Security update for SUSE Manager Client Tools

SUSE Security Update: Security update for SUSE Manager Client Tools
Announcement ID: SUSE-SU-2017:1347-1
Rating: moderate
References: #1023233 #1024406 #1024714 #1025312 #1026633 #1027426 #1029755 #1031667 #1032256
Affected Products:
  • SUSE Linux Enterprise Server 11-SP4-CLIENT-TOOLS
  • SUSE Linux Enterprise Server 11-SP3-CLIENT-TOOLS
    		•

    An update that solves one vulnerability and has 8 fixes is now available.

    Description:


    The following security issue in spacewalk-backend has been fixed:

    - Non admin or disabled user cannot make changes to a system anymore using
    spacewalk-channel. (bsc#1026633, CVE-2017-7470)

    Additionally, the following non-security issues have been fixed:

    rhnlib:

    - Support all TLS versions in rpclib. (bsc#1025312)

    spacecmd:

    - Improve output on error for listrepo. (bsc#1027426)
    - Reword spacecmd removal message. (bsc#1024406)

    spacewalk-backend:

    - Do not fail with traceback when media.1 does not exist. (bsc#1032256)
    - Create scap files directory beforehand. (bsc#1029755)
    - Fix error if SPACEWALK_DEBUG_NO_REPORTS environment variable is not
    present.
    - Don't skip 'rhnErrataPackage' cleanup during an errata update.
    (bsc#1023233)
    - Add support for running spacewalk-debug without creating reports.
    (bsc#1024714)
    - Set scap store directory mod to 775 and group owner to susemanager.
    - incomplete_package_import: Do import rhnPackageFile as it breaks some
    package installations.
    - Added traceback printing to the exception block.
    - Change postgresql starting commands.

    spacewalk-client-tools:

    - Fix reboot message to use correct product name. (bsc#1031667)

    Patch Instructions:

    To install this SUSE Security Update use YaST online_update.
    Alternatively you can run the command listed for your product:

    • SUSE Linux Enterprise Server 11-SP4-CLIENT-TOOLS:
      zypper in -t patch slesctsp4-client-tools-201704-13115=1
    • SUSE Linux Enterprise Server 11-SP3-CLIENT-TOOLS:
      zypper in -t patch slesctsp3-client-tools-201704-13115=1

    To bring your system up-to-date, use "zypper patch".

    Package List:

    • SUSE Linux Enterprise Server 11-SP4-CLIENT-TOOLS (i586 ia64 ppc64 s390x x86_64):
      • rhnlib-2.5.84.4-8.1
      • spacecmd-2.5.5.5-14.1
      • spacewalk-backend-libs-2.5.24.9-24.1
    • SUSE Linux Enterprise Server 11-SP4-CLIENT-TOOLS (noarch):
      • spacewalk-check-2.5.13.8-23.1
      • spacewalk-client-setup-2.5.13.8-23.1
      • spacewalk-client-tools-2.5.13.8-23.1
    • SUSE Linux Enterprise Server 11-SP3-CLIENT-TOOLS (i586 ia64 ppc64 s390x x86_64):
      • rhnlib-2.5.84.4-8.1
      • spacecmd-2.5.5.5-14.1
      • spacewalk-backend-libs-2.5.24.9-24.1
    • SUSE Linux Enterprise Server 11-SP3-CLIENT-TOOLS (noarch):
      • spacewalk-check-2.5.13.8-23.1
      • spacewalk-client-setup-2.5.13.8-23.1
      • spacewalk-client-tools-2.5.13.8-23.1

    References: