CVE-2018-1077

Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server.

Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server.

Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server.

Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server.

Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server.

This update fixes the following issues:

mgr-osad:

• Take care that osad is not disabled nor deactivated during update (bsc#1157700, bsc#1158697)

patterns-suse-manager:

• Add recommends for virtualization-host-formula to suma_server pattern
• Add recommends for virtualization-host-formula to retail

spacecmd:

• Bugfix: attempt to purge SSM when it is empty (bsc#1155372)

spacewalk-backend:

• Fix mgrcfg-client python3 breakage (bsc#1164309)
• Update doc link to point to new documentation server
• Prevent timestamp format exception on mgr-inter-sync while processing comps (bsc#1157346)
• When downloading repo metadata, don't add '/' to the repo url if it already ends with one (bsc#1158899)
• Use HTTP proxy settings when fetching the mirrorlist on spacewalk-repo-sync (bsc#1159076)
• Enhance suseProducts via ISS to fix SP migration on slave server (bsc#1159184)
• Prevent a traceback when reposyncing openSUSE 15.1 (bsc#1158672)
• Close config files after reading them (bsc#1158283)
• Associate VMs and systems with the same machine ID at bootstrap (bsc#1144176)

spacewalk-certs-tools:

• Add 'start_event_grains' minion option to configfile when generated by bootstrap script
• Forbid multiple activation keys for salt minions during bootstrap (bsc#1164452)
• Add additional minion options to configfile when generated by bootstrap script (bsc#1159492)
• Change the order to check the version correctly for RES (bsc#1152795)

spacewalk-client-tools:

• Spell correctly 'successful' and 'successfully'

spacewalk-web:

• Don't validate mandatory fields that are not visible (bsc#1158943)
• Fix count of changes to build (bsc#1160940)
• Report merge_subscriptions message in a readable way (bsc#1140332)
• Fix ordering by date (bsc#1158818)

supportutils-plugin-susemanager-client:

• Rename rhncfg-actions to mgr-cfg-actions

supportutils-plugin-susemanager-proxy:

• Rename rhncfg-actions to mgr-cfg-actions

How to apply this update:

1. Log in as root user to the SUSE Manager proxy.
2. Stop the proxy service: spacewalk-proxy stop
3. Apply the patch using either zypper patch or YaST Online Update.
4. Start the Spacewalk service: spacewalk-proxy start

This update fixes the following issues:

branch-network-formula:

• Update formula to include terminal naming and identification

image-sync-formula:

• Prevent installing xdelta3 package and disable delta functionality on SLE12 branch servers (bsc#1159553)

mgr-osad:

• Take care that osad is not disabled nor deactivated during update (bsc#1157700, bsc#1158697)

patterns-suse-manager:

• Add recommends for virtualization-host-formula to suma_server pattern
• Add recommends for virtualization-host-formula to retail

prometheus-formula:

• Bugfix: disabled fields not enabled when checkbox is checked

pxe-default-image-sle15:

• Adapt to new kiwi version to fix pre registration in the bare-metal image (bsc#1153269)

pxe-formula:

• Add support for new features in terminal naming
• Remove branch_id from pxe form, moved to branch-network form

py26-compat-salt:

• Replace pycrypto with M2Crypto as dependency for SLE15+

python-susemanager-retail:

• Add support for terminal naming block
• Add delta support for SLE15 tar.xz bundles

redstone-xmlrpc:

• Disable external entity parsing (1790381, bsc#1164120, CVE-2020-1693)
• Do not download external entities (1555429, bsc#1085414, CVE-2018-1077)

salt-netapi-client:

• Version 0.17.0 See: https://github.com/SUSE/salt-netapi-client/releases/tag/v0.17.0

spacecmd:

• Bugfix: attempt to purge SSM when it is empty (bsc#1155372)

spacewalk-admin:

• Spell correctly 'successful' and 'successfully'

spacewalk-backend:

• Fix mgrcfg-client python3 breakage (bsc#1164309)
• Update doc link to point to new documentation server
• Prevent timestamp format exception on mgr-inter-sync while processing comps (bsc#1157346)
• When downloading repo metadata, don't add '/' to the repo url if it already ends with one (bsc#1158899)
• Use HTTP proxy settings when fetching the mirrorlist on spacewalk-repo-sync (bsc#1159076)
• Enhance suseProducts via ISS to fix SP migration on slave server (bsc#1159184)
• Prevent a traceback when reposyncing openSUSE 15.1 (bsc#1158672)
• Close config files after reading them (bsc#1158283)
• Associate VMs and systems with the same machine ID at bootstrap (bsc#1144176)

spacewalk-certs-tools:

• Add 'start_event_grains' minion option to configfile when generated by bootstrap script
• Forbid multiple activation keys for salt minions during bootstrap (bsc#1164452)
• Add additional minion options to configfile when generated by bootstrap script (bsc#1159492)
• Change the order to check the version correctly for RES (bsc#1152795)

spacewalk-client-tools:

• Spell correctly 'successful' and 'successfully'

system-lock-formula:

• Clarified terms along documentation and product (bsc#1166061)

spacewalk-java:

• Feat: enable Salt system lock when CaaSP node is onboarded and add depedency to 'system-lock-formula' (bsc#1165541)
• Support non discoverable fqdns via custom grain (bsc#1155281)
• Handle the non-existent requested grains gracefully
• Get the machineid grain from the minion startup event
• Use term 'patch' instead of 'errata' (bsc#1164649)
• Enable provisioning API with salt and bootstrap entitled systems
• Fix a problem with removing the monitoring entitlement from a system
• Improve performance when adding systems to system groups (bsc#1158754)
• Migrate pillar and formula data on minion id change (bsc#1161755)
• Change doc links pointing to new documentation server
• Call saltutil.sync_all before calling highstate (bsc#1152673)
• Exclude base products from PAYG (Pay-As-You-Go) instances when doing subscription matching
• Show additional headers and dependencies for deb packages
• Show adequate message on saving formulas that change only pillar data
• Fix mgr-sync add channel when fromdir is configured (bsc#1160184)
• Handle not found re-activation key (bsc#1159012)
• Write a list of formulas sorted by execution order (bsc#1083326)
• Use channel name from product tree instead of constructing it (bsc#1157317)
• Read the subscriptions from the output…

This update fixes the following issues:

py26-compat-salt:

• Replace pycrypto with M2Crypto as dependency for SLE15+ (bsc#1165425)

redstone-xmlrpc:

• Disable external entity parsing (1790381, bsc#1164120, CVE-2020-1693)
• Do not download external entities (1555429, bsc#1085414, CVE-2018-1077)

spacecmd:

• Bugfix: attempt to purge SSM when it is empty (bsc#1155372)

spacewalk-admin:

• Spell correctly 'successful' and 'successfully'

spacewalk-backend:

• When downloading repo metadata, don't add '/' to the repo url if it already ends with one (bsc#1158899)
• Enhance suseProducts via ISS to fix SP migration on slave server (bsc#1159184)

spacewalk-certs-tools:

• Add minion option in config file to disable salt mine when generated by bootstrap script (bsc#1163001)

spacewalk-client-tools:

• Do not crash 'mgr-update-status' because 'long' type is not defined in Python 3
• Add workaround for uptime overflow to spacewalk-update-status as well (bsc#1165921)
• Spell correctly 'successful' and 'successfully'

spacewalk-java:

• Fix error when adding systems to ssm with 'add to ssm' button (bsc#1160246)
• Validate the suseproductchannel table and update missing date when running mgr-sync refresh (bsc#1163538)
• Read the subscriptions from the output instead of input (bsc#1140332)
• Show additional headers and dependencies for deb packages
• Use channel name from product tree instead of constructing it (bsc#1157317)

spacewalk-setup:

• Spell correctly 'successful' and 'successfully'

spacewalk-utils:

• Check for delimiter as well when detecting current phase (bsc#1164771)

spacewalk-web:

• Report merge_subscriptions message in a readable way (bsc#1140332)

subscription-matcher:

• Add missing library for SLE15 SP2 (slf4j-log4j12)
• Make the code usable with Math3 on SLES
• Use log4j12 package on newer SLE versions
• Aggregate stackable subscriptions with same parameters
• Implement new 'swap move' used in optaplanner (bsc#1140332)
• Enable aarch64 builds, except for SLE < 15

susemanager:

• Fix salt bootstrapping on SLE15 (require python3-pycrypto or python3-M2Crypto to support all variants) (bsc#1164563)
• Add bootstrap-repo data for OES 2018 SP2 (bsc#1161862)
• Add bootstrap-repo data for SLE15 SP2 Family

susemanager-sls:

• Adapt 'mgractionchains' module to work with Salt 3000
• Do not workaround util.syncmodules for SSH minions (bsc#1162609)
• Force to run util.synccustomall when triggering action chains on SSH minions (bsc#1162683).

susemanager-sync-data:

• Add OES 2018 SP2 (bsc#1161862)
• Rename RHEL 8 Base product
• Change channel family name according to SCC data

How to apply this update:

1. Log in as root user to the SUSE Manager server.
2. Stop the Spacewalk service: spacewalk-service stop
3. Apply the patch using either zypper patch or YaST Online Update.
4. Upgrade the database schema: spacewalk-schema-upgrade
5. Start the Spacewalk service: spacewalk-service start