CVE-2017-7514

A cross-site scripting (XSS) flaw was found in how the failed action entry is processed in Red Hat Satellite before version 5.8.0. A user able to specify a failed action could exploit this flaw to perform XSS attacks against other Satellite users.

A cross-site scripting (XSS) flaw was found in how the failed action entry is processed in Red Hat Satellite before version 5.8.0. A user able to specify a failed action could exploit this flaw to perform XSS attacks against other Satellite users.

A cross-site scripting (XSS) flaw was found in how the failed action entry is processed in Red Hat Satellite before version 5.8.0. A user able to specify a failed action could exploit this flaw to perform XSS attacks against other Satellite users.

A cross-site scripting (XSS) flaw was found in how the failed action entry is processed in Red Hat Satellite before version 5.8.0. A user able to specify a failed action could exploit this flaw to perform XSS attacks against other Satellite users.

This update fixes the following issues:

nutch:

• Log Hadoop into proper log dir (bsc#1061574): change-default-log-location.patch

salt-netapi-client:

See: https://github.com/SUSE/salt-netapi-client/releases/tag/v0.13.0

spacecmd:

• Configchannel export binary flag to json (bsc#1044719)

spacewalk:

• Support postgresql 9.6 (bsc#1045152)

spacewalk-backend:

• Add hostname to duplicate machine_id email (bsc#1055292)
• Fix link to manual and described procedure
• Fix SP migration for traditional clients which were registered by a currently disabled user (bsc#1057126)

spacewalk-branding:

• Disallow entering multiple identical mirror credentials (bsc#971785)
• Fix ISE error with invalid custom key id (bsc#1048294)

spacewalk-certs-tools:

• Do not use registration keys from last autoinstallation (bsc#1057599)

spacewalk-java:

• Disallow entering multiple identical mirror credentials (bsc#971785)
• Fix ISE error with invalid custom key id (bsc#1048294)
• Skip the server if no channel can be guessed (bsc#1040420)
• Keep the GPG Check value if validation fails (bsc#1061548)
• Make systems in system group list selectable by the group admins (bsc#1021432)
• Hide non-relevant typed systems in SystemCurrency (bsc#1019097)
• Exclude salt systems from the list of target systems for traditional configuration stack installation
• Start registration for accepted minions only on the minion start event, not automatically on any event (bsc#1054044)
• Extract proxy version from named installed product (bsc#1055467)
• Install update stack erratas as a package list (bsc#1049139)
• Schedule one action for all selected patches on RHEL (bsc#1038862)
• Improve duplicate hostname and transaction handling in minion registration
• Display GUI message after successfully deleting custom key (bsc#1048295)
• Harmonize presentation of patch information (bsc#1032065)
• Fix links on schedule pages (bsc#1059201)
• Fix duplicate machine id in event history on minion restart (bsc#1059388)
• Show link in message when rescheduling actions (bsc#1032122)
• Prevent ISE when distribution does not exist (bsc#1059524)
• Do not store registration-keys during autoinstallation (bsc#1057599)
• Fix cloning Kickstart Profiles with Custom Options (bsc#1061576)
• Checkin the foreign host if a s390 minion finished a job (bsc#971916)
• Increase max length of hardware address to 32 bytes (bsc#989991)
• Adapt Salt runner and wheel calls to the new error handling introduced in salt-netapi-client-0.12.0
• Change log level and event history for duplicate machine id (bsc#1041489)
• Trim spaces around the target expression in the Salt remote command page (bsc#1056678)
• Fix a ConstraintViolationException when refreshing hardware with changed network interfaces or IP addresses
• Check entitlement usage based on grains when onboarding a minion (bsc#1043880)
• Escape failure-text of failed-actions (CVE-2017-7514, bsc#1042265)
• Fix minor UI issues on overview page (bsc#1063590)

spacewalk-reports:

• Add machine_id and minion_id to system-profiles and inventory report (bsc#1054902)

spacewalk-web:

• Disallow entering multiple identical mirror credentials (bsc#971785)

supportutils-plugin-susemanager:

• Use correct function validate_rpm for supportconfig (bsc#1062094)

susemanager:

• Add 'yum-plugin-security' package to RES6 bootstrap rep (bsc#1059319)
• Ensure postgres db template uses unicode (bsc#1062476)

susemanager-docs_en:

• Update text and image files.
• Fix some version strings (bsc#1065085)

release-notes-susemanager:

• Enable SUSE Linux Enterprise 12 SP3 as base OS

susemanager-schema:

• Re-create unique index on minion_id (bsc#1059568, bsc#1056358)
• Increase max length of hardware address to 32 bytes (bsc#989991)

susemanager-sls:

• Targeting patches instead of packages for non Zypper patch installation (bsc#1038862)
• Support xccdf 1.2 namespace in openscap result file (bsc#1059319)
• Fix create empty top.sls with no-op (bsc#1053038)…