1. Home
  2. Security Advisories
  3. SUSE
  4. SUSE-SU-2023:3474-1

[SUSE-SU-2023:3474-1] Recommended update for SUSE Manager Server 4.2

Severity Important
CVEs 1
Info References Vulnerabilities

Recommended update for SUSE Manager Server 4.2

This update fixes the following issues:

hub-xmlrpc-api:

  • Security fix:
    • CVE-2023-29409: Restrict RSA keys in certificates to less than or equal to 8192 bits to avoid DoSing client/server while validating signatures for extremely large RSA keys. (bsc#1213880)
    • There are no direct source changes. The CVE on hub-xmlrpc-api is fixed rebuilding the sources with the patched Go version.

spacecmd:

  • Version 4.2.24-1
    • Update translations

spacewalk-backend:

  • Version 4.2.29-1
    • Use a constant to get the product name in python code rather than reading rhn.conf (bsc#1212943)
    • Only show missing /root/.curlrc error with log_level = 5 (bsc#1212507)

spacewalk-java:

  • Version 4.2.55-1
    • Set swap memory value if available
    • Set primary FQDN to hostname if none is set (bsc#1209156, bsc#1214333)
  • Version 4.2.54-1
    • Consider venv-salt-minion package update as a Salt update to prevent backtraces on upgrading salt with itself (bsc#1211884)
  • Version 4.2.53-1
    • Fix 'more then one method candidate found' for API function (bsc#1211100)
    • Fixed a bug that caused the tab Autoinstallation to hide when clicking on Power Management Management/Operations on SSM -> Provisioning
    • Update copyright year (bsc#1212106)
    • Disable jinja processing for the roster file (bsc#1211650)
  • Version 4.2.52-1
    • Update jetty-util to version 9.4.51
  • Version 4.2.51-1
    • Update version of Tomcat build dependencies

spacewalk-reports:

  • Version 4.2.8-1
    • Drop Python2 compatibility (bsc#1212589)

spacewalk-setup:

  • Version 4.2.13-1
    • Drop usage of salt.ext.six in embedded_diskspace_check

spacewalk-utils:

  • Version 4.2.20-1
    • Drop Python2 compatibility

spacewalk-web:

  • Version 4.2.36-1
    • Update translation
    • Fix VHM CPU and RAM display when 0 (bsc#1175823)
    • Fix parsing error when showing notification message details (bsc#1211469)

susemanager:

  • Version 4.2.44-1
    • Require LTSS channels for SUSE Linux Enterprise 15 SP1/SP2/SP3 and SUSE Manager Proxy 4.2 (bsc#1214187)
  • Version 4.2.43-1
    • Add missing Salt 3006.0 dependencies to bootstrap repo definitions (bsc#1212700)
    • Make mgr-salt-ssh to properly fix HOME environment to avoid issues with gitfs (bsc#1210994)

susemanager-doc-indexes:

  • Typo correction for Cobbler buildiso command in Client Configuration Guide
  • Replaced plain text with dedicated attribute for AutoYaST
  • Added a note about Oracle Unbreakable Linux Network mirroring requirements in Client Configuration Guide (bsc#1212032)
  • Added SUSE Linux Enterprise 15 SP5 and openSUSE Leap 15.5 as supported clients in the Client Configuration Guide
  • Fixed missing tables of content in the Reference Guide (bsc#1208577)
  • Fixed instruction for Single sign-on implementation example in the Administration Guide (bsc#1210103)
  • Removed reference to non-exitent files in Reference Guide (bsc#1208528)

susemanager-docs_en:

  • Typo correction for Cobbler buildiso command in Client Configuration Guide
  • Replaced plain text with dedicated attribute for AutoYaST
  • Added a note about Oracle Unbreakable Linux Network mirroring requirements in Client Configuration Guide (bsc#1212032)
  • Added SUSE Linux Enterprise 15 SP5 and openSUSE Leap 15.5 as supported clients in the Client Configuration Guide
  • Fixed missing tables of content in the Reference Guide (bsc#1208577)
  • Fixed instruction for Single sign-on implementation example in the Administration Guide (bsc#1210103)
  • Removed reference to non-exitent files in Reference Guide (bsc#1208528)

susemanager-schema:

  • Version 4.2.29-1
    • Add schema directory for susemanager-schema-4.2.29

susemanager-sls:

  • Version 4.2.35-1
    • Do not disable salt-minion on salt-ssh managed clients
    • Use venv-salt-minion instead of salt for docker states (bsc#1212416)

How to apply this update:

  1. Log in as root user to the SUSE Manager Server.
  2. Stop the Spacewalk service: spacewalk-service stop
  3. Apply the patch using either zypper patch or YaST Online Update.
  4. Start the Spacewalk service: spacewalk-service start
ID
SUSE-SU-2023:3474-1
Severity
important
URL
https://www.suse.com/support/update/announcement/2023/suse-su-20233474-1/
Published
2023-08-29T09:38:52
(12 months ago)
Modified
2023-08-29T09:38:52
(12 months ago)
Rights
Copyright 2024 SUSE LLC. All rights reserved.
Other Advisories
Source # ID Name URL
Suse SUSE ratings https://www.suse.com/support/security/rating/
Suse URL of this CSAF notice https://ftp.suse.com/pub/projects/security/csaf/suse-su-2023_3474-1.json
Suse URL for SUSE-SU-2023:3474-1 https://www.suse.com/support/update/announcement/2023/suse-su-20233474-1/
Suse E-Mail link for SUSE-SU-2023:3474-1 https://lists.suse.com/pipermail/sle-security-updates/2024-February/018039.html
Bugzilla SUSE Bug 1175823 https://bugzilla.suse.com/1175823
Bugzilla SUSE Bug 1208528 https://bugzilla.suse.com/1208528
Bugzilla SUSE Bug 1208577 https://bugzilla.suse.com/1208577
Bugzilla SUSE Bug 1209156 https://bugzilla.suse.com/1209156
Bugzilla SUSE Bug 1210103 https://bugzilla.suse.com/1210103
Bugzilla SUSE Bug 1210994 https://bugzilla.suse.com/1210994
Bugzilla SUSE Bug 1211100 https://bugzilla.suse.com/1211100
Bugzilla SUSE Bug 1211469 https://bugzilla.suse.com/1211469
Bugzilla SUSE Bug 1211650 https://bugzilla.suse.com/1211650
Bugzilla SUSE Bug 1211884 https://bugzilla.suse.com/1211884
Bugzilla SUSE Bug 1212032 https://bugzilla.suse.com/1212032
Bugzilla SUSE Bug 1212106 https://bugzilla.suse.com/1212106
Bugzilla SUSE Bug 1212416 https://bugzilla.suse.com/1212416
Bugzilla SUSE Bug 1212507 https://bugzilla.suse.com/1212507
Bugzilla SUSE Bug 1212589 https://bugzilla.suse.com/1212589
Bugzilla SUSE Bug 1212700 https://bugzilla.suse.com/1212700
Bugzilla SUSE Bug 1212943 https://bugzilla.suse.com/1212943
Bugzilla SUSE Bug 1213880 https://bugzilla.suse.com/1213880
Bugzilla SUSE Bug 1214187 https://bugzilla.suse.com/1214187
Bugzilla SUSE Bug 1214333 https://bugzilla.suse.com/1214333
CVE SUSE CVE CVE-2023-29409 page https://www.suse.com/security/cve/CVE-2023-29409/
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date