Login
Newsletter
Werbung

Sicherheit: Zwei Probleme in SUSE Manager Server, SUSE Manager Proxy
Aktuelle Meldungen Distributionen
Name: Zwei Probleme in SUSE Manager Server, SUSE Manager Proxy
ID: SUSE-SU-2019:1789-1
Distribution: SUSE
Plattformen: SUSE Linux Enterprise Module for SUSE Manager Proxy 4.0, SUSE Linux Enterprise Module for SUSE Manager Server 4.0
Datum: Di, 9. Juli 2019, 22:43
Referenzen: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10137
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10136
Applikationen: SUSE Manager Proxy, SUSE Manager Server

Originalnachricht


SUSE Security Update: Security update for SUSE Manager 4.0 : Server and
Proxy
______________________________________________________________________________

Announcement ID: SUSE-SU-2019:1789-1
Rating: moderate
References: #1136476 #1136480 #1136561 #1136857 #1137955
#1138313 #1138358 #1138364 #1139693
Cross-References: CVE-2019-10136 CVE-2019-10137
Affected Products:
SUSE Linux Enterprise Module for SUSE Manager Server 4.0
SUSE Linux Enterprise Module for SUSE Manager Proxy 4.0
______________________________________________________________________________

An update that solves two vulnerabilities and has 7 fixes
is now available.

Description:


This update fixes the following issues:

spacewalk-backend:

- Do not duplicate "http://" protocol when using proxies with "deb"
repositories (bsc#1138313)
- Fix reposync when dealing with RedHat CDN (bsc#1138358)
- Fix for CVE-2019-10136. An attacker with a valid, but expired,
authenticated set of headers could move some digits around, artificially
extending the session validity without modifying the checksum.
(bsc#1136480)

spacewalk-proxy:

- Fix for CVE-2019-10137. A path traversal flaw was found in the way the
proxy processes cached client tokens. A remote, unauthenticated,
attacker could use this flaw to test the existence of arbitrary files,
or if they have access to the proxy's filesystem, execute arbitrary
code
in the context of the proxy. (bsc#1136476)

spacewalk-web:

- Change WebUI version 4.0.1

susemanager-doc-indexes:

- Updated wording for prometheus section
- Jeos VM update
- Port 8050 for graphical console display
- Content life-cycle docs are not enough for customer to understand
(bsc#1137955)
- Salt boot formula fails for SLES11 SP3 terminal (bsc#1136857)
- Certificate verify failed when using vmware esxi virtual host gatherer
(bsc#1136561)

susemanager-docs_en:

- Updated wording for prometheus section
- Jeos VM update
- Port 8050 for graphical console display
- Content life-cycle docs are not enough for customer to understand
(bsc#1137955)
- Salt boot formula fails for SLES11 SP3 terminal (bsc#1136857)
- Certificate verify failed when using vmware esxi virtual host gatherer
(bsc#1136561)

susemanager-sync-data:

- Add channel family definitions for SLES12 SP3 LTSS (bsc#1139693)
- Add OPENSUSE to allowed channel_families to make
openSUSE Leap product visible in the product list (bsc#1138364)


Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation
methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- SUSE Linux Enterprise Module for SUSE Manager Server 4.0:

zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Server-4.0-2019-1789=1

- SUSE Linux Enterprise Module for SUSE Manager Proxy 4.0:

zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Proxy-4.0-2019-1789=1



Package List:

- SUSE Linux Enterprise Module for SUSE Manager Server 4.0 (noarch):

python3-spacewalk-backend-libs-4.0.22-3.3.1
spacewalk-backend-4.0.22-3.3.1
spacewalk-backend-app-4.0.22-3.3.1
spacewalk-backend-applet-4.0.22-3.3.1
spacewalk-backend-config-files-4.0.22-3.3.1
spacewalk-backend-config-files-common-4.0.22-3.3.1
spacewalk-backend-config-files-tool-4.0.22-3.3.1
spacewalk-backend-iss-4.0.22-3.3.1
spacewalk-backend-iss-export-4.0.22-3.3.1
spacewalk-backend-package-push-server-4.0.22-3.3.1
spacewalk-backend-server-4.0.22-3.3.1
spacewalk-backend-sql-4.0.22-3.3.1
spacewalk-backend-sql-postgresql-4.0.22-3.3.1
spacewalk-backend-tools-4.0.22-3.3.1
spacewalk-backend-xml-export-libs-4.0.22-3.3.1
spacewalk-backend-xmlrpc-4.0.22-3.3.1
spacewalk-base-4.0.14-3.3.1
spacewalk-base-minimal-4.0.14-3.3.1
spacewalk-base-minimal-config-4.0.14-3.3.1
spacewalk-html-4.0.14-3.3.1
susemanager-doc-indexes-4.0-10.3.1
susemanager-docs_en-4.0-10.3.1
susemanager-docs_en-pdf-4.0-10.3.1
susemanager-sync-data-4.0.12-3.3.1
susemanager-web-libs-4.0.14-3.3.1

- SUSE Linux Enterprise Module for SUSE Manager Proxy 4.0 (noarch):

python3-spacewalk-backend-libs-4.0.22-3.3.1
spacewalk-backend-4.0.22-3.3.1
spacewalk-base-minimal-4.0.14-3.3.1
spacewalk-base-minimal-config-4.0.14-3.3.1
spacewalk-proxy-broker-4.0.12-3.3.1
spacewalk-proxy-common-4.0.12-3.3.1
spacewalk-proxy-management-4.0.12-3.3.1
spacewalk-proxy-package-manager-4.0.12-3.3.1
spacewalk-proxy-redirect-4.0.12-3.3.1
spacewalk-proxy-salt-4.0.12-3.3.1


References:

https://www.suse.com/security/cve/CVE-2019-10136.html
https://www.suse.com/security/cve/CVE-2019-10137.html
https://bugzilla.suse.com/1136476
https://bugzilla.suse.com/1136480
https://bugzilla.suse.com/1136561
https://bugzilla.suse.com/1136857
https://bugzilla.suse.com/1137955
https://bugzilla.suse.com/1138313
https://bugzilla.suse.com/1138358
https://bugzilla.suse.com/1138364
https://bugzilla.suse.com/1139693

_______________________________________________
sle-security-updates mailing list
sle-security-updates@lists.suse.com
http://lists.suse.com/mailman/listinfo/sle-security-updates
Pro-Linux
Traut euch!
Neue Nachrichten
Werbung