SUSE-RU-2023:2566-1

SUSE-RU-2023:2566-1 · Security update for SUSE Manager Server 4.3

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

This update fixes the following issues: branch-network-formula: - Update to version 0.1.1680167239.23f2fec * Remove unnecessary import of 'salt.ext.six' cobbler: - Fix cobbler buildiso so that the artifact can be booted by EFI firmware. (bsc#1206060) - Switch packaging from patch based to Git tree based development - S390X systems require their kernel options to have a linebreak at 79 characters (bsc#1207595) - Settings-migration-v1-to-v2.sh will now handle paths with whitespace correctly - Fix renaming Cobbler items (bsc#1204900, bsc#1209149) - 'cobbler buildiso' arguments '--system' and '--profile' are now accepted in the right order (bsc#1210776) cpu-mitigations-formula: - Update to version 0.5.0: * Mark all SUSE Linux Enterprise 15 SP4 and newer and openSUSE 15.4 and newer as supported (bsc#1210835) hub-xmlrpc-api: - Do not strictly require Go 1.18 on SUSE Linux Enterprise 15 SP3 (bsc#1203599) perl-Satcon: - Version 4.3.2-1 * Accept keys with dots python-urlgrabber: - Raise proper exception from urlgrab() when local file is not found (bsc#1208288) spacecmd: - Version 4.3.21-1 * Fix argument parsing of distribution_update (bsc#1210458) - Version 4.3.20-1 * Display activation key details after executing the corresponding command (bsc#1208719) * Show targetted packages before actually removing them (bsc#1207830) spacewalk-admin: - Version 4.3.11-1 * change backup file extension from .orig to .current_time (bsc#1206783) spacewalk-backend: - Version 4.3.21-1 * Add package details to reposync error logging * Fix the mgr-inter-sync not creating valid repository metadata when dealing with empty channels (bsc#1207829) * Filter CLM modular packages using release strings (bsc#1207814) * Fix issues with kickstart syncing on mirrorlist repositories * Do not sync .mirrorlist and other non needed files * reposync: catch local file not found urlgrabber error properly (bsc#1208288) - Version 4.3.20-1 * Fix repo sync for cloud payg connected repositories (bsc#1208772) spacewalk-config: - Version 4.3.10-1 * Add /saltboot directory * Mark /os-images and /tftp as static content spacewalk-java: - Security fixes included in this version update from 4.3.52-1 to 4.3.58-1: * CVE-2023-22644: Fix session information leak (bsc#1210107) * CVE-2023-22644: Do not output cobbler xmlrpc token in debug logs (bsc#1210162) * CVE-2023-22644: fix credentials and other secrets disclosure when debug log is enabled (bsc#1210154) * CVE-2023-22644: Don't output URL parameters for tiny urls (bsc#1210101) * CVE-2023-22644: Do not log SSL certificate / key file content (bsc#1210094) * CVE-2023-22644: Remove web session swap secrets output in logs (bsc#1210086) - Non-security bug fixes included in this version update from 4.3.52-1 to 4.3.58-1: * Version 4.3.58-1 + Make sure that all hibernate connections are closed (bsc#1208687) * Version 4.3.57-1 + Update version of tomcat build dependencies * Version 4.3.55-1 + Fix breadcrumbs on recurring actions pages * Version 4.3.54-1 + Kernel options: only add quotes if there is a space in the value (bsc#1209926) * Version 4.3.53-1 + Update Cobbler profile when a new image is deployed + Add mapping of image URLs for containerized proxy + Remove channels from client after transfer to a different organization (bsc#1209220) + Fix RHEL9 / SLL9 product discovery (bsc#1209993) + Fix displaying system channels when no base product is installed (bsc#1206423) + Fix NPE in cobbler system sync when server has no creator set + Recurring custom states + Removed the expensive 'diff' column (bsc#1208427) + Fix possible 'NullPointerException' when clicking on the 'Create PXE installation configuration' button from Provising page + Fix possible 'NullPointerException' issues when running cobbler-sync-bunch + Do not trigger extra cobbler sync when changing kickstart data (bsc#1208536) + Set jasper development mode to false (bsc#1206191) + Fixed select all for ptf packages list (bsc#1209143) + Added SLES 12 support for ptf removal + Fixed issue with checking ptf repositories on cloned channels + Add support to add optional channels via webUI + Added APIs to allow frontend to install and remove ptf + Show the package summary where applicable to better describe PTF packages + Added CLM filters to match product temporary fixes packages + Restrict product temporary fixes visibility in the UI and in the APIs responses + Fixed empty selection warning in the lock/unlock page + Set GPG Key Url for PTF repositories + Fix deleting custom info pillar (bsc#1209253) + Update report outdated system query to de-duplicate errata id's + Refactor Software / Manage / Packages to use SQL paging (bsc#1206725) + Filter CLM modular packages using release strings (bsc#1207814) + Fix systems subscribed to channel CSV download (bsc#1201063) + Fix cobbler system entries for retail terminals (bsc#1208661) + Make API method systemgroup.listSystemsMinimal read-only (bsc#1208550) + Add missing text for user preferenaces page + Do not include channels from different orgs when listing mandatory channels (bsc#1204270) + Save scheduler user when creating Patch actions manually (bsc#1208321) * Version 4.3.52-1 + Add more restricted arguments to prevent HTTP API logging sensitive data (bsc#1209386, bsc#1209395) * Version 4.3.51-1 + Support multiple gpgkey urls for a channel (bsc#1208540) spacewalk-search: - Version 4.3.9-1 * Add maxPoolSize option to search spacewalk-setup: - Version 4.3.16-1 * Enable netapi clients in master configuration (required for Salt 3006) * Persist report_db_sslrootcert value (bsc#1210349) * Fix migration test * Escape `%` in spec file. * remove useless tomcat configuration (bsc#1206191) * use template for reportdb configuration (bsc#1206783) spacewalk-web: - Version 4.3.31-1 * Fix title on recurring actions edit page - Version 4.3.30-1 * Disable login button with empty password * Ignore mandatory channels results that don't match list of channels (bsc#1204270) * Increase datetimepicker font sizes (bsc#1210437) * Recurring custom states * fix an issue where the datetimepicker shows wrong date (bsc#1209231) * Add support to add optional channels via webUI * Added pages to install and remove ptf * Added CLM filters to match product temporary fixes packages * Refactor Software / Manage / Packages to use SQL paging (bsc#1206725) subscription-matcher: - Relax antlr version requirement supportutils-plugin-susemanager: - Version 4.3.7-1 * fix db connection check tool (bsc#1208586) susemanager: - version 4.3.27-1 * Use newest venv-salt-minion version available to generate the venv-enabled-*.txt file in bootstrap repos (bsc#1211958) - Version 4.3.26-1 * Add bootstrap repository definitions for SLE-Micro 5.4 * Make python3-ordered-set optional for the SLE15 bootstrap repo as it is not required or present in SLE15SP3 or older * Add bootstrap repository definitions for openSUSE Leap 15.5 * add bootstrap repository definitions for SLE-Micro 5.1 (bsc#1209557) * Add SLES15SP5 to bootstrap repo definitions susemanager-build-keys: - Version 15.4.9 * add Debian 12 (bookworm) GPG keys (bsc#1212363) * add new 4096 bit RSA SUSE Package Hub key - Version 15.4.8 * add new 4096 bit RSA openSUSE build key gpg-pubkey-29b700a4.asc susemanager-docs_en: - Change cleanup Salt Client description - Documentation Salt version updated to 3006 - Added SUSE Linux Enterprise Micro 5.4 support - Added openSUSE Leap version 15.5 - Added SUSE Linux Enterprise version 15 SP5 - Documented new Recurring Actions feature - Adjusted Single Sign-On example in Administration Guide according to Keycloak 21.0.1 update - Add multiple GPG key url usage to Client Configuration Guide to Keycloak 22.0.1

Fix available

Published

2023-06-21T11:19:37Z

Updated

2026-02-04T02:17:01.906226Z

Stack: system

Check your server →