CVE-2022-0860

Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2.

These are all security issues fixed in the cobbler-3.3.2.0+git.9044aa99-1.1 package on the GA media of openSUSE Tumbleweed.

Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2.

This update fixes the following issues:

cobbler:

• Consider case of 'next_server' being a hostname during migration of Cobbler collections.
• Fix problem with 'proxy_url_ext' setting being None type.
• Fix settings migration schema to work while upgrading on existing running Uyuni and SUSE Manager servers running with old Cobbler settings (bsc#1203478)
• Do generate boot menus even if no profiles or systems - only local boot
• Avoid crashing running buildiso in certain conditions.
• Fix issue that a custom kernel with the extension '.kernel' is not accepted by 'cobbler distro add'
• Fix issue with 'get_item_resolved_value' that prevented it from returning in cases where a complex object would have been returned
• Fix issue where the logs would have been spammed with 'grab_tree' messages that are meant for debugging
• Buildiso - Fix DNS append line generation
• Change apache2 conf dir for SUSE distros to allow integration with Uyuni and SUSE Manager
• Avoid permissions errors during cobbler sync
• Update to version 3.3.3
• Add UEFI capabilities to 'cobbler buildiso' (jsc#SUMA-112)
• Relevant changes on this release:
  • New:
    • Uyuni Proxies can now be set with the schema validation.
    • Cobbler should now build on AlmaLinux.
    • The initrd is not required anymore as it is an optional file.
    • XML-RPC: Added dump_vars endpoint. This is intended to replace get_blended_data as of 3.4.0.
    • XML-RPC: Added get_item_resolved_value & set_item_resolved_value endpoints.
  • Breaking Changes:
    • The field virt_file_size is now a float and the related settings as well.
  • Changes:
    • The error messages for duplicated objects now contains the name of the duplicated object.
  • Bugfixes:
    • Dictionaries had the wrong value set for <<inherit>>.
    • There were some cases in which the autoinstallation manager was handed the wrong object and then crashed.
    • The inheritance of the owners field was fixed.
    • Serial Console options should not contain bogous -1 value anymore.
    • HTTP API should not throw permission errors anymore.
    • During build the log was not visible due to a custom logger without output.
    • cobbler mkloaders now also copies dependencies of menu.c32.
    • We now generate the grub configuration for the architectures correct again.
    • virt_file_size now is a float at all times.
    • Cobbler should restart successfully now if you have attached an image to a system.
    • If you have a system named default the bootloader was not removed properly before.
    • cobbler buildiso: The isolinux.cfg was not properly formatted.
    • There were unharmful templating errors in the log related to redhat_management_type. The parts depending on this were removed.
    • The DNS managers were non-functional before because of a not existing function call.
    • cobbler buildiso failed with --tmpdirs that don't end in buildiso.
    • cobbler buildiso had outdated docs and help messages for some parameters.
    • cobbler import: It was impossible to import Rocky Linux 8.5 successfully.
    • Cobbler created duplicated settings files before.
    • cobbler sync was broken by refactoring to shell=False before.
• CVE-2022-0860: Improper Authorization in Cobbler. (bsc#1197027)
• Version 3.3.0 fixed jsc#SUMA-112
• Update to version 3.3.2
  • cobbler sync doesn't have to be executed no more after enable_ipxe was flipped
  • Auth: Support for Global Secure Catalog via LDAP provider
  • Reposync now deletes old metadata to prevent metadata merge conflicts
  • The automigration of the settings is now not enabled per default.
  • We removed ppc from RedHat EL 7 as it is not supported
  • Network interface is not subscriptable errors were fixed
  • The stacktraces related to the package and file pre & post triggers should no longer appear
  • You should be able to add multiple initrds if needed again
  • Debian: Fix regex for SHIM_FILE which now provides a working reasonable…

This update for release-notes-susemanager, release-notes-susemanager-proxy fixes the following issues:

Release notes for SUSE Manager:

• Update to SUSE Manager 4.3.2
  • Containerized proxy and RBS are now fully supported
  • HTTP API is now fully supported
  • Ubuntu 22.04 is now supported as a client
  • Cobbler has been upgraded to version 3.3.3 which also includes building ISOs with UEFI support
  • pip support has been added for the Salt Bundle
  • Prometheus exporter for Apache has been upgraded to 0.10.0
  • CVEs fixed: CVE-2021-41411, CVE-2021-42740, CVE-2021-43138, CVE-2022-0860, CVE-2022-31129
  • Bugs mentioned: bsc#1191857, bsc#1195624, bsc#1196729, bsc#1197027, bsc#1198168 bsc#1198903, bsc#1199726, bsc#1200480, bsc#1200573, bsc#1200629 bsc#1201210, bsc#1201220, bsc#1201260, bsc#1201626, bsc#1201753 bsc#1201788, bsc#1201913, bsc#1201918, bsc#1202271, bsc#1202272 bsc#1202367, bsc#1202455, bsc#1202464, bsc#1202602, bsc#1202728 bsc#1202729, bsc#1202805, bsc#1202899, bsc#1203026, bsc#1203049 bsc#1203056, bsc#1203169, bsc#1203287, bsc#1203288, bsc#1203385 bsc#1203406, bsc#1203422, bsc#1203449, bsc#1203478, bsc#1203484 bsc#1203564, bsc#1203585, bsc#1203611

Release notes for SUSE Manager Proxy:

• Update to SUSE Manager 4.3.2
  • Containerized proxy and RBS are now fully supported
  • CVEs fixed: CVE-2021-42740, CVE-2021-43138, CVE-2022-31129
  • Bugs mentioned: bsc#1198168, bsc#1198903, bsc#1200480, bsc#1201589, bsc#1201788 bsc#1203287, bsc#1203288, bsc#1203585

This update fixes the following issues:

cobbler:

• Fix improper authorization (bsc#1197027, CVE-2022-0860)
• Prevent error when starting up logrotate.service (bsc#1188191)

drools:

• Deserialization of Untrusted Data: unsafe data deserialization in DroolsStreamUtils.java (bsc#1204879, CVE-2022-1415)

grafana-formula:

• Version 0.8.1
  • Fix Uyuni/SUMA dashboard names
• Version 0.8.0
  • Set dashboard names depending on project
  • Update dashboards to use new JSON schema
  • Fix PostgreSQL dashboard queries
  • Migrate deprecated panels to their current replacements
• Version 0.7.1
  • Fix default password field description (bsc#1203698)
  • Do not require default admin and password fields

inter-server-sync:

• Version 0.2.7
  • Do not update pillars table if it does not exists like in 4.2
• Version 0.2.6
  • Export package extra tags for complete debian repo metatdata (bsc#1206375)
  • Replace URLs in OS Images pillars when exporting and importing images
• Version 0.2.5
  • Correct error when importing without debug log level (bsc#1204699)

mgr-osad:

• Version 4.2.9-1
  • Updated logrotate configuration (bsc#1206470)

prometheus-formula:

• Version 0.7.0
  • Switch from basic authentication to TLS certificate client authentication for Blackbox exporter
  • Fix scheme label in clients targets configration
  • Add README.md

py27-compat-salt:

• Ignore extend declarations from excluded SLS files (bsc#1203886)
• Enhance capture of error messages for Zypper calls in zypperpkg module

rhnlib:

• Version 4.2.7-1
  • Don't get stuck at the end of SSL transfers (bsc#1204032)

saltboot-formula:

• Update to version 0.1.1676908681.e90e0b1
  • Add failsafe stop file when salt-minion does not stop (bsc#1208418)
  • Support salt bundle (bsc#1208499)

salt-netapi-client:

• Version 0.21.0
  • See: https://github.com/SUSE/salt-netapi-client/releases/tag/v0.21.0
• Add transactional_update module
• Improve logging when creating salt exception

smdba:

• Version 1.7.11
  • fix config update from wal_keep_segments to wal_keep_size for newer postgresql versions (bsc#1204519)

spacecmd:

• Version 4.2.21-1
  • Prevent string api parameters to be parsed as dates if not in ISO-8601 format (bsc#1205759)
  • Add python-dateutil dependency, required to process date values in spacecmd api calls
  • Correctly understand 'ssm' keyword on scap scheduling
  • Fix dict_keys not supporting indexing in systems_setconfigchannelorger

spacewalk-admin:

• Version 4.2.13-1
  • Generate uyuni_roster.conf with salt-secrets-config (bsc#1200096)

spacewalk-backend:

• Version 4.2.26-1
  • Fix reposync error about missing 'content-type' key when syncing certain channels
  • Compute headers as list of two-tuples to be used by url grabber (bsc#1205523)
  • Updated logrotate configuration (bsc#1206470)
  • Add 'octet-stream' to accepted content-types for reposync mirrorlists
  • Exclude invalid mirror urls for reposync (bsc#1203826)
  • do not fetch mirrorlist when a file url is given
  • Keep older module metadata files in database (bsc#1201893)
  • Removed the activation keys report from the debug information

spacewalk-certs-tools:

• Version 4.2.19-1
  • some i18n functions moved to new module which needs to be loaded (bsc#1201142)
  • Generated bootstrap scripts installs all needed Salt 3004 dependencies for Ubuntu 18.04 (bsc#1204517)

spacewalk-client-tools:

• Version 4.2.22-1
  • Update translation strings

spacewalk-java:

• Version 4.2.47-1
  • Use uyuni roster salt module instead of flat roster files (bsc#1200096)
• Version 4.2.46-1
  • Fix registration with proxy and tunnel SSH (bsc#1200096)
• Version 4.2.45-1
  • Add 'none' matcher to CLM AppStream filters (bsc#1206817)
  • Improve logs when sls action chain file is missing
  • Do not forward ssh command if proxy and tunnel are present (bsc#1200096)
  • Fix not being able to delete CLM environment if there are custom child channels that where not built by the environment…

It was discovered that Cobbler did not properly handle user input, which could result in an absolute path traversal. An attacker could possibly use this issue to read arbitrary files. (CVE-2014-3225)

It was discovered that Cobbler did not properly handle user input, which could result in command injection. An attacker could possibly use this issue to execute arbitrary code with high privileges. (CVE-2017-1000469, CVE-2021-45082)

It was discovered that Cobbler did not properly hide private functions in a class. A remote attacker could possibly use this issue to gain high privileges and upload files to an arbitrary location. (CVE-2018-10931, CVE-2018-1000225, CVE-2018-1000226)

Nicolas Chatelain discovered that Cobbler did not properly handle user input, which could result in log poisoning. A remote attacker could possibly use this issue to bypass authorization, write in an arbitrary file, or execute arbitrary code. (CVE-2021-40323, CVE-2021-40324, CVE-2021-40325)

It was discovered that Cobbler did not properly handle file permissions during package install or update operations. An attacker could possibly use this issue to perform a privilege escalation attack. (CVE-2021-45083)

It was discovered that Cobbler did not properly process credentials for expired accounts. An attacker could possibly use this issue to login to the platform with an expired account or password. (CVE-2022-0860)