Skip to content
OpenAdvisories
Critical SUSE-RU-2023:2592-1 2 CVEs

Security update for SUSE Manager Server 4.3

Published Jun 21, 2023 · Updated Feb 4, 2026

Ecosystem: SUSE

Summary

This update fixes the following issues:

release-notes-susemanager:

- Update to SUSE Manager 4.3.6
* Salt has been upgraded to 3006.0
* SUSE Linux Enterprise Server 15 SP5 Family support has been added
* SUSE Linux Enterprise Server Micro 5.4 support has been added
* openSUSE Leap 15.5 support has been added
* Ability to install PTFs from SUSE Manager has been added
* Scheduling Custom States on recurrent basis is now possible
* Syncing optional channels from the webUI is now possible
* All Tomcat logs are now rotated with logrotate
* Grafana upgraded to 9.5.1
* Node exporter upgraded to 1.5.0
* Prometheus upgraded to 2.37.6
* Postgres exporter upgraded to 0.10.1
* CVEs fixed
CVE-2023-22644, CVE-2022-46146
* Bugs mentioned

bsc#1201063, bsc#1203599, bsc#1204089, bsc#1204270, bsc#1204900
bsc#1205600, bsc#1206060, bsc#1206191, bsc#1206423, bsc#1206725
bsc#1206783, bsc#1207063, bsc#1207595, bsc#1207814, bsc#1207829
bsc#1207830, bsc#1208288, bsc#1208321, bsc#1208427, bsc#1208522
bsc#1208536, bsc#1208540, bsc#1208550, bsc#1208586, bsc#1208661
bsc#1208687, bsc#1208719, bsc#1208772, bsc#1209143, bsc#1209149
bsc#1209215, bsc#1209220, bsc#1209231, bsc#1209253, bsc#1209277
bsc#1209386, bsc#1209395, bsc#1209508, bsc#1209557, bsc#1209926
bsc#1209938, bsc#1209993, bsc#1210086, bsc#1210094, bsc#1210101
bsc#1210107, bsc#1210154, bsc#1210162, bsc#1210349, bsc#1210437
bsc#1210458, bsc#1210835, bsc#1211958, bsc#1210776, bsc#1209434
bsc#1208046, bsc#1212363, bsc#1212096, bsc#1212516

Fixed packages 2

ReleasePackageFixed in
SUSE · Manager Proxy 4.3 release-notes-susemanager-proxy 4.3.6-150400.3.55.4
SUSE · Manager Server 4.3 release-notes-susemanager 4.3.6-150400.3.63.2

Vulnerabilities 2

  • Critical 9.4
    CVE-2023-22644

    JWT token compromise can allow malicious actions including Remote Code Execution (RCE)

    A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE.

    SUSE NeuVector github.com/neuvector/neuvector Go
  • Medium 6.2
    CVE-2022-46146

    Prometheus Exporter Toolkit vulnerable to basic authentication bypass

    Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. …

    prometheus exporter-toolkit prometheus-process-exporter prometheus Debian Ubuntu Azure Linux Alpine Go

References

  • report
    https://bugzilla.suse.com/1201059
  • report
    https://bugzilla.suse.com/1204186
  • report
    https://bugzilla.suse.com/1204270
  • report
    https://bugzilla.suse.com/1205011
  • report
    https://bugzilla.suse.com/1205088
  • report
    https://bugzilla.suse.com/1205759
  • report
    https://bugzilla.suse.com/1206146
  • report
    https://bugzilla.suse.com/1206520
  • report
    https://bugzilla.suse.com/1206562
  • report
    https://bugzilla.suse.com/1206725
  • report
    https://bugzilla.suse.com/1206800
  • report
    https://bugzilla.suse.com/1206817
  • report
    https://bugzilla.suse.com/1206861
  • report
    https://bugzilla.suse.com/1206932
  • report
    https://bugzilla.suse.com/1206963
  • report
    https://bugzilla.suse.com/1206973
  • report
    https://bugzilla.suse.com/1206979
  • report
    https://bugzilla.suse.com/1206981
  • report
    https://bugzilla.suse.com/1207087
  • report
    https://bugzilla.suse.com/1207141
  • report
    https://bugzilla.suse.com/1207297
  • report
    https://bugzilla.suse.com/1207352
  • report
    https://bugzilla.suse.com/1207792
  • report
    https://bugzilla.suse.com/1207799
  • report
    https://bugzilla.suse.com/1207814
  • report
    https://bugzilla.suse.com/1207829
  • report
    https://bugzilla.suse.com/1207830
  • report
    https://bugzilla.suse.com/1207838
  • report
    https://bugzilla.suse.com/1207867
  • report
    https://bugzilla.suse.com/1207883
  • report
    https://bugzilla.suse.com/1208046
  • report
    https://bugzilla.suse.com/1208119
  • report
    https://bugzilla.suse.com/1208288
  • report
    https://bugzilla.suse.com/1208325
  • report
    https://bugzilla.suse.com/1208611
  • report
    https://bugzilla.suse.com/1208719
  • report
    https://bugzilla.suse.com/1208772
  • report
    https://bugzilla.suse.com/1208908
  • report
    https://bugzilla.suse.com/1209119