CVE-2021-31607

In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely).

In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely).

This update for salt fixes the following issues:

Update to Salt release version 3002.2 (jsc#ECO-3212, jsc#SLE-18033, jsc#SLE-18028)

• Check if dpkgnotify is executable (bsc#1186674)
• Drop support for Python2. Obsoletes python2-salt package (jsc#SLE-18028)
• virt module updates
  • network: handle missing ipv4 netmask attribute
  • more network support
  • PCI/USB host devices passthrough support
• Set distro requirement to oldest supported version in requirements/base.txt
• Bring missing part of async batch implementation back (CVE-2021-25315, bsc#1182382)
• Always require python3-distro (bsc#1182293)
• Remove deprecated warning that breaks minion execution when 'server_id_use_crc' opts is missing
• Fix pkg states when DEB package has 'all' arch
• Do not force beacons configuration to be a list.
• Remove msgpack < 1.0.0 from base requirements (bsc#1176293)
• msgpack support for version >= 1.0.0 (bsc#1171257)
• Fix issue parsing errors in ansiblegate state module
• Prevent command injection in the snapper module (bsc#1185281, CVE-2021-31607)
• transactional_update: detect recursion in the executor
• Add subpackage salt-transactional-update (jsc#SLE-18033)
• Improvements on 'ansiblegate' module (bsc#1185092):
  • New methods: ansible.targets / ansible.discover_playbooks
• Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
• Regression fix of salt-ssh on processing targets
• Update target fix for salt-ssh and avoiding race condition on salt-ssh event processing (bsc#1179831, bsc#1182281)
• Add notify beacon for Debian/Ubuntu systems
• Fix zmq bug that causes salt-call to freeze (bsc#1181368)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for salt fixes the following issues:

• Check if dpkgnotify is executable (bsc#1186674)
• Update to Salt release version 3002.2 (jsc#ECO-3212, jsc#SLE-18033, jsc#SLE-18028)
• Drop support for Python2. Obsoletes python2-salt package (jsc#SLE-18028)
• Fix issue parsing errors in ansiblegate state module
• Prevent command injection in the snapper module (bsc#1185281, CVE-2021-31607)
• transactional_update: detect recursion in the executor
• Add subpackage salt-transactional-update (jsc#SLE-18033)
• Remove duplicate directories

This update for salt fixes the following issues:

Update to Salt release version 3002.2 (jsc#ECO-3212, jsc#SLE-18033, jsc#SLE-18028)

• Check if dpkgnotify is executable (bsc#1186674)
• Drop support for Python2. Obsoletes python2-salt package (jsc#SLE-18028)
• virt module updates
  • network: handle missing ipv4 netmask attribute
  • more network support
  • PCI/USB host devices passthrough support
• Set distro requirement to oldest supported version in requirements/base.txt
• Bring missing part of async batch implementation back (CVE-2021-25315, bsc#1182382)
• Always require python3-distro (bsc#1182293)
• Remove deprecated warning that breaks minion execution when 'server_id_use_crc' opts is missing
• Fix pkg states when DEB package has 'all' arch
• Do not force beacons configuration to be a list.
• Remove msgpack < 1.0.0 from base requirements (bsc#1176293)
• msgpack support for version >= 1.0.0 (bsc#1171257)
• Fix issue parsing errors in ansiblegate state module
• Prevent command injection in the snapper module (bsc#1185281, CVE-2021-31607)
• transactional_update: detect recursion in the executor
• Add subpackage salt-transactional-update (jsc#SLE-18033)
• Improvements on 'ansiblegate' module (bsc#1185092):
  • New methods: ansible.targets / ansible.discover_playbooks
• Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
• Regression fix of salt-ssh on processing targets
• Update target fix for salt-ssh and avoiding race condition on salt-ssh event processing (bsc#1179831, bsc#1182281)
• Add notify beacon for Debian/Ubuntu systems
• Fix zmq bug that causes salt-call to freeze (bsc#1181368)

These are all security issues fixed in the python3-salt-3002.2-6.1 package on the GA media of openSUSE Tumbleweed.

In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely).

This update fixes the following issues:

golang-github-wrouesnel-postgres_exporter:

• Add support for aarch64

mgr-cfg:

• SPEC: Updated Python definitions for RHEL8 and quoted text comparisons.

mgr-custom-info:

• Update package version to 4.2.0

mgr-daemon:

• Update translation strings
• Update the translations from weblate
• Added quotes around %{_vendor} token for the if statements in spec file.
• Fix removal of mgr-deamon with selinux enabled (bsc#1177928)
• Updating translations from weblate

mgr-osad:

• Change the log file permissions as expected by logrotate (bsc#1177884)
• Change deprecated path /var/run into /run for systemd (bsc#1185178)
• Python fixes
• Removal of RHEL5

mgr-push:

• Defined __python for python2.
• Excluded RHEL8 for Python 2 build.

mgr-virtualization:

• Update package version to 4.2.0

rhnlib:

• Update package version to 4.2.0

salt:

• Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)

spacecmd:

• Rename system migration to system transfer
• Rename SP to product migration
• Update translation strings
• Add group_addconfigchannel and group_removeconfigchannel
• Add group_listconfigchannels and configchannel_listgroups
• Fix spacecmd compat with Python 3
• Deprecated 'Software Crashes' feature
• Document advanced package search on '--help' (bsc#1180583)
• Fixed advanced search on 'package_listinstalledsystems'
• Fixed duplicate results when using multiple search criteria (bsc#1180585)
• Fixed 'non-advanced' package search when using multiple package names (bsc#1180584)
• Update translations
• Fix: make spacecmd build on Debian
• Add Service Pack migration operations (bsc#1173557)

spacewalk-client-tools:

• Update the translations from weblate
• Drop the --noSSLServerURL option
• Updated RHEL Python requirements.
• Added quotes around %{_vendor}.

spacewalk-koan:

• Fix for spacewalk-koan test

spacewalk-oscap:

• Update package version to 4.2.0

spacewalk-remote-utils:

• Update package version to 4.2.0

supportutils-plugin-susemanager-client:

• Update package version to 4.2.0

suseRegisterInfo:

• Add support for Amazon Linux 2
• Add support for Alibaba Cloud Linux 2
• Adapted for RHEL build.

uyuni-base:

• Added Apache as prerequisite for RHEL and Fedora (due to required users).
• Removed RHEL specific folder rights from SPEC file.
• Added RHEL8 compatibility.

uyuni-common-libs:

• Cleaning up unused Python 2 build leftovers.
• Disabled debug package build.

This update fixes the following issues:

salt:

• Parsing Epoch out of version provided during pkg remove (bsc#1173692)
• Fix issue parsing errors in ansiblegate state module
• Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
• Transactional_update: detect recursion in the executor
• Add subpackage salt-transactional-update
• Remove duplicate directories from specfile
• Improvements on 'ansiblegate' module (bsc#1185092):
  • New methods: ansible.targets / ansible.discover_playbooks
  • General bugfixes

This update fixes the following issues:

salt:

• Update to Salt release version 3002.2 (jsc#ECO-3212)
• Drop support for Python2. Obsoletes 'python2-salt' package
• Virt module updates
  • network: handle missing ipv4 netmask attribute
  • more network support
  • PCI/USB host devices passthrough support
• Set distro requirement to oldest supported version in requirements/base.txt
• Bring missing part of async batch implementation back
• Always require python3-distro (bsc#1182293)
• Remove deprecated warning that breaks minion execution when 'server_id_use_crc' opts is missing
• Remove msgpack < 1.0.0 from base requirements (bsc#1176293)
• Msgpack support for version >= 1.0.0 (bsc#1171257)
• Fix issue parsing errors in ansiblegate state module
• Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
• Transactional_update: detect recursion in the executor
• Add subpackage salt-transactional-update
• Remove duplicate directories from specfile
• Improvements on 'ansiblegate' module (bsc#1185092):
  • New methods: ansible.targets / ansible.discover_playbooks
• Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
• Regression fix of salt-ssh on processing targets
• Update target fix for salt-ssh and avoiding race condition on salt-ssh event processing (bsc#1179831, bsc#1182281)
• Add notify beacon for Debian/Ubuntu systems
• Fix zmq bug that causes salt-call to freeze (bsc#1181368)
• Add core grains support for AlmaLinux
• Allow vendor change option with zypper
• Virt: virtual network backports to Salt 3000
• Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
• Only require python-certifi for CentOS7
• Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
• Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
• Fix recursion false detection in payload (bsc#1180101)
• Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
• Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
• Always require python-certifi (used by salt.ext.tornado)
• Exclude SLE 12 from requiring python-certifi
• Do not crash when unexpected cmd output at listing patches (bsc#1181290)
• Fix behavior for 'onlyif/unless' when multiple conditions (bsc#1180818)
• Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
• Allow extra_filerefs as sanitized kwargs for SSH client
• Fix errors with virt.update
• Fix for multiple for security issues (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144) (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197) (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560) (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
• Virt: search for grub.xen path
• Xen spicevmc, DNS SRV records backports: Fix virtual network generated DNS XML for SRV records Don't add spicevmc channel to xen VMs
• Virt UEFI fix: virt.update when efi=True
• Revert wrong zypper patch to support vendorchanges flags on pkg.install

This update for salt fixes the following issues:

• Check if dpkgnotify is executable (bsc#1186674)
• Update to Salt release version 3002.2 (jsc#ECO-3212, jsc#SLE-18033, jsc#SLE-18028)
• Drop support for Python2. Obsoletes python2-salt package (jsc#SLE-18028)
• Fix issue parsing errors in ansiblegate state module
• Prevent command injection in the snapper module (bsc#1185281, CVE-2021-31607)
• transactional_update: detect recursion in the executor
• Add subpackage salt-transactional-update (jsc#SLE-18033)
• Remove duplicate directories

This update fixes the following issues:

cobbler:

• Make fence_ipmitool a wrapper for fence_ipmilan using always lanplus. (bsc#1184361)
• Remove unused template for fence_ipmitool.
• Prevent some race conditions when writting tftpboot files and the destination directory is not existing. (bsc#1186124)
• Fix trail stripping in case of using UTF symbols. (bsc#1184561)

golang-github-prometheus-node_exporter:

• Update to 1.1.2
  • Bug fixes
    • Handle errors from disabled PSI subsystem
    • Sanitize strings from /sys/class/power_supply
    • Silence missing netclass errors
    • Fix ineffassign issue
    • Fix some noisy log lines
    • filesystem_freebsd: Fix label values
    • Fix various procfs parsing errors
    • Handle no data from powersupplyclass
    • udp_queues_linux.go: change upd to udp in two error strings
    • Fix node_scrape_collector_success behaviour
    • Fix NodeRAIDDegraded to not use a string rule expressions
    • Fix node_md_disks state label from fail to failed
    • Handle EPERM for syscall in timex collector
    • bcache: fix typo in a metric name
    • Fix XFS read/write stats
  • Changes
    • Improve filter flag names
    • Add btrfs and powersupplyclass to list of exporters enabled by default
  • Features
    • Add fibre channel collector
    • Expose cpu bugs and flags as info metrics
    • Add network_route collector
    • Add zoneinfo collector
  • Enhancements
    • Add more InfiniBand counters
    • Add flag to aggr ipvs metrics to avoid high cardinality metrics
    • Adding backlog/current queue length to qdisc collector
    • Include TCP OutRsts in netstat metrics
    • Add pool size to entropy collector
    • Remove CGO dependencies for OpenBSD amd64
    • bcache: add writeback_rate_debug status
    • Add check state for mdadm arrays via node_md_state metric
    • Expose XFS inode statistics
    • Expose zfs zpool state
    • Added an ability to pass collector.supervisord.url via SUPERVISORD_URL environment variable
• Do not include sources (bsc#1151558)
• Remove rc symlink

grafana-formula:

• Fix Grafana dashboards requiring single series (bsc#1184471)

patterns-suse-manager:

• Add require for py27-compat-salt (salt 3002 does not provide python2-salt anymore)

prometheus-exporter-formula:

• Add support for schema migration (bsc#1186025)

pxe-yomi-image-sle15:

• Remove PermitEmptyPasswords from SSH config (Fix bsc#1182744)

py26-compat-salt:

• Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)

spacewalk-admin:

• Stop jabberd when osa-dispatcher is enabled (bsc#1185042)

spacewalk-backend:

• Fix binary blob corruptions in tradidional config file deployment (bsc#1183864)
• Fix for GPG checking on synchonizing mirrored dpkg repo (bsc#1184351)
• switch to www group for satellite logs (bsc#1185097)
• Fail traditional errata and package actions when they act on retracted items
• Add advisory_status to reposync and ISS
• Add minrate/timeout configuration values for downloading DEB/RPM packages

spacewalk-branding:

• Add the CSS class for retracted errata/packages

spacewalk-certs-tools:

• Add support of DISABLE_LOCAL_REPOS=0 for salt minions (bsc#1185568)
• Add missing environment variable SALT_RUNNING for pkg module to the minion configuration
• Fix typo: activaion -> activation

spacewalk-java:

• Change Prometheus exporters formula data schema to make it more generic and extendable
• Do not require advisory_status to be set in ErrataHandler.create (bsc#1185965)
• Speed up pages to compare or add packages to channels (bsc#1178767)
• Bugfix: Remove the unneeded check that was stopping updating a virtual instance type (bsc#1180673)
• Exclude minions from the list of locally-managed/sandbox systems when copying config files (bsc#1184940)
• Lower case fqdn comparation when calculating minion connection path (bsc#1184849)
• Bugfix: Retracted Patches: Filter minion correctly when executing package install (bsc#1184929)
• Implement retracted…

This update fixes the following issues:

salt:

• Parsing Epoch out of version provided during pkg remove (bsc#1173692)
• Fix issue parsing errors in ansiblegate state module
• Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
• Transactional_update: detect recursion in the executor
• Add subpackage salt-transactional-update
• Remove duplicate directories from specfile
• Improvements on 'ansiblegate' module (bsc#1185092):
  • New methods: ansible.targets / ansible.discover_playbooks
  • General bugfixes
• Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
• Regression fix of salt-ssh on processing targets
• Update target fix for salt-ssh and avoiding race condition on salt-ssh event processing (bsc#1179831, bsc#1182281)
• Add notify beacon for Debian/Ubuntu systems
• Fix zmq bug that causes salt-call to freeze (bsc#1181368)

This update fixes the following issues:

salt:

Update to Salt release version 3002.2 (jsc#ECO-3212, jsc#SLE-18033, jsc#SLE-18028)

• Check if dpkgnotify is executable (bsc#1186674)
• Drop support for Python2. Obsoletes python2-salt package (jsc#SLE-18028)
• Virt module updates
  • network: handle missing ipv4 netmask attribute
  • more network support
  • PCI/USB host devices passthrough support
• Set distro requirement to oldest supported version in requirements/base.txt
• Bring missing part of async batch implementation back (bsc#1182382, CVE-2021-25315)
• Always require python3-distro (bsc#1182293)
• Remove deprecated warning that breaks minion execution when 'server_id_use_crc' opts is missing
• Fix pkg states when DEB package has 'all' arch
• Do not force beacons configuration to be a list.
• Remove msgpack < 1.0.0 from base requirements (bsc#1176293)
• Msgpack support for version >= 1.0.0 (bsc#1171257)
• Fix issue parsing errors in ansiblegate state module
• Prevent command injection in the snapper module (bsc#1185281, CVE-2021-31607)
• Transactional_update: detect recursion in the executor
• Add subpackage salt-transactional-update (jsc#SLE-18033)
• Remove duplicate directories from specfile
• Improvements on 'ansiblegate' module (bsc#1185092):
  • New methods: ansible.targets / ansible.discover_playbooks
• Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
• Regression fix of salt-ssh on processing targets
• Update target fix for salt-ssh and avoiding race condition on salt-ssh event processing (bsc#1179831, bsc#1182281)
• Add notify beacon for Debian/Ubuntu systems
• Fix zmq bug that causes salt-call to freeze (bsc#1181368)

This update for salt fixes the following issues:

Update to Salt release version 3002.2 (jsc#ECO-3212, jsc#SLE-18033, jsc#SLE-18028)

• Check if dpkgnotify is executable (bsc#1186674)
• Drop support for Python2. Obsoletes python2-salt package (jsc#SLE-18028)
• virt module updates
  • network: handle missing ipv4 netmask attribute
  • more network support
  • PCI/USB host devices passthrough support
• Set distro requirement to oldest supported version in requirements/base.txt
• Bring missing part of async batch implementation back (bsc#1182382, CVE-2021-25315)
• Always require python3-distro (bsc#1182293)
• Remove deprecated warning that breaks minion execution when 'server_id_use_crc' opts is missing
• Fix pkg states when DEB package has 'all' arch
• Do not force beacons configuration to be a list.
• Remove msgpack < 1.0.0 from base requirements (bsc#1176293)
• msgpack support for version >= 1.0.0 (bsc#1171257)
• Fix issue parsing errors in ansiblegate state module
• Prevent command injection in the snapper module (bsc#1185281, CVE-2021-31607)
• transactional_update: detect recursion in the executor
• Add subpackage salt-transactional-update (jsc#SLE-18033)
• Remove duplicate directories from specfile
• Improvements on 'ansiblegate' module (bsc#1185092):
  • New methods: ansible.targets / ansible.discover_playbooks
• Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
• Regression fix of salt-ssh on processing targets
• Update target fix for salt-ssh and avoiding race condition on salt-ssh event processing (bsc#1179831, bsc#1182281)
• Add notify beacon for Debian/Ubuntu systems
• Fix zmq bug that causes salt-call to freeze (bsc#1181368)

This update for salt fixes the following issues:

Update to Salt release version 3002.2 (jsc#ECO-3212, jsc#SLE-18033, jsc#SLE-18028)

• Check if dpkgnotify is executable (bsc#1186674)
• Drop support for Python2. Obsoletes python2-salt package (jsc#SLE-18028)
• virt module updates
  • network: handle missing ipv4 netmask attribute
  • more network support
  • PCI/USB host devices passthrough support
• Set distro requirement to oldest supported version in requirements/base.txt
• Bring missing part of async batch implementation back (CVE-2021-25315, bsc#1182382)
• Always require python3-distro (bsc#1182293)
• Remove deprecated warning that breaks minion execution when 'server_id_use_crc' opts is missing
• Fix pkg states when DEB package has 'all' arch
• Do not force beacons configuration to be a list.
• Remove msgpack < 1.0.0 from base requirements (bsc#1176293)
• msgpack support for version >= 1.0.0 (bsc#1171257)
• Fix issue parsing errors in ansiblegate state module
• Prevent command injection in the snapper module (bsc#1185281, CVE-2021-31607)
• transactional_update: detect recursion in the executor
• Add subpackage salt-transactional-update (jsc#SLE-18033)
• Improvements on 'ansiblegate' module (bsc#1185092):
  • New methods: ansible.targets / ansible.discover_playbooks
• Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
• Regression fix of salt-ssh on processing targets
• Update target fix for salt-ssh and avoiding race condition on salt-ssh event processing (bsc#1179831, bsc#1182281)
• Add notify beacon for Debian/Ubuntu systems
• Fix zmq bug that causes salt-call to freeze (bsc#1181368)

This update fixes the following issues:

cobbler:

• Make 'fence_ipmitool' a wrapper for 'fence_ipmilan' using always lanplus (bsc#1184361)
• Remove unused template for fence_ipmitool.
• Prevent some race conditions when writing tftpboot files and the destination directory is not existing (bsc#1186124)
• Fix trail stripping in case of using UTF symbols (bsc#1184561)

grafana-formula:

• Fix Grafana dashboards requiring single series (bsc#1184471)

patterns-suse-manager:

• Add require for py27-compat-salt (salt 3002 does not provide python2-salt anymore)

prometheus-exporters-formula:

• Move exporters configurations to dedicated group prometheus_exporters
• Add formula data schema migration script
• This version changes the formula data schema and is not backwards compatible. Downgrading from this version will require reconfiguring the formula for all your minions.
• Add Ubuntu support for Prometheus exporters' reverse proxy

pxe-default-image-sle15:

• Adapt rpm-properties.xml for containment-rpm-pxe v0.2.1 and newer

py26-compat-salt:

• Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)

spacewalk-backend:

• Maintainer field in debian packages are only recommended (bsc#1186508)
• Switch to www group for satellite logs (bsc#1185097)

spacewalk-java:

• Change Prometheus exporters formula data schema to make it more generic and extendable
• Adapt logging for testing accessability of URLs (bsc#1182817)
• Fix problem reading product_tree.json from wrong location in offline setups (bsc#1184283)
• For a SUSE system get metadata and package from same source (bsc#1184475)
• Check if the directory exists prior to modular data cleanup (bsc#1184311)
• Assign right base product for res8 (bsc#1184005)
• Fix check for for mirrorlist URLs when refreshing products (bsc#1184861)

spacewalk-utils:

• Bugfix for ubuntu-18.04 repo urls: multiverse, restricted and backports
• Add multiverse, restricted and backports to Ubuntu 16.04, 18.04 and 20.04

spacewalk-web:

• Update the WebUI version to 4.0.14

susemanager:

• Add python3-pycryptodome to Ubuntu 18 and 20 bootstrap repos (bsc#1186346)
• Require gio-branding-SLE for SLE15 but not for openSUSE Leap 15
• Add python3-distro to RES8, SLE15 and Ubuntu20.04 bootstrap repositories to fix bootstrapping issues (bsc#1184332)

susemanager-doc-indexes:

• Update for Disconnected Setup chapter in Administration Guide

susemanager-docs_en:

• Update for Disconnected Setup chapter in Administration Guide

susemanager-sls:

• Do not install python2-salt on Salt 3002.2 Docker build hosts (bsc#1185506)
• Fix insecure JMX configuration (bsc#1184617)
• Avoid conflicts with running ioloop on mgr_events engine (bsc#1172711)

tika-core:

• New upstream version 1.26. Fixes:
  • Infinite loop in the MP3Parser (bsc#1184892, CVE-2021-28657)
  • Out of memory error while loading a file in PDFBox before 2.0.23.
  • Infinite loop while loading a file in PDFBox before 2.0.23.
  • System.exit vulnerability in Tika's OneNote Parser; out of memory errors and/or infinite loops in Tika's ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser and ImageParser.
  • Excessive memory usage (DoS) vulnerability in Apache Tika's PSDParser
  • Infinite Loop (DoS) vulnerability in Apache Tika's PSDParser

How to apply this update:

1. Log in as root user to the SUSE Manager server.
2. Stop the Spacewalk service: spacewalk-service stop
3. Apply the patch using either zypper patch or YaST Online Update.
4. Upgrade the database schema: spacewalk-schema-upgrade
5. Start the Spacewalk service: spacewalk-service start