Maintenance update for SUSE Manager 4.3: Server, Proxy and Retail Branch Server

Announcement ID: SUSE-SU-2024:4006-1
Release Date: 2024-11-18T13:20:05Z
Rating: critical
References:
Cross-References:
CVSS scores:
  • CVE-2024-47533 ( SUSE ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVE-2024-49502 ( SUSE ): 4.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
  • CVE-2024-49502 ( SUSE ): 3.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
  • CVE-2024-49503 ( SUSE ): 4.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
  • CVE-2024-49503 ( SUSE ): 3.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Affected Products:
  • openSUSE Leap 15.3
  • openSUSE Leap 15.4
  • openSUSE Leap 15.5
  • openSUSE Leap 15.6
  • SUSE Linux Enterprise Desktop 15
  • SUSE Linux Enterprise Desktop 15 SP1
  • SUSE Linux Enterprise Desktop 15 SP2
  • SUSE Linux Enterprise Desktop 15 SP3
  • SUSE Linux Enterprise Desktop 15 SP4
  • SUSE Linux Enterprise Desktop 15 SP5
  • SUSE Linux Enterprise Desktop 15 SP6
  • SUSE Linux Enterprise High Performance Computing 15
  • SUSE Linux Enterprise High Performance Computing 15 SP1
  • SUSE Linux Enterprise High Performance Computing 15 SP2
  • SUSE Linux Enterprise High Performance Computing 15 SP3
  • SUSE Linux Enterprise High Performance Computing 15 SP4
  • SUSE Linux Enterprise High Performance Computing 15 SP5
  • SUSE Linux Enterprise Micro 5.0
  • SUSE Linux Enterprise Micro 5.1
  • SUSE Linux Enterprise Micro 5.2
  • SUSE Linux Enterprise Micro 5.3
  • SUSE Linux Enterprise Micro 5.4
  • SUSE Linux Enterprise Micro 5.5
  • SUSE Linux Enterprise Real Time 15 SP1
  • SUSE Linux Enterprise Real Time 15 SP2
  • SUSE Linux Enterprise Real Time 15 SP3
  • SUSE Linux Enterprise Real Time 15 SP4
  • SUSE Linux Enterprise Real Time 15 SP5
  • SUSE Linux Enterprise Real Time 15 SP6
  • SUSE Linux Enterprise Server 15
  • SUSE Linux Enterprise Server 15 SP1
  • SUSE Linux Enterprise Server 15 SP2
  • SUSE Linux Enterprise Server 15 SP3
  • SUSE Linux Enterprise Server 15 SP4
  • SUSE Linux Enterprise Server 15 SP5
  • SUSE Linux Enterprise Server 15 SP6
  • SUSE Linux Enterprise Server for SAP Applications 15
  • SUSE Linux Enterprise Server for SAP Applications 15 SP1
  • SUSE Linux Enterprise Server for SAP Applications 15 SP2
  • SUSE Linux Enterprise Server for SAP Applications 15 SP3
  • SUSE Linux Enterprise Server for SAP Applications 15 SP4
  • SUSE Linux Enterprise Server for SAP Applications 15 SP5
  • SUSE Linux Enterprise Server for SAP Applications 15 SP6
  • SUSE Manager Client Tools for SLE 15
  • SUSE Manager Client Tools for SLE Micro 5
  • SUSE Manager Proxy 4.3
  • SUSE Manager Proxy 4.3 Module 4.3
  • SUSE Manager Retail Branch Server 4.3
  • SUSE Manager Server 4.3
  • SUSE Manager Server 4.3 Module 4.3

An update that solves three vulnerabilities, contains one feature and has 50 security fixes can now be installed.

Security update for SUSE Manager Proxy and Retail Branch Server 4.3

Description:

This update fixes the following issues:

mgr-daemon:

  • Version 4.3.11-0
  • Update translation strings

spacecmd:

  • Version 4.3.29-0
  • Speed up softwarechannel_removepackages (bsc#1227606)

spacewalk-backend:

  • Version 4.3.30-0
  • Make ISSv1 timezone independent (bsc#1221505)
  • reposync: introduce timeout when syncing DEB channels (bsc#1225960)
  • yum_src: use proper name variable name for subprocess.TimeoutExpired
  • Check and populate PTF attributes at the time of importing packages (bsc#1225619)
  • reposync: import GPG keys to RPM DB individually (bsc#1217003)
  • Add log string to the journal when services are stopped because of insufficient disk space

spacewalk-certs-tools:

  • Version 4.3.26-0
  • Fix private key format in jabberd certificate file (bsc#1228851)
  • Fix parsing Authority Key Identifier when keyid is not prefixed (bsc#1229079)
  • Support multiple certificates for root-ca-file and server-cert-file

spacewalk-client-tools:

  • Version 4.3.21-0

  • Update translation strings

spacewalk-proxy:

  • Version 4.3.19-0

  • Allow execute of ssh-keygen command on the Proxy to clean up SSH known_hosts (bsc#1228345)

spacewalk-web:

  • Security issues fixed:

  • Version 4.3.42-0

    • CVE-2024-49503: Escape organization credentials username to mitigate XSS vulnerability (bsc#1231922)

  • Version 4.3.41-0

    • CVE-2024-49502: Validate proxy hostname format and escape proxy username to mitigate XSS vulnerabilities (bsc#1231852)

  • Bugs fixed:

  • Version 4.3.40-0

    • Fix channel selection using SSM (bsc#1226917)
    • Fix datetime selection when using maintenance windows (bsc#1228036)

susemanager-build-keys:

  • Extended 2048 bit SUSE SLE 12, 15 GA-SP5 key until 2028. (bsc#1229339)

uyuni-common-libs:

  • Version 4.3.11-0

  • Enforce directory permissions at repo-sync when creating directories (bsc#1229260)

  • Make ISSv1 timezone independent (bsc#1221505)

uyuni-proxy-systemd-services:

  • version 4.3.14-0

  • Update to SUSE Manager 4.3.14

How to apply this update:

  1. Log in as root user to the SUSE Manager Proxy or Retail Branch Server.
  2. Stop the proxy service: spacewalk-proxy stop
  3. Apply the patch using either zypper patch or YaST Online Update.
  4. Start the Spacewalk service: spacewalk-proxy start

Security update for SUSE Manager Server 4.3

Description:

This update fixes the following issues:

cobbler:

  • Security issues fixed:

  • CVE-2024-47533: Prevent privilege escalation from none to admin (bsc#1231332)

  • Other bugs fixed:

  • Increase start timeout for cobblerd unit (bsc#1219450)

  • Provide sync_single_system for DHCP modules to improve performance (bsc#1219450)
  • Add input_string_*, input_boolean, input_int functions to public API
  • Add new setting for Uyuni authentication endpoint (bsc#1219887)

grafana-formula:

  • Version 0.11.0
  • Add SLES 15 SP6 to supported versions (bsc#1228286)

inter-server-sync:

  • Version 0.3.5-0
  • Decode boolean values for export (bsc#1228545)

saltboot-formula:

  • Update to version 0.1.1723628891.ffb1da5
  • Rework request stop function to avoid unnecessary warnings (bsc#1212985)

spacecmd:

  • Version 4.3.29-0
  • Speed up softwarechannel_removepackages (bsc#1227606)

spacewalk-backend:

  • Version 4.3.30-0
  • Make ISSv1 timezone independent (bsc#1221505)
  • reposync: introduce timeout when syncing DEB channels (bsc#1225960)
  • yum_src: use proper name variable name for subprocess.TimeoutExpired
  • Check and populate PTF attributes at the time of importing packages (bsc#1225619)
  • reposync: import GPG keys to RPM DB individually (bsc#1217003)
  • Add log string to the journal when services are stopped because of insufficient disk space

spacewalk-certs-tools:

  • Version 4.3.26-0
  • Fix private key format in jabberd certificate file (bsc#1228851)
  • Fix parsing Authority Key Identifier when keyid is not prefixed (bsc#1229079)
  • Support multiple certificates for root-ca-file and server-cert-file

spacewalk-client-tools:

  • Version 4.3.21-0
  • Update translation strings

spacewalk-config:

  • Version 4.3.14-0
  • Trust the Content-Length header from AJP (bsc#1226439)

spacewalk-java:

  • Version 4.3.82-0
  • Limit frontend-log message size (bsc#1231900)
  • Version 4.3.81-0
  • Add detection of Ubuntu 24.04
  • Version 4.3.80-0
  • Use custom select instead of errata view for better performance (bsc#1225619)
  • Version 4.3.79-0
  • Add info URL for cobbler to clean the system profile (bsc#1219645)
  • Require correct scap packages for Ubuntu
  • Require correct scap packages for Debian 12 (bsc#1227746)
  • Fix finding system_checkin_threshold configuration value on Sytems Overview page (bsc#1224108)
  • Allow changing base channel to SUSE Liberty Linux LTSS when the system is on Liberty (bsc#1228326)
  • Implement product migration from RHEL and Clones to SUSE Liberty Linux
  • Remove system also from proxy SSH known_hosts (bsc#1228345)
  • Fix NullPointerException when generating subscription matcher input (bsc#1228638)
  • Allow free products and SUSE Manager Proxy being managed by SUSE Manager Server PAYG
  • Open bootstrap script directory URL in a new page (bsc#1225603)
  • Delay package list refresh when Salt was updated (bsc#1217978)
  • Add SLE Micro 5 to the list of systems which support monitoring (bsc#1227334)
  • Add all SLE Micro systems to the list of systems which get PTF repositories
  • Update last sync refresh timestamp only when at least one time products were synced before
  • Prevent NullPointerException when listing history events without completion time (bsc#1146701)
  • Autoinstallation: prevent issues with duplicate IP address due to some networks (bsc#1226461)
  • Improve SQL queries and performance to check for PTF packages (bsc#1225619)
  • Check the correct Salt package before product migration (bsc#1224209)
  • Fix the date format output when using the HTTP API to use ISO 8601 format (bsc#1227543)
  • Fix transactional update check for SL Micro (bsc#1227406)
  • Improve score comparison in system search to fix ISE (bsc#1228412)
  • Fix package profile update on CentOS 7 when yum-utils is not installed (bsc#1227133)

spacewalk-utils:

  • Version 4.3.22-0
  • Add repositories for Ubuntu 24.04 LTS
  • Version 4.3.21-0
  • Drop unsupported tool spacewalk-final-archive as it is broken and may disclose sensitive information (bsc#1228945)

spacewalk-web:

  • Security issues fixed:

  • Version 4.3.42-0

    • CVE-2024-49503: Escape organization credentials username to mitigate XSS vulnerability (bsc#1231922)

  • Version 4.3.41-0

    • CVE-2024-49502: Validate proxy hostname format and escape proxy username to mitigate XSS vulnerabilities (bsc#1231852)

  • Bugs fixed:

  • Version 4.3.40-0

    • Fix channel selection using SSM (bsc#1226917)
    • Fix datetime selection when using maintenance windows (bsc#1228036)

susemanager:

  • Version 4.3.39-0
  • Enable bootstrapping for Ubuntu 24.04 LTS
  • Version 4.3.38-0
  • Add missing package python3-ply to bootstrap repo definition (bsc#1228130)
  • Create special bootstrap data for SUSE Manager Server 4.3 with LTSS updates for Hub scenario (bsc#1211899)
  • Add LTSS updates to SUSE Manager Proxy 4.3 bootstrap data
  • Add traditional stack to boostrap repo on sles15sp6 (bsc#1228147)
  • Change package to libdbus-glib-1-2 on sle15sp6 (bsc#1228147)

susemanager-build-keys:

  • Extended 2048 bit SUSE SLE 12, 15 GA-SP5 key until 2028. (bsc#1229339)

susemanager-docs_en:

  • Documented Ubuntu 24.04 LTS as a supported client OS in Client
  • SUSE Manager 4.3.14 documentation update
  • In network ports section, deleted partially outdated image, added port 443 for clients, and removed Cobbler only used internally (bsc#1217338)
  • Added installer-updates.suse.com to the list of URLs in Installation and Upgrade Guide (bsc#1229178)
  • Enhanced instructions about the permissions for the IAM role in Public Cloud Guide
  • Fixed OS minor number in Client Configuration Guide (bsc#1218090)
  • Added warning about Package Hub (bsc#1221435)
  • Removed Verify Packages section from Package Management chapter in Client Configuration Guide
  • Added note about usernames in PAM section in Administration Guide (bsc#1227599)
  • Updated Content Lifecycle Management (CLM) examples for Red Hat Enterprise Linux 9 (bsc#1226687)
  • Added VM based proxy installation in Installation and Upgrade Guide
  • Fixed PostgreSQL name entity
  • Improved Large Deployments Guide with better tuning values and extra parameters added
  • Updated lists of SUSE Linux Enterprise hardening profiles in openSCAP chapter in the Administration Guide

susemanager-schema:

  • Version 4.3.27-0
  • Introduce new attributes to detect PTF packages (bsc#1225619)

susemanager-sls:

  • Version 4.3.45-0
  • Start using DEB822 format for repository sources beginning with Ubuntu 24.04
  • Version 4.3.44-0
  • Speed-up mgrutil.remove_ssh_known_host runner (bsc#1223312)
  • Implement product migration from RHEL and clones to SUSE Liberty Linux
  • Disable transactional-update.timer on SLEM at bootstrap
  • Explicitly remove old venv-minion environment when updating Python versions
  • sumautil: properly detect bridge interfaces (bsc#1226461)
  • Fix typo on directories to clean up when deleting a system (bsc#1228101)
  • Translate GPG URL if it has server name and client behind proxy (bsc#1223988)
  • Fix yum-utils package missing on CentOS7 minions (bsc#1227133)
  • Implement IMDSv2 for AWS instance detection (bsc#1226090)
  • Fix package profile update on CentOS 7 when yum-utils is not installed (bsc#1227133)
  • Fix parsing passwords with special characters for PostgreSQL exporter

susemanager-sync-data:

  • Version 4.3.21-0
  • Add SLES15-SP5-LTSS channel families
  • Add MicroOS PPC channel family
  • Version 4.3.20-0
  • Add Ubuntu 24.04 support
  • Version 4.3.19-0
  • Fix CentOS 7 repo urls (bsc#1227526)
  • Add channel family for SLES 12 SP5 LTSS Extended Security
  • Implement product migration from RHEL and clones to SUSE Liberty Linux

uyuni-common-libs:

  • Version 4.3.11-0
  • Enforce directory permissions at repo-sync when creating directories (bsc#1229260)
  • Make ISSv1 timezone independent (bsc#1221505)

uyuni-reportdb-schema:

  • Version 4.3.11-0
  • Change Errata CVE column to type text as a varchar reaches the maximum (bsc#1226478)

How to apply this update:

  1. Log in as root user to the SUSE Manager Server.
  2. Stop the Spacewalk service: spacewalk-service stop
  3. Apply the patch using either zypper patch or YaST Online Update.
  4. Start the Spacewalk service: spacewalk-service start

Recommended update for SUSE Manager Client Tools

Description:

This update fixes the following issues:

uyuni-proxy-systemd-services:

  • version 4.3.14-0
  • Update to SUSE Manager 4.3.14

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE Manager Client Tools for SLE Micro 5
    zypper in -t patch SUSE-SLE-Manager-Tools-For-Micro-5-2024-4006=1
  • SUSE Manager Proxy 4.3 Module 4.3
    zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Proxy-4.3-2024-4006=1
  • SUSE Manager Server 4.3 Module 4.3
    zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Server-4.3-2024-4006=1
  • SUSE Manager Client Tools for SLE 15
    zypper in -t patch SUSE-SLE-Manager-Tools-15-2024-4006=1

Package List:

  • SUSE Manager Client Tools for SLE Micro 5 (noarch)
    • uyuni-proxy-systemd-services-4.3.14-150000.1.27.4
  • SUSE Manager Proxy 4.3 Module 4.3 (noarch)
    • spacewalk-proxy-redirect-4.3.19-150400.3.29.9
    • python3-spacewalk-certs-tools-4.3.26-150400.3.36.7
    • spacewalk-proxy-package-manager-4.3.19-150400.3.29.9
    • spacewalk-client-tools-4.3.21-150400.3.33.11
    • uyuni-proxy-systemd-services-4.3.14-150000.1.27.4
    • mgr-daemon-4.3.11-150400.3.21.6
    • spacewalk-base-minimal-4.3.42-150400.3.52.1
    • spacewalk-backend-4.3.30-150400.3.47.16
    • spacecmd-4.3.29-150400.3.42.8
    • spacewalk-proxy-salt-4.3.19-150400.3.29.9
    • python3-spacewalk-client-setup-4.3.21-150400.3.33.11
    • python3-spacewalk-client-tools-4.3.21-150400.3.33.11
    • spacewalk-certs-tools-4.3.26-150400.3.36.7
    • spacewalk-client-setup-4.3.21-150400.3.33.11
    • spacewalk-proxy-common-4.3.19-150400.3.29.9
    • susemanager-build-keys-15.4.10-150400.3.29.4
    • spacewalk-proxy-broker-4.3.19-150400.3.29.9
    • susemanager-build-keys-web-15.4.10-150400.3.29.4
    • python3-spacewalk-check-4.3.21-150400.3.33.11
    • spacewalk-proxy-management-4.3.19-150400.3.29.9
    • spacewalk-check-4.3.21-150400.3.33.11
    • spacewalk-base-minimal-config-4.3.42-150400.3.52.1
  • SUSE Manager Proxy 4.3 Module 4.3 (x86_64)
    • python3-uyuni-common-libs-4.3.11-150400.3.21.6
  • SUSE Manager Server 4.3 Module 4.3 (noarch)
    • spacewalk-backend-sql-postgresql-4.3.30-150400.3.47.16
    • spacewalk-taskomatic-4.3.82-150400.3.96.1
    • spacewalk-backend-sql-4.3.30-150400.3.47.16
    • spacewalk-java-4.3.82-150400.3.96.1
    • susemanager-schema-utility-4.3.27-150400.3.45.11
    • spacewalk-backend-config-files-common-4.3.30-150400.3.47.16
    • susemanager-schema-4.3.27-150400.3.45.11
    • python3-spacewalk-certs-tools-4.3.26-150400.3.36.7
    • spacewalk-backend-applet-4.3.30-150400.3.47.16
    • spacewalk-java-postgresql-4.3.82-150400.3.96.1
    • spacewalk-backend-server-4.3.30-150400.3.47.16
    • spacewalk-client-tools-4.3.21-150400.3.33.11
    • susemanager-docs_en-pdf-4.3.14-150400.9.66.2
    • susemanager-docs_en-4.3.14-150400.9.66.2
    • spacewalk-backend-xmlrpc-4.3.30-150400.3.47.16
    • spacewalk-backend-package-push-server-4.3.30-150400.3.47.16
    • spacewalk-base-minimal-4.3.42-150400.3.52.1
    • spacewalk-backend-config-files-4.3.30-150400.3.47.16
    • spacewalk-backend-4.3.30-150400.3.47.16
    • spacecmd-4.3.29-150400.3.42.8
    • spacewalk-base-4.3.42-150400.3.52.1
    • python3-spacewalk-client-tools-4.3.21-150400.3.33.11
    • spacewalk-backend-config-files-tool-4.3.30-150400.3.47.16
    • spacewalk-certs-tools-4.3.26-150400.3.36.7
    • spacewalk-backend-iss-export-4.3.30-150400.3.47.16
    • spacewalk-html-4.3.42-150400.3.52.1
    • susemanager-build-keys-15.4.10-150400.3.29.4
    • saltboot-formula-0.1.1723628891.ffb1da5-150400.3.18.4
    • spacewalk-utils-4.3.22-150400.3.29.2
    • susemanager-build-keys-web-15.4.10-150400.3.29.4
    • spacewalk-backend-xml-export-libs-4.3.30-150400.3.47.16
    • spacewalk-java-config-4.3.82-150400.3.96.1
    • susemanager-sls-4.3.45-150400.3.55.4
    • spacewalk-java-lib-4.3.82-150400.3.96.1
    • spacewalk-backend-app-4.3.30-150400.3.47.16
    • uyuni-config-modules-4.3.45-150400.3.55.4
    • spacewalk-backend-iss-4.3.30-150400.3.47.16
    • spacewalk-utils-extras-4.3.22-150400.3.29.2
    • cobbler-3.3.3-150400.5.52.3
    • spacewalk-backend-tools-4.3.30-150400.3.47.16
    • susemanager-sync-data-4.3.21-150400.3.35.2
    • uyuni-reportdb-schema-4.3.11-150400.3.18.12
    • spacewalk-base-minimal-config-4.3.42-150400.3.52.1
    • spacewalk-config-4.3.14-150400.3.18.6
    • grafana-formula-0.11.0-150400.3.21.4
  • SUSE Manager Server 4.3 Module 4.3 (ppc64le s390x x86_64)
    • susemanager-4.3.39-150400.3.58.5
    • inter-server-sync-0.3.5-150400.3.36.13
    • python3-uyuni-common-libs-4.3.11-150400.3.21.6
    • susemanager-tools-4.3.39-150400.3.58.5
    • inter-server-sync-debuginfo-0.3.5-150400.3.36.13
  • SUSE Manager Client Tools for SLE 15 (noarch)
    • uyuni-proxy-systemd-services-4.3.14-150000.1.27.4

References: