Security update for Spacewalk stack

SUSE Security Update: Security update for Spacewalk stack
Announcement ID: SUSE-SU-2014:0223-1
Rating: moderate
References: #846356 #850925 #853913 #854090 #855610
Affected Products:
  • SUSE Manager Proxy 1.7 for SLE 11 SP2

  • An update that solves one vulnerability and has four fixes is now available. It includes four new package versions.


    This SUSE Manager Proxy update fixes the following security
    issue and bugs:


    * Check for empty result before printing software
    entitlement. (bnc#853913)
    * Added extra log folder to spacewalk-debug.
    * Better detection for SUSE KVM and Cloud systems.


    * Older versions of ssh-copy-id do not support the -o
    * ssh-keygen fails with an error when known_hosts
    doesn't exist.
    * Call the new script from the old one and print
    deprecation warning.
    * New ssh-push client initialization script.


    * Fixed client registration via proxy. (bnc#855610)


    * CVE-2013-4415: PAGE_SIZE_LABEL_SELECTED cross-site
    scripting. (bnc#850925)
    * Put the given year in the valid range. (bnc#846356)
    * Paste event handler parsing CVE identifiers with
    Javascript. (bnc#846356)

    How to apply this update:

    1. Log in as root user to the SUSE Manager proxy. 2. Stop
    the proxy service: spacewalk-proxy stop 3. Apply the patch
    using either zypper patch or YaST Online Update. 4. Start
    the Spacewalk service: spacewalk-proxy start

    Security Issues:

    * CVE-2013-4415

    Patch Instructions:

    To install this SUSE Security Update use YaST online_update.
    Alternatively you can run the command listed for your product:

    • SUSE Manager Proxy 1.7 for SLE 11 SP2:
      zypper in -t patch slemap17sp2-suse-manager-proxy-201401-8818

    To bring your system up-to-date, use "zypper patch".

    Package List:

    • SUSE Manager Proxy 1.7 for SLE 11 SP2 (x86_64) [New Version:]:
    • spacewalk-backend-
    • spacewalk-backend-libs-
    • SUSE Manager Proxy 1.7 for SLE 11 SP2 (noarch) [New Version:, and]:
    • spacewalk-base-minimal-
    • spacewalk-certs-tools-
    • spacewalk-proxy-broker-
    • spacewalk-proxy-common-
    • spacewalk-proxy-management-
    • spacewalk-proxy-package-manager-
    • spacewalk-proxy-redirect-