CVE-2018-20433

c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.

c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.

TuxCare rebuilt com.mchange:c3p0 to address 2 CVEs. Fixed in 0.9.5.2-tuxcare.2.

TuxCare rebuilt com.mchange:c3p0 to address 2 CVEs. Fixed in 0.9.2.1-tuxcare.3.

An XML external entity processing vulnerability was found in extractXmlConfigFromInputStream function in c3p0 (CVE-2018-20433).

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration (CVE-2019-5427).

These are all security issues fixed in the c3p0-0.9.5.5-1.3 package on the GA media of openSUSE Tumbleweed.

This update fixes the following issues:

c3p0:

• Update to version c3p0 0.9.5.5 and mchange-commons-java 0.2.19
  • Address CVE-2018-20433
  • Address CVE-2019-5427 - XML-config parsing related attacks (bsc#1133198)
  • Properly implement the JDBC 4.1 abort method
• Build with log4j mapper
• Enhanced for RHEL8

dhcpd-formula:

• Update to version 0.1.1641480250.d5bd14c
  • make routers option optional
• Add arm64 support
• Update to version 0.1.1615805990.f15c8d9

hub-xmlrpc-api:

• Updated to build on Enterprise Linux 8.

py26-compat-msgpack-python:

• Adapted to build on OBS for Enterprise Linux.

py27-compat-salt:

• Fix inspector module export function (bsc#1097531)
• Fix possible traceback on ip6_interface grain (bsc#1193565)
• Don't check for cached pillar errors on state.apply (bsc#1190781)
• Simplify 'transactional_update' module to not use SSH wrapper and allow more flexible execution
• Add '--no-return-event' option to salt-call to prevent sending return event back to master.
• Make 'state.highstate' to acts on concurrent flag.
• Fix the regression with invalid syntax in test_parse_cpe_name_v23.

spacecmd:

• Version 4.1.17-1
  • Fix interactive mode for 'system_applyerrata' and 'errata_apply' (bsc#1194363)

spacewalk-java:

• Version 4.1.44-1
  • allow SCC to display the last check-in time for registered systems
  • Suggest Product Migration when patch for CVE is in a successor Product (bsc#1191360)
  • Add store info to Equals and hash methods to fix CVE audit process (bsc#1195282)
  • fix ClassCastException during action processing (bsc#1195043)
  • Fix disappearing metadata key files after channel change (bsc#1192822)
  • Pass only selected servers to taskomatic for cancelation (bsc#1194044)

spacewalk-web:

• Version 4.1.32-1
  • Suggest Product Migration when patch for CVE is in a successor Product (bsc#1191360)

susemanager:

• Version 4.1.33-1
  • set default for registration batch size

susemanager-doc-indexes:

• Added a warning about the origin of the salt-minion package in the Register on the Command Line (Salt) section of the Client Configuration Guide
• In the Client Configuration Guide, explain how you find channel names to register older SUSE Linux Enterprise clients.
• Added grub.cfg for GRUB 2 in the Upgrade chapter of the Client

susemanager-docs_en:

• Added a warning about the origin of the salt-minion package in the Register on the Command Line (Salt) section of the Client Configuration Guide
• In the Client Configuration Guide, explain how you find channel names to register older SUSE Linux Enterprise clients.
• Added grub.cfg for GRUB 2 in the Upgrade chapter of the Client Configuration Guide

susemanager-schema:

• Version 4.1.25-1
  • Continue with index migration when the expected indexes do not exist (bsc#1192566)

susemanager-sls:

• Version 4.1.34-1
  • Improve pkgset beacon with using salt.cache to notify about the changes made while the minion was stopped.
  • Align the code of pkgset beacon to prevent warnings (bsc#1194464)
• Version 4.1.33-1
  • Fix errors on calling sed -E ... by force_restart_minion with action chains
  • Postgres exporter package was renamed
  • fix deprecation warnings
  • enforce correct minion configuration similar to bootstrapping (bsc#1192510)

How to apply this update:

1. Log in as root user to the SUSE Manager server.
2. Stop the Spacewalk service: spacewalk-service stop
3. Apply the patch using either zypper patch or YaST Online Update.
4. Start the Spacewalk service: spacewalk-service start

This update fixes the following issues:

c3p0:

• Update to version c3p0 0.9.5.5 and mchange-commons-java 0.2.19
  • Address CVE-2018-20433
  • Address CVE-2019-5427 - XML-config parsing related attacks (bsc#1133198)
  • Properly implement the JDBC 4.1 abort method

grafana-formula:

• Version 0.7.0
  • Add SLES 15 SP4 and openSUSE Leap 15.4 to supported versions

hub-xmlrpc-api:

• Updated to build on Enterprise Linux 8.

inter-server-sync:

• Version 0.1.0
  • Allow export and import of configuration channels
  • Clean lookup cache after processing a channel (bsc#1195750)
  • Improve lookup method for generate foreign key export
• Adapted for build on Enterprise Linux 8.

mgr-osad:

• Version 4.2.8-1
  • Fix the condition for preventing building python 2 subpackage for SLE15

mgr-push:

• Version 4.2.5-1
  • Fix the condition for preventing building python 2 subpackage for SLE15

patterns-suse-manager:

• golang-github-wrouesnel-postgres_exporter was renamed to prometheus-postgres_exporter

prometheus-exporters-formula:

• Version 1.2.0
  • Postres exporter package was renamed for RedHat
• Version 1.1.0
  • Postgres exporter package was renamed for SLES/openSUSE

py26-compat-msgpack-python:

• Adapted to build on OBS for Enterprise Linux.

rhnlib:

• Version 4.2.6-1
  • Fix the condition for preventing building python 2 subpackage for SLE15

saltboot-formula:

• Update to version 0.1.1645440615.7f1328c
  • skip device lookup for correctly provided devices
  • improve image url modifications - preparation for ftp/http changes
• Skip device lookup if correct path to device is already provided (bsc#1195757)
• Improve image url modifications

smdba:

• Version 1.7.10
  • adapt pgtune using new defaults for new postgres versions
  • support special configuration for SSD storage
  • make argument '--backup-dir' symlink aware
• Version 1.7.9
• Allow different standard configuration file location for other OSes

spacecmd:

• Version 4.2.16-1
  • implement system.bootstrap (bsc#1194909)
  • Fix interactive mode for 'system_applyerrata' and 'errata_apply' (bsc#1194363)

spacewalk-admin:

• Version 4.2.10-1
  • wait after copying the CA to give systemd time to finish automation

spacewalk-backend:

• Version 4.2.20-1
  • Fix reposync update notice formatting and date parsing (bsc#1194447)
  • implement more decompression algorithms for reposync (bsc#1196704)
  • enable check for client certificates in reposync
  • remove auto inherit of host entitlements for virtual guests

spacewalk-branding:

• Version 4.2.13-1
  • Fix modal footer misalignment

spacewalk-certs-tools:

• Version 4.2.15-1
  • Add dynamic version for bootstrap script header (bsc#1186336)

spacewalk-client-tools:

• Version 4.2.18-1
  • Fix the condition for preventing building python 2 subpackage for SLE15
• Version 4.2.17-1
  • Update translation strings

spacewalk-config:

• Version 4.2.6-1
  • Upgrade build tooling, and corresponding cache configuration

spacewalk-java:

• Version 4.2.34-1
  • Added new XML-RPC mathod: configchannel.syncSaltFilesOnDisk
  • update last checkin only if job is successful (bsc#1197007)
  • Fix NPE when accessing cancelled action via system history (bsc#1195762)
  • CVE Audit: Show patch as available in the currently installed product even if successor patch affects additional packages (bsc#1196455)
  • send notifications for new or changed ubuntu errata (bsc#1196977)
  • change directory owner and permissions only when needed
  • Fixed broken help link for system overview
  • Provide link to Sync page when unsynced patches message show up (bsc#1196094)
  • fix class cast exception during action chains (bsc#1195772)
  • Finding empty profiles by mac address must be case insensitive (bsc#1196407)
  • prepare to use new postgresql-jdbc driver with stringprep and saslprep support (bsc#1196693)
  • allow SCC to display the last check-in time for registered systems
  • generate the system ssh key when bootstrapping a salt-ssh client…