Skip to content
OpenAdvisories
High WID-SEC-2022-1476 4 CVEs

SUSE Manager: Mehrere Schwachstellen

Published Sep 19, 2022 · Updated Mar 2, 2023 · Revision 3 · de-DE

Vendor: SUSE Product: Linux Product: Manager < 4.2.9 Platform: Linux

Summary

Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in SUSE Manager ausnutzen, um Sicherheitsvorkehrungen zu umgehen, beliebigen Code auszuführen, seine Privilegien zu erweitern und einen Denial-of-Service-Zustand zu verursachen.

Product

SUSE Manager basiert auf Spacewalk, welche die Codebase vom Red Hat
Satellite Server nutzt und ermöglicht ein zentrale Systemmanagement von Linux-Umgebungen.

Vulnerabilities 4

  • Critical 9.8
    CVE-2021-41411

    XML External Entity Reference in drools

    drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.

    org.drools:drools-core Maven
  • Critical 9.8
    CVE-2021-42740

    Improper Neutralization of Special Elements used in a Command in Shell-quote

    The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted arg…

    shell-quote node-shell-quote node-shell-quote Debian Ubuntu npm
  • High 7.8
    CVE-2021-43138

    Prototype Pollution in async

    In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.

    async npm
  • High 7.5
    CVE-2022-31129

    Inefficient Regular Expression Complexity in moment

    moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 par…

    moment moment mediawiki wordpress Debian Ubuntu npm NuGet

Revision history

  1. #3

    Neue Updates von SUSE aufgenommen

  2. #2

    Neue Updates von SUSE aufgenommen

  3. #1

    Initiale Fassung

References