Skip to content
OpenAdvisories
Critical SUSE-RU-2021:3162-1 3 CVEs

Recommended update for SUSE Manager 4.2.2 Release Notes

Published Sep 20, 2021 · Updated Feb 4, 2026

Ecosystem: SUSE

Summary

This update for SUSE Manager 4.2.2 Release Notes provides the following additions:

Release notes for SUSE Manager:

- Update to 4.2.2
* SUSE Manager is now able to manage Rocky Linux 8 clients
* Tech Preview: Inter-Server Sync V2
* Bugs mentioned
bsc#1171483, bsc#1173143, bsc#1181223, bsc#1186281,
bsc#1186339, bsc#1187335, bsc#1187549, bsc#1188032,
bsc#1188042, bsc#1188136, bsc#1188163, bsc#1188193,
bsc#1188260, bsc#1188393, bsc#1188400, bsc#1188503,
bsc#1188505, bsc#1188551, bsc#1188641, bsc#1188647,
bsc#1188656, bsc#1188853, bsc#1188855, bsc#1189011,
bsc#1189040, bsc#1189167, bsc#1189419, bsc#1189458,
- CVE-2021-40323: Fixed an arbitrary file disclosure/Template Injection (bsc#1189458)
- CVE-2021-40324: Fixed an arbitrary file write (bsc#1189458)
- CVE-2021-40325: Fixed a problem with the token validation (bsc#1189458)
- Please note that with these changes, a valid log data from Anamon (Red Hat Autoinstallation Process) uploaded
to cobbler may be rejected.

Release notes for SUSE Manager proxy:

- Update to 4.2.2
* Bugs mentioned
bsc#1181223, bsc#1186026, bsc#1188042, bsc#1189011, bsc#1189263

Fixed packages 3

ReleasePackageFixed in
SUSE · Manager Proxy 4.2 release-notes-susemanager-proxy 4.2.2-3.12.1
SUSE · Manager Retail Branch Server 4.2 release-notes-susemanager-proxy 4.2.2-3.12.1
SUSE · Manager Server 4.2 release-notes-susemanager 4.2.2-3.12.1

Vulnerabilities 3

  • Critical 9.8
    CVE-2021-40323 Scanner template EPSS 87%

    Cobbler before 3.3.0 allows log poisoning

    Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.

    cobbler cobbler Ubuntu PyPI
  • High 7.5
    CVE-2021-40324 EPSS 69%

    Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.

    Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.

    cobbler cobbler Ubuntu PyPI
  • High 7.5
    CVE-2021-40325

    Cobbler before 3.3.0 allows authorization bypass for modification of settings.

    Cobbler before 3.3.0 allows authorization bypass for modification of settings.

    cobbler cobbler Ubuntu PyPI

References

  • report
    https://bugzilla.suse.com/1171483
  • report
    https://bugzilla.suse.com/1173143
  • report
    https://bugzilla.suse.com/1181223
  • report
    https://bugzilla.suse.com/1186026
  • report
    https://bugzilla.suse.com/1186281
  • report
    https://bugzilla.suse.com/1186339
  • report
    https://bugzilla.suse.com/1187335
  • report
    https://bugzilla.suse.com/1187549
  • report
    https://bugzilla.suse.com/1188032
  • report
    https://bugzilla.suse.com/1188042
  • report
    https://bugzilla.suse.com/1188136
  • report
    https://bugzilla.suse.com/1188163
  • report
    https://bugzilla.suse.com/1188193
  • report
    https://bugzilla.suse.com/1188260
  • report
    https://bugzilla.suse.com/1188393
  • report
    https://bugzilla.suse.com/1188400
  • report
    https://bugzilla.suse.com/1188503
  • report
    https://bugzilla.suse.com/1188505
  • report
    https://bugzilla.suse.com/1188551
  • report
    https://bugzilla.suse.com/1188641
  • report
    https://bugzilla.suse.com/1188647
  • report
    https://bugzilla.suse.com/1188656
  • report
    https://bugzilla.suse.com/1188853
  • report
    https://bugzilla.suse.com/1188855
  • report
    https://bugzilla.suse.com/1189011
  • report
    https://bugzilla.suse.com/1189040
  • report
    https://bugzilla.suse.com/1189167
  • report
    https://bugzilla.suse.com/1189263
  • report
    https://bugzilla.suse.com/1189419
  • report
    https://bugzilla.suse.com/1189458
  • web
    https://www.suse.com/security/cve/CVE-2021-40323
  • web
    https://www.suse.com/security/cve/CVE-2021-40324
  • web
    https://www.suse.com/security/cve/CVE-2021-40325