Skip to content
OpenAdvisories
High SUSE-RU-2020:0671-1 3 CVEs

Recommended update for SUSE Manager Proxy 4.0

Published Mar 13, 2020 · Updated Feb 4, 2026

Ecosystem: SUSE

Summary

This update fixes the following issues:

mgr-osad:

- Take care that osad is not disabled nor deactivated during update
(bsc#1157700, bsc#1158697)

patterns-suse-manager:

- Add recommends for virtualization-host-formula to suma_server pattern
- Add recommends for virtualization-host-formula to retail

spacecmd:

- Bugfix: attempt to purge SSM when it is empty (bsc#1155372)

spacewalk-backend:

- Fix mgrcfg-client python3 breakage (bsc#1164309)
- Update doc link to point to new documentation server
- Prevent timestamp format exception on mgr-inter-sync while processing comps (bsc#1157346)
- When downloading repo metadata, don't add '/' to the repo url if it already ends with one (bsc#1158899)
- Use HTTP proxy settings when fetching the mirrorlist on spacewalk-repo-sync (bsc#1159076)
- Enhance suseProducts via ISS to fix SP migration on slave server (bsc#1159184)
- Prevent a traceback when reposyncing openSUSE 15.1 (bsc#1158672)
- Close config files after reading them (bsc#1158283)
- Associate VMs and systems with the same machine ID at bootstrap (bsc#1144176)

spacewalk-certs-tools:

- Add 'start_event_grains' minion option to configfile when generated by bootstrap script
- Forbid multiple activation keys for salt minions during bootstrap (bsc#1164452)
- Add additional minion options to configfile when generated by
bootstrap script (bsc#1159492)
- Change the order to check the version correctly for RES (bsc#1152795)

spacewalk-client-tools:

- Spell correctly 'successful' and 'successfully'

spacewalk-web:

- Don't validate mandatory fields that are not visible (bsc#1158943)
- Fix count of changes to build (bsc#1160940)
- Report merge_subscriptions message in a readable way (bsc#1140332)
- Fix ordering by date (bsc#1158818)

supportutils-plugin-susemanager-client:

- Rename rhncfg-actions to mgr-cfg-actions

supportutils-plugin-susemanager-proxy:

- Rename rhncfg-actions to mgr-cfg-actions

How to apply this update:
1. Log in as root user to the SUSE Manager proxy.
2. Stop the proxy service:
spacewalk-proxy stop
3. Apply the patch using either zypper patch or YaST Online Update.
4. Start the Spacewalk service:
spacewalk-proxy start

Fixed packages 9

ReleasePackageFixed in
SUSE · Manager Proxy Module 4.0 mgr-osad 4.0.11-3.9.2
SUSE · Manager Proxy Module 4.0 patterns-suse-manager 4.0-9.10.2
SUSE · Manager Proxy Module 4.0 spacecmd 4.0.18-3.13.2
SUSE · Manager Proxy Module 4.0 spacewalk-backend 4.0.30-3.23.3
SUSE · Manager Proxy Module 4.0 spacewalk-certs-tools 4.0.15-3.15.2
SUSE · Manager Proxy Module 4.0 spacewalk-client-tools 4.0.12-3.13.2
SUSE · Manager Proxy Module 4.0 spacewalk-web 4.0.19-3.18.3
SUSE · Manager Proxy Module 4.0 supportutils-plugin-susemanager-client 4.0.3-3.3.2
SUSE · Manager Proxy Module 4.0 supportutils-plugin-susemanager-proxy 4.0.3-3.3.2

Vulnerabilities 3

  • High 8.6
    CVE-2020-1693

    A flaw was found in Spacewalk up to version 2.9 where it was vulnerable to XML internal entity attacks via the /rpc/api…

    Red Hat spacewalk
  • Medium 4.2
    CVE-2019-16769

    Affected versions of serialize-javascript are vulnerable to Cross-site Scripting (XSS)

    The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since N…

    yahoo serialize-javascript serialize-javascript npm
  • Unscored —
    CVE-2018-1077

    Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information fr…

    spacewalk spacewalk

References

  • report
    https://bugzilla.suse.com/1083326
  • report
    https://bugzilla.suse.com/1085414
  • report
    https://bugzilla.suse.com/1121640
  • report
    https://bugzilla.suse.com/1123274
  • report
    https://bugzilla.suse.com/1137248
  • report
    https://bugzilla.suse.com/1140332
  • report
    https://bugzilla.suse.com/1144176
  • report
    https://bugzilla.suse.com/1152673
  • report
    https://bugzilla.suse.com/1152795
  • report
    https://bugzilla.suse.com/1153269
  • report
    https://bugzilla.suse.com/1154246
  • report
    https://bugzilla.suse.com/1154590
  • report
    https://bugzilla.suse.com/1154599
  • report
    https://bugzilla.suse.com/1155281
  • report
    https://bugzilla.suse.com/1155372
  • report
    https://bugzilla.suse.com/1156751
  • report
    https://bugzilla.suse.com/1157317
  • report
    https://bugzilla.suse.com/1157346
  • report
    https://bugzilla.suse.com/1157447
  • report
    https://bugzilla.suse.com/1157700
  • report
    https://bugzilla.suse.com/1157975
  • report
    https://bugzilla.suse.com/1158178
  • report
    https://bugzilla.suse.com/1158181
  • report
    https://bugzilla.suse.com/1158283
  • report
    https://bugzilla.suse.com/1158480
  • report
    https://bugzilla.suse.com/1158564
  • report
    https://bugzilla.suse.com/1158672
  • report
    https://bugzilla.suse.com/1158697
  • report
    https://bugzilla.suse.com/1158754
  • report
    https://bugzilla.suse.com/1158818
  • report
    https://bugzilla.suse.com/1158899
  • report
    https://bugzilla.suse.com/1158943
  • report
    https://bugzilla.suse.com/1159012
  • report
    https://bugzilla.suse.com/1159023
  • report
    https://bugzilla.suse.com/1159076
  • report
    https://bugzilla.suse.com/1159184
  • report
    https://bugzilla.suse.com/1159492
  • report
    https://bugzilla.suse.com/1159553
  • report
    https://bugzilla.suse.com/1160184