Skip to content
OpenAdvisories
Medium SUSE-RU-2024:4008-1 1 CVE

Security update for SUSE Manager Server 5.0

Published Nov 18, 2024 · Updated Feb 4, 2026

Summary

This update fixes the following issues:

uyuni-storage-setup:

- Version 5.0.3-0
* Do not create partition on extra storage disk
- Version 5.0.2-0
* Do not build debuginfo package

uyuni-tools:

- Security issues fixed:
* Version 0.1.24-0
+ CVE-2024-22037: Use podman secret to store the database credentials (bsc#1231497)
- Bugs fixed:
* Version 0.1.26-0
+ Ignore all zypper caches during migration (bsc#1232769)
* Version 0.1.25-0
+ Don't migrate enabled systemd services, recreate them (bsc#1232575)
* Version 0.1.24-0
+ Redact JSESSIONID and pxt-session-cookie values from logs and console output (bsc#1231568)
* Version 0.1.23-0
+ Ensure namespace is defined in all kubernetes commands
+ Use SCC credentials to authenticate against registry.suse.com
for kubernetes (bsc#1231157)
+ Fix namespace usage on mgrctl cp command
* Version 0.1.22-0
+ Set projectId also for test packages/images
+ mgradm migration should not pull Confidential Computing and Hub
image is replicas == 0 (bsc#1229432, bsc#1230136)
+ Do not allow SUSE Manager downgrade
+ Prevent completion issue when /var/log/uyuni-tools.log is missing
+ Fix proxy shared volume flag
+ During migration, exclude mgr-sync configuration file (bsc#1228685)
+ Migrate from PostgreSQL 14 to PostgreSQL 16 pg_hba.conf and
postgresql.conf files (bsc#1231206)
+ During migration, handle empty autoinstallation path (bsc#1230285)
+ During migration, handle symlinks (bsc#1230288)
+ During migration, trust the remote sender's file list (bsc#1228424)
+ Use SCC flags during podman pull
+ Restore SELinux permission after migration (bsc#1229501)
+ Share volumes between containers (bsc#1223142)
+ Save supportconfig in current directory (bsc#1226759)
+ Fix error code handling on reinstallation (bsc#1230139)
+ Fix creating first user and organization
+ Add missing variable quotes for install vars (bsc#1229108)
+ Add API login and logout calls to allow persistent login

How to apply this update:

1. Log in as root user to the SUSE Manager Server.
2. Upgrade mgradm and mgrctl.
3. If you are in a disconnected environment, upgrade the image packages.
4. Reboot the system.
5. Run `mgradm upgrade podman` which will use the default image tags.

Fixed packages 6

ReleasePackageFixed in
SUSE · Manager Proxy 5.0 uyuni-storage-setup 5.0.3-150500.12.6.4
SUSE · Manager Proxy 5.0 uyuni-tools 0.1.26-150500.3.12.2
SUSE · Manager Retail Branch Server Extension 5.0 uyuni-storage-setup 5.0.3-150500.12.6.4
SUSE · Manager Retail Branch Server Extension 5.0 uyuni-tools 0.1.26-150500.3.12.2
SUSE · Manager Server 5.0 uyuni-storage-setup 5.0.3-150500.12.6.4
SUSE · Manager Server 5.0 uyuni-tools 0.1.26-150500.3.12.2

Vulnerabilities 1

  • Medium 5.5

    Database password leaked by systemd uyuni-server-attestation service

    The uyuni-server-attestation systemd service needs a database_password environment variable. This file has 640 permission, and cannot be shown users, but the environment is still exposed by systemd to non-privileged users.

References

  • report
    https://bugzilla.suse.com/1223142
  • report
    https://bugzilla.suse.com/1226759
  • report
    https://bugzilla.suse.com/1228424
  • report
    https://bugzilla.suse.com/1228685
  • report
    https://bugzilla.suse.com/1229108
  • report
    https://bugzilla.suse.com/1229432
  • report
    https://bugzilla.suse.com/1229501
  • report
    https://bugzilla.suse.com/1230136
  • report
    https://bugzilla.suse.com/1230139
  • report
    https://bugzilla.suse.com/1230285
  • report
    https://bugzilla.suse.com/1230288
  • report
    https://bugzilla.suse.com/1231157
  • report
    https://bugzilla.suse.com/1231206
  • report
    https://bugzilla.suse.com/1231497
  • report
    https://bugzilla.suse.com/1231568
  • report
    https://bugzilla.suse.com/1232575
  • report
    https://bugzilla.suse.com/1232769
  • web
    https://www.suse.com/security/cve/CVE-2024-22037