SUSE-SU-2022:3878-1: hub-xmlrpc-api&distro=SUSE Manager Server Module 4.2 SUSE Linux Enterprise

Vulnerability summary

SUSE-SU-2022:3878-1 is a vulnerability in hub-xmlrpc-api&distro=SUSE Manager Server Module 4.2 SUSE Linux Enterprise with no CVSS score yet.

Timeline

1. 04-11-2022
   PublishedVulnerability first disclosed.
2. 04-02-2026
   Last modifiedVulnerability information updated.

Description

Security update for SUSE Manager Server 4.2 This update fixes the following issues: hub-xmlrpc-api: - Use golang(API) = 1.18 for building on SUSE (bsc#1203599) This source fails to build with the current go1.19 on SUSE and we need to use go1.18 instead. inter-server-sync: - Version 0.2.4 * Improve memory usage and log information #17193 * Conditional insert check for FK reference exists (bsc#1202785) * Correct navigation path for table rhnerratafilechannel (bsc#1202785) locale-formula: - Update to version 0.3 * Remove .map.gz from kb_map dictionary (bsc#1203406) py27-compat-salt: - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) python-urlgrabber: - Fix wrong logic on find_proxy method causing proxy not being used (bsc#1201788) spacecmd: - Version 4.2.20-1 * Remove 'Undefined return code' from debug messages (bsc#1203283) spacewalk-backend: - Version 4.2.25-1 * Enhance passwords cleanup and add extra files in spacewalk-debug (bsc#1201059) * Prevent mixing credentials for proxy and repository server while using basic authentication and avoid hiding errors i.e. timeouts while having proxy settings issues with extra logging in verbose mode (bsc#1201788) spacewalk-client-tools: - Version 4.2.21-1 * Update translation strings spacewalk-java: - Version 4.2.43-1 * CVE-2022-31255: Fix directory path traversal vulnerability (bsc#1204543) * CVE-2022-43754: Fix reflected cross site scripting vulnerability (bsc#1204741) * CVE-2022-43753: Fix arbitrary file disclosure vulnerability (bsc#1204716) - Version 4.2.42-1 * Properly pass allow vendor change to salt state (bsc#1204203) * add ongres requirements to spec file (bsc#1203898) * Refresh pillar data (bsc#1197724) * Fix hardware update where there is no DNS FQDN changes (bsc#1203611) * Use mgrnet.dns_fqdns module to improve FQDN detection (bsc#1199726) * Support Pay-as-you-go new CA location for SLES15SP4 and higher (bsc#1202729) * Detect the clients running on Amazon EC2 (bsc#1195624) spacewalk-utils: - Version 4.2.18-1 * Make spacewalk-hostname-rename working with settings.yaml cobbler config file (bsc#1203564) spacewalk-web: - Version 4.2.30-1 * Upgrade moment-timezone susemanager: - Version 4.2.38-1 * add venv-salt-minion to bootstrap repo (bsc#1204146) susemanager-doc-indexes: - Documented that only SUSE clients are supported as monitoring servers in the Administration Guide - Fixed description of default notification settings (bsc#1203422) - Added missing Debian 11 references - Removed references to Debian 9, as it is EoL, and therefore unsupported by SUSE Manager - Document Helm deployment of the proxy on k3s and MetalLB in Installation and Upgrade Guide - Added secure mail communication settings in Administration Guide - Fixed the incorrect path to state and pillar files in Salt Guide - Documented how pxeboot works with Secure Boot enabled in Client Configuration Guide - Added SLE Micro 5.2 and 5.3 as available as a technology preview in the Client Configuration Guide, and the IBM Z architecture for 5.1, 5.2, and 5.3 susemanager-docs_en: - Documented that only SUSE clients are supported as monitoring servers in the Administration Guide - Fixed description of default notification settings (bsc#1203422) - Added missing Debian 11 references - Removed references to Debian 9, as it is EoL, and therefore unsupported by SUSE Manager - Document Helm deployment of the proxy on k3s and MetalLB in Installation and Upgrade Guide - Added secure mail communication settings in Administration Guide - Fixed the incorrect path to state and pillar files in Salt Guide - Documented how pxeboot works with Secure Boot enabled in Client Configuration Guide - Added SLE Micro 5.2 and 5.3 as available as a technology preview in the Client Configuration Guide, and the IBM Z architecture for 5.1, 5.2, and 5.3 susemanager-schema: - Version 4.2.25-1 * Add subtypes for Amazon EC2 virtual instances (bsc#1195624) susemanager-sls: - Version 4.2.28-1 * Fix mgrnet availability check * Remove dependence on Kiwi libraries * Use mgrnet.dns_fqdns module to improve FQDN detection (bsc#1199726) * Add mgrnet salt module with mgrnet.dns_fqnd function implementation allowing to get all possible FQDNs from DNS (bsc#1199726) How to apply this update: 1. Log in as root user to the SUSE Manager server. 2. Stop the Spacewalk service: `spacewalk-service stop` 3. Apply the patch using either zypper patch or YaST Online Update. 4. Start the Spacewalk service: `spacewalk-service start`

No weakness data has been published for this record.