Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2021.0978 Security update for SUSE Manager Server 4.1 22 March 2021 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: SUSE Manager Server 4.1 Publisher: SUSE Operating System: SUSE Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated Delete Arbitrary Files -- Existing Account Denial of Service -- Remote/Unauthenticated Access Confidential Data -- Existing Account Resolution: Patch/Upgrade CVE Names: CVE-2020-28477 CVE-2020-26259 CVE-2020-26258 CVE-2020-26217 Reference: ESB-2021.0977 ESB-2021.0436 ESB-2021.0381 ESB-2021.0328 Original Bulletin: https://www.suse.com/support/update/announcement/2021/suse-su-20210906-1 - --------------------------BEGIN INCLUDED TEXT-------------------- SUSE Security Update: Security update for SUSE Manager Server 4.1 ______________________________________________________________________________ Announcement ID: SUSE-SU-2021:0906-1 Rating: moderate References: #1157711 #1173893 #1175660 #1177508 #1179579 #1180145 #1180146 #1180224 #1180439 #1180547 #1180558 #1180757 #1180994 #1181048 #1181165 #1181228 #1181290 #1181416 #1181423 #1181635 #1181807 #1181814 #1182001 #1182006 #1182008 #1182071 #1182200 #1182492 #1182685 Cross-References: CVE-2020-26217 CVE-2020-26258 CVE-2020-26259 CVE-2020-28477 Affected Products: SUSE Linux Enterprise Module for SUSE Manager Server 4.1 SUSE Linux Enterprise Module for SUSE Manager Proxy 4.1 ______________________________________________________________________________ An update that solves four vulnerabilities and has 25 fixes is now available. Description: This update fixes the following issues: cobbler: o Fix string replacement for @@xyz@@ o Better performing string replacements grafana-formula: o Set `supported` to false for unsupported systems (bsc#1182001) o Add SLES 15 SP3 and openSUSE Leap 15.3 to supported versions mgr-libmod: o Fix 'list_modules' JSON serialization (bsc#1182492) mgr-osad: o Adapt to new SSL implementation of rhnlib (bsc#1181807) prometheus-exporters-formula: o Add Ubuntu support for Prometheus exporters' reverse proxy prometheus-formula: o Set server hostname from pillar data (bsc#1180439) py26-compat-salt: o Do not crash when unexpected cmd output at listing patches (bsc#1181290) rhnlib: o Change SSL implementation to python ssl for better SAN and hostname matching support (bsc#1181807) smdba: o Do not remove the database if there is no backup and deal with manifest spacewalk-backend: o Open repomd files as binary (bsc#1173893) o Fix requesting Release file in debian repos (bsc#1182006) o Reposync: Fixed Kickstart functionality. o Reposync: Fixed URLGrabber error handling. o Reposync: Fix modular data handling for cloned channels (bsc#1177508) spacewalk-client-tools: o Adapt to new SSL implementation of rhnlib (bsc#1181807) spacewalk-config: o Increase apache ssl logs to include response code and process time spacewalk-java: o Homogenizes style in filter buttons, facilitating testability o Cleanup sessions via SQL query instead of SQL function (bsc#1180224) o Rebuild and improve rendering of error pages 404 and 500 pages (bsc# 1181228) o Fix user creation with pam auth and no password (bsc#1179579) o Fix action chains for saltssh minions (bsc#1182200) o FIX: Slow response of 'Software > Install' in Ubuntu minions (bsc#1181165) o Do not call page decorator in HEAD requests (bsc#1181228) o Add 'mgr_origin_server' to Salt pillar data (bsc#1180439) o Ensure new files are synced just after writing them (bsc#1175660) o Enable openscap auditing for salt systems in SSM (bsc#1157711) o Detect debian products (bsc#1181416) o Show packages from channels assigned to the targeted system (bsc#1181423) o Add an API endpoint to allow/disallow scheduling irrelevant patches (bsc# 1180757) o Open raw output in new tab for ScriptRunAction (bsc#1180547) o Default to preferred items per page in content lifecycle lists (bsc# 1180558) o Fix modular data handling for cloned channels (bsc#1177508) o Fix: login gets an ISE when SSO is enabled (bsc#1181048) spacewalk-utils: o Fix modular data handling for cloned channels (bsc#1177508) spacewalk-web: o Replace CRLF in ssh priv key when bootstrapping (bsc#1182685) o Upgrade immer to fix CVE-2020-28477 o Default to preferred items per page in content lifecycle lists (bsc# 1180558) o Fix sorting in content lifecycle projects and cluster tables (bsc#1180558) susemanager: o Add SLE 15 SP3 bootstrap repository definitions (bsc#1182008) o Python3-dbus-python and dependencies not installed by default on JeOS SLE15 images, add them to the bootstrap repository list of packages for traditional (bsc#1182071) susemanager-doc-indexes: o Updated Command Line Registration with Salt section in the Client Configuration Guide for clarity. o Adds openSUSE Leap SP migration to the SP migration section of the Client Configuration Guide o Adds note that bootstrap procedure for selecting a parent channel is optional in Client Configuration Guide (bsc#1181635) o Adds note about checking for valid UUIDs in fstab when backing up (bsc# 1181814) o Updated command for running configure proxy script when replacing a proxy o Fixed bad SUSE Customer Center URL susemanager-docs_en: o Updated Command Line Registration with Salt section in the Client Configuration Guide for clarity. o Adds openSUSE Leap SP migration to the SP migration section of the Client Configuration Guide o Adds note that bootstrap procedure for selecting a parent channel is optional in Client Configuration Guide (bsc#1181635) o Adds note about checking for valid UUIDs in fstab when backing up (bsc# 1181814) o Updated command for running configure proxy script when replacing a proxy o Fixed bad SUSE Customer Center URL susemanager-schema: o Drop "pxt_session_cleanup" function (bsc#1180224) o Enable openscap auditing for salt systems in SSM (bsc#1157711) susemanager-sls: o Ubuntu 18 has version of apt which does not correctly support auth.conf.d directory. Detect the working version and use this feature only when we have a higher version installed xstream: Upgrade to 1.4.15 o fixes bsc#1180146, CVE-2020-26258 and bsc#1180145, CVE-2020-26259 o fixes bsc#1180994, CVE-2020-26217 subscription-matcher: o Update the xstream dependency to 1.4.15 How to apply this update: 1. Log in as root user to the SUSE Manager server. 2. Stop the Spacewalk service: `spacewalk-service stop` 3. Apply the patch using either zypper patch or YaST Online Update. 4. Start the Spacewalk service: `spacewalk-service start` Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: o SUSE Linux Enterprise Module for SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Server-4.1-2021-906=1 o SUSE Linux Enterprise Module for SUSE Manager Proxy 4.1: zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Proxy-4.1-2021-906=1 Package List: o SUSE Linux Enterprise Module for SUSE Manager Server 4.1 (ppc64le s390x x86_64): smdba-1.7.8-0.3.6.2 susemanager-4.1.24-3.20.2 susemanager-tools-4.1.24-3.20.2 o SUSE Linux Enterprise Module for SUSE Manager Server 4.1 (noarch): cobbler-3.0.0+git20190806.32c4bae0-5.6.4 grafana-formula-0.4.0-3.6.2 mgr-libmod-4.1.7-3.16.2 mgr-osa-dispatcher-4.1.5-2.9.4 prometheus-exporters-formula-0.9.0-3.19.2 prometheus-formula-0.3.1-3.6.2 py26-compat-salt-2016.11.10-6.11.2 python3-mgr-osa-common-4.1.5-2.9.4 python3-mgr-osa-dispatcher-4.1.5-2.9.4 python3-rhnlib-4.1.3-4.3.2 python3-spacewalk-client-tools-4.1.9-4.12.4 spacewalk-backend-4.1.21-4.22.7 spacewalk-backend-app-4.1.21-4.22.7 spacewalk-backend-applet-4.1.21-4.22.7 spacewalk-backend-config-files-4.1.21-4.22.7 spacewalk-backend-config-files-common-4.1.21-4.22.7 spacewalk-backend-config-files-tool-4.1.21-4.22.7 spacewalk-backend-iss-4.1.21-4.22.7 spacewalk-backend-iss-export-4.1.21-4.22.7 spacewalk-backend-package-push-server-4.1.21-4.22.7 spacewalk-backend-server-4.1.21-4.22.7 spacewalk-backend-sql-4.1.21-4.22.7 spacewalk-backend-sql-postgresql-4.1.21-4.22.7 spacewalk-backend-tools-4.1.21-4.22.7 spacewalk-backend-xml-export-libs-4.1.21-4.22.7 spacewalk-backend-xmlrpc-4.1.21-4.22.7 spacewalk-base-4.1.23-3.18.6 spacewalk-base-minimal-4.1.23-3.18.6 spacewalk-base-minimal-config-4.1.23-3.18.6 spacewalk-client-tools-4.1.9-4.12.4 spacewalk-config-4.1.5-3.3.2 spacewalk-html-4.1.23-3.18.6 spacewalk-java-4.1.30-3.31.7 spacewalk-java-config-4.1.30-3.31.7 spacewalk-java-lib-4.1.30-3.31.7 spacewalk-java-postgresql-4.1.30-3.31.7 spacewalk-taskomatic-4.1.30-3.31.7 spacewalk-utils-4.1.14-3.12.2 spacewalk-utils-extras-4.1.14-3.12.2 subscription-matcher-0.26-3.6.2 susemanager-doc-indexes-4.1-11.28.4 susemanager-docs_en-4.1-11.28.2 susemanager-docs_en-pdf-4.1-11.28.2 susemanager-schema-4.1.19-3.24.4 susemanager-sls-4.1.21-3.26.2 susemanager-web-libs-4.1.23-3.18.6 uyuni-config-modules-4.1.21-3.26.2 xpp3-1.1.4c-11.2.2 xpp3-minimal-1.1.4c-11.2.2 xstream-1.4.15-3.5.2 o SUSE Linux Enterprise Module for SUSE Manager Proxy 4.1 (noarch): mgr-osad-4.1.5-2.9.4 python3-mgr-osa-common-4.1.5-2.9.4 python3-mgr-osad-4.1.5-2.9.4 python3-rhnlib-4.1.3-4.3.2 python3-spacewalk-check-4.1.9-4.12.4 python3-spacewalk-client-setup-4.1.9-4.12.4 python3-spacewalk-client-tools-4.1.9-4.12.4 spacewalk-backend-4.1.21-4.22.7 spacewalk-base-minimal-4.1.23-3.18.6 spacewalk-base-minimal-config-4.1.23-3.18.6 spacewalk-check-4.1.9-4.12.4 spacewalk-client-setup-4.1.9-4.12.4 spacewalk-client-tools-4.1.9-4.12.4 spacewalk-proxy-broker-4.1.4-3.9.4 spacewalk-proxy-common-4.1.4-3.9.4 spacewalk-proxy-installer-4.1.6-3.3.2 spacewalk-proxy-management-4.1.4-3.9.4 spacewalk-proxy-package-manager-4.1.4-3.9.4 spacewalk-proxy-redirect-4.1.4-3.9.4 spacewalk-proxy-salt-4.1.4-3.9.4 References: o https://www.suse.com/security/cve/CVE-2020-26217.html o https://www.suse.com/security/cve/CVE-2020-26258.html o https://www.suse.com/security/cve/CVE-2020-26259.html o https://www.suse.com/security/cve/CVE-2020-28477.html o https://bugzilla.suse.com/1157711 o https://bugzilla.suse.com/1173893 o https://bugzilla.suse.com/1175660 o https://bugzilla.suse.com/1177508 o https://bugzilla.suse.com/1179579 o https://bugzilla.suse.com/1180145 o https://bugzilla.suse.com/1180146 o https://bugzilla.suse.com/1180224 o https://bugzilla.suse.com/1180439 o https://bugzilla.suse.com/1180547 o https://bugzilla.suse.com/1180558 o https://bugzilla.suse.com/1180757 o https://bugzilla.suse.com/1180994 o https://bugzilla.suse.com/1181048 o https://bugzilla.suse.com/1181165 o https://bugzilla.suse.com/1181228 o https://bugzilla.suse.com/1181290 o https://bugzilla.suse.com/1181416 o https://bugzilla.suse.com/1181423 o https://bugzilla.suse.com/1181635 o https://bugzilla.suse.com/1181807 o https://bugzilla.suse.com/1181814 o https://bugzilla.suse.com/1182001 o https://bugzilla.suse.com/1182006 o https://bugzilla.suse.com/1182008 o https://bugzilla.suse.com/1182071 o https://bugzilla.suse.com/1182200 o https://bugzilla.suse.com/1182492 o https://bugzilla.suse.com/1182685 - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBYFgFKeNLKJtyKPYoAQhe0A//Qnls0l5DIV+5TSxaKT3bBUR4lqeL2HoS pIWhfx1YEOO+LYv0Ve0o3i7aKMJVg8696tcHnoiJMr9C0Q1uATCB+5whutpzBbxf koMe7Y0E20jm30xk1UefrTN6rq+GGQ6EILlwthCrVppCAXz9ZscMiWWNMFO7T5mn fiIw4kP6VsS+lSIFAY6IwuKHhkJAFpqqghHppe4iHqAnnrSkrn/mnf6Res2UD1Z9 xiz6ncqYJySqXLnlY880fqFElDWzPEhnDFhGVVL+ZOXqJpOUqMQzdrwXDN2j8fB7 VRC3ieQ8m3p8khhv9nR5KhQ13hlc/vF+uw1myq3wvQw7aZOtjBJvfeL0na+NIu65 6xElzmrXQexKsNCbj2kdg4SPE1b+Kk0v/qHgtJ+CbMvZW7EmN5VDVj5O/1/J4b+q zNjhlqrXupBQdmEiDDm+axfZlB842h+3b6jSMVVyv2s1niATQpguMm5ASqvz13lM xgvlo4+/edKa82XrNYgz2/PBhLUUWQ/Bd/UqHG15YTrNhy5k4w4BwjdCvDND6C6T aTpwS+DG1XZRpxfMgn8dpqLhKFUju+W8OPsbGFKDWorLflXAb0NKFX7lyKMhtxdy sVWLyrExngeJna1M4UUmw308GDXAFl5XkQsajikM8+slb9DOvil+HfIpBwNqe+hD A91FFKJJMVQ= =5upt -----END PGP SIGNATURE-----