Summary
This update for the SUSE Manager 3.0 Release Notes provides the following additions:
- SUSE Manager Server bugs fixed by latest updates
+ bsc#1057635, bsc#1083295, bsc#1087837, bsc#1089362, bsc#1089526,
bsc#1089662, bsc#1093458, bsc#1096264, bsc#1096514, bsc#1097250,
bsc#1097697, bsc#1098388, bsc#1098394, bsc#1098815, bsc#1098993,
bsc#1099583, bsc#1099638, bsc#1099781, bsc#1100131, bsc#1100731,
bsc#1101670, bsc#1102009, bsc#1103044, bsc#1103090, bsc#1103218,
bsc#1104025, bsc#1104503, bsc#1105440, bsc#1105442
- SUSE Manager Server security issues fixed by latest updates
+ CVE-2018-1000225, CVE-2018-1000226, CVE-2018-9159
- SUSE Manager Proxy bugs fixed by latest updates
+ bsc#1083295, bsc#1094705, bsc#1097697
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| SUSE · Manager Proxy 3.1 | release-notes-susemanager-proxy | 3.1.8-0.15.29.1 |
| SUSE · Manager Server 3.1 | release-notes-susemanager | 3.1.8-5.38.1 |
Vulnerabilities 3
-
Critical 9.8
Cobbler Improper Validation of Security Tokens
Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Incorrect Access Control vulnerability in XMLRPC API (/cobbler_api) that can result in P…
-
Medium 6.1
Cobbler XSS Vulnerability
Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Cross Site Scripting (XSS) vulnerability in cobbler-web that can result in Privilege esc…
-
Medium 5.3CVE-2018-9159 Public exploit
Moderate severity vulnerability that affects com.sparkjava:spark-core
In Spark before 2.7.2, a remote attacker can read unintended static files via various representations of absolute or relative pathnames, as demonstrated by file: URLs and directory traversal sequences. NOTE: this product is unrelated to Ignite Realtime Spark.