CVE-2014-7811

Multiple cross-site scripting (XSS) vulnerabilities in Spacewalk and Red Hat Network (RHN) Satellite before 5.7.0 allow remote authenticated users to inject arbitrary web script or HTML via crafted XML data to the REST API.

Multiple cross-site scripting (XSS) vulnerabilities in Spacewalk and Red Hat Network (RHN) Satellite before 5.7.0 allow remote authenticated users to inject arbitrary web script or HTML via crafted XML data to the REST API.

Multiple cross-site scripting (XSS) vulnerabilities in Spacewalk and Red Hat Network (RHN) Satellite before 5.7.0 allow remote authenticated users to inject arbitrary web script or HTML via crafted XML data to the REST API.

Multiple cross-site scripting (XSS) vulnerabilities in Spacewalk and Red Hat Network (RHN) Satellite before 5.7.0 allow remote authenticated users to inject arbitrary web script or HTML via crafted XML data to the REST API.

This collective update for SUSE Manager Server 2.1 provides the following new features:

* ISS: export/import information about cloned channels to support
  Service Pack migration on ISS slaves. (FATE#317789)
* New API calls: system.scheduleSPMigration(),
  system.scheduleDistUpgrade(). (FATE#314785, FATE#314340)

Additionally, several issues have been fixed:

cobbler:

* Fix re-installation on SLE with static network configuration.
  (bsc#883487)
* Add RHEL 7 as a valid operating system version.

smdba:

* Archival of PosgreSQL transaction log does not recover in case of no
  space left on device. (bsc#915140)

sm-ncc-sync-data:

* Add support for RES7 in SUSE Manager. (bsc#897723, bsc#893608)

spacewalk-backend:

* Convert mtime to localtime to prevent invalid times because of DST.
  (bsc#914437)
* Do not exit with error if a vendor channel has no URL associated.
  (bsc#914260)
* Copy all SUSE Manager logfiles into spacewalk-debug.
* Exclude old backup-logs from spacewalk-debug to reduce size.
* Fix ISS export with unset patch severity.
* Convert empty string to null for DMI values. (bsc#911272)
* Fixed double-counting of systems subscribed to more than one channel.

spacewalk-certs-tools:

* Do not allow registering a SUSE Manager server against itself.
  (bsc#841731)

spacewalk-java:

* Fix auditlog config yaml syntax. (bsc#913221)
* Show Proxy tab if system is a proxy even when assigned to cloned
  channels. (bsc#913939)
* Fixed uncaught error which prevent correct error handling.
  (bsc#858971)
* Fix NPE by setting max_members to 0 instead of NULL. (bsc#912035)
* Fix more cross-site-scripting (XSS) issues. (CVE-2014-7811,
  bsc#902915)
* Fix basic authentication for HTTP proxies. (bsc#912057)
* Accept repos with same SCC ID and different URLs. (bsc#911808)
* Avoid mgr-sync-refresh failure because clear_log_id was not called.
  (bsc#911166)
* Fix cross-site-scripting (XSS) issue in system-group (CVE-2014-7812,
  bsc#912886)
* Fix 'Select All' buttons display on rhn:list and make it consistent
  with new rl:list. (bsc#909724)
* Fix List tag missing submit parameter for 'Select All' and others.
  (bnc#909724)
* Sort filelist in configfile.compare event history alphabetically.
  (bsc#910243)
* Allow parenthesis in system group description. (bsc#903064)
* Provide new API documentation in PDF format. (bsc#896029)
* Update the example scripts section. (bsc#896029)
* Fixed wording issues on package lock page. (bsc#880022)
* Make text more clear for package profile sync. (bsc#884350)

spacewalk-web:

* Show Proxy tab if system is a proxy even when assigned to cloned
  channels. (bsc#913939)

supportutils-plugin-susemanager:

* Write current service and repository configuration into
  supportconfig.

susemanager-jsp_en, susemanager-manuals_en:

* Update text and image files (bsc#910494).
* Firewall rules are incomplete - ssh-push and ssh-push-tunnel settings
  missing. (bsc#904703).
* Document SP migration and ISS. (bsc#913215, partially).
* Fix 'beta packages' mentioned in documentation. (bsc#886421).
* User guide: Snapshots: clarify snaphot usage. (bsc#906851).
* Document maximal supported configuration file limit. (bsc#910482).

susemanager-schema:

* Fix NPE by setting max_members to 0 instead of NULL. (bsc#912035)
* Fix old migration for future reference. (bsc#911180)
* Avoid NPE when migrating to SCC on Oracle migrated from 1.7.
  (bsc#911180)
* Fixed double-counting systems subscribed to more than one channel.

susemanager:

* Ask for the authentication beforehand. (bsc#908317)
* Bring back the ability to save credentials to the configuration file.
* Bring back token verification availability.
* Never ask for user credentials when scheduling a refresh.

…

This collective update for SUSE Manager Server 2.1 provides the following new features:

* Connect SUSE Manager to the SUSE Customer Center.
* Manage SLE12 systems.
* ISS: export/import information about cloned channels to support
  Service Pack migration on ISS slaves. (FATE#317789)
* New API calls: system.scheduleSPMigration(),
  system.scheduleDistUpgrade(). (FATE#314785, FATE#314340)

Additionally, several issues have been fixed:

auditlog-keeper:

* Fix value too long for type character varying(2048). (bnc#872351)
* Fix init.d script restart. (bsc#872029)

cobbler:

* Require syslinux-x86_64 on s390x. (bsc#884051)
* Fix fetching of profiles for auto-installation. (bsc#880936)
* Fix port guessing in koan. (bsc#855389)
* Add 'copy-default' option to grubby-compat. (bsc#855389)
* Handle elilo in SUSE. (bsc#855389)
* Fix wrong option 'text' in SUSE environment. (bsc#901058)
* Fix re-installation on SLE with static network configuration.
  (bsc#883487)
* Add RHEL 7 as a valid operating system version.

oracle-config:

* No need to pre-require Apache as its user and group are available in
  the base system.

osad:

* Enable and install osad during first installation. (bsc#901958)

pxe-default-image:

* Add bind-utils (dig) to packagelist. (bsc#889739)
* Wait for gateway to become available before register. (bsc#895001)

rhnlib:

* Ensure bytes strings are sent to pyOpenSSL. (bnc#880388)

rhnpush:

* Add default path structure to proxy lookaside that avoids collisions.

sm-ncc-sync-data:

* Add SUSE Cloud 4 channels. (bnc#883057)
* Add channels for SUSE Manager Server 2.1 s390x.
* Fix parent label of the LTSS channel for SLMS.
* Add ATI and nVidia channels for SLED11-SP3. (bsc#901108)
* Add support for RES7 in SUSE Manager. (bsc#897723, bsc#893608)

smdba:

* Fix 'system check breaks backup and other configuration'.
* Implement rotating PostgreSQL backup. (bsc#896244)
* Space reclamation caused ORA-00942: table or view does not exist.
  (bsc#906850)
* Archival of PosgreSQL transaction log does not recover in case of no
  space left on device. (bsc#915140)

spacecmd:

* Fix listupgrades. (bsc#892707)
* Make print_result a static method of SpacewalkShell. (bsc#889605)
* Call listAutoinstallableChannels() for listing distributions.
  (bsc#887879)
* Fix spacecmd schedule listing. (bsc#902494)
* Fix call of setCustomOptions() during kickstart_importjson.
  (bsc#879904)
* Fix configchannel export: do not create 'contents' key for
  directories. (bsc#908849)

spacewalk-backend:

* Insert update tag at the correct place for SLE12. (bsc#907677)
* Trigger generation of metadata if the repo contains no packages.
  (bsc#870159)
* Convert mtime to localtime to prevent invalid times because of DST.
  (bsc#914437)
* Do not exit with error if a vendor channel has no URL associated.
  (bsc#914260)
* Convert empty string to null for DMI values. (bsc#911272)

spacewalk-branding:

* CVE patches adapted for colour blind users. (bnc#872298)
* Underline in icons is removed. (bnc#880001)
* Fix link to macro documentation. (bsc#895961)
* Fix branding in error message. (bsc#902503)

spacewalk-certs-tools:

* Fix removal of existing host key entries. (bsc#886391)
* Remove duplicates from authorized_keys2 as well. (bsc#885889)
* Do not allow registering a SUSE Manager server against itself.
  (bsc#841731)

spacewalk-client-tools:

* Allow unicode characters in proxy username and password.
* Send correct hostname. (bsc#887538)

spacewalk-config:

* Add recommended Apache settings from the Security Team.

spacewalk-java:

* Fix human dates now() staying unmodified. (bnc#880081)
* Allow for null evr and archs on event history detail. (bnc#880327)
* Disable form autocompletion in some places.…

This update for sm-ncc-sync-data contains the following changes:

* Add SUSE Cloud 4 channels. (bnc#883057)
* Fix parent label of the LTSS channel for SLMS.