SUSE-SU-2022:1397-1: c3p0&distro=SUSE Manager Server Module 4.2 SUSE Linux Enterprise

Vulnerability summary

SUSE-SU-2022:1397-1 is a vulnerability in c3p0&distro=SUSE Manager Server Module 4.2 SUSE Linux Enterprise with no CVSS score yet.

Timeline

1. 25-04-2022
   PublishedVulnerability first disclosed.
2. 04-02-2026
   Last modifiedVulnerability information updated.

Description

Security update for SUSE Manager Server 4.2 This update fixes the following issues: c3p0: - Update to version c3p0 0.9.5.5 and mchange-commons-java 0.2.19 * Address CVE-2018-20433 * Address CVE-2019-5427 - XML-config parsing related attacks (bsc#1133198) * Properly implement the JDBC 4.1 abort method grafana-formula: - Version 0.7.0 * Add SLES 15 SP4 and openSUSE Leap 15.4 to supported versions hub-xmlrpc-api: - Updated to build on Enterprise Linux 8. inter-server-sync: - Version 0.1.0 * Allow export and import of configuration channels * Clean lookup cache after processing a channel (bsc#1195750) * Improve lookup method for generate foreign key export - Adapted for build on Enterprise Linux 8. mgr-osad: - Version 4.2.8-1 * Fix the condition for preventing building python 2 subpackage for SLE15 mgr-push: - Version 4.2.5-1 * Fix the condition for preventing building python 2 subpackage for SLE15 patterns-suse-manager: - golang-github-wrouesnel-postgres_exporter was renamed to prometheus-postgres_exporter prometheus-exporters-formula: - Version 1.2.0 * Postres exporter package was renamed for RedHat - Version 1.1.0 * Postgres exporter package was renamed for SLES/openSUSE py26-compat-msgpack-python: - Adapted to build on OBS for Enterprise Linux. rhnlib: - Version 4.2.6-1 * Fix the condition for preventing building python 2 subpackage for SLE15 saltboot-formula: - Update to version 0.1.1645440615.7f1328c * skip device lookup for correctly provided devices * improve image url modifications - preparation for ftp/http changes - Skip device lookup if correct path to device is already provided (bsc#1195757) - Improve image url modifications smdba: - Version 1.7.10 * adapt pgtune using new defaults for new postgres versions * support special configuration for SSD storage * make argument '--backup-dir' symlink aware - Version 1.7.9 - Allow different standard configuration file location for other OSes spacecmd: - Version 4.2.16-1 * implement system.bootstrap (bsc#1194909) * Fix interactive mode for 'system_applyerrata' and 'errata_apply' (bsc#1194363) spacewalk-admin: - Version 4.2.10-1 * wait after copying the CA to give systemd time to finish automation spacewalk-backend: - Version 4.2.20-1 * Fix reposync update notice formatting and date parsing (bsc#1194447) * implement more decompression algorithms for reposync (bsc#1196704) * enable check for client certificates in reposync * remove auto inherit of host entitlements for virtual guests spacewalk-branding: - Version 4.2.13-1 * Fix modal footer misalignment spacewalk-certs-tools: - Version 4.2.15-1 * Add dynamic version for bootstrap script header (bsc#1186336) spacewalk-client-tools: - Version 4.2.18-1 * Fix the condition for preventing building python 2 subpackage for SLE15 - Version 4.2.17-1 * Update translation strings spacewalk-config: - Version 4.2.6-1 * Upgrade build tooling, and corresponding cache configuration spacewalk-java: - Version 4.2.34-1 * Added new XML-RPC mathod: configchannel.syncSaltFilesOnDisk * update last checkin only if job is successful (bsc#1197007) * Fix NPE when accessing cancelled action via system history (bsc#1195762) * CVE Audit: Show patch as available in the currently installed product even if successor patch affects additional packages (bsc#1196455) * send notifications for new or changed ubuntu errata (bsc#1196977) * change directory owner and permissions only when needed * Fixed broken help link for system overview * Provide link to Sync page when unsynced patches message show up (bsc#1196094) * fix class cast exception during action chains (bsc#1195772) * Finding empty profiles by mac address must be case insensitive (bsc#1196407) * prepare to use new postgresql-jdbc driver with stringprep and saslprep support (bsc#1196693) * allow SCC to display the last check-in time for registered systems * generate the system ssh key when bootstrapping a salt-ssh client (bsc#1194909) * Provide link for CVEs * Fix lock/unlock scheduling on page Software Packages Lock (bsc#1195271) * When adding a product, check if the new vendor channels conflicts with any of the existing custom channel (bsc#1193448) * Fix disappearing metadata key files after channel change (bsc#1192822) * Suggest Product Migration when patch for CVE is in a successor Product (bsc#1191360) * Add store info to Equals and hash methods to fix CVE audit process (bsc#1195282) * Fix virtualization list rendering for foreign systems (bsc#1195712) * FIX errors when an image profile / store is deleted during build / inspect action (bsc#1191597, bsc#1192150) * Remove verbose token log (bsc#1195666) * fix ClassCastException during action processing (bsc#1195043) spacewalk-web: - Version 4.2.26-1 * Provide link to Sync page when unsynced patches message show up (bsc#1196094) * Provide a search box on section name for Formulas content * Add expand/collapse all button for formula sections * Improved large data support in channel selection * Provide link for CVEs * Improved error handling in the product setup page * Suggest Product Migration when patch for CVE is in a successor Product (bsc#1191360) * susemanager-web-libs is now packaged as a part of spacewalk-html subscription-matcher: - Version 0.29 * Migration to log4j 2 - Version 0.28 * Support both antlr3-java and antlr3-runtime as dependencies * Make it obvious that log4j12 is used supportutils-plugin-susemanager: - Version 4.2.4-1 * Get version of bootstrap scripts for supportconfig (bsc#1186336) suseRegisterInfo: - Version 4.2.6-1 * Fix the condition for preventing building python 2 subpackage for SLE15 susemanager: - Version 4.2.28-1 * set default for registration batch size susemanager-doc-indexes: - Renamed golang-github-wrouesnel-postgres_exporter to prometheus-postgres_exporter in the Administration Guide - Clarified in Client Configuration Guide and Retail Guide that mandatory channels are automatically checked. Also recommended channels as long as they are not deactivated (bsc#1173527) - In Custom Channels chapter of the Administration Guide, provide information about creating metadata (bsc#1195294) - In the Client Configuration Guide, mark Yomi as unsupported on SUSE Linux Enterprise Server 11 and 12 - Documented GPG encrypted Salt Pillars in the Salt book - In Client Configuration Guide, fixed channel configuration and registration of Expanded Support clients - Clarified channel label name in Registering Clients with RHUI section of the Client Configuration Guide (bsc#1196067) - In Throubleshooting Synchronization chapter in the Administration Guide added instructions for GPG removal - In Client Configuration Guide, integrated SUSE Linux Enterprise Micro Client documentation next to SUSE Linux Enterprise Client documentation and other related documentation improvements (bsc#1195145) - Added a warning about the origin of the salt-minion package in the Register on the Command Line (Salt) section of the Client Configuration Guide - Add troubleshooting section about avoiding package conflicts with custom channels susemanager-docs_en: - Renamed golang-github-wrouesnel-postgres_exporter to prometheus-postgres_exporter in the Administration Guide - Clarified in Client Configuration Guide and Retail Guide that mandatory channels are automatically checked. Also recommended channels as long as they are not deactivated (bsc#1173527) - In Custom Channels chapter of the Administration Guide, provide information about creating metadata (bsc#1195294) - In the Client Configuration Guide, mark Yomi as unsupported on SUSE Linux Enterprise Server 11 and 12 - Documented GPG encrypted Salt Pillars in the Salt book - In Client Configuration Guide, fixed channel configuration and registration of Expanded Support clients - Clarified channel label name in Registering Clients with RHUI section of the Client Configuration Guide (bsc#1196067) - In Throubleshooting Synchronization chapter in the Administration Guide added instructions for GPG removal - In Client Configuration Guide, integrated SUSE Linux Enterprise Micro Client documentation next to SUSE Linux Enterprise Client documentation and other related documentation improvements (bsc#1195145) - Added a warning about the origin of the salt-minion package in the Register on the Command Line (Salt) section of the Client Configuration Guide - Add troubleshooting section about avoiding package conflicts with custom channels susemanager-schema: - Version 4.2.21-1 * fix check on allowVendorChange * fix advisory status migration (bsc#1195765) * FIX error when an image profile / store is deleted during build / inspect action (bsc#1191597, bsc#1192150) susemanager-sls: - Version 4.2.21-1 * Improve `pkgset` beacon with using `salt.cache` to notify about the changes made while the minion was stopped * Align the code of pkgset beacon to prevent warnings (bsc#1194464) * fixing how the return code is returned in mgrutil runner (bsc#1194909) * Fix errors on calling sed -E ... by force_restart_minion with action chains * Avoid using lscpu -J option in grains (bsc#1195920) * Postgres exporter package was renamed * fix deprecation warnings virtualization-formulas: - Update to version 0.6.2 * Ensure qemu-ksm is installed on host How to apply this update: 1. Log in as root user to the SUSE Manager server. 2. Stop the Spacewalk service: `spacewalk-service stop` 3. Apply the patch using either zypper patch or YaST Online Update. 4. Start the Spacewalk service: `spacewalk-service start`

No weakness data has been published for this record.