Security update for SUSE Manager 3.2 : Server and Proxy

Announcement ID: SUSE-SU-2019:1790-1
Rating: moderate
References:
Cross-References:
CVSS scores:
  • CVE-2019-10136 ( SUSE ): 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
  • CVE-2019-10136 ( NVD ): 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
  • CVE-2019-10137 ( SUSE ): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
  • CVE-2019-10137 ( NVD ): 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products:
  • SUSE Linux Enterprise High Performance Computing 12 SP3
  • SUSE Linux Enterprise High Performance Computing 12 SP4
  • SUSE Linux Enterprise Server 12 SP3
  • SUSE Linux Enterprise Server 12 SP4
  • SUSE Manager Proxy 3.2
  • SUSE Manager Server 3.2

An update that solves two vulnerabilities and has one security fix can now be installed.

Description:

This update fixes the following issues:

release-notes-susemanager:

  • Fix invalid characters in ncurses mode (bsc#1102770)

release-notes-susemanager-proxy:

  • Fix invalid characters in ncurses mode (bsc#1102770)

spacewalk-backend:

  • Fix for CVE-2019-10136. An attacker with a valid, but expired, authenticated set of headers could move some digits around, artificially extending the session validity without modifying the checksum. (bsc#1136480)

spacewalk-proxy:

  • Fix for CVE-2019-10137. A path traversal flaw was found in the way the proxy processes cached client tokens. A remote, unauthenticated, attacker could use this flaw to test the existence of arbitrary files, or if they have access to the proxy's filesystem, execute arbitrary code in the context of the proxy. (bsc#1136476)

spacewalk-web:

  • Change WebUI string version to 3.2.9

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE Manager Proxy 3.2
    zypper in -t patch SUSE-SUSE-Manager-Proxy-3.2-2019-1790=1
  • SUSE Manager Server 3.2
    zypper in -t patch SUSE-SUSE-Manager-Server-3.2-2019-1790=1

Package List:

  • SUSE Manager Proxy 3.2 (x86_64)
    • release-notes-susemanager-proxy-3.2.9-0.16.27.1
  • SUSE Manager Proxy 3.2 (noarch)
    • spacewalk-backend-2.8.57.17-3.33.1
    • susemanager-web-libs-2.8.7.17-3.30.1
    • spacewalk-base-minimal-config-2.8.7.17-3.30.1
    • spacewalk-proxy-management-2.8.5.6-3.11.1
    • spacewalk-base-minimal-2.8.7.17-3.30.1
    • spacewalk-proxy-package-manager-2.8.5.6-3.11.1
    • spacewalk-proxy-broker-2.8.5.6-3.11.1
    • spacewalk-proxy-common-2.8.5.6-3.11.1
    • spacewalk-proxy-redirect-2.8.5.6-3.11.1
    • spacewalk-proxy-salt-2.8.5.6-3.11.1
    • spacewalk-backend-libs-2.8.57.17-3.33.1
  • SUSE Manager Server 3.2 (ppc64le s390x x86_64)
    • release-notes-susemanager-3.2.9-6.35.1
  • SUSE Manager Server 3.2 (noarch)
    • spacewalk-backend-sql-oracle-2.8.57.17-3.33.1
    • spacewalk-backend-sql-2.8.57.17-3.33.1
    • spacewalk-base-minimal-config-2.8.7.17-3.30.1
    • spacewalk-backend-xml-export-libs-2.8.57.17-3.33.1
    • spacewalk-backend-config-files-common-2.8.57.17-3.33.1
    • spacewalk-backend-app-2.8.57.17-3.33.1
    • spacewalk-backend-tools-2.8.57.17-3.33.1
    • spacewalk-backend-applet-2.8.57.17-3.33.1
    • spacewalk-html-2.8.7.17-3.30.1
    • spacewalk-base-minimal-2.8.7.17-3.30.1
    • spacewalk-backend-config-files-tool-2.8.57.17-3.33.1
    • spacewalk-backend-package-push-server-2.8.57.17-3.33.1
    • spacewalk-backend-libs-2.8.57.17-3.33.1
    • spacewalk-backend-2.8.57.17-3.33.1
    • susemanager-web-libs-2.8.7.17-3.30.1
    • spacewalk-backend-server-2.8.57.17-3.33.1
    • spacewalk-backend-iss-export-2.8.57.17-3.33.1
    • spacewalk-backend-xmlrpc-2.8.57.17-3.33.1
    • spacewalk-backend-config-files-2.8.57.17-3.33.1
    • spacewalk-backend-sql-postgresql-2.8.57.17-3.33.1
    • spacewalk-backend-iss-2.8.57.17-3.33.1
    • spacewalk-base-2.8.7.17-3.30.1

References: