{"schemaVersion":3,"id":"SUSE-SU-2022:3878-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for SUSE Manager Server 4.2\n\n\nThis update fixes the following issues:\n\nhub-xmlrpc-api:\n\n- Use golang(API) = 1.18 for building on SUSE (bsc#1203599)\n  This source fails to build with the current go1.19 on SUSE and we\n  need to use go1.18 instead.\n\ninter-server-sync:\n\n- Version 0.2.4\n  * Improve memory usage and log information #17193\n  * Conditional insert check for FK reference exists (bsc#1202785)\n  * Correct navigation path for table rhnerratafilechannel (bsc#1202785)\n\nlocale-formula:\n\n- Update to version 0.3\n  * Remove .map.gz from kb_map dictionary (bsc#1203406)\n\npy27-compat-salt:\n\n- Fix state.apply in test mode with file state module\n  on user/group checking (bsc#1202167)\n- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)\n\npython-urlgrabber:\n\n- Fix wrong logic on find_proxy method causing proxy not being used\n  (bsc#1201788)\n\nspacecmd:\n\n- Version 4.2.20-1\n  * Remove 'Undefined return code' from debug messages (bsc#1203283)\n\nspacewalk-backend:\n\n- Version 4.2.25-1\n  * Enhance passwords cleanup and add extra files in spacewalk-debug (bsc#1201059)\n  * Prevent mixing credentials for proxy and repository server\n    while using basic authentication and avoid hiding errors\n    i.e. timeouts while having proxy settings issues\n    with extra logging in verbose mode (bsc#1201788)\n\nspacewalk-client-tools:\n\n- Version 4.2.21-1\n  * Update translation strings\n\nspacewalk-java:\n\n- Version 4.2.43-1\n  * CVE-2022-31255: Fix directory path traversal vulnerability (bsc#1204543)\n  * CVE-2022-43754: Fix reflected cross site scripting vulnerability (bsc#1204741)\n  * CVE-2022-43753: Fix arbitrary file disclosure vulnerability (bsc#1204716)\n- Version 4.2.42-1\n  * Properly pass allow vendor change to salt state (bsc#1204203)\n  * add ongres requirements to spec file (bsc#1203898)\n  * Refresh pillar data (bsc#1197724)\n  * Fix hardware update where there is no DNS FQDN changes (bsc#1203611)\n  * Use mgrnet.dns_fqdns module to improve FQDN detection (bsc#1199726)\n  * Support Pay-as-you-go new CA location for SLES15SP4\n    and higher (bsc#1202729)\n  * Detect the clients running on Amazon EC2 (bsc#1195624)\n\nspacewalk-utils:\n\n- Version 4.2.18-1\n  * Make spacewalk-hostname-rename working with settings.yaml\n    cobbler config file (bsc#1203564)\n\nspacewalk-web:\n\n- Version 4.2.30-1\n  * Upgrade moment-timezone\n\nsusemanager:\n\n- Version 4.2.38-1\n  * add venv-salt-minion to bootstrap repo (bsc#1204146)\n\nsusemanager-doc-indexes:\n\n- Documented that only SUSE clients are supported as monitoring servers\n  in the Administration Guide\n- Fixed description of default notification settings (bsc#1203422)\n- Added missing Debian 11 references\n- Removed references to Debian 9, as it is EoL, and therefore\n  unsupported by SUSE Manager\n- Document Helm deployment of the proxy on k3s and MetalLB in Installation\n  and Upgrade Guide\n- Added secure mail communication settings in Administration Guide\n- Fixed the incorrect path to state and pillar files in Salt Guide\n- Documented how pxeboot works with Secure Boot enabled in Client\n  Configuration Guide\n- Added SLE Micro 5.2 and 5.3 as available as a technology preview in\n  the Client Configuration Guide, and the IBM Z architecture for 5.1,\n  5.2, and 5.3\n\nsusemanager-docs_en:\n\n- Documented that only SUSE clients are supported as monitoring servers\n  in the Administration Guide\n- Fixed description of default notification settings (bsc#1203422)\n- Added missing Debian 11 references\n- Removed references to Debian 9, as it is EoL, and therefore\n  unsupported by SUSE Manager\n- Document Helm deployment of the proxy on k3s and MetalLB in Installation\n  and Upgrade Guide\n- Added secure mail communication settings in Administration Guide\n- Fixed the incorrect path to state and pillar files in Salt Guide\n- Documented how pxeboot works with Secure Boot enabled in Client\n  Configuration Guide\n- Added SLE Micro 5.2 and 5.3 as available as a technology preview in\n  the Client Configuration Guide, and the IBM Z architecture for 5.1,\n  5.2, and 5.3\n\nsusemanager-schema:\n\n- Version 4.2.25-1\n  * Add subtypes for Amazon EC2 virtual instances (bsc#1195624)\n\nsusemanager-sls:\n\n- Version 4.2.28-1\n  * Fix mgrnet availability check\n  * Remove dependence on Kiwi libraries\n  * Use mgrnet.dns_fqdns module to improve FQDN detection (bsc#1199726)\n  * Add mgrnet salt module with mgrnet.dns_fqnd function implementation\n    allowing to get all possible FQDNs from DNS (bsc#1199726)\n\nHow to apply this update:\n\n1. Log in as root user to the SUSE Manager server.\n2. Stop the Spacewalk service:\n`spacewalk-service stop`\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Start the Spacewalk service:\n`spacewalk-service start`","dates":{"published":"2022-11-04T14:24:46.000Z","modified":"2026-02-04T02:37:58.884Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"suse","product":"hub-xmlrpc-api&distro=SUSE Manager Server Module 4.2","name":"hub-xmlrpc-api","label":"hub-xmlrpc-api&distro=SUSE Manager Server Module 4.2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/hub-xmlrpc-api&distro=SUSE Manager Server Module 4.2","purlType":"rpm","versions":[{"text":"< 0.7-150300.3.9.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.7-150300.3.9.2","eol":null,"hubHref":null},{"vendor":"suse","product":"inter-server-sync&distro=SUSE Manager Server Module 4.2","name":"inter-server-sync","label":"inter-server-sync&distro=SUSE Manager Server Module 4.2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/inter-server-sync&distro=SUSE Manager Server Module 4.2","purlType":"rpm","versions":[{"text":"< 0.2.4-150300.8.25.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.2.4-150300.8.25.2","eol":null,"hubHref":null},{"vendor":"suse","product":"locale-formula&distro=SUSE Manager Server Module 4.2","name":"locale-formula","label":"locale-formula&distro=SUSE Manager Server Module 4.2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/locale-formula&distro=SUSE Manager Server Module 4.2","purlType":"rpm","versions":[{"text":"< 0.3-150300.3.3.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.3-150300.3.3.2","eol":null,"hubHref":null},{"vendor":"suse","product":"py27-compat-salt&distro=SUSE Manager Server Module 4.2","name":"py27-compat-salt","label":"py27-compat-salt&distro=SUSE Manager Server Module 4.2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/py27-compat-salt&distro=SUSE Manager Server Module 4.2","purlType":"rpm","versions":[{"text":"< 3000.3-150300.7.7.26.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3000.3-150300.7.7.26.2","eol":null,"hubHref":null},{"vendor":"suse","product":"python-urlgrabber&distro=SUSE Manager Server Module 4.2","name":"python-urlgrabber","label":"python-urlgrabber&distro=SUSE Manager Server Module 4.2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python-urlgrabber&distro=SUSE Manager Server Module 4.2","purlType":"rpm","versions":[{"text":"< 3.10.2.1py2_3-150300.3.3.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.10.2.1py2_3-150300.3.3.2","eol":null,"hubHref":null},{"vendor":"suse","product":"spacecmd&distro=SUSE Manager Server Module 4.2","name":"spacecmd","label":"spacecmd&distro=SUSE Manager Server Module 4.2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/spacecmd&distro=SUSE Manager Server Module 4.2","purlType":"rpm","versions":[{"text":"< 4.2.20-150300.4.30.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.2.20-150300.4.30.2","eol":null,"hubHref":null},{"vendor":"suse","product":"spacewalk-backend&distro=SUSE Manager Server Module 4.2","name":"spacewalk-backend","label":"spacewalk-backend&distro=SUSE Manager Server Module 4.2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/spacewalk-backend&distro=SUSE Manager Server Module 4.2","purlType":"rpm","versions":[{"text":"< 4.2.25-150300.4.32.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.2.25-150300.4.32.4","eol":null,"hubHref":null},{"vendor":"suse","product":"spacewalk-client-tools&distro=SUSE Manager Server Module 4.2","name":"spacewalk-client-tools","label":"spacewalk-client-tools&distro=SUSE Manager Server Module 4.2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/spacewalk-client-tools&distro=SUSE Manager Server Module 4.2","purlType":"rpm","versions":[{"text":"< 4.2.21-150300.4.27.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.2.21-150300.4.27.3","eol":null,"hubHref":null},{"vendor":"suse","product":"spacewalk-java&distro=SUSE Manager Server Module 4.2","name":"spacewalk-java","label":"spacewalk-java&distro=SUSE Manager Server Module 4.2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/spacewalk-java&distro=SUSE Manager Server Module 4.2","purlType":"rpm","versions":[{"text":"< 4.2.43-150300.3.48.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.2.43-150300.3.48.2","eol":null,"hubHref":null},{"vendor":"suse","product":"spacewalk-utils&distro=SUSE Manager Server Module 4.2","name":"spacewalk-utils","label":"spacewalk-utils&distro=SUSE Manager Server Module 4.2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/spacewalk-utils&distro=SUSE Manager Server Module 4.2","purlType":"rpm","versions":[{"text":"< 4.2.18-150300.3.21.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.2.18-150300.3.21.2","eol":null,"hubHref":null},{"vendor":"suse","product":"spacewalk-web&distro=SUSE Manager Server Module 4.2","name":"spacewalk-web","label":"spacewalk-web&distro=SUSE Manager Server Module 4.2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/spacewalk-web&distro=SUSE Manager Server Module 4.2","purlType":"rpm","versions":[{"text":"< 4.2.30-150300.3.30.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.2.30-150300.3.30.3","eol":null,"hubHref":null},{"vendor":"suse","product":"susemanager-doc-indexes&distro=SUSE Manager Server Module 4.2","name":"susemanager-doc-indexes","label":"susemanager-doc-indexes&distro=SUSE Manager Server Module 4.2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/susemanager-doc-indexes&distro=SUSE Manager Server Module 4.2","purlType":"rpm","versions":[{"text":"< 4.2-150300.12.36.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.2-150300.12.36.3","eol":null,"hubHref":null},{"vendor":"suse","product":"susemanager-docs_en&distro=SUSE Manager Server Module 4.2","name":"susemanager-docs_en","label":"susemanager-docs_en&distro=SUSE Manager Server Module 4.2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/susemanager-docs_en&distro=SUSE Manager Server Module 4.2","purlType":"rpm","versions":[{"text":"< 4.2-150300.12.36.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.2-150300.12.36.2","eol":null,"hubHref":null},{"vendor":"suse","product":"susemanager-schema&distro=SUSE Manager Server Module 4.2","name":"susemanager-schema","label":"susemanager-schema&distro=SUSE Manager Server Module 4.2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/susemanager-schema&distro=SUSE Manager Server Module 4.2","purlType":"rpm","versions":[{"text":"< 4.2.25-150300.3.30.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.2.25-150300.3.30.3","eol":null,"hubHref":null},{"vendor":"suse","product":"susemanager-sls&distro=SUSE Manager Server Module 4.2","name":"susemanager-sls","label":"susemanager-sls&distro=SUSE Manager Server Module 4.2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/susemanager-sls&distro=SUSE Manager Server Module 4.2","purlType":"rpm","versions":[{"text":"< 4.2.28-150300.3.36.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.2.28-150300.3.36.2","eol":null,"hubHref":null},{"vendor":"suse","product":"susemanager&distro=SUSE Manager Server Module 4.2","name":"susemanager","label":"susemanager&distro=SUSE Manager Server Module 4.2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/susemanager&distro=SUSE Manager Server Module 4.2","purlType":"rpm","versions":[{"text":"< 4.2.38-150300.3.44.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.2.38-150300.3.44.3","eol":null,"hubHref":null}],"affectedCount":16,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223878-1/","label":"www.suse.com/support/update/announcement/2022/suse-su-20223878-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1195624","label":"bugzilla.suse.com/1195624","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1197724","label":"bugzilla.suse.com/1197724","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1199726","label":"bugzilla.suse.com/1199726","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1200596","label":"bugzilla.suse.com/1200596","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1201059","label":"bugzilla.suse.com/1201059","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1201788","label":"bugzilla.suse.com/1201788","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1202167","label":"bugzilla.suse.com/1202167","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1202729","label":"bugzilla.suse.com/1202729","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1202785","label":"bugzilla.suse.com/1202785","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1203283","label":"bugzilla.suse.com/1203283","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1203406","label":"bugzilla.suse.com/1203406","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1203422","label":"bugzilla.suse.com/1203422","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1203564","label":"bugzilla.suse.com/1203564","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1203599","label":"bugzilla.suse.com/1203599","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1203611","label":"bugzilla.suse.com/1203611","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1203898","label":"bugzilla.suse.com/1203898","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1204146","label":"bugzilla.suse.com/1204146","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1204203","label":"bugzilla.suse.com/1204203","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1204543","label":"bugzilla.suse.com/1204543","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1204716","label":"bugzilla.suse.com/1204716","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1204741","label":"bugzilla.suse.com/1204741","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31255","label":"www.suse.com/security/cve/CVE-2022-31255","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2022-43753","label":"www.suse.com/security/cve/CVE-2022-43753","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2022-43754","label":"www.suse.com/security/cve/CVE-2022-43754","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2022-31255","CVE-2022-43753","CVE-2022-43754"],"downstream":[],"duplicates":[],"related":["CVE-2022-31255","CVE-2022-43753","CVE-2022-43754"]},"timeline":[{"kind":"published","date":"2022-11-04T14:24:46.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-02-04T02:37:58.884Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T15:05:13.649Z","stale":false,"partial":false}}