SUSE-SU-2021:3151-1: cobbler&distro=SUSE Manager Server Module 4.1 SUSE Linux Enterprise
Published
Published 20-09-2021Last modified 02-05-2025
Vulnerability summary
SUSE-SU-2021:3151-1 is a vulnerability in cobbler&distro=SUSE Manager Server Module 4.1 SUSE Linux Enterprise with no CVSS score yet.
Priority
Insufficient evidence
No CVSS vector published; no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
Not scored
010
No CVSS score recordedEPSS scoreNot scoredRisk metrics not yet published.
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 3 · Downstream 0 · Related 3Timeline
- 20-09-2021PublishedVulnerability first disclosed.
- 02-05-2025Last modifiedVulnerability information updated.
Description
Security update for cobbler This update for cobbler fixes the following issues: Security issues fixed: - CVE-2021-40323: Fixed an arbitrary file disclosure/Template Injection (bsc#1189458) - CVE-2021-40324: Fixed an arbitrary file write (bsc#1189458) - CVE-2021-40325: Fixed a problem with the token validation (bsc#1189458) - Please note that with these changes, a valid log data from Anamon (Red Hat Autoinstallation Process) uploaded to cobbler may be rejected
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Version check
Known conditions: not stated in public data.
Suse1 product
- cobbler&distro=SUSE Manager Server Module 4.1< 3.0.0+git20190806.32c4bae0-8.22.6.1
1 vendor · 1 product
References
5 linksRelated vulnerabilities
Insufficient evidenceSUSE-SU-2022:0510-1SUSE Linux Enterprisesuse · cobbler&distro=SUSE Manager Server Module 4.1suse cobbler&distro=SUSE Manager Server Module 4.1Security update for cobbler
This update for cobbler fixes the following issues:
- CVE-2021-45083: Fixed unsafe permissions on sensitive files (bsc#1193671).
- CVE-2021-45082: Fixed incomplete template sanitation (bsc#1193678).
The following non-security bugs were fixed:
- Fix issues with installation module logging and validation (bsc#1195918)
- Move configuration files ownership to apache (bsc#1195906)
- Remove hardcoded test credentials (bsc#1193673)
- Prevent log pollution (bsc#1193675)
- Missing sanity check on MongoDB configuration file (bsc#1193676)CVSSUnscoredInsufficient evidenceSUSE-SU-2021:2098-1SUSE Linux Enterprisesuse · cobbler&distro=SUSE Manager Server Module 4.1 +22 moresuse cobbler&distro=SUSE Manager Server Module 4.1Security update for SUSE Manager Server 4.1
This update fixes the following issues:
cobbler:
- Make `fence_ipmitool` a wrapper for `fence_ipmilan` using always `lanplus`. (bsc#1184361)
- Remove unused template for `fence_ipmitool`.
- Prevent some race conditions when writting tftpboot files and the destination directory is not existing. (bsc#1186124)
- Fix trail stripping in case of using UTF symbols. (bsc#1184561)
golang-github-prometheus-node_exporter:
- Update to 1.1.2
* Bug fixes
+ Handle errors from disabled PSI subsystem
+ Sanitize strings from /sys/class/power_supply
+ Silence missing netclass errors
+ Fix ineffassign issue
+ Fix some noisy log lines
+ filesystem_freebsd: Fix label values
+ Fix various procfs parsing errors
+ Handle no data from powersupplyclass
+ udp_queues_linux.go: change upd to udp in two error strings
+ Fix node_scrape_collector_success behaviour
+ Fix NodeRAIDDegraded to not use a string rule expressions
+ Fix node_md_disks state label from fail to failed
+ Handle EPERM for syscall in timex collector
+ bcache: fix typo in a metric name
+ Fix XFS read/write stats
* Changes
+ Improve filter flag names
+ Add btrfs and powersupplyclass to list of exporters enabled by default
* Features
+ Add fibre channel collector
+ Expose cpu bugs and flags as info metrics
+ Add network_route collector
+ Add zoneinfo collector
* Enhancements
+ Add more InfiniBand counters
+ Add flag to aggr ipvs metrics to avoid high cardinality metrics
+ Adding backlog/current queue length to qdisc collector
+ Include TCP OutRsts in netstat metrics
+ Add pool size to entropy collector
+ Remove CGO dependencies for OpenBSD amd64
+ bcache: add writeback_rate_debug status
+ Add check state for mdadm arrays via node_md_state metric
+ Expose XFS inode statistics
+ Expose zfs zpool state
+ Added an ability to pass collector.supervisord.url via SUPERVISORD_URL environment variable
- Do not include sources (bsc#1151558)
- Remove rc symlink
grafana-formula:
- Fix Grafana dashboards requiring single series (bsc#1184471)
patterns-suse-manager:
- Add require for py27-compat-salt (salt 3002 does not provide
python2-salt anymore)
prometheus-exporter-formula:
- Add support for schema migration (bsc#1186025)
pxe-yomi-image-sle15:
- Remove PermitEmptyPasswords from SSH config (Fix bsc#1182744)
py26-compat-salt:
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
spacewalk-admin:
- Stop jabberd when osa-dispatcher is enabled (bsc#1185042)
spacewalk-backend:
- Fix binary blob corruptions in tradidional config file deployment (bsc#1183864)
- Fix for GPG checking on synchonizing mirrored dpkg repo (bsc#1184351)
- switch to www group for satellite logs (bsc#1185097)
- Fail traditional errata and package actions when they act on retracted items
- Add advisory_status to reposync and ISS
- Add minrate/timeout configuration values for downloading DEB/RPM packages
spacewalk-branding:
- Add the CSS class for retracted errata/packages
spacewalk-certs-tools:
- Add support of DISABLE_LOCAL_REPOS=0 for salt minions (bsc#1185568)
- Add missing environment variable SALT_RUNNING for pkg module to the minion configuration
- Fix typo: activaion -> activation
spacewalk-java:
- Change Prometheus exporters formula data schema to make it more generic and extendable
- Do not require advisory_status to be set in ErrataHandler.create (bsc#1185965)
- Speed up pages to compare or add packages to channels (bsc#1178767)
- Bugfix: Remove the unneeded check that was stopping updating a virtual instance
type (bsc#1180673)
- Exclude minions from the list of locally-managed/sandbox systems when copying config
files (bsc#1184940)
- Lower case fqdn comparation when calculating minion connection path (bsc#1184849)
- Bugfix: Retracted Patches: Filter minion correctly when executing package
install (bsc#1184929)
- Implement retracted patches
- For a SUSE system get metadata and package from same source (bsc#1184475)
- Check if the directory exists prior to modular data cleanup (bsc#1184311)
- Assign right base product for res8 (bsc#1184005)
- Fix docs link in my organization configuration (bsc#1184286)
- Only update the kickstart path in cobbler if necessary (bsc#1175216)
spacewalk-utils:
- Bugfix for ubuntu-18.04 repo urls: multiverse, restricted and backports
- Add multiverse, restricted and backports to Ubuntu 16.04, 18.04 and 20.04
spacewalk-web:
- Upgrade react-select to 4.3.0 and lodash to 4.17.21
- Show the info about unsynced patches in the Content Lifecycle Management screens
susemanager:
- Add bootstrap repo data for SUSE Manager 4.1 Proxy
- Require gio-branding-SLE for SLE15 but not for openSUSE Leap 15
- Add bootstrap repo data for OES2018-SP3-x86_64 (bsc#1183845)
- Enable bootstrap repository creation for openSUSE Leap 15.3 for Uyuni
- Add python3-distro to RES8, SLE15, Ubuntu20.04 and Debian 10 bootstrap
repositories to fix bootstrapping issues (bsc#1184332)
- Add python3-pycryptodome to Ubuntu and Debian 10 bootstrap repos (bsc#1186346)
- Add gnupg and its dependencies to debian 10 bootstrap repo
susemanager-build-keys:
- Add SUSE Linux Enterprise 15-SP3 Updates for openSUSE Leap 15.3 key (bsc#1186852)
susemanager-doc-indexes:
- Adds additional dependencies for Debian client registration
in Client Configuration Guide (bsc#1183649)
- Remove some openSUSE Leap 15.1 references
- Add reposync configuration settings to Troubleshooting chapter of
the Administration Guide
- Update the entry about module.run for SAP Guide
susemanager-docs_en:
- Adds additional dependencies for Debian client registration
in Client Configuration Guide (bsc#1183649)
- Remove some openSUSE Leap 15.1 references
- Add reposync configuration settings to Troubleshooting chapter of
the Administration Guide
- Update the entry about module.run for SAP Guide
susemanager-schema:
- DB schema & migrations for retracted patches
susemanager-sls:
- Exclude openSUSE Leap 15.3 from product installation (bsc#1186858)
- Enable certificate deployment for Leap 15.3 clients which is needed for bootstrapping (bsc#1186765)
- Do not install python2-salt on Salt 3002.2 Docker build hosts (bsc#1185506)
- Add support for 'disable_local_repos' salt minion config parameter(bsc#1185568)
- Fix insecure JMX configuration (bsc#1184617)
- Avoid conflicts with running ioloop on mgr_events engine (bsc#1172711)
- Keep salt-minion when it is installed to prevent update problems with
dependend packages not available in the bootstrap repo (bsc#1183573)
- Fix installation of gnupg on Debian 10
susemanager-sync-data:
- Add OES2018 SP3 (bsc#1183845)
tika-core:
- New upstream version 1.26.
* Infinite loop in the MP3Parser (bsc#1184892 CVE-2021-28657)
* Out of memory error while loading a file in PDFBox before 2.0.23.
* Infinite loop while loading a file in PDFBox before 2.0.23.
* System.exit vulnerability in Tika's OneNote Parser; out of memory errors and/or infinite loops in Tika's
ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser and ImageParser.
* Excessive memory usage (DoS) vulnerability in Apache Tika's PSDParser
* Infinite Loop (DoS) vulnerability in Apache Tika's PSDParser
uyuni-common-libs:
- Maintainer field in debian packages are only recommended (bsc#1186508)
How to apply this update:
1. Log in as root user to the SUSE Manager server.
2. Stop the Spacewalk service:
`spacewalk-service stop`
3. Apply the patch using either zypper patch or YaST Online Update.
4. Start the Spacewalk service:
`spacewalk-service start`CVSSUnscoredInsufficient evidenceSUSE-SU-2021:0906-1SUSE Linux Enterprisesuse · cobbler&distro=SUSE Manager Server Module 4.1 +29 moresuse cobbler&distro=SUSE Manager Server Module 4.1Security update for SUSE Manager Server 4.1
This update fixes the following issues:
cobbler:
- Fix string replacement for @@xyz@@
- Better performing string replacements
grafana-formula:
- Set `supported` to false for unsupported systems (bsc#1182001)
- Add SLES 15 SP3 and openSUSE Leap 15.3 to supported versions
mgr-libmod:
- Fix 'list_modules' JSON serialization (bsc#1182492)
mgr-osad:
- Adapt to new SSL implementation of rhnlib (bsc#1181807)
prometheus-exporters-formula:
- Add Ubuntu support for Prometheus exporters' reverse proxy
prometheus-formula:
- Set server hostname from pillar data (bsc#1180439)
py26-compat-salt:
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
rhnlib:
- Change SSL implementation to python ssl for better SAN and
hostname matching support (bsc#1181807)
smdba:
- Do not remove the database if there is no backup and deal with manifest
spacewalk-backend:
- Open repomd files as binary (bsc#1173893)
- Fix requesting Release file in debian repos (bsc#1182006)
- Reposync: Fixed Kickstart functionality.
- Reposync: Fixed URLGrabber error handling.
- Reposync: Fix modular data handling for cloned channels (bsc#1177508)
spacewalk-client-tools:
- Adapt to new SSL implementation of rhnlib (bsc#1181807)
spacewalk-config:
- Increase apache ssl logs to include response code and process time
spacewalk-java:
- Homogenizes style in filter buttons, facilitating testability
- Cleanup sessions via SQL query instead of SQL function (bsc#1180224)
- Rebuild and improve rendering of error pages 404 and 500 pages (bsc#1181228)
- Fix user creation with pam auth and no password (bsc#1179579)
- Fix action chains for saltssh minions (bsc#1182200)
- FIX: Slow response of 'Software > Install' in Ubuntu minions (bsc#1181165)
- Do not call page decorator in HEAD requests (bsc#1181228)
- Add 'mgr_origin_server' to Salt pillar data (bsc#1180439)
- Ensure new files are synced just after writing them (bsc#1175660)
- Enable openscap auditing for salt systems in SSM (bsc#1157711)
- Detect debian products (bsc#1181416)
- Show packages from channels assigned to the targeted system (bsc#1181423)
- Add an API endpoint to allow/disallow scheduling irrelevant patches (bsc#1180757)
- Open raw output in new tab for ScriptRunAction (bsc#1180547)
- Default to preferred items per page in content lifecycle lists (bsc#1180558)
- Fix modular data handling for cloned channels (bsc#1177508)
- Fix: login gets an ISE when SSO is enabled (bsc#1181048)
spacewalk-utils:
- Fix modular data handling for cloned channels (bsc#1177508)
spacewalk-web:
- Replace CRLF in ssh priv key when bootstrapping (bsc#1182685)
- Upgrade immer to fix CVE-2020-28477
- Default to preferred items per page in content lifecycle lists (bsc#1180558)
- Fix sorting in content lifecycle projects and cluster tables (bsc#1180558)
susemanager:
- Add SLE 15 SP3 bootstrap repository definitions (bsc#1182008)
- Python3-dbus-python and dependencies not installed by default
on JeOS SLE15 images, add them to the bootstrap repository list
of packages for traditional (bsc#1182071)
susemanager-doc-indexes:
- Updated Command Line Registration with Salt section in the Client
Configuration Guide for clarity.
- Adds openSUSE Leap SP migration to the SP migration section of the Client
Configuration Guide
- Adds note that bootstrap procedure for selecting a parent
channel is optional in Client Configuration Guide (bsc#1181635)
- Adds note about checking for valid UUIDs in fstab
when backing up (bsc#1181814)
- Updated command for running configure proxy script when replacing a proxy
- Fixed bad SUSE Customer Center URL
susemanager-docs_en:
- Updated Command Line Registration with Salt section in the Client
Configuration Guide for clarity.
- Adds openSUSE Leap SP migration to the SP migration section of the Client
Configuration Guide
- Adds note that bootstrap procedure for selecting a parent
channel is optional in Client Configuration Guide (bsc#1181635)
- Adds note about checking for valid UUIDs in fstab
when backing up (bsc#1181814)
- Updated command for running configure proxy script when replacing a proxy
- Fixed bad SUSE Customer Center URL
susemanager-schema:
- Drop 'pxt_session_cleanup' function (bsc#1180224)
- Enable openscap auditing for salt systems in SSM (bsc#1157711)
susemanager-sls:
- Ubuntu 18 has version of apt which does not correctly support
auth.conf.d directory. Detect the working version and use this feature
only when we have a higher version installed
xstream:
Upgrade to 1.4.15
- fixes bsc#1180146, CVE-2020-26258 and bsc#1180145, CVE-2020-26259
- fixes bsc#1180994, CVE-2020-26217
subscription-matcher:
- Update the xstream dependency to 1.4.15
How to apply this update:
1. Log in as root user to the SUSE Manager server.
2. Stop the Spacewalk service:
`spacewalk-service stop`
3. Apply the patch using either zypper patch or YaST Online Update.
4. Start the Spacewalk service:
`spacewalk-service start`CVSSUnscoredRoutineCVE-2020-11022jquery +150 morejQuery has a potential XSS vulnerabilityIn jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.CVSS6.9MediumEPSS99.22%