Affected Products: Subscription Management Tool for SUSE Linux Enterprise 11-SP3 ______________________________________________________________________________
An update that solves three vulnerabilities and has two fixes is now available.
Description:
This update for smt to 2.0.34 fixes the following issues:
These security issues were fixed:
- CVE-2018-12471: Xml External Entity processing in the RegistrationSharing modules allowed to read arbitrary file read (bsc#1103809) - CVE-2018-12470: SQL injection in RegistrationSharing module allows remote attackers to run arbitary SQL statements (bsc#1103810) - CVE-2018-12472: Authentication bypass in sibling check facilitated further attacks on SMT (bsc#1104076)
SUSE would like to thank Jake Miller for reporting these issues to us.
This non-security issue was fixed:
- More verbose incomplete registration logging (bsc#1072921, bsc#1074608)
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- Subscription Management Tool for SUSE Linux Enterprise 11-SP3:
zypper in -t patch slesmtsp3-smt-13798=1
Package List:
- Subscription Management Tool for SUSE Linux Enterprise 11-SP3 (i586 s390x x86_64):
