CVE-2021-42740

The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is [A-z] instead of the correct [A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.

The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.

TuxCare rebuilt shell-quote to address 1 CVE. Fixed in 1.7.2-tuxcare.1.

Root has patched CVE-2021-42740 in the shell-quote package for Root:npm. Multiple fixed versions available.

This update for release-notes-susemanager, release-notes-susemanager-proxy fixes the following issues:

Release notes for SUSE Manager:

• Update to SUSE:Manager 4.2.9
  • Notification about SUSE Manager end-of-life has been added
  • CVEs fixed: CVE-2021-43138, CVE-2021-42740, CVE-2022-31129, CVE-2021-41411
  • Bugs mentioned: bsc#1172705, bsc#1187028, bsc#1195455, bsc#1195895, bsc#1196729 bsc#1198168, bsc#1198489, bsc#1198738, bsc#1198903, bsc#1199372 bsc#1199659, bsc#1199913, bsc#1199950, bsc#1200276, bsc#1200296 bsc#1200480, bsc#1200532, bsc#1200573, bsc#1200591, bsc#1200629 bsc#1201142, bsc#1201189, bsc#1201210, bsc#1201220, bsc#1201224 bsc#1201527, bsc#1201606, bsc#1201607, bsc#1201626, bsc#1201753 bsc#1201913, bsc#1201918, bsc#1202142, bsc#1202272, bsc#1202464 bsc#1202728, bsc#1203287, bsc#1203288, bsc#1203449

Release notes for SUSE Manager Proxy:

• Update to SUSE Manager 4.2.9
  • CVEs fixed: CVE-2021-43138, CVE-2021-42740, CVE-2022-31129
  • Bugs mentioned: bsc#1198168, bsc#1198903, bsc#1199659, bsc#1200480, bsc#1200591 bsc#1201142, bsc#1202142, bsc#1202724

This update fixes the following issues:

drools:

• CVE-2021-41411: XML External Entity injection in KieModuleModelImpl.java. (bsc#1200629)

httpcomponents-asyncclient:

• Provide maven metadata needed by other packages to build

image-sync-formula:

• Update to version 0.1.1661440526.b08d95b
  • Add option to sort boot images by version (bsc#1196729)

inter-server-sync:

• Version 0.2.3
  • Compress exported sql data #16631
  • Add gzip dependency to decompress data file during import process

patterns-suse-manager:

• Strictly require OpenJDK 11 (bsc#1202142)

py27-compat-salt:

• Add support for gpgautoimport in zypperpkg module
• Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
• Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
• Unify logic on using multiple requisites and add onfail_all (bsc#1198738)
• Normalize package names once with pkg.installed/removed using yum (bsc#1195895)

salt-netapi-client:

• Declare the LICENSE file as license and not doc
• Adapted for Enterprise Linux 9.
• Version 0.20.0
  • See: https://github.com/SUSE/salt-netapi-client/releases/tag/v0.20.0

saltboot-formula:

• Update to version 0.1.1661440526.b08d95b
  • Fallback to local boot if the configured image is not synced
  • improve image url modifications - preparation for ftp/http changes

spacecmd:

• Version 4.2.19-1
  • Process date values in spacecmd api calls (bsc#1198903)
  • Show correct help on calling kickstart_importjson with no arguments
  • Fix tracebacks on spacecmd kickstart_export (bsc#1200591)

spacewalk-admin:

• Version 4.2.12-1
  • Add --help option to mgr-monitoring-ctl

spacewalk-backend:

• Version 4.2.24-1
  • Make reposync use the configured http proxy with mirrorlist (bsc#1198168)
  • Revert proxy listChannels token caching pr#4548
  • cleanup leftovers from removing unused xmlrpc endpoint

spacewalk-certs-tools:

• Version 4.2.18-1
  • traditional stack bootstrap: install product packages (bsc#1201142)

spacewalk-client-tools:

• Version 4.2.20-1
  • Update translation strings

spacewalk-java:

• Version 4.2.41-1
  • Fixed date format on scheduler related messages (bsc#1195455)
  • Support inherited values for kernel options from Cobbler API (bsc#1199913)
  • Add channel availability check for product migration (bsc#1200296)
  • Check if system has all formulas correctly assigned (bsc#1201607)
  • Remove group formula assignments and data on group delete (bsc#1201606)
  • Fix sync for external repositories (bsc#1201753)
  • fix state.apply result parsing in test mode (bsc#1201913)
  • Reduce the length of image channel URL (bsc#1201220)
  • Calculate dependencies between cloned channels of vendor channels (bsc#1201626)
  • fix symlinks pointing to ongres-stringprep
  • Modify parameter type when communicating with the search server (bsc#1187028)
  • Fix initial profile and build host on Image Build page (bsc#1199659)
  • Fix the confirm message on the refresh action by adding a link to pending actions on it (bsc#1172705)
  • require new salt-netapi-client version
  • Clean grub2 reinstall entry in autoyast snippet (bsc#1199950)

spacewalk-search:

• Version 4.2.8-1
  • Add methods to handle session id as String

spacewalk-web:

• Version 4.2.29-1
  • CVE-2021-43138: Obtain privileges via the mapValues() method. (bsc#1200480)
  • CVE-2021-42740: Command injection in the shell-quote package. (bsc#1203287)
  • CVE-2022-31129: Denial-of-Service moment: inefficient parsing algorithm (bsc#1203288)
  • Fix table header layout for unselectable tables
  • Fix initial profile and build host on Image Build page (bsc#1199659)

subscription-matcher:

• Added Guava maximum version requirement.

susemanager:

• Version 4.2.37-1
  • mark new dependencies for python-py optional in bootstrap repo to fix generation for older service packs (bsc#1203449)
• Version 4.2.36-1
  • add missing packages on SLES 15
  • remove…

This update for release-notes-susemanager, release-notes-susemanager-proxy fixes the following issues:

Release notes for SUSE Manager:

• Update to SUSE Manager 4.3.2
  • Containerized proxy and RBS are now fully supported
  • HTTP API is now fully supported
  • Ubuntu 22.04 is now supported as a client
  • Cobbler has been upgraded to version 3.3.3 which also includes building ISOs with UEFI support
  • pip support has been added for the Salt Bundle
  • Prometheus exporter for Apache has been upgraded to 0.10.0
  • CVEs fixed: CVE-2021-41411, CVE-2021-42740, CVE-2021-43138, CVE-2022-0860, CVE-2022-31129
  • Bugs mentioned: bsc#1191857, bsc#1195624, bsc#1196729, bsc#1197027, bsc#1198168 bsc#1198903, bsc#1199726, bsc#1200480, bsc#1200573, bsc#1200629 bsc#1201210, bsc#1201220, bsc#1201260, bsc#1201626, bsc#1201753 bsc#1201788, bsc#1201913, bsc#1201918, bsc#1202271, bsc#1202272 bsc#1202367, bsc#1202455, bsc#1202464, bsc#1202602, bsc#1202728 bsc#1202729, bsc#1202805, bsc#1202899, bsc#1203026, bsc#1203049 bsc#1203056, bsc#1203169, bsc#1203287, bsc#1203288, bsc#1203385 bsc#1203406, bsc#1203422, bsc#1203449, bsc#1203478, bsc#1203484 bsc#1203564, bsc#1203585, bsc#1203611

Release notes for SUSE Manager Proxy:

• Update to SUSE Manager 4.3.2
  • Containerized proxy and RBS are now fully supported
  • CVEs fixed: CVE-2021-42740, CVE-2021-43138, CVE-2022-31129
  • Bugs mentioned: bsc#1198168, bsc#1198903, bsc#1200480, bsc#1201589, bsc#1201788 bsc#1203287, bsc#1203288, bsc#1203585

This update fixes the following issues:

cobbler:

• Fix improper authorization (bsc#1197027, CVE-2022-0860)
• Prevent error when starting up logrotate.service (bsc#1188191)

drools:

• Deserialization of Untrusted Data: unsafe data deserialization in DroolsStreamUtils.java (bsc#1204879, CVE-2022-1415)

grafana-formula:

• Version 0.8.1
  • Fix Uyuni/SUMA dashboard names
• Version 0.8.0
  • Set dashboard names depending on project
  • Update dashboards to use new JSON schema
  • Fix PostgreSQL dashboard queries
  • Migrate deprecated panels to their current replacements
• Version 0.7.1
  • Fix default password field description (bsc#1203698)
  • Do not require default admin and password fields

inter-server-sync:

• Version 0.2.7
  • Do not update pillars table if it does not exists like in 4.2
• Version 0.2.6
  • Export package extra tags for complete debian repo metatdata (bsc#1206375)
  • Replace URLs in OS Images pillars when exporting and importing images
• Version 0.2.5
  • Correct error when importing without debug log level (bsc#1204699)

mgr-osad:

• Version 4.2.9-1
  • Updated logrotate configuration (bsc#1206470)

prometheus-formula:

• Version 0.7.0
  • Switch from basic authentication to TLS certificate client authentication for Blackbox exporter
  • Fix scheme label in clients targets configration
  • Add README.md

py27-compat-salt:

• Ignore extend declarations from excluded SLS files (bsc#1203886)
• Enhance capture of error messages for Zypper calls in zypperpkg module

rhnlib:

• Version 4.2.7-1
  • Don't get stuck at the end of SSL transfers (bsc#1204032)

saltboot-formula:

• Update to version 0.1.1676908681.e90e0b1
  • Add failsafe stop file when salt-minion does not stop (bsc#1208418)
  • Support salt bundle (bsc#1208499)

salt-netapi-client:

• Version 0.21.0
  • See: https://github.com/SUSE/salt-netapi-client/releases/tag/v0.21.0
• Add transactional_update module
• Improve logging when creating salt exception

smdba:

• Version 1.7.11
  • fix config update from wal_keep_segments to wal_keep_size for newer postgresql versions (bsc#1204519)

spacecmd:

• Version 4.2.21-1
  • Prevent string api parameters to be parsed as dates if not in ISO-8601 format (bsc#1205759)
  • Add python-dateutil dependency, required to process date values in spacecmd api calls
  • Correctly understand 'ssm' keyword on scap scheduling
  • Fix dict_keys not supporting indexing in systems_setconfigchannelorger

spacewalk-admin:

• Version 4.2.13-1
  • Generate uyuni_roster.conf with salt-secrets-config (bsc#1200096)

spacewalk-backend:

• Version 4.2.26-1
  • Fix reposync error about missing 'content-type' key when syncing certain channels
  • Compute headers as list of two-tuples to be used by url grabber (bsc#1205523)
  • Updated logrotate configuration (bsc#1206470)
  • Add 'octet-stream' to accepted content-types for reposync mirrorlists
  • Exclude invalid mirror urls for reposync (bsc#1203826)
  • do not fetch mirrorlist when a file url is given
  • Keep older module metadata files in database (bsc#1201893)
  • Removed the activation keys report from the debug information

spacewalk-certs-tools:

• Version 4.2.19-1
  • some i18n functions moved to new module which needs to be loaded (bsc#1201142)
  • Generated bootstrap scripts installs all needed Salt 3004 dependencies for Ubuntu 18.04 (bsc#1204517)

spacewalk-client-tools:

• Version 4.2.22-1
  • Update translation strings

spacewalk-java:

• Version 4.2.47-1
  • Use uyuni roster salt module instead of flat roster files (bsc#1200096)
• Version 4.2.46-1
  • Fix registration with proxy and tunnel SSH (bsc#1200096)
• Version 4.2.45-1
  • Add 'none' matcher to CLM AppStream filters (bsc#1206817)
  • Improve logs when sls action chain file is missing
  • Do not forward ssh command if proxy and tunnel are present (bsc#1200096)
  • Fix not being able to delete CLM environment if there are custom child channels that where not built by the environment…