CVE-2021-41411

This update for release-notes-susemanager, release-notes-susemanager-proxy fixes the following issues:

Release notes for SUSE Manager:

• Update to SUSE:Manager 4.2.9
  • Notification about SUSE Manager end-of-life has been added
  • CVEs fixed: CVE-2021-43138, CVE-2021-42740, CVE-2022-31129, CVE-2021-41411
  • Bugs mentioned: bsc#1172705, bsc#1187028, bsc#1195455, bsc#1195895, bsc#1196729 bsc#1198168, bsc#1198489, bsc#1198738, bsc#1198903, bsc#1199372 bsc#1199659, bsc#1199913, bsc#1199950, bsc#1200276, bsc#1200296 bsc#1200480, bsc#1200532, bsc#1200573, bsc#1200591, bsc#1200629 bsc#1201142, bsc#1201189, bsc#1201210, bsc#1201220, bsc#1201224 bsc#1201527, bsc#1201606, bsc#1201607, bsc#1201626, bsc#1201753 bsc#1201913, bsc#1201918, bsc#1202142, bsc#1202272, bsc#1202464 bsc#1202728, bsc#1203287, bsc#1203288, bsc#1203449

Release notes for SUSE Manager Proxy:

• Update to SUSE Manager 4.2.9
  • CVEs fixed: CVE-2021-43138, CVE-2021-42740, CVE-2022-31129
  • Bugs mentioned: bsc#1198168, bsc#1198903, bsc#1199659, bsc#1200480, bsc#1200591 bsc#1201142, bsc#1202142, bsc#1202724

This update fixes the following issues:

drools:

• CVE-2021-41411: XML External Entity injection in KieModuleModelImpl.java. (bsc#1200629)

httpcomponents-asyncclient:

• Provide maven metadata needed by other packages to build

image-sync-formula:

• Update to version 0.1.1661440526.b08d95b
  • Add option to sort boot images by version (bsc#1196729)

inter-server-sync:

• Version 0.2.3
  • Compress exported sql data #16631
  • Add gzip dependency to decompress data file during import process

patterns-suse-manager:

• Strictly require OpenJDK 11 (bsc#1202142)

py27-compat-salt:

• Add support for gpgautoimport in zypperpkg module
• Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
• Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
• Unify logic on using multiple requisites and add onfail_all (bsc#1198738)
• Normalize package names once with pkg.installed/removed using yum (bsc#1195895)

salt-netapi-client:

• Declare the LICENSE file as license and not doc
• Adapted for Enterprise Linux 9.
• Version 0.20.0
  • See: https://github.com/SUSE/salt-netapi-client/releases/tag/v0.20.0

saltboot-formula:

• Update to version 0.1.1661440526.b08d95b
  • Fallback to local boot if the configured image is not synced
  • improve image url modifications - preparation for ftp/http changes

spacecmd:

• Version 4.2.19-1
  • Process date values in spacecmd api calls (bsc#1198903)
  • Show correct help on calling kickstart_importjson with no arguments
  • Fix tracebacks on spacecmd kickstart_export (bsc#1200591)

spacewalk-admin:

• Version 4.2.12-1
  • Add --help option to mgr-monitoring-ctl

spacewalk-backend:

• Version 4.2.24-1
  • Make reposync use the configured http proxy with mirrorlist (bsc#1198168)
  • Revert proxy listChannels token caching pr#4548
  • cleanup leftovers from removing unused xmlrpc endpoint

spacewalk-certs-tools:

• Version 4.2.18-1
  • traditional stack bootstrap: install product packages (bsc#1201142)

spacewalk-client-tools:

• Version 4.2.20-1
  • Update translation strings

spacewalk-java:

• Version 4.2.41-1
  • Fixed date format on scheduler related messages (bsc#1195455)
  • Support inherited values for kernel options from Cobbler API (bsc#1199913)
  • Add channel availability check for product migration (bsc#1200296)
  • Check if system has all formulas correctly assigned (bsc#1201607)
  • Remove group formula assignments and data on group delete (bsc#1201606)
  • Fix sync for external repositories (bsc#1201753)
  • fix state.apply result parsing in test mode (bsc#1201913)
  • Reduce the length of image channel URL (bsc#1201220)
  • Calculate dependencies between cloned channels of vendor channels (bsc#1201626)
  • fix symlinks pointing to ongres-stringprep
  • Modify parameter type when communicating with the search server (bsc#1187028)
  • Fix initial profile and build host on Image Build page (bsc#1199659)
  • Fix the confirm message on the refresh action by adding a link to pending actions on it (bsc#1172705)
  • require new salt-netapi-client version
  • Clean grub2 reinstall entry in autoyast snippet (bsc#1199950)

spacewalk-search:

• Version 4.2.8-1
  • Add methods to handle session id as String

spacewalk-web:

• Version 4.2.29-1
  • CVE-2021-43138: Obtain privileges via the mapValues() method. (bsc#1200480)
  • CVE-2021-42740: Command injection in the shell-quote package. (bsc#1203287)
  • CVE-2022-31129: Denial-of-Service moment: inefficient parsing algorithm (bsc#1203288)
  • Fix table header layout for unselectable tables
  • Fix initial profile and build host on Image Build page (bsc#1199659)

subscription-matcher:

• Added Guava maximum version requirement.

susemanager:

• Version 4.2.37-1
  • mark new dependencies for python-py optional in bootstrap repo to fix generation for older service packs (bsc#1203449)
• Version 4.2.36-1
  • add missing packages on SLES 15
  • remove…

This update fixes the following issues:

cobbler:

• Consider case of 'next_server' being a hostname during migration of Cobbler collections.
• Fix problem with 'proxy_url_ext' setting being None type.
• Fix settings migration schema to work while upgrading on existing running Uyuni and SUSE Manager servers running with old Cobbler settings (bsc#1203478)
• Do generate boot menus even if no profiles or systems - only local boot
• Avoid crashing running buildiso in certain conditions.
• Fix issue that a custom kernel with the extension '.kernel' is not accepted by 'cobbler distro add'
• Fix issue with 'get_item_resolved_value' that prevented it from returning in cases where a complex object would have been returned
• Fix issue where the logs would have been spammed with 'grab_tree' messages that are meant for debugging
• Buildiso - Fix DNS append line generation
• Change apache2 conf dir for SUSE distros to allow integration with Uyuni and SUSE Manager
• Avoid permissions errors during cobbler sync
• Update to version 3.3.3
• Add UEFI capabilities to 'cobbler buildiso' (jsc#SUMA-112)
• Relevant changes on this release:
  • New:
    • Uyuni Proxies can now be set with the schema validation.
    • Cobbler should now build on AlmaLinux.
    • The initrd is not required anymore as it is an optional file.
    • XML-RPC: Added dump_vars endpoint. This is intended to replace get_blended_data as of 3.4.0.
    • XML-RPC: Added get_item_resolved_value & set_item_resolved_value endpoints.
  • Breaking Changes:
    • The field virt_file_size is now a float and the related settings as well.
  • Changes:
    • The error messages for duplicated objects now contains the name of the duplicated object.
  • Bugfixes:
    • Dictionaries had the wrong value set for <<inherit>>.
    • There were some cases in which the autoinstallation manager was handed the wrong object and then crashed.
    • The inheritance of the owners field was fixed.
    • Serial Console options should not contain bogous -1 value anymore.
    • HTTP API should not throw permission errors anymore.
    • During build the log was not visible due to a custom logger without output.
    • cobbler mkloaders now also copies dependencies of menu.c32.
    • We now generate the grub configuration for the architectures correct again.
    • virt_file_size now is a float at all times.
    • Cobbler should restart successfully now if you have attached an image to a system.
    • If you have a system named default the bootloader was not removed properly before.
    • cobbler buildiso: The isolinux.cfg was not properly formatted.
    • There were unharmful templating errors in the log related to redhat_management_type. The parts depending on this were removed.
    • The DNS managers were non-functional before because of a not existing function call.
    • cobbler buildiso failed with --tmpdirs that don't end in buildiso.
    • cobbler buildiso had outdated docs and help messages for some parameters.
    • cobbler import: It was impossible to import Rocky Linux 8.5 successfully.
    • Cobbler created duplicated settings files before.
    • cobbler sync was broken by refactoring to shell=False before.
• CVE-2022-0860: Improper Authorization in Cobbler. (bsc#1197027)
• Version 3.3.0 fixed jsc#SUMA-112
• Update to version 3.3.2
  • cobbler sync doesn't have to be executed no more after enable_ipxe was flipped
  • Auth: Support for Global Secure Catalog via LDAP provider
  • Reposync now deletes old metadata to prevent metadata merge conflicts
  • The automigration of the settings is now not enabled per default.
  • We removed ppc from RedHat EL 7 as it is not supported
  • Network interface is not subscriptable errors were fixed
  • The stacktraces related to the package and file pre & post triggers should no longer appear
  • You should be able to add multiple initrds if needed again
  • Debian: Fix regex for SHIM_FILE which now provides a working reasonable…

This update for release-notes-susemanager, release-notes-susemanager-proxy fixes the following issues:

Release notes for SUSE Manager:

• Update to SUSE Manager 4.3.2
  • Containerized proxy and RBS are now fully supported
  • HTTP API is now fully supported
  • Ubuntu 22.04 is now supported as a client
  • Cobbler has been upgraded to version 3.3.3 which also includes building ISOs with UEFI support
  • pip support has been added for the Salt Bundle
  • Prometheus exporter for Apache has been upgraded to 0.10.0
  • CVEs fixed: CVE-2021-41411, CVE-2021-42740, CVE-2021-43138, CVE-2022-0860, CVE-2022-31129
  • Bugs mentioned: bsc#1191857, bsc#1195624, bsc#1196729, bsc#1197027, bsc#1198168 bsc#1198903, bsc#1199726, bsc#1200480, bsc#1200573, bsc#1200629 bsc#1201210, bsc#1201220, bsc#1201260, bsc#1201626, bsc#1201753 bsc#1201788, bsc#1201913, bsc#1201918, bsc#1202271, bsc#1202272 bsc#1202367, bsc#1202455, bsc#1202464, bsc#1202602, bsc#1202728 bsc#1202729, bsc#1202805, bsc#1202899, bsc#1203026, bsc#1203049 bsc#1203056, bsc#1203169, bsc#1203287, bsc#1203288, bsc#1203385 bsc#1203406, bsc#1203422, bsc#1203449, bsc#1203478, bsc#1203484 bsc#1203564, bsc#1203585, bsc#1203611

Release notes for SUSE Manager Proxy:

• Update to SUSE Manager 4.3.2
  • Containerized proxy and RBS are now fully supported
  • CVEs fixed: CVE-2021-42740, CVE-2021-43138, CVE-2022-31129
  • Bugs mentioned: bsc#1198168, bsc#1198903, bsc#1200480, bsc#1201589, bsc#1201788 bsc#1203287, bsc#1203288, bsc#1203585