Security update for for SUSE Manager 4.1 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:2647-1 Final 1 1 2020-09-16T12:22:50Z current 2020-09-16T12:22:50Z 2020-09-16T12:22:50Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for for SUSE Manager 4.1 This update for SUSE Manager 4.1 fixes the following issues: google-gson: - Use packages from SUSE:SLE-15-SP2:Update:Products:Manager41:Update to fix building other packages. httpcomponents-client: - Use packages from SUSE:SLE-15-SP2:Update:Products:Manager41:Update to fix building other packages. httpcomponents-core: - Use packages from SUSE:SLE-15-SP2:Update:Products:Manager41:Update to fix building other packages. salt-netapi-client: - Refresh authentication module list to newer Salt versions spacewalk-admin: - Use the Salt API in authenticated and encrypted form (bsc#1175884, CVE-2020-8028) spacewalk-java: - Use the Salt API in authenticated and encrypted form (bsc#1175884, CVE-2020-8028) spacewalk-setup: - Use the Salt API in authenticated and encrypted form (bsc#1175884, CVE-2020-8028) velocity: - Use packages from SUSE:SLE-15-SP2:Update:Products:Manager41:Update to fix building other packages. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure-2020-2647,Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM-2020-2647,Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE-2020-2647,SUSE-2020-2647,SUSE-SLE-Module-SUSE-Manager-Server-4.1-2020-2647 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20202647-1/ Link for SUSE-SU-2020:2647-1 https://lists.suse.com/pipermail/sle-security-updates/2020-September/007434.html E-Mail link for SUSE-SU-2020:2647-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1175884 SUSE Bug 1175884 https://www.suse.com/security/cve/CVE-2020-8028/ SUSE CVE CVE-2020-8028 page Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE SUSE Manager Server Module 4.1 google-gson-2.8.5-3.4.3 httpcomponents-client-4.5.6-3.4.2 httpcomponents-core-4.4.10-3.4.2 salt-netapi-client-0.17.0-3.3.2 spacewalk-admin-4.1.6-3.3.3 spacewalk-java-4.1.19-3.8.2 spacewalk-java-config-4.1.19-3.8.2 spacewalk-java-lib-4.1.19-3.8.2 spacewalk-java-postgresql-4.1.19-3.8.2 spacewalk-setup-4.1.6-3.3.2 spacewalk-taskomatic-4.1.19-3.8.2 google-gson-javadoc-2.8.5-3.4.3 httpcomponents-client-cache-4.5.6-3.4.2 httpcomponents-client-javadoc-4.5.6-3.4.2 httpcomponents-core-javadoc-4.4.10-3.4.2 spacewalk-java-apidoc-sources-4.1.19-3.8.2 velocity-1.7-11.4.3 velocity-demo-1.7-11.4.3 velocity-javadoc-1.7-11.4.3 velocity-manual-1.7-11.4.3 google-gson-2.8.5-3.4.3 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure httpcomponents-client-4.5.6-3.4.2 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure httpcomponents-core-4.4.10-3.4.2 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure salt-netapi-client-0.17.0-3.3.2 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure spacewalk-admin-4.1.6-3.3.3 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure spacewalk-java-4.1.19-3.8.2 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure spacewalk-java-config-4.1.19-3.8.2 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure spacewalk-java-lib-4.1.19-3.8.2 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure spacewalk-java-postgresql-4.1.19-3.8.2 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure spacewalk-setup-4.1.6-3.3.2 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure spacewalk-taskomatic-4.1.19-3.8.2 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure google-gson-2.8.5-3.4.3 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM httpcomponents-client-4.5.6-3.4.2 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM httpcomponents-core-4.4.10-3.4.2 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM salt-netapi-client-0.17.0-3.3.2 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM spacewalk-admin-4.1.6-3.3.3 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM spacewalk-java-4.1.19-3.8.2 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM spacewalk-java-config-4.1.19-3.8.2 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM spacewalk-java-lib-4.1.19-3.8.2 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM spacewalk-java-postgresql-4.1.19-3.8.2 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM spacewalk-setup-4.1.6-3.3.2 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM spacewalk-taskomatic-4.1.19-3.8.2 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM google-gson-2.8.5-3.4.3 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE httpcomponents-client-4.5.6-3.4.2 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE httpcomponents-core-4.4.10-3.4.2 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE salt-netapi-client-0.17.0-3.3.2 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE spacewalk-admin-4.1.6-3.3.3 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE spacewalk-java-4.1.19-3.8.2 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE spacewalk-java-config-4.1.19-3.8.2 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE spacewalk-java-lib-4.1.19-3.8.2 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE spacewalk-java-postgresql-4.1.19-3.8.2 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE spacewalk-setup-4.1.6-3.3.2 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE spacewalk-taskomatic-4.1.19-3.8.2 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE google-gson-2.8.5-3.4.3 as a component of SUSE Manager Server Module 4.1 httpcomponents-client-4.5.6-3.4.2 as a component of SUSE Manager Server Module 4.1 httpcomponents-core-4.4.10-3.4.2 as a component of SUSE Manager Server Module 4.1 salt-netapi-client-0.17.0-3.3.2 as a component of SUSE Manager Server Module 4.1 spacewalk-admin-4.1.6-3.3.3 as a component of SUSE Manager Server Module 4.1 spacewalk-java-4.1.19-3.8.2 as a component of SUSE Manager Server Module 4.1 spacewalk-java-config-4.1.19-3.8.2 as a component of SUSE Manager Server Module 4.1 spacewalk-java-lib-4.1.19-3.8.2 as a component of SUSE Manager Server Module 4.1 spacewalk-java-postgresql-4.1.19-3.8.2 as a component of SUSE Manager Server Module 4.1 spacewalk-setup-4.1.6-3.3.2 as a component of SUSE Manager Server Module 4.1 spacewalk-taskomatic-4.1.19-3.8.2 as a component of SUSE Manager Server Module 4.1 A Improper Access Control vulnerability in the configuration of salt of SUSE Linux Enterprise Module for SUSE Manager Server 4.1, SUSE Manager Proxy 4.0, SUSE Manager Retail Branch Server 4.0, SUSE Manager Server 3.2, SUSE Manager Server 4.0 allows local users to escalate to root on every system managed by SUSE manager. On the managing node itself code can be executed as user salt, potentially allowing for escalation to root there. This issue affects: SUSE Linux Enterprise Module for SUSE Manager Server 4.1 google-gson versions prior to 2.8.5-3.4.3, httpcomponents-client-4.5.6-3.4.2, httpcomponents-. SUSE Manager Proxy 4.0 release-notes-susemanager-proxy versions prior to 4.0.9-0.16.38.1. SUSE Manager Retail Branch Server 4.0 release-notes-susemanager-proxy versions prior to 4.0.9-0.16.38.1. SUSE Manager Server 3.2 salt-netapi-client versions prior to 0.16.0-4.14.1, spacewalk-. SUSE Manager Server 4.0 release-notes-susemanager versions prior to 4.0.9-3.54.1. CVE-2020-8028 Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure:google-gson-2.8.5-3.4.3 Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure:httpcomponents-client-4.5.6-3.4.2 Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure:httpcomponents-core-4.4.10-3.4.2 Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure:salt-netapi-client-0.17.0-3.3.2 Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure:spacewalk-admin-4.1.6-3.3.3 Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure:spacewalk-java-4.1.19-3.8.2 Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure:spacewalk-java-config-4.1.19-3.8.2 Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure:spacewalk-java-lib-4.1.19-3.8.2 Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure:spacewalk-java-postgresql-4.1.19-3.8.2 Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure:spacewalk-setup-4.1.6-3.3.2 Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure:spacewalk-taskomatic-4.1.19-3.8.2 Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM:google-gson-2.8.5-3.4.3 Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM:httpcomponents-client-4.5.6-3.4.2 Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM:httpcomponents-core-4.4.10-3.4.2 Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM:salt-netapi-client-0.17.0-3.3.2 Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM:spacewalk-admin-4.1.6-3.3.3 Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM:spacewalk-java-4.1.19-3.8.2 Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM:spacewalk-java-config-4.1.19-3.8.2 Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM:spacewalk-java-lib-4.1.19-3.8.2 Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM:spacewalk-java-postgresql-4.1.19-3.8.2 Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM:spacewalk-setup-4.1.6-3.3.2 Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM:spacewalk-taskomatic-4.1.19-3.8.2 Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE:google-gson-2.8.5-3.4.3 Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE:httpcomponents-client-4.5.6-3.4.2 Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE:httpcomponents-core-4.4.10-3.4.2 Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE:salt-netapi-client-0.17.0-3.3.2 Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE:spacewalk-admin-4.1.6-3.3.3 Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE:spacewalk-java-4.1.19-3.8.2 Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE:spacewalk-java-config-4.1.19-3.8.2 Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE:spacewalk-java-lib-4.1.19-3.8.2 Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE:spacewalk-java-postgresql-4.1.19-3.8.2 Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE:spacewalk-setup-4.1.6-3.3.2 Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE:spacewalk-taskomatic-4.1.19-3.8.2 SUSE Manager Server Module 4.1:google-gson-2.8.5-3.4.3 SUSE Manager Server Module 4.1:httpcomponents-client-4.5.6-3.4.2 SUSE Manager Server Module 4.1:httpcomponents-core-4.4.10-3.4.2 SUSE Manager Server Module 4.1:salt-netapi-client-0.17.0-3.3.2 SUSE Manager Server Module 4.1:spacewalk-admin-4.1.6-3.3.3 SUSE Manager Server Module 4.1:spacewalk-java-4.1.19-3.8.2 SUSE Manager Server Module 4.1:spacewalk-java-config-4.1.19-3.8.2 SUSE Manager Server Module 4.1:spacewalk-java-lib-4.1.19-3.8.2 SUSE Manager Server Module 4.1:spacewalk-java-postgresql-4.1.19-3.8.2 SUSE Manager Server Module 4.1:spacewalk-setup-4.1.6-3.3.2 SUSE Manager Server Module 4.1:spacewalk-taskomatic-4.1.19-3.8.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20202647-1/ https://www.suse.com/security/cve/CVE-2020-8028.html CVE-2020-8028 https://bugzilla.suse.com/1175884 SUSE Bug 1175884