CVE-2020-25638

A flaw was found in hibernate-core in versions prior to 5.3.20.Final and in 5.4.0.Final up to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.

A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.

TuxCare rebuilt org.hibernate:hibernate-core to address 1 CVE. Fixed in 4.3.11.Final-tuxcare.2.

TuxCare rebuilt org.hibernate:hibernate-core to address 1 CVE. Fixed in 5.4.3.Final-tuxcare.2.

This update fixes the following issues:

hibernate5:

• Fix potential SQL injection CVE-2020-25638 (bsc#1193832)

mgr-libmod:

• Version 4.1.10-1
  • require python macros for building

mgr-osad:

• Version 4.1.6-1
  • require python macros for building

prometheus-formula:

• Version 0.3.5
  • Add support for new Uyuni SD in Prometheus >= 2.31

py27-compat-salt:

• Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
• Remove wrong _parse_cpe_name from grains.core
• Fix file.find tracebacks with non utf8 file names (bsc#1190114)
• Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
• Added Python2 build possibility for RHEL8
• Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
• Fix traceback.*_exc() calls
• Fix the regression of docker_container state module (bsc#1191285)

spacecmd:

• Version 4.1.16-1
  • require python macros for building

spacewalk-admin:

• Version 4.1.11-1
  • add service to update configfile and introduce a backup scc user

spacewalk-backend:

• Version 4.1.30-1
  • Add headers to update proxy auth token in listChannels (bsc#1193585)
  • require python macros for building
  • Fix the IS_SUSE variable in spacewalk-debug
  • exchange zypp-plugin dependency to use the python3 version (bsc#1192514)
  • Minor spec update.
  • Added RHN config parameter httpd_config_dir.

spacewalk-certs-tools:

• Version 4.1.20-1
  • Make bootstrap script to use bash when called with a different interpreter (bsc#1191656)

spacewalk-client-tools:

• Version 4.1.11-1
  • require python macros for building

spacewalk-java:

• Version 4.1.43-1
  • Fix stack overflow when building a CLM project from modular sources (bsc#1194990)
  • Avoid using RPM tags when filtering modular packages in CLM (bsc#1192487)
  • fix XML syntax in cobbler snippets (bsc#1193694)
  • Fix stripping module metadata when cloning channels in CLM (bsc#1193008)
  • Fix system information forwarding to SCC (bsc#1188900)
  • forward registration data to SUSE Customer Center
  • Run Prometheus JMX exporter as Java agent (bsc#1184617)
  • Fix calling wrong XMLRPC bootstrap method (bsc#1192736)
  • Fix package update action with shared channels (bsc#1191313)
  • fix issue with empty action chains getting deleted too early (bsc#1191377)
  • switch to best repo auth item for contentsources (bsc#1191442)
  • Set product name and version in the User-Agent header when connecting to SCC
  • update last boot time of SSH Minions after bootstrapping (bsc#1191899)
  • Mark SSH minion actions when they're picked up (bsc#1188505)
  • Add compressed flag to image pillars when kiwi image is compressed (bsc#1191702)
  • mgr-sync refresh logs when a vendor channel is expired and shows how to remove it (bsc#1191222)
• Readable error when 'mgr-sync add channel' is called with a non-existing label (bsc#1173143)

spacewalk-reports:

• Version 4.1.5-1
  • Fixes query for system-history report to prevent more than one row returned by a subquery with rhnxccdftestresult.identifier (bsc#1191192)

spacewalk-setup:

• Version 4.1.10-1
  • Increase 'max_event_size' value for the Salt master (bsc#1191340)
  • Leave Cobbler bootloader directory at the default (bsc#1187708)
  • Don't delete cobbler.conf contents.
  • Fixed FileNotFoundError on cobbler setup.
  • cobbler20-setup was removed
  • spacewalk-setup-cobbler was reimplemented in Python
  • Config files for Cobbler don't get edited in place anymore, thus the original ones are saved with a '.backup' suffix

spacewalk-utils:

• Version 4.1.19-1
  • require python macros for building

spacewalk-web:

• Version 4.1.31-1
  • Update Web UI version to 4.1.13

suseRegisterInfo:

• Version 4.1.4-1
  • require python macros for building

susemanager:

• Version 4.1.32-1
  • add additional default config values for forwarding registrations to SCC

susemanager-doc-indexes:

• In the Troubleshooting section of the Client Configuration Guide, SUSE Linux…

This update fixes the following issues:

c3p0:

• Build with log4j mapper

dhcpd-formula:

• Update to version 0.1.1641480250.d5bd14c
  • make routers option optional

hibernate5:

• Fix potential SQL injection CVE-2020-25638 (bsc#1193832)

mgr-libmod:

• Version 4.2.7-1
  • require python macros for building

mgr-osad:

• Version 4.2.7-1
  • Do not build python 2 package for SLE15SP4 and higher
  • require python macros for building

mgr-push:

• Version 4.2.4-1
  • Do not build python 2 package for SLE15SP4 and higher

py27-compat-salt:

• Fix inspector module export function (bsc#1097531)
• Fix possible traceback on ip6_interface grain (bsc#1193565)
• Don't check for cached pillar errors on state.apply (bsc#1190781)
• Simplify 'transactional_update' module to not use SSH wrapper and allow more flexible execution
• Add '--no-return-event' option to salt-call to prevent sending return event back to master.
• Make 'state.highstate' to acts on concurrent flag.
• Fix the regression with invalid syntax in test_parse_cpe_name_v23.
• Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
• Fix the regression of docker_container state module (bsc#1191285)

rhnlib:

• Version 4.2.5-1
  • do not build python 2 package for SLE15

salt-netapi-client:

• Hotfix (bsc#1192550):
• Version 0.19.0
  • See: https://github.com/SUSE/salt-netapi-client/releases/tag/v0.19.0

saltboot-formula:

• Update to version 0.1.1637232240.87d79ed
  • Prevent python failure under some circumstances when filesystem was not set (bsc#1192440)
  • Add missing boot_images option in SLE11 saltboot version

spacecmd:

• Version 4.2.15-1
  • require python macros for building

spacewalk-backend:

• Version 4.2.19-1
  • Retrieve and store copyright information about patches
  • SLES PAYG client support on cloud
  • Add headers to update proxy auth token in listChannels (bsc#1193585)
  • require python macros for building
  • exchange zypp-plugin dependency to use the python3 version (bsc#1192514)

spacewalk-branding:

• Version 4.2.12-1
  • Fix header search autofocus

spacewalk-client-tools:

• Version 4.2.16-1
  • do not build python 2 package for SLE15
  • require python macros for building

spacewalk-config:

• Version 4.2.5-1
  • add migration for changed rhn.conf values

spacewalk-java:

• Version 4.2.32-1
  • Pass only selected servers to taskomatic for cancelation (bsc#1194044)
  • Added rights field to generated updateinfo.xml to handle copyright
  • provide static configuration key name for SSHMinionActionExecutor parallel threads
  • Add support for custom SSH port for SSH minions
  • add ubuntu errata data and install handling
  • Fix stack overflow when building a CLM project from modular sources (bsc#1194990)
  • SLES PAYG client support on cloud
  • Change order of 'Relevant' and 'All' in patches menu
  • Handle multiple Kiwi bundles (bsc#1194905)
  • Install product by default after a channel is subscribed
  • Improve token validation logs
  • fix possible race condition in job handling (bsc#1192510)
  • Migrate the displaying of the date/time to rhn:formatDate
  • Add additional matchers to package (nevra) filter
  • Add greater equals matcher to package (nevra) filter
  • fix XML syntax in cobbler snippets (bsc#1193694)
  • Add new endpoints to packages API: schedulePackageLockChange, listPackagesLockStatus
  • Avoid using RPM tags when filtering modular packages in CLM (bsc#1192487)
  • Fix stripping module metadata when cloning channels in CLM (bsc#1193008)
  • UI and API call for changing proxy
  • require postgresql14 on SLE15 SP4
  • Update proxy path on minion connection
  • fix actionchain stuck in pending/picked up (bsc#1189561)
  • fix parsing error by making SCAP Profile description attribute optional (bsc#1192321)
  • Show salt ssh error message in failed action details

spacewalk-reports:

• Version 4.2.7-1
  • Fixes query for system-history report to prevent more than one row returned by a subquery with…

It was discovered that Hibernate incorrectly handled certain inputs with unsanitized literals. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to obtain sensitive information.