Security update for SUSE Manager Server 3.1

SUSE Security Update: Security update for SUSE Manager Server 3.1
Announcement ID: SUSE-SU-2019:0863-1
Rating: moderate
References: #1109316 #1111191 #1111910 #1114029 #1114059 #1114157 #1114169 #1117759 #1119081 #1119964 #1121038 #1121195 #1121856 #1122836 #1123991 #1124639 #1126862 #1128781 #1129765 #1130658
Cross-References: CVE-2018-10851 CVE-2018-14626 CVE-2018-17197
Affected Products:
  • SUSE Manager Server 3.1
  • SUSE Manager Proxy 3.1

An update that solves three vulnerabilities and has 17 fixes is now available.

Description:


This update fixes the following issues:
cobbler:

  • Fixes case where distribution detection returns None (bsc#1130658)
  • SUSE texmode fix (bsc#1109316)
  • Fix for SUSE distribution detection in ISO building (bsc#1123991)

py26-compat-salt:
  • Remove arch from name when pkg.list_pkgs is called with 'attr' (bsc#1114029)

spacecmd:
  • Fix importing state channels using configchannel_import
  • Fix getting file info for latest revision (via configchannel_filedetails)

spacewalk-branding:
  • Update jquery.timepicker dependency to 1.11.14 to allow parsing the time format without depending on the language. (bsc#1119081)

spacewalk-java:
  • Fix a problem when cloning public child channels with a private base channel (bsc#1124639)
  • Keep assigned channels on traditional to minion migration (bsc#1122836)
  • Fix "Add Selected to SSM" on System Groups -> systems page (bsc#1121856)
  • Disable notification types with 'java.notifications_type_disabled' in rhn.conf (bsc#1111910)
  • XMLRPC API: Include init.sls in channel file list (bsc#1111191)
  • Fix the config channels assignment via SSM (bsc#1117759)

spacewalk-utils:
  • Create /etc/rhn with correct ownership to prevent file conflicts

spacewalk-web:
  • Fix action scheduler time picker prefill when the server is on "UTC/GMT" timezone (bsc#1121195)
  • Fix initializing of the datetime picker (bsc#1126862)
  • Show feedback messages after using the retry option on the notification messages page

subscription-matcher:
  • Old style hard bundle merging fix (bsc#1114059)

susemanager:
  • Fix creation of bootstrap repositories for SLE12 (no SP) by requiring python-setuptools only for SLE12 >= SP1 (bsc#1129765)
  • Add `python-setuptools` package dependency to SLES12 bootstrap repo (bsc#1119964)
  • Rhnlib was renamed to python2-rhnlib. Change bootstrap data accordingly.

susemanager-schema:
  • Fix performance regression in inter-server-sync (bsc#1128781)

susemanager-docs_en:
  • Update text and image files
  • 2.1 comparison: clarify profile syncing support
  • Adjust documentation about notification settings
  • Fix internal link (SMT documentation).
  • Remove documentation about the "mgr-sync enable-scc" subcommand. This subcommand is no longer available.

susemanager-frontend-libs:
  • Update jquery.timepicker to 1.11.14 (bsc#1119081)

tika-core:
  • New upstream version (1.20). Fixes infinite loop in SQLite3Parser (CVE-2018-17197) (bsc#1121038)

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE Manager Server 3.1:
    zypper in -t patch SUSE-SUSE-Manager-Server-3.1-2019-863=1
  • SUSE Manager Proxy 3.1:
    zypper in -t patch SUSE-SUSE-Manager-Proxy-3.1-2019-863=1

Package List:

  • SUSE Manager Server 3.1 (ppc64le s390x x86_64):
    • spacewalk-branding-2.7.2.17-2.31.3
    • susemanager-3.1.19-2.34.2
    • susemanager-tools-3.1.19-2.34.2
  • SUSE Manager Server 3.1 (noarch):
    • cobbler-2.6.6-5.25.1
    • py26-compat-salt-2016.11.10-1.19.3
    • spacecmd-2.7.8.15-2.32.1
    • spacewalk-base-2.7.1.21-2.35.1
    • spacewalk-base-minimal-2.7.1.21-2.35.1
    • spacewalk-base-minimal-config-2.7.1.21-2.35.1
    • spacewalk-html-2.7.1.21-2.35.1
    • spacewalk-java-2.7.46.19-2.41.3
    • spacewalk-java-config-2.7.46.19-2.41.3
    • spacewalk-java-lib-2.7.46.19-2.41.3
    • spacewalk-java-oracle-2.7.46.19-2.41.3
    • spacewalk-java-postgresql-2.7.46.19-2.41.3
    • spacewalk-taskomatic-2.7.46.19-2.41.3
    • spacewalk-utils-2.7.10.11-2.23.3
    • subscription-matcher-0.22-4.9.2
    • susemanager-advanced-topics_en-pdf-3.1-10.29.4
    • susemanager-best-practices_en-pdf-3.1-10.29.4
    • susemanager-docs_en-3.1-10.29.4
    • susemanager-frontend-libs-3.1.2-3.10.1
    • susemanager-getting-started_en-pdf-3.1-10.29.4
    • susemanager-jsp_en-3.1-10.29.4
    • susemanager-reference_en-pdf-3.1-10.29.4
    • susemanager-schema-3.1.21-2.36.1
    • tika-core-1.20-1.6.2
  • SUSE Manager Proxy 3.1 (noarch):
    • spacewalk-base-minimal-2.7.1.21-2.35.1
    • spacewalk-base-minimal-config-2.7.1.21-2.35.1

References: