_en:

  • Updated wording for prometheus section
  • Jeos VM update
  • Port 8050 for graphical console display
  • Content life-cycle docs are not enough for customer to understand (bsc#1137955)
  • Salt boot formula fails for SLES11 SP3 terminal (bsc#1136857)
  • Certificate verify failed when using vmware esxi virtual host gatherer (bsc#1136561)

susemanager-sync-data:

  • Add channel family definitions for SLES12 SP3 LTSS (bsc#1139693)
  • Add OPENSUSE to allowed channel_families to make openSUSE Leap product visible in the product list (bsc#1138364)

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE Manager Proxy 4.0 Module 4.0
    zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Proxy-4.0-2019-1789=1
  • SUSE Manager Server 4.0 Module 4.0
    zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Server-4.0-2019-1789=1

Package List:

  • SUSE Manager Proxy 4.0 Module 4.0 (noarch)
    • python3-spacewalk-backend-libs-4.0.22-3.3.1
    • spacewalk-proxy-broker-4.0.12-3.3.1
    • spacewalk-base-minimal-4.0.14-3.3.1
    • spacewalk-proxy-package-manager-4.0.12-3.3.1
    • spacewalk-backend-4.0.22-3.3.1
    • spacewalk-proxy-salt-4.0.12-3.3.1
    • spacewalk-proxy-management-4.0.12-3.3.1
    • spacewalk-base-minimal-config-4.0.14-3.3.1
    • spacewalk-proxy-common-4.0.12-3.3.1
    • spacewalk-proxy-redirect-4.0.12-3.3.1
  • SUSE Manager Server 4.0 Module 4.0 (noarch)
    • spacewalk-backend-xml-export-libs-4.0.22-3.3.1
    • python3-spacewalk-backend-libs-4.0.22-3.3.1
    • spacewalk-backend-xmlrpc-4.0.22-3.3.1
    • spacewalk-base-minimal-4.0.14-3.3.1
    • spacewalk-html-4.0.14-3.3.1
    • susemanager-docs_en-4.0-10.3.1
    • susemanager-sync-data-4.0.12-3.3.1
    • spacewalk-backend-4.0.22-3.3.1
    • spacewalk-backend-sql-postgresql-4.0.22-3.3.1
    • susemanager-doc-indexes-4.0-10.3.1
    • spacewalk-backend-package-push-server-4.0.22-3.3.1
    • spacewalk-backend-sql-4.0.22-3.3.1
    • spacewalk-backend-config-files-4.0.22-3.3.1
    • spacewalk-backend-app-4.0.22-3.3.1
    • spacewalk-backend-config-files-common-4.0.22-3.3.1
    • spacewalk-backend-iss-export-4.0.22-3.3.1
    • susemanager-docs_en-pdf-4.0-10.3.1
    • spacewalk-backend-config-files-tool-4.0.22-3.3.1
    • spacewalk-backend-applet-4.0.22-3.3.1
    • spacewalk-backend-server-4.0.22-3.3.1
    • susemanager-web-libs-4.0.14-3.3.1
    • spacewalk-backend-tools-4.0.22-3.3.1
    • spacewalk-backend-iss-4.0.22-3.3.1
    • spacewalk-base-minimal-config-4.0.14-3.3.1
    • spacewalk-base-4.0.14-3.3.1

References: