CVE-2018-19638

In supportutils, before version 3.1-5.7.1 and if pacemaker is installed on the system, an unprivileged user could have overwritten arbitrary files in the directory that is used by supportutils to collect the log files.

In supportutils, before version 3.1-5.7.1 and if pacemaker is installed on the system, an unprivileged user could have overwritten arbitrary files in the directory that is used by supportutils to collect the log files.

In supportutils, before version 3.1-5.7.1 and if pacemaker is installed on the system, an unprivileged user could have overwritten arbitrary files in the directory that is used by supportutils to collect the log files.

In supportutils, before version 3.1-5.7.1 and if pacemaker is installed on the system, an unprivileged user could have overwritten arbitrary files in the directory that is used by supportutils to collect the log files.

This update for supportutils fixes the following issues:

Security issues fixed:

• CVE-2018-19640: Fixed an issue where users could kill arbitrary processes (bsc#1118463).
• CVE-2018-19638: Fixed an issue where users could overwrite arbitrary log files (bsc#1118460).
• CVE-2018-19639: Fixed a code execution if run with -v (bsc#1118462).
• CVE-2018-19637: Fixed an issue where static temporary filename could allow overwriting of files (bsc#1117776).

Other issues fixed:

• Fixed invalid exit code commands (bsc#1125666).
• Included additional SUSE separation (bsc#1125609).
• Merged added listing of locked packes by zypper.
• Exclude pam.txt per GDPR by default (bsc#1112461).
• Clarified -x functionality in supportconfig(8) (bsc#1115245).
• udev service and provide the whole journal content in supportconfig (bsc#1051797).
• supportconfig collects tuned profile settings (bsc#1071545).
• sfdisk -d no disk device specified (bsc#1043311).
• Added vulnerabilites status check in basic-health.txt (bsc#1105849).
• Added only sched_domain from cpu0.
• Blacklist sched_domain from proc.txt (bsc#1046681).
• Added firewall-cmd info.
• Add ls -lA --time-style=long-iso /etc/products.d/
• Dump lsof errors.
• Added corosync status to ha_info.
• Dump find errors in ib_info.

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the supportutils-3.1.17-2.2 package on the GA media of openSUSE Tumbleweed.

This update for supportutils fixes the following issues:

Security issues fixed:

• CVE-2018-19640: Fixed an issue where users could kill arbitrary processes (bsc#1118463).
• CVE-2018-19638: Fixed an issue where users could overwrite arbitrary log files (bsc#1118460).
• CVE-2018-19639: Fixed a code execution if run with -v (bsc#1118462).
• CVE-2018-19637: Fixed an issue where static temporary filename could allow overwriting of files (bsc#1117776).

Other issues fixed:

• Fixed invalid exit code commands (bsc#1125666).
• Included additional SUSE separation (bsc#1125609).
• Merged added listing of locked packes by zypper.
• Exclude pam.txt per GDPR by default (bsc#1112461).
• Clarified -x functionality in supportconfig(8) (bsc#1115245).
• udev service and provide the whole journal content in supportconfig (bsc#1051797).
• supportconfig collects tuned profile settings (bsc#1071545).
• sfdisk -d no disk device specified (bsc#1043311).
• Added vulnerabilites status check in basic-health.txt (bsc#1105849).
• Added only sched_domain from cpu0.
• Blacklist sched_domain from proc.txt (bsc#1046681).
• Added firewall-cmd info.
• Add ls -lA --time-style=long-iso /etc/products.d/
• Dump lsof errors.
• Added corosync status to ha_info.
• Dump find errors in ib_info.

This update for hostinfo, supportutils fixes the following issues:

Security issues fixed for supportutils:

• CVE-2018-19640: Fixed an issue where users could kill arbitrary processes (bsc#1118463).
• CVE-2018-19638: Fixed an issue where users could overwrite arbitrary log files (bsc#1118460).
• CVE-2018-19639: Fixed a code execution if run with -v (bsc#1118462).
• CVE-2018-19637: Fixed an issue where static temporary filename could allow overwriting of files (bsc#1117776).
• CVE-2018-19636: Fixed a local root exploit via inclusion of attacker controlled shell script (bsc#1117751).

Other issues fixed for supportutils:

• Fixed invalid exit code commands (bsc#1125666)
• SUSE separation in supportconfig (bsc#1125623)
• Clarified supportconfig(8) -x option (bsc#1115245)
• supportconfig: 3.0.127
• btrfs filesystem usage
• List products.d
• Dump lsof errors
• Added ha commands for corosync
• Dumped find errors in ib_info

Issues fixed in hostinfo:

• Removed extra kernel install dates (bsc#1099498)
• Resolved network bond issue (bsc#1054979)

This update for supportutils fixes the following issues:

Security vulnerabilities fixed:

• CVE-2018-19636: Local root exploit via inclusion of attacker controlled shell script (bsc#1117751)
• CVE-2018-19640: Users can kill arbitrary processes (bsc#1118463)
• CVE-2018-19638: User can overwrite arbitrary log files in support tar (bsc#1118460)
• CVE-2018-19639: Code execution if run with -v (bsc#1118462)