Skip to content
OpenAdvisories
Critical SUSE-RU-2023:2595-1 1 CVE

Security update for SUSE Manager Server 4.2

Published Jun 21, 2023 · Updated Feb 4, 2026

Summary

This update fixes the following issues:

branch-network-formula:

- Update to version 0.1.1680167239.23f2fec
* Remove unnecessary import of 'salt.ext.six'

cpu-mitigations-formula:

- Update to version 0.5.0:
* Mark all SUSE Linux Enterprise 15 SP4 and newer and openSUSE 15.4 and newer as supported (bsc#1210835)

hub-xmlrpc-api:

- Do not strictly require Go 1.18 on SUSE Linux Enterprise 15 SP3 (bsc#1203599)

inter-server-sync:

- Version 0.2.8
* Correctly detect product name and product version number
* Import image channel data only when related software channel is available (bsc#1211330)

perl-Satcon:

- Version 4.2.3-1
* Accept keys with dots

spacecmd:

- Version 4.2.23-1
* Fix argument parsing of distribution_update (bsc#1210458)

spacewalk-backend:

- Version 4.2.28-1
* Filter CLM modular packages using release strings (bsc#1207814)
* Add package details to reposync error logging

spacewalk-certs-tools:

- Version 4.2.20-1
* Update translations

spacewalk-java:

- Security fixes in version 4.2.50-1:
* CVE-2023-22644: Remove web session swap secrets output in logs (bsc#1210086)
* CVE-2023-22644: Do not output URL parameters for tiny urls (bsc#1210101)
* CVE-2023-22644: Fix session information leak (bsc#1210107)
* CVE-2023-22644: Do not output Cobbler xmlrpc token in debug logs (bsc#1210162)
* CVE-2023-22644: Fix credentials and other secrets disclosure when debug log is enabled (bsc#1210154)
* CVE-2023-22644: Prevent logging formula data (bsc#1209386, bsc#1209434)
- Other non-security issues fixed in version 4.2.50-1:
* Fix misleading error message regarding SCC credentials removal (bsc#1207941)
* Fix issue with `aclChannelTypeCapable` that prevented errata view in deb arch
* Refresh pillars after setting custom values via SSM (bsc#1210659)
* Report SSM power management errors in 'rhn_web_ui' (bsc#1210406)
* Filter CLM modular packages using release strings (bsc#1207814)
* Allow processing big state results (bsc#1210957)
* Use glassfish-activation-api instead of gnu-jaf
* Fix Intenal Server Error when URI contains invalid sysid (bsc#1186011)
* kernel options: only add quotes if there is a space in the value (bsc#1209926)
* Fix link to Knowledge Base articles (bsc#1210311)
* Remove channels from client after transfer to a different organization (bsc#1209220)
* Fix displaying system channels when no base product is installed (bsc#1206423)
* Fix broken ifcfg grub option on reinstallation (bsc#1210232)
* Fix NPE in Cobbler system sync when server has no creator set
* Add listSystemEvents missing API endpoint (bsc#1209877)

spacewalk-setup:

- Version 4.2.12-1
* Enable netapi clients in master configuration (required for Salt 3006)

spacewalk-utils:

- Version 4.2.19-1
* spacewalk-hostname-rename remains stuck at refreshing pillars (bsc#1207550)

spacewalk-web:

- Version 4.2.35-1
* Show loading indicator on formula details pages (bsc#1179747)
* Increase datetimepicker font sizes (bsc#1210437)
* Fix an issue where the datetimepicker shows wrong date (bsc#1209231)

supportutils-plugin-susemanager:

- Version 4.2.7-1
* Fix property name to tune for salt events queue processing

susemanager:

- version 4.3.27-1
* Use newest venv-salt-minion version available to generate the venv-enabled-*.txt file in bootstrap repos
(bsc#1211958)
- Version 4.2.41-1
* Add bootstrap repository definitions for openSUSE Leap 15.5
* Add bootstrap repository definitions for SUSE Linux Enterprise Server 15 SP5

susemanager-build-keys:

- Version 15.3.9
* add SUSE Liberty v2 key (bsc#1212096)
* add Debian 12 (bookworm) GPG keys (bsc#1212363)
* add new 4096 bit RSA SUSE Package Hub key
- Version 15.3.8
* Fix installation of SUSE Linux Enterprise 15 RSA reserve build key
* Add new 4096 bit RSA openSUSE build key gpg-pubkey-29b700a4.asc

susemanager-sls:

- Version 4.2.34-1
* Trust new Liberty Linux v2 key (bsc#1212096)

susemanager-doc-indexes:

- Salt version changed to 3006.0
- Added note for clarification between self-installed and cloud instances of Ubuntu
- Improved pay-as-you-go documentation in the Install and Upgrade Guide (bsc#1208984)
- Added comment about activation keys for LTSS clients in Client Configuration Guide (bsc#1210011)
- Updated API script examples to Python 3 in Administration Guide and Large Deployment Guide
- Change cleanup Salt Client description
- Added instruction for Cobbler to use the correct label in Client Configuration Guide distro label (bsc#1205600)
- Added updated options for rhn.conf file in the Administration Guide (bsc#1209508)
- Fixed calculation of DB max-connections and align it with the supportconfig checking tool in the Tuning Guide

susemanager-docs_en:

- Salt version changed to 3006.0
- Added note for clarification between self-installed and cloud instances of Ubuntu
- Improved Pay-as-you-go documentation in the Install and Upgrade Guide (bsc#1208984)
- Added comment about activation keys for LTSS clients in Client Configuration Guide (bsc#1210011)
- Updated API script examples to Python 3 in Administration Guide and Large Deployment Guide
- Change cleanup Salt Client description
- Added instruction for Cobbler to use the correct label in Client Configuration Guide distro label (bsc#1205600)
- Added updated options for rhn.conf file in the Administration Guide (bsc#1209508)
- Fixed calculation of DB max-connections and align it with the supportconfig checking tool in the Tuning Guide

susemanager-schema:

- Version 4.2.28-1
* Filter CLM modular packages using release strings (bsc#1207814)
* Repeat schema migrations for module metadata storage (bsc#1209915)

susemanager-sls:

- Version 4.2.33-1
* Include automatic migration from Salt 3000 to Salt bundle in highstate
* Disable salt-minion and remove its config file on cleanup (bsc#1209277)
* To update everything on a debian system, call dist-upgrade to be able to install and remove packages

virtual-host-gatherer:

-

Fixed packages 27

ReleasePackageFixed in
SUSE · Manager Proxy Module 4.2 spacecmd 4.2.23-150300.4.39.4
SUSE · Manager Proxy Module 4.2 spacewalk-backend 4.2.28-150300.4.41.4
SUSE · Manager Proxy Module 4.2 spacewalk-certs-tools 4.2.20-150300.3.30.4
SUSE · Manager Proxy Module 4.2 spacewalk-proxy-installer 4.2.12-150300.3.17.2
SUSE · Manager Proxy Module 4.2 spacewalk-ssl-cert-check 4.2.3-150300.3.3.2
SUSE · Manager Proxy Module 4.2 spacewalk-web 4.2.35-150300.3.44.4
SUSE · Manager Proxy Module 4.2 susemanager-build-keys 15.3.9-150300.3.14.1
SUSE · Manager Server Module 4.2 branch-network-formula 0.1.1680167239.23f2fec-150300.3.6.2
SUSE · Manager Server Module 4.2 cpu-mitigations-formula 0.5.0-150300.3.6.2
SUSE · Manager Server Module 4.2 hub-xmlrpc-api 0.7-150300.3.12.3
SUSE · Manager Server Module 4.2 inter-server-sync 0.2.8-150300.8.31.2
SUSE · Manager Server Module 4.2 perl-Satcon 4.2.3-150300.3.3.3
SUSE · Manager Server Module 4.2 spacecmd 4.2.23-150300.4.39.4
SUSE · Manager Server Module 4.2 spacewalk-backend 4.2.28-150300.4.41.4
SUSE · Manager Server Module 4.2 spacewalk-certs-tools 4.2.20-150300.3.30.4
SUSE · Manager Server Module 4.2 spacewalk-java 4.2.50-150300.3.66.5
SUSE · Manager Server Module 4.2 spacewalk-setup 4.2.12-150300.3.18.3
SUSE · Manager Server Module 4.2 spacewalk-utils 4.2.19-150300.3.24.2
SUSE · Manager Server Module 4.2 spacewalk-web 4.2.35-150300.3.44.4
SUSE · Manager Server Module 4.2 supportutils-plugin-susemanager 4.2.7-150300.3.15.4
SUSE · Manager Server Module 4.2 susemanager 4.2.42-150300.3.54.4
SUSE · Manager Server Module 4.2 susemanager-build-keys 15.3.9-150300.3.14.1
SUSE · Manager Server Module 4.2 susemanager-doc-indexes 4.2-150300.12.45.4
SUSE · Manager Server Module 4.2 susemanager-docs_en 4.2-150300.12.45.2
SUSE · Manager Server Module 4.2 susemanager-schema 4.2.28-150300.3.38.4
SUSE · Manager Server Module 4.2 susemanager-sls 4.2.34-150300.3.51.1
SUSE · Manager Server Module 4.2 virtual-host-gatherer 1.0.26-150300.3.15.2

Vulnerabilities 1

  • Critical 9.4

    JWT token compromise can allow malicious actions including Remote Code Execution (RCE)

    A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE.

References

  • report
    https://bugzilla.suse.com/1179747
  • report
    https://bugzilla.suse.com/1186011
  • report
    https://bugzilla.suse.com/1203599
  • report
    https://bugzilla.suse.com/1205600
  • report
    https://bugzilla.suse.com/1206423
  • report
    https://bugzilla.suse.com/1207550
  • report
    https://bugzilla.suse.com/1207814
  • report
    https://bugzilla.suse.com/1207941
  • report
    https://bugzilla.suse.com/1208984
  • report
    https://bugzilla.suse.com/1209220
  • report
    https://bugzilla.suse.com/1209231
  • report
    https://bugzilla.suse.com/1209277
  • report
    https://bugzilla.suse.com/1209386
  • report
    https://bugzilla.suse.com/1209434
  • report
    https://bugzilla.suse.com/1209508
  • report
    https://bugzilla.suse.com/1209877
  • report
    https://bugzilla.suse.com/1209915
  • report
    https://bugzilla.suse.com/1209926
  • report
    https://bugzilla.suse.com/1210011
  • report
    https://bugzilla.suse.com/1210086
  • report
    https://bugzilla.suse.com/1210101
  • report
    https://bugzilla.suse.com/1210107
  • report
    https://bugzilla.suse.com/1210154
  • report
    https://bugzilla.suse.com/1210162
  • report
    https://bugzilla.suse.com/1210232
  • report
    https://bugzilla.suse.com/1210311
  • report
    https://bugzilla.suse.com/1210406
  • report
    https://bugzilla.suse.com/1210437
  • report
    https://bugzilla.suse.com/1210458
  • report
    https://bugzilla.suse.com/1210659
  • report
    https://bugzilla.suse.com/1210835
  • report
    https://bugzilla.suse.com/1210957
  • report
    https://bugzilla.suse.com/1211330
  • report
    https://bugzilla.suse.com/1211958
  • report
    https://bugzilla.suse.com/1212096
  • report
    https://bugzilla.suse.com/1212363
  • web
    https://www.suse.com/security/cve/CVE-2023-22644