Security update for several packages related to SUSE Manger 3.1

Announcement ID: SUSE-SU-2019:0863-1
Rating: moderate
References:
Cross-References:
CVSS scores:
  • CVE-2018-10851 ( SUSE ): 5.3 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2018-10851 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • CVE-2018-14626 ( SUSE ): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
  • CVE-2018-14626 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • CVE-2018-17197 ( SUSE ): 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
  • CVE-2018-17197 ( NVD ): 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected Products:
  • SUSE Linux Enterprise High Performance Computing 12 SP2
  • SUSE Linux Enterprise High Performance Computing 12 SP3
  • SUSE Linux Enterprise High Performance Computing 12 SP4
  • SUSE Linux Enterprise Server 12 SP2
  • SUSE Linux Enterprise Server 12 SP3
  • SUSE Linux Enterprise Server 12 SP4
  • SUSE Manager Proxy 3.1
  • SUSE Manager Server 3.1

An update that solves three vulnerabilities and has 17 security fixes can now be installed.

Description:

This consolidated update includes multiple patchinfos for SUSE Manager Server and Proxy and follow security issues fixed:

  • CVE-2018-10851: Fixed denial of service via crafted zone record or crafted answer (bsc#1114157).
  • CVE-2018-14626: Fixed packet cache pollution via crafted query (bsc#1114169).

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE Manager Proxy 3.1
    zypper in -t patch SUSE-SUSE-Manager-Proxy-3.1-2019-863=1
  • SUSE Manager Server 3.1
    zypper in -t patch SUSE-SUSE-Manager-Server-3.1-2019-863=1

Package List:

  • SUSE Manager Proxy 3.1 (noarch)
    • spacewalk-base-minimal-config-2.7.1.21-2.35.1
    • spacewalk-base-minimal-2.7.1.21-2.35.1
  • SUSE Manager Server 3.1 (noarch)
    • susemanager-reference_en-pdf-3.1-10.29.4
    • spacewalk-base-2.7.1.21-2.35.1
    • susemanager-jsp_en-3.1-10.29.4
    • py26-compat-salt-2016.11.10-1.19.3
    • spacecmd-2.7.8.15-2.32.1
    • spacewalk-java-lib-2.7.46.19-2.41.3
    • spacewalk-html-2.7.1.21-2.35.1
    • spacewalk-taskomatic-2.7.46.19-2.41.3
    • spacewalk-base-minimal-config-2.7.1.21-2.35.1
    • spacewalk-java-2.7.46.19-2.41.3
    • spacewalk-base-minimal-2.7.1.21-2.35.1
    • susemanager-getting-started_en-pdf-3.1-10.29.4
    • spacewalk-java-oracle-2.7.46.19-2.41.3
    • susemanager-best-practices_en-pdf-3.1-10.29.4
    • susemanager-advanced-topics_en-pdf-3.1-10.29.4
    • cobbler-2.6.6-5.25.1
    • spacewalk-java-config-2.7.46.19-2.41.3
    • susemanager-schema-3.1.21-2.36.1
    • susemanager-frontend-libs-3.1.2-3.10.1
    • susemanager-docs_en-3.1-10.29.4
    • spacewalk-java-postgresql-2.7.46.19-2.41.3
    • tika-core-1.20-1.6.2
    • spacewalk-utils-2.7.10.11-2.23.3
    • subscription-matcher-0.22-4.9.2
  • SUSE Manager Server 3.1 (ppc64le s390x x86_64)
    • susemanager-3.1.19-2.34.2
    • susemanager-tools-3.1.19-2.34.2
    • spacewalk-branding-2.7.2.17-2.31.3

References: