CVE-2021-40348

Spacewalk 2.10, and derivatives such as Uyuni 2021.08, allows code injection. rhn-config-satellite.pl doesn't sanitize the configuration filename used to append Spacewalk-specific key-value pair. The script is intended to be run by the tomcat user account with Sudo, according to the installation setup. This can lead to the ability of an attacker to use --option to append arbitrary code to a root-owned file that eventually will be executed by the system. This is fixed in Uyuni spacewalk-admin 4.3.2-1.

Spacewalk 2.10, and derivatives such as Uyuni 2021.08, allows code injection. rhn-config-satellite.pl doesn't sanitize the configuration filename used to append Spacewalk-specific key-value pair. The script is intended to be run by the tomcat user account with Sudo, according to the installation setup. This can lead to the ability of an attacker to use --option to append arbitrary code to a root-owned file that eventually will be executed by the system. This is fixed in Uyuni spacewalk-admin 4.3.2-1.

Spacewalk 2.10, and derivatives such as Uyuni 2021.08, allows code injection. rhn-config-satellite.pl doesn't sanitize the configuration filename used to append Spacewalk-specific key-value pair. The script is intended to be run by the tomcat user account with Sudo, according to the installation setup. This can lead to the ability of an attacker to use --option to append arbitrary code to a root-owned file that eventually will be executed by the system. This is fixed in Uyuni spacewalk-admin 4.3.2-1.

Spacewalk 2.10, and derivatives such as Uyuni 2021.08, allows code injection. rhn-config-satellite.pl doesn't sanitize the configuration filename used to append Spacewalk-specific key-value pair. The script is intended to be run by the tomcat user account with Sudo, according to the installation setup. This can lead to the ability of an attacker to use --option to append arbitrary code to a root-owned file that eventually will be executed by the system. This is fixed in Uyuni spacewalk-admin 4.3.2-1.

Spacewalk 2.10, and derivatives such as Uyuni 2021.08, allows code injection. rhn-config-satellite.pl doesn't sanitize the configuration filename used to append Spacewalk-specific key-value pair. The script is intended to be run by the tomcat user account with Sudo, according to the installation setup. This can lead to the ability of an attacker to use --option to append arbitrary code to a root-owned file that eventually will be executed by the system. This is fixed in Uyuni spacewalk-admin 4.3.2-1.

This update for SUSE Manager 4.2.3 Release Notes provides the following additions:

Release notes for SUSE Manager:

• Update to 4.2.3
  • aarch64 support for CentOS 7/8, Oracle Linux 7/8, Rocky Linux 8, AlmaLinux 8, Amazon Linux 2 and openSUSE Leap 15.3
  • Package Locking features is now available for Salt Minions
  • New XMLRPC API methods for SaltKey
  • Bugs mentioned: bsc#1171520, bsc#1181223, bsc#1187572, bsc#1187998, bsc#1188315, bsc#1188977, bsc#1189260, bsc#1189422, bsc#1189609, bsc#1189799, bsc#1189818, bsc#1189933, bsc#1190040, bsc#1190123, bsc#1190151, bsc#1190164, bsc#1190166, bsc#1190265, bsc#1190275, bsc#1190276, bsc#1190300, bsc#1190396, bsc#1190405, bsc#1190455, bsc#1190512, bsc#1190602, bsc#1190751, bsc#1190820, bsc#1191123, bsc#1191139, bsc#1191348, bsc#1191551, CVE-2021-40348, CVE-2021-21996

Release notes for SUSE Manager proxy:

• Update to 4.2.3
  • Bugs mentioned: bsc#1171520, bsc#1181223, bsc#1187998, bsc#1188315, bsc#1188977, bsc#1190405, bsc#1190512, bsc#1190602, bsc#1190751, bsc#1190820, bsc#1191348

This update fixes the following issues:

cobbler:

• Fixed modify_setting test to complete successfully

hub-xmlrpc-api:

• Use rpm systemd macro to restart service in replace of systemctl

patterns-suse-manager:

• Virtualization-host-formula was renamed to virtualization-formulas

py26-compat-salt:

• Exclude the full path of a download URL to prevent injection of malicious code (bsc#1190265, CVE-2021-21996)

py26-compat-tornado:

• Added compatibility to Enterprise Linux 8

py27-compat-salt:

• Fix the regression of docker_container state module
• Support querying for JSON data in external sql pillar
• Exclude the full path of a download URL to prevent injection of malicious code (bsc#1190265, CVE-2021-21996)
• Fix wrong relative paths resolution with Jinja renderer when importing subdirectories

spacecmd:

• Version 4.2.13-1
  • Update translation strings
  • configchannel_updatefile handles directory properly (bsc#1190512)
  • Add schedule_archivecompleted to mass archive actions (bsc#1181223)
  • Remove whoami from the list of unauthenticated commands (bsc#1188977)

spacewalk-admin:

• Version 4.2.9-1
  • Fix setup with rhn-config-satellite (bsc#1190300)
  • Allow admins to modify only spacewalk config files with rhn-config-satellite.pl (bsc#1190040) (CVE-2021-40348)

spacewalk-backend:

• Version 4.2.17-1
  • Update translations strings
  • handle download of metadata filesnames with checksums (bsc#1188315)
  • Sanitize cached filename for custom SSL certs used by reposync (bsc#1190751)

spacewalk-certs-tools:

• Version 4.2.13-1
  • add GPG keys using apt-key on debian machines (bsc#1187998)

spacewalk-client-tools:

• Version 4.2.14-1
  • Update translation strings

spacewalk-java:

• Version 4.2.30-1
  • Fix datetime format parsing with moment (bsc#1191348)
• Version 4.2.29-1
  • Update translation strings
  • fix logging of the spark framework and map requests to media.1 directory in the download controller (bsc#1189933)
  • Add 'Last build date' column to CLM project list (jsc#PM-2644) (jsc#SUMA-61)
  • Improve exception handling and logging for mgr-libmod calls
  • Add checksums to repository metadata filenames (bsc#1188315)
  • Fix ISE in product migration if base product is missing (bsc#1190151)
  • use TLSv1.3 if it is a supported Protocol
  • Adapt auto errata update to respect maintenance windows
  • Adapt auto errata update to skip during CLM build (bsc#1189609)
  • add CentOS 7/8 aarch64
  • add Oracle Linux 7/8 aarch64
  • add Rocky Linux 8 aarch64
  • add AlmaLinux 8 aarch64
  • add Amazon Linux 2 aarch64
  • Add new endpoints to saltkeys API: acceptedList, pendingList, rejectedList, deniedList, accept and reject
  • fix ISE in SSM when scheduling patches on multiple systems (bsc#1190396, bsc#1190275)
  • Add 'Flush cache' option to Ansible playbook execution (bsc#1190405)
  • Update kernel live patch version on minion startup (bsc#1190276)
  • Allow getting all completed actions via XMLRPC without display limit (bsc#1181223)
  • Support syncing patches with advisory status 'pending' (bsc#1190455)
  • Add XMLRPC API to force refreshing pillar data (bsc#1190123)
  • Add missing string on XCCDF scan results (bsc#1190164)
  • Ignore duplicates in 'pkg.installed' result when applying patches (bsc#1187572)
  • Improved timezone support
  • implement package locking for salt minions

spacewalk-utils:

• Version 4.2.14-1
  • When renaming: don't regenerate CA, allow using third-party certificate and trigger pillar refresh (bsc#1190123)

spacewalk-web:

• Version 4.2.23-1
  • Fix datetime format parsing with moment (bsc#1191348)
• Version 4.2.22-1
  • Add 'Last build date' column to CLM project list (jsc#PM-2644) (jsc#SUMA-61)
  • Fix 'Type' input in CLM source edit form (bsc#1190820)
  • Add 'Flush cache' checkbox to Ansible playbook execution page (bsc#1190405)
  • Fix the VM creation and editing submit button action (bsc#1190602)
  • Improved timezone support
  • Enhance the…

This update fixes the following issues:

spacewalk-admin:

• Version 4.1.10-1
  • Fix setup with rhn-config-satellite (bsc#1190300)
  • Allow admins to modify only spacewalk config files with rhn-config-satellite.pl (bsc#1190040) (CVE-2021-40348)

How to apply this update:

1. Log in as root user to the SUSE Manager server.
2. Stop the Spacewalk service: spacewalk-service stop
3. Apply the patch using either zypper patch or YaST Online Update.
4. Start the Spacewalk service: spacewalk-service start