Security update for cobbler

Announcement ID:	SUSE-SU-2018:2561-1
Rating:	important
References:	bsc#1097733 bsc#1101670 bsc#1104189 bsc#1104190 bsc#1104287 bsc#1105440 bsc#1105442
Cross-References:	CVE-2018-1000225 CVE-2018-1000226 CVE-2018-10931
CVSS scores:	CVE-2018-1000225 ( SUSE ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2018-1000225 ( NVD ): 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2018-1000226 ( SUSE ): 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2018-1000226 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2018-10931 ( SUSE ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2018-10931 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products:	HPE Helion OpenStack 8 SUSE Linux Enterprise Desktop 12 SUSE Linux Enterprise Desktop 12 SP1 SUSE Linux Enterprise Desktop 12 SP2 SUSE Linux Enterprise Desktop 12 SP3 SUSE Linux Enterprise Desktop 12 SP4 SUSE Linux Enterprise High Performance Computing 12 SP2 SUSE Linux Enterprise High Performance Computing 12 SP3 SUSE Linux Enterprise High Performance Computing 12 SP4 SUSE Linux Enterprise High Performance Computing 12 SP5 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Server for the Raspberry Pi 12-SP2 SUSE Manager Client Tools for SLE 12 SUSE Manager Server 3.0 SUSE OpenStack Cloud 8

An update that solves three vulnerabilities and has four security fixes can now be installed.

Description:

This update for cobbler fixes the following issues:

Security issues fixed:

• Forbid exposure of private methods in the API (CVE-2018-10931, CVE-2018-1000225, bsc#1104287, bsc#1104189, bsc#1105442)
• Check access token when calling 'modify_setting' API endpoint (bsc#1104190, bsc#1105440, CVE-2018-1000226)

Other bugs fixed:

• Do not try to hardlink to a symlink. The result will be a dangling symlink in the general case. (bsc#1097733)
• fix kernel options when generating bootiso (bsc#1101670)

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• HPE Helion OpenStack 8
  zypper in -t patch HPE-Helion-OpenStack-8-2018-1795=1
• SUSE OpenStack Cloud 8
  zypper in -t patch SUSE-OpenStack-Cloud-8-2018-1795=1
• SUSE Manager Client Tools for SLE 12
  zypper in -t patch SUSE-SLE-Manager-Tools-12-2018-1795=1
• SUSE Manager Server 3.0
  zypper in -t patch SUSE-SUSE-Manager-Server-3.0-2018-1795=1

Package List:

• HPE Helion OpenStack 8 (noarch)
  • cobbler-2.6.6-49.14.1
• SUSE OpenStack Cloud 8 (noarch)
  • cobbler-2.6.6-49.14.1
• SUSE Manager Client Tools for SLE 12 (noarch)
  • koan-2.6.6-49.14.1
• SUSE Manager Server 3.0 (noarch)
  • cobbler-2.6.6-49.14.1

References:

• https://www.suse.com/security/cve/CVE-2018-1000225.html
• https://www.suse.com/security/cve/CVE-2018-1000226.html
• https://www.suse.com/security/cve/CVE-2018-10931.html
• https://bugzilla.suse.com/show_bug.cgi?id=1097733
• https://bugzilla.suse.com/show_bug.cgi?id=1101670
• https://bugzilla.suse.com/show_bug.cgi?id=1104189
• https://bugzilla.suse.com/show_bug.cgi?id=1104190
• https://bugzilla.suse.com/show_bug.cgi?id=1104287
• https://bugzilla.suse.com/show_bug.cgi?id=1105440
• https://bugzilla.suse.com/show_bug.cgi?id=1105442