CVE-2021-28657

A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or later.

A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or later.

This update fixes the following issues:

cobbler:

• Make fence_ipmitool a wrapper for fence_ipmilan using always lanplus. (bsc#1184361)
• Remove unused template for fence_ipmitool.
• Prevent some race conditions when writting tftpboot files and the destination directory is not existing. (bsc#1186124)
• Fix trail stripping in case of using UTF symbols. (bsc#1184561)

golang-github-prometheus-node_exporter:

• Update to 1.1.2
  • Bug fixes
    • Handle errors from disabled PSI subsystem
    • Sanitize strings from /sys/class/power_supply
    • Silence missing netclass errors
    • Fix ineffassign issue
    • Fix some noisy log lines
    • filesystem_freebsd: Fix label values
    • Fix various procfs parsing errors
    • Handle no data from powersupplyclass
    • udp_queues_linux.go: change upd to udp in two error strings
    • Fix node_scrape_collector_success behaviour
    • Fix NodeRAIDDegraded to not use a string rule expressions
    • Fix node_md_disks state label from fail to failed
    • Handle EPERM for syscall in timex collector
    • bcache: fix typo in a metric name
    • Fix XFS read/write stats
  • Changes
    • Improve filter flag names
    • Add btrfs and powersupplyclass to list of exporters enabled by default
  • Features
    • Add fibre channel collector
    • Expose cpu bugs and flags as info metrics
    • Add network_route collector
    • Add zoneinfo collector
  • Enhancements
    • Add more InfiniBand counters
    • Add flag to aggr ipvs metrics to avoid high cardinality metrics
    • Adding backlog/current queue length to qdisc collector
    • Include TCP OutRsts in netstat metrics
    • Add pool size to entropy collector
    • Remove CGO dependencies for OpenBSD amd64
    • bcache: add writeback_rate_debug status
    • Add check state for mdadm arrays via node_md_state metric
    • Expose XFS inode statistics
    • Expose zfs zpool state
    • Added an ability to pass collector.supervisord.url via SUPERVISORD_URL environment variable
• Do not include sources (bsc#1151558)
• Remove rc symlink

grafana-formula:

• Fix Grafana dashboards requiring single series (bsc#1184471)

patterns-suse-manager:

• Add require for py27-compat-salt (salt 3002 does not provide python2-salt anymore)

prometheus-exporter-formula:

• Add support for schema migration (bsc#1186025)

pxe-yomi-image-sle15:

• Remove PermitEmptyPasswords from SSH config (Fix bsc#1182744)

py26-compat-salt:

• Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)

spacewalk-admin:

• Stop jabberd when osa-dispatcher is enabled (bsc#1185042)

spacewalk-backend:

• Fix binary blob corruptions in tradidional config file deployment (bsc#1183864)
• Fix for GPG checking on synchonizing mirrored dpkg repo (bsc#1184351)
• switch to www group for satellite logs (bsc#1185097)
• Fail traditional errata and package actions when they act on retracted items
• Add advisory_status to reposync and ISS
• Add minrate/timeout configuration values for downloading DEB/RPM packages

spacewalk-branding:

• Add the CSS class for retracted errata/packages

spacewalk-certs-tools:

• Add support of DISABLE_LOCAL_REPOS=0 for salt minions (bsc#1185568)
• Add missing environment variable SALT_RUNNING for pkg module to the minion configuration
• Fix typo: activaion -> activation

spacewalk-java:

• Change Prometheus exporters formula data schema to make it more generic and extendable
• Do not require advisory_status to be set in ErrataHandler.create (bsc#1185965)
• Speed up pages to compare or add packages to channels (bsc#1178767)
• Bugfix: Remove the unneeded check that was stopping updating a virtual instance type (bsc#1180673)
• Exclude minions from the list of locally-managed/sandbox systems when copying config files (bsc#1184940)
• Lower case fqdn comparation when calculating minion connection path (bsc#1184849)
• Bugfix: Retracted Patches: Filter minion correctly when executing package install (bsc#1184929)
• Implement retracted…

This update fixes the following issues:

cobbler:

• Make 'fence_ipmitool' a wrapper for 'fence_ipmilan' using always lanplus (bsc#1184361)
• Remove unused template for fence_ipmitool.
• Prevent some race conditions when writing tftpboot files and the destination directory is not existing (bsc#1186124)
• Fix trail stripping in case of using UTF symbols (bsc#1184561)

grafana-formula:

• Fix Grafana dashboards requiring single series (bsc#1184471)

patterns-suse-manager:

• Add require for py27-compat-salt (salt 3002 does not provide python2-salt anymore)

prometheus-exporters-formula:

• Move exporters configurations to dedicated group prometheus_exporters
• Add formula data schema migration script
• This version changes the formula data schema and is not backwards compatible. Downgrading from this version will require reconfiguring the formula for all your minions.
• Add Ubuntu support for Prometheus exporters' reverse proxy

pxe-default-image-sle15:

• Adapt rpm-properties.xml for containment-rpm-pxe v0.2.1 and newer

py26-compat-salt:

• Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)

spacewalk-backend:

• Maintainer field in debian packages are only recommended (bsc#1186508)
• Switch to www group for satellite logs (bsc#1185097)

spacewalk-java:

• Change Prometheus exporters formula data schema to make it more generic and extendable
• Adapt logging for testing accessability of URLs (bsc#1182817)
• Fix problem reading product_tree.json from wrong location in offline setups (bsc#1184283)
• For a SUSE system get metadata and package from same source (bsc#1184475)
• Check if the directory exists prior to modular data cleanup (bsc#1184311)
• Assign right base product for res8 (bsc#1184005)
• Fix check for for mirrorlist URLs when refreshing products (bsc#1184861)

spacewalk-utils:

• Bugfix for ubuntu-18.04 repo urls: multiverse, restricted and backports
• Add multiverse, restricted and backports to Ubuntu 16.04, 18.04 and 20.04

spacewalk-web:

• Update the WebUI version to 4.0.14

susemanager:

• Add python3-pycryptodome to Ubuntu 18 and 20 bootstrap repos (bsc#1186346)
• Require gio-branding-SLE for SLE15 but not for openSUSE Leap 15
• Add python3-distro to RES8, SLE15 and Ubuntu20.04 bootstrap repositories to fix bootstrapping issues (bsc#1184332)

susemanager-doc-indexes:

• Update for Disconnected Setup chapter in Administration Guide

susemanager-docs_en:

• Update for Disconnected Setup chapter in Administration Guide

susemanager-sls:

• Do not install python2-salt on Salt 3002.2 Docker build hosts (bsc#1185506)
• Fix insecure JMX configuration (bsc#1184617)
• Avoid conflicts with running ioloop on mgr_events engine (bsc#1172711)

tika-core:

• New upstream version 1.26. Fixes:
  • Infinite loop in the MP3Parser (bsc#1184892, CVE-2021-28657)
  • Out of memory error while loading a file in PDFBox before 2.0.23.
  • Infinite loop while loading a file in PDFBox before 2.0.23.
  • System.exit vulnerability in Tika's OneNote Parser; out of memory errors and/or infinite loops in Tika's ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser and ImageParser.
  • Excessive memory usage (DoS) vulnerability in Apache Tika's PSDParser
  • Infinite Loop (DoS) vulnerability in Apache Tika's PSDParser

How to apply this update:

1. Log in as root user to the SUSE Manager server.
2. Stop the Spacewalk service: spacewalk-service stop
3. Apply the patch using either zypper patch or YaST Online Update.
4. Upgrade the database schema: spacewalk-schema-upgrade
5. Start the Spacewalk service: spacewalk-service start