Skip to content
OpenAdvisories
Medium · 5.3 CVE-2022-31248 EUVD-2022-52826GHSA-jcvh-6rq4-c7xr

SUMA user enumeration via weak error message

Published Jun 22, 2022 · Updated Sep 16, 2024 · Assigned by suse

Vendor: SUSE Product: SUSE Manager Server 4.1 Product: SUSE Manager Server 4.2

Description

A Observable Response Discrepancy vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to discover valid usernames. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46-1. SUSE Manager Server 4.2 spacewalk-java versions prior to 4.2.37-1.

Affected products

VendorProductAffectedFixed
SUSE SUSE Manager Server 4.1 spacewalk-java – < 4.1.46-1 4.1.46-1
SUSE SUSE Manager Server 4.2 spacewalk-java – < 4.2.37-1 4.2.37-1

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SUSE Manager Server Module 4.3 apache-commons-csv 1.2-150400.3.3.1 SUSE-SU-2022:3194-1
SUSE Manager Server Module 4.3 apache-commons-math3 3.2-150400.3.3.1 SUSE-SU-2022:3194-1
SUSE Manager Server Module 4.3 drools +2 7.17.0-150400.3.3.1 SUSE-SU-2022:3194-1
SUSE Manager Server Module 4.3 image-sync-formula 0.1.1658330139.861779d-150400.3.3.1 SUSE-SU-2022:3194-1
SUSE Manager Server Module 4.3 inter-server-sync 0.2.3-150400.3.3.1 SUSE-SU-2022:3194-1
SUSE Manager Server Module 4.3 jakarta-commons-validator 1.1.4-21.150400.21.3.4 SUSE-SU-2022:3194-1
SUSE Manager Server Module 4.3 jose4j 0.5.1-150400.3.3.1 SUSE-SU-2022:3194-1
SUSE Manager Server Module 4.3 mvel2 2.2.6.Final-150400.3.3.1 SUSE-SU-2022:3194-1
SUSE Manager Server Module 4.3 python-susemanager-retail 1.0.1658330139.861779d-150400.3.3.1 SUSE-SU-2022:3194-1
SUSE Manager Server Module 4.3 python-urlgrabber 4.1.0-150400.3.3.1 SUSE-SU-2022:3194-1
SUSE Manager Server Module 4.3 reprepro 5.3.0-150400.3.3.1 SUSE-SU-2022:3194-1
SUSE Manager Server Module 4.3 salt-netapi-client 0.20.0-150400.3.3.5 SUSE-SU-2022:3194-1
SUSE Manager Server Module 4.3 smdba 1.7.10-0.150400.4.3.1 SUSE-SU-2022:3194-1
SUSE Manager Server Module 4.3 spacecmd +1 4.3.14-150400.3.3.2 SUSE-SU-2022:3194-1
SUSE Manager Server Module 4.3 spacewalk +1 4.3.5-150400.3.3.2 SUSE-SU-2022:3194-1
SUSE Manager Server Module 4.3 spacewalk-backend 4.3.15-150400.3.3.5 SUSE-SU-2022:3194-1
SUSE Manager Server Module 4.3 spacewalk-client-tools 4.3.11-150400.3.3.4 SUSE-SU-2022:3194-1
SUSE Manager Server Module 4.3 spacewalk-config 4.3.9-150400.3.3.3 SUSE-SU-2022:3194-1
SUSE Manager Server Module 4.3 spacewalk-java 4.3.35-150400.3.3.5 SUSE-SU-2022:3194-1
SUSE Manager Server Module 4.3 spacewalk-search 4.3.6-150400.3.3.3 SUSE-SU-2022:3194-1
SUSE Manager Server Module 4.3 spacewalk-setup 4.3.10-150400.3.3.3 SUSE-SU-2022:3194-1
SUSE Manager Server Module 4.3 spacewalk-utils +1 4.3.13-150400.3.3.3 SUSE-SU-2022:3194-1
SUSE Manager Server Module 4.3 spacewalk-web 4.3.23-150400.3.3.4 SUSE-SU-2022:3194-1
SUSE Manager Server Module 4.3 subscription-matcher 0.29-150400.3.3.1 SUSE-SU-2022:3194-1
SUSE Manager Server Module 4.3 susemanager 4.3.18-150400.3.3.2 SUSE-SU-2022:3194-1
SUSE Manager Server Module 4.3 susemanager-build-keys 15.4.3-150400.3.3.1 SUSE-SU-2022:3194-1
SUSE Manager Server Module 4.3 susemanager-docs_en 4.3-150400.9.3.1 SUSE-SU-2022:3194-1
SUSE Manager Server Module 4.3 susemanager-sls 4.3.24-150400.3.3.1 SUSE-SU-2022:3194-1
SUSE Manager Server Module 4.3 virtual-host-gatherer 1.0.23-150400.3.3.1 SUSE-SU-2022:3194-1
SUSE Manager Server Module 4.3 woodstox 4.4.2-150400.3.3.1 SUSE-SU-2022:3194-1
SUSE Manager Server Module 4.3 xmlpull-api 1.1.3.1-150400.3.3.1 SUSE-SU-2022:3194-1
SUSE Manager Server Module 4.2 apache-commons-csv 1.2-150300.3.3.2 SUSE-SU-2022:2568-1
SUSE Manager Server Module 4.2 apache-commons-math3 3.2-150300.3.3.2 SUSE-SU-2022:2568-1
SUSE Manager Server Module 4.2 drools +2 7.17.0-150300.4.3.2 SUSE-SU-2022:2568-1
SUSE Manager Server Module 4.2 inter-server-sync 0.2.2-150300.8.17.1 SUSE-SU-2022:2144-1
SUSE Manager Server Module 4.2 jakarta-commons-validator 1.1.4-21.150300.21.3.3 SUSE-SU-2022:2568-1
SUSE Manager Server Module 4.2 jose4j 0.5.1-150300.3.3.2 SUSE-SU-2022:2568-1
SUSE Manager Server Module 4.2 mvel2 2.2.6.Final-150300.3.3.2 SUSE-SU-2022:2568-1
SUSE Manager Server Module 4.2 prometheus-formula 0.6.2-150300.3.14.1 SUSE-SU-2022:2144-1
SUSE Manager Server Module 4.2 py27-compat-salt 3000.3-150300.7.7.20.2 SUSE-SU-2022:2568-1
SUSE Manager Server Module 4.2 python-susemanager-retail 1.0.1653987003.92d4870-150300.3.3.2 SUSE-SU-2022:2568-1
SUSE Manager Server Module 4.2 salt-netapi-client 0.19.0-150300.3.6.1 SUSE-SU-2022:2144-1
SUSE Manager Server Module 4.2 smdba 1.7.10-0.150300.3.6.1 SUSE-SU-2022:2568-1, SUSE-SU-2022:2144-1
SUSE Manager Server Module 4.2 spacecmd 4.2.17-150300.4.21.4 SUSE-SU-2022:2568-1, SUSE-SU-2022:2144-1
SUSE Manager Server Module 4.2 spacewalk-admin 4.2.11-150300.3.12.3 SUSE-SU-2022:2568-1
SUSE Manager Server Module 4.2 spacewalk-backend 4.2.22-150300.4.23.1 SUSE-SU-2022:2568-1, SUSE-SU-2022:2144-1
SUSE Manager Server Module 4.2 spacewalk-branding 4.2.14-150300.3.12.3 SUSE-SU-2022:2568-1
SUSE Manager Server Module 4.2 spacewalk-certs-tools 4.2.16-150300.3.18.3 SUSE-SU-2022:2568-1, SUSE-SU-2022:2144-1
SUSE Manager Server Module 4.2 spacewalk-client-tools 4.2.19-150300.4.21.3 SUSE-SU-2022:2568-1
SUSE Manager Server Module 4.2 spacewalk-java 4.2.38-150300.3.35.1 SUSE-SU-2022:2568-1, SUSE-SU-2022:2144-1
SUSE Manager Server Module 4.2 spacewalk-search 4.2.7-150300.3.9.2 SUSE-SU-2022:2568-1
SUSE Manager Server Module 4.2 spacewalk-setup 4.2.11-150300.3.15.2 SUSE-SU-2022:2568-1
SUSE Manager Server Module 4.2 spacewalk-utils 4.2.16-150300.3.15.5 SUSE-SU-2022:2568-1, SUSE-SU-2022:2144-1
SUSE Manager Server Module 4.2 spacewalk-web 4.2.27-150300.3.21.7 SUSE-SU-2022:2568-1, SUSE-SU-2022:2144-1
SUSE Manager Server Module 4.2 subscription-matcher 0.29-150300.6.9.2 SUSE-SU-2022:2568-1
SUSE Manager Server Module 4.2 supportutils-plugin-salt 1.2.0-150300.3.3.1 SUSE-SU-2022:2144-1
SUSE Manager Server Module 4.2 susemanager 4.2.32-150300.3.31.1 SUSE-SU-2022:2568-1, SUSE-SU-2022:2144-1
SUSE Manager Server Module 4.2 susemanager-doc-indexes 4.2-150300.12.27.6 SUSE-SU-2022:2568-1, SUSE-SU-2022:2144-1
SUSE Manager Server Module 4.2 susemanager-docs_en 4.2-150300.12.27.1 SUSE-SU-2022:2568-1, SUSE-SU-2022:2144-1
SUSE Manager Server Module 4.2 susemanager-schema 4.2.22-150300.3.21.6 SUSE-SU-2022:2568-1, SUSE-SU-2022:2144-1
SUSE Manager Server Module 4.2 susemanager-sls 4.2.23-150300.3.25.4 SUSE-SU-2022:2568-1, SUSE-SU-2022:2144-1
SUSE Manager Server Module 4.2 susemanager-sync-data 4.2.12-150300.3.18.3 SUSE-SU-2022:2568-1, SUSE-SU-2022:2144-1
SUSE Manager Server Module 4.2 virtual-host-gatherer 1.0.23-150300.3.3.1 SUSE-SU-2022:2568-1, SUSE-SU-2022:2144-1
SUSE Manager Server Module 4.2 woodstox 4.4.2-150300.3.3.2 SUSE-SU-2022:2568-1
SUSE Manager Server Module 4.2 xmlpull-api 1.1.3.1-150300.3.3.2 SUSE-SU-2022:2568-1
SUSE Manager Server Module 4.1 golang-github-QubitProducts-exporter_exporter 0.4.0-150200.6.12.2 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 golang-github-lusitaniae-apache_exporter 0.7.0-150200.2.6.2 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 golang-github-prometheus-node_exporter 1.3.0-150200.3.9.3 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 patterns-suse-manager 4.1-150200.6.12.2 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 postgresql-jdbc 42.2.10-150200.3.8.2 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 prometheus-exporters-formula 0.9.5-150200.3.31.2 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 prometheus-formula 0.3.7-150200.3.21.2 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 py27-compat-salt 3000.3-150200.6.24.2 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 spacecmd 4.1.18-150200.4.39.3 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 spacewalk-backend 4.1.31-150200.4.50.4 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 spacewalk-java 4.1.46-150200.3.71.5 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 spacewalk-setup 4.1.11-150200.3.18.2 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 spacewalk-utils 4.1.20-150200.3.30.2 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 spacewalk-web 4.1.34-150200.3.47.6 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 subscription-matcher 0.28-150200.3.15.2 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 susemanager 4.1.36-150200.3.52.1 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 susemanager-doc-indexes 4.1-150200.11.55.4 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 susemanager-docs_en 4.1-150200.11.55.2 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 susemanager-schema 4.1.26-150200.3.45.4 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 susemanager-sls 4.1.36-150200.3.64.2 SUSE-SU-2022:2145-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE Manager Server 4.2 release-notes-susemanager 4.2.7-150300.3.44.1 SUSE-SU-2022:2567-1, SUSE-SU-2022:2146-1
SUSE Manager Server 4.1 release-notes-susemanager 4.1.15-150200.3.80.1 SUSE-SU-2022:2143-1
SUSE Manager Retail Branch Server 4.2 release-notes-susemanager-proxy 4.2.7-150300.3.31.2 SUSE-SU-2022:2567-1, SUSE-SU-2022:2146-1
SUSE Manager Retail Branch Server 4.1 release-notes-susemanager-proxy 4.1.15-150200.3.56.1 SUSE-SU-2022:2143-1
SUSE Manager Proxy Module 4.2 spacecmd 4.2.17-150300.4.21.4 SUSE-SU-2022:2144-1
SUSE Manager Proxy Module 4.2 spacewalk-backend 4.2.22-150300.4.23.1 SUSE-SU-2022:2144-1
SUSE Manager Proxy Module 4.2 spacewalk-certs-tools 4.2.16-150300.3.18.3 SUSE-SU-2022:2144-1
SUSE Manager Proxy Module 4.2 spacewalk-web 4.2.27-150300.3.21.7 SUSE-SU-2022:2144-1
SUSE Manager Proxy Module 4.2 supportutils-plugin-salt 1.2.0-150300.3.3.1 SUSE-SU-2022:2144-1
SUSE Manager Proxy 4.2 release-notes-susemanager-proxy 4.2.7-150300.3.31.2 SUSE-SU-2022:2567-1, SUSE-SU-2022:2146-1
SUSE Manager Proxy 4.1 release-notes-susemanager-proxy 4.1.15-150200.3.56.1 SUSE-SU-2022:2143-1

Advisories 7

References