Security update for cobbler
Announcement ID: | SUSE-SU-2022:0509-1 |
---|---|
Rating: | important |
References: | |
Cross-References: | |
CVSS scores: |
|
Affected Products: |
|
An update that solves two vulnerabilities and has five security fixes can now be installed.
Description:
This update for cobbler fixes the following issues:
- CVE-2021-45083: Fixed unsafe permissions on sensitive files (bsc#1193671).
- CVE-2021-45082: Fixed incomplete template sanitation (bsc#1193678).
The following non-security bugs were fixed:
- Fix issues with installation module logging and validation (bsc#1195918)
- Move configuration files ownership to apache (bsc#1195906)
- Remove hardcoded test credentials (bsc#1193673)
- Prevent log pollution (bsc#1193675)
- Missing sanity check on MongoDB configuration file (bsc#1193676)
Patch Instructions:
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
-
SUSE Manager Server 4.2 Module 4.2
zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Server-4.2-2022-509=1
Package List:
-
SUSE Manager Server 4.2 Module 4.2 (noarch)
- cobbler-3.1.2-150300.5.14.1
References:
- https://www.suse.com/security/cve/CVE-2021-45082.html
- https://www.suse.com/security/cve/CVE-2021-45083.html
- https://bugzilla.suse.com/show_bug.cgi?id=1193671
- https://bugzilla.suse.com/show_bug.cgi?id=1193673
- https://bugzilla.suse.com/show_bug.cgi?id=1193675
- https://bugzilla.suse.com/show_bug.cgi?id=1193676
- https://bugzilla.suse.com/show_bug.cgi?id=1193678
- https://bugzilla.suse.com/show_bug.cgi?id=1195906
- https://bugzilla.suse.com/show_bug.cgi?id=1195918