Description
A flaw was found in Spacewalk up to version 2.9 where it was vulnerable to XML internal entity attacks via the /rpc/api endpoint. An unauthenticated remote attacker could use this flaw to retrieve the content of certain files and trigger a denial of service, or in certain circumstances, execute arbitrary code on the Spacewalk server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | spacewalk | All spacewalk versions up 2.9 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Manager Server Module 4.0 | branch-network-formula | 0.1.1580471316.1839544-3.10.2 | SUSE-SU-2020:0671-1 |
| SUSE Manager Server Module 4.0 | image-sync-formula | 0.1.1579102150.4716559-3.11.2 | SUSE-SU-2020:0671-1 |
| SUSE Manager Server Module 4.0 | mgr-osad | 4.0.11-3.9.2 | SUSE-SU-2020:0671-1 |
| SUSE Manager Server Module 4.0 | patterns-suse-manager | 4.0-9.10.2 | SUSE-SU-2020:0671-1 |
| SUSE Manager Server Module 4.0 | prometheus-formula | 0.1-4.7.2 | SUSE-SU-2020:0671-1 |
| SUSE Manager Server Module 4.0 | pxe-default-image-sle15 | 4.0.1-20200305173027 | SUSE-SU-2020:0671-1 |
| SUSE Manager Server Module 4.0 | pxe-formula | 0.1.1580384994.6076a7e-3.11.2 | SUSE-SU-2020:0671-1 |
| SUSE Manager Server Module 4.0 | py26-compat-salt | 2016.11.10-10.11.2 | SUSE-SU-2020:0671-1 |
| SUSE Manager Server Module 4.0 | python-susemanager-retail | 1.0.1580471316.1839544-3.13.2 | SUSE-SU-2020:0671-1 |
| SUSE Manager Server Module 4.0 | redstone-xmlrpc | 1.1_20071120-0.11.3.2 | SUSE-SU-2020:0671-1 |
| SUSE Manager Server Module 4.0 | salt-netapi-client | 0.17.0-4.3.2 | SUSE-SU-2020:0671-1 |
| SUSE Manager Server Module 4.0 | spacecmd | 4.0.18-3.13.2 | SUSE-SU-2020:0671-1 |
| SUSE Manager Server Module 4.0 | spacewalk-admin | 4.0.9-3.6.2 | SUSE-SU-2020:0671-1 |
| SUSE Manager Server Module 4.0 | spacewalk-backend | 4.0.30-3.23.3 | SUSE-SU-2020:0671-1 |
| SUSE Manager Server Module 4.0 | spacewalk-certs-tools | 4.0.15-3.15.2 | SUSE-SU-2020:0671-1 |
| SUSE Manager Server Module 4.0 | spacewalk-client-tools | 4.0.12-3.13.2 | SUSE-SU-2020:0671-1 |
| SUSE Manager Server Module 4.0 | spacewalk-java | 4.0.31-3.23.1 | SUSE-SU-2020:0671-1 |
| SUSE Manager Server Module 4.0 | spacewalk-search | 4.0.9-3.11.2 | SUSE-SU-2020:0671-1 |
| SUSE Manager Server Module 4.0 | spacewalk-setup | 4.0.13-3.11.1 | SUSE-SU-2020:0671-1 |
| SUSE Manager Server Module 4.0 | spacewalk-utils +1 | 4.0.16-3.15.2 | SUSE-SU-2020:0671-1 |
| SUSE Manager Server Module 4.0 | spacewalk-web | 4.0.19-3.18.3 | SUSE-SU-2020:0671-1 |
| SUSE Manager Server Module 4.0 | subscription-matcher | 0.25-3.3.2 | SUSE-SU-2020:0671-1 |
| SUSE Manager Server Module 4.0 | susemanager | 4.0.22-3.20.3 | SUSE-SU-2020:0671-1 |
| SUSE Manager Server Module 4.0 | susemanager-docs_en +1 | 4.0-10.18.2 | SUSE-SU-2020:0671-1 |
| SUSE Manager Server Module 4.0 | susemanager-schema | 4.0.18-3.17.2 | SUSE-SU-2020:0671-1 |
| SUSE Manager Server Module 4.0 | susemanager-sls | 4.0.24-3.17.2 | SUSE-SU-2020:0671-1 |
| SUSE Manager Server Module 4.0 | system-lock-formula | 0.2-4.5.1 | SUSE-SU-2020:0671-1 |
| SUSE Manager Server Module 4.0 | virtualization-host-formula | 0.2-4.3.2 | SUSE-SU-2020:0671-1 |
| SUSE Manager Server 3.2 | py26-compat-salt | 2016.11.10-6.35.1 | SUSE-SU-2020:0856-1 |
| SUSE Manager Server 3.2 | redstone-xmlrpc | 1.1_20071120-0.11.3.1 | SUSE-SU-2020:0856-1 |
| SUSE Manager Server 3.2 | spacecmd | 2.8.25.14-3.32.1 | SUSE-SU-2020:0856-1 |
| SUSE Manager Server 3.2 | spacewalk-admin | 2.8.4.6-3.12.1 | SUSE-SU-2020:0856-1 |
| SUSE Manager Server 3.2 | spacewalk-backend | 2.8.57.22-3.48.1 | SUSE-SU-2020:0856-1 |
| SUSE Manager Server 3.2 | spacewalk-certs-tools | 2.8.8.14-3.23.1 | SUSE-SU-2020:0856-1 |
| SUSE Manager Server 3.2 | spacewalk-client-tools | 2.8.22.7-3.12.1 | SUSE-SU-2020:0856-1 |
| SUSE Manager Server 3.2 | spacewalk-java | 2.8.78.28-3.47.1 | SUSE-SU-2020:0856-1 |
| SUSE Manager Server 3.2 | spacewalk-setup | 2.8.7.10-3.25.1 | SUSE-SU-2020:0856-1 |
| SUSE Manager Server 3.2 | spacewalk-utils | 2.8.18.6-3.12.1 | SUSE-SU-2020:0856-1 |
| SUSE Manager Server 3.2 | spacewalk-web | 2.8.7.23-3.45.1 | SUSE-SU-2020:0856-1 |
| SUSE Manager Server 3.2 | subscription-matcher | 0.25-4.15.1 | SUSE-SU-2020:0856-1 |
| SUSE Manager Server 3.2 | susemanager | 3.2.23-3.40.2 | SUSE-SU-2020:0856-1 |
| SUSE Manager Server 3.2 | susemanager-sls | 3.2.30-3.44.1 | SUSE-SU-2020:0856-1 |
| SUSE Manager Server 3.2 | susemanager-sync-data | 3.2.19-3.35.1 | SUSE-SU-2020:0856-1 |
| SUSE Manager Proxy Module 4.0 | mgr-osad | 4.0.11-3.9.2 | SUSE-SU-2020:0671-1, SUSE-RU-2020:0671-1 |
| SUSE Manager Proxy Module 4.0 | patterns-suse-manager | 4.0-9.10.2 | SUSE-SU-2020:0671-1, SUSE-RU-2020:0671-1 |
| SUSE Manager Proxy Module 4.0 | spacecmd | 4.0.18-3.13.2 | SUSE-SU-2020:0671-1, SUSE-RU-2020:0671-1 |
| SUSE Manager Proxy Module 4.0 | spacewalk-backend | 4.0.30-3.23.3 | SUSE-SU-2020:0671-1, SUSE-RU-2020:0671-1 |
| SUSE Manager Proxy Module 4.0 | spacewalk-certs-tools | 4.0.15-3.15.2 | SUSE-SU-2020:0671-1, SUSE-RU-2020:0671-1 |
| SUSE Manager Proxy Module 4.0 | spacewalk-client-tools | 4.0.12-3.13.2 | SUSE-SU-2020:0671-1, SUSE-RU-2020:0671-1 |
| SUSE Manager Proxy Module 4.0 | spacewalk-web | 4.0.19-3.18.3 | SUSE-SU-2020:0671-1, SUSE-RU-2020:0671-1 |
| SUSE Manager Proxy Module 4.0 | supportutils-plugin-susemanager-proxy +1 | 4.0.3-3.3.2 | SUSE-SU-2020:0671-1, SUSE-RU-2020:0671-1 |
Advisories 3
- SUSE-RU-2020:0671-1 Recommended update for SUSE Manager Proxy 4.0 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:0671-1 Security update for SUSE Manager Server 4.0 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:0856-1 Security update for SUSE Manager Server 3.2 SUSE / openSUSE Security Updates · Feb 4, 2026