Login
Newsletter
Werbung

Sicherheit: Zwei Probleme in SUSE Manager Server, SUSE Manager Proxy
Aktuelle Meldungen Distributionen
Name: Zwei Probleme in SUSE Manager Server, SUSE Manager Proxy
ID: SUSE-SU-2019:1790-1
Distribution: SUSE
Plattformen: SUSE Manager Server 3.2, SUSE Manager Proxy 3.2
Datum: Di, 9. Juli 2019, 22:41
Referenzen: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10136
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10137
Applikationen: SUSE Manager Proxy, SUSE Manager Server

Originalnachricht


SUSE Security Update: Security update for SUSE Manager 3.2 : Server and
Proxy
______________________________________________________________________________

Announcement ID: SUSE-SU-2019:1790-1
Rating: moderate
References: #1102770 #1136476 #1136480
Cross-References: CVE-2019-10136 CVE-2019-10137
Affected Products:
SUSE Manager Server 3.2
SUSE Manager Proxy 3.2
______________________________________________________________________________

An update that solves two vulnerabilities and has one
errata is now available.

Description:


This update fixes the following issues:

release-notes-susemanager:

- Fix invalid characters in ncurses mode (bsc#1102770)

release-notes-susemanager-proxy:

- Fix invalid characters in ncurses mode (bsc#1102770)

spacewalk-backend:

- Fix for CVE-2019-10136. An attacker with a valid, but expired,
authenticated set of headers could move some digits around, artificially
extending the session validity without modifying the checksum.
(bsc#1136480)

spacewalk-proxy:

- Fix for CVE-2019-10137. A path traversal flaw was found in the way the
proxy processes cached client tokens. A remote, unauthenticated,
attacker could use this flaw to test the existence of arbitrary files,
or if they have access to the proxy's filesystem, execute arbitrary
code
in the context of the proxy. (bsc#1136476)

spacewalk-web:

- Change WebUI string version to 3.2.9


Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation
methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- SUSE Manager Server 3.2:

zypper in -t patch SUSE-SUSE-Manager-Server-3.2-2019-1790=1

- SUSE Manager Proxy 3.2:

zypper in -t patch SUSE-SUSE-Manager-Proxy-3.2-2019-1790=1



Package List:

- SUSE Manager Server 3.2 (ppc64le s390x x86_64):

release-notes-susemanager-3.2.9-6.35.1

- SUSE Manager Server 3.2 (noarch):

spacewalk-backend-2.8.57.17-3.33.1
spacewalk-backend-app-2.8.57.17-3.33.1
spacewalk-backend-applet-2.8.57.17-3.33.1
spacewalk-backend-config-files-2.8.57.17-3.33.1
spacewalk-backend-config-files-common-2.8.57.17-3.33.1
spacewalk-backend-config-files-tool-2.8.57.17-3.33.1
spacewalk-backend-iss-2.8.57.17-3.33.1
spacewalk-backend-iss-export-2.8.57.17-3.33.1
spacewalk-backend-libs-2.8.57.17-3.33.1
spacewalk-backend-package-push-server-2.8.57.17-3.33.1
spacewalk-backend-server-2.8.57.17-3.33.1
spacewalk-backend-sql-2.8.57.17-3.33.1
spacewalk-backend-sql-oracle-2.8.57.17-3.33.1
spacewalk-backend-sql-postgresql-2.8.57.17-3.33.1
spacewalk-backend-tools-2.8.57.17-3.33.1
spacewalk-backend-xml-export-libs-2.8.57.17-3.33.1
spacewalk-backend-xmlrpc-2.8.57.17-3.33.1
spacewalk-base-2.8.7.17-3.30.1
spacewalk-base-minimal-2.8.7.17-3.30.1
spacewalk-base-minimal-config-2.8.7.17-3.30.1
spacewalk-html-2.8.7.17-3.30.1
susemanager-web-libs-2.8.7.17-3.30.1

- SUSE Manager Proxy 3.2 (noarch):

spacewalk-backend-2.8.57.17-3.33.1
spacewalk-backend-libs-2.8.57.17-3.33.1
spacewalk-base-minimal-2.8.7.17-3.30.1
spacewalk-base-minimal-config-2.8.7.17-3.30.1
spacewalk-proxy-broker-2.8.5.6-3.11.1
spacewalk-proxy-common-2.8.5.6-3.11.1
spacewalk-proxy-management-2.8.5.6-3.11.1
spacewalk-proxy-package-manager-2.8.5.6-3.11.1
spacewalk-proxy-redirect-2.8.5.6-3.11.1
spacewalk-proxy-salt-2.8.5.6-3.11.1
susemanager-web-libs-2.8.7.17-3.30.1

- SUSE Manager Proxy 3.2 (x86_64):

release-notes-susemanager-proxy-3.2.9-0.16.27.1


References:

https://www.suse.com/security/cve/CVE-2019-10136.html
https://www.suse.com/security/cve/CVE-2019-10137.html
https://bugzilla.suse.com/1102770
https://bugzilla.suse.com/1136476
https://bugzilla.suse.com/1136480

_______________________________________________
sle-security-updates mailing list
sle-security-updates@lists.suse.com
http://lists.suse.com/mailman/listinfo/sle-security-updates
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung