CVE-2022-1415

A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.

A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.

A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.

A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.

A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.

A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.

This update fixes the following issues:

cobbler:

• Improve Cobbler performance with item cache and threadpool (bsc#1205489)
• Skip collections that are inconsistent instead of crashing (bsc#1205749)
• Add new 'cobbler-tests-containers' subpackage which contains setup and configuration files to run Cobbler tests in containers.
• Add missing code for previous patch file around boot_loaders migration.
• Avoid possible override of existing values during migration of collections to 3.0.0 (bsc#1206160)
• Fix regression: allow empty string as interface_type value (bsc#1203478)
• Fix failing Cobbler tests after upgrading to 3.3.3.

drools:

• CVE-2022-1415: Deserialization of Untrusted Data: unsafe data deserialization in DroolsStreamUtils.java (bsc#1204879)

grafana-formula:

• Version 0.8.0
  • Set dashboard names depending on project
  • Update dashboards to use new JSON schema
  • Fix PostgreSQL dashboard queries
  • Migrate deprecated panels to their current replacements

image-sync-formula:

• Update to version 0.1.1673279145.e7616bd
  • Add form entry for use lates boot image pillar value (bsc#1206055)

inter-server-sync:

• Version 0.2.6
  • Export package extra tags for complete debian repo metatdata (bsc#1206375)
  • Replace URLs in OS Images pillars when exporting and importing images

mgr-osad:

• Version 4.3.7-1
  • Updated logrotate configuration (bsc#1206470)

mgr-push:

• Version 4.3.5-1
  • Update translation strings

rhnlib:

• Version 4.3.5-1
  • Don't get stuck at the end of SSL transfers (bsc#1204032)

saltboot-formula:

• Update to version 0.1.1673279145.e7616bd
  • Add failsafe stop file when salt-minion does not stop (bsc#1172110)
  • Add use case of saltboot group formula outside containerized env (bsc#1206186)
  • Add 'kernel_action' to saltboot form (bsc#1206055)

spacecmd:

• Version 4.3.18-1
  • Add python-dateutil dependency, required to process date values in spacecmd api calls
• Version 4.3.17-1
  • Remove python3-simplejson dependency
  • Correctly understand 'ssm' keyword on scap scheduling
  • Add vendor_advisory information to errata_details call (bsc#1205207)
  • Added two missing options to schedule product migration: allow-vendor-change and remove-products-without-successor (bsc#1204126)
  • Changed schedule product migration to use the correct API method
  • Change default port of 'Containerized Proxy configuration' 8022

spacewalk-backend:

• Version 4.3.18-1
  • Add 'octet-stream' to accepted content-types for reposync mirrorlists
  • Exclude invalid mirror urls for reposync (bsc#1203826)
  • Compute headers as list of two-tuples to be used by url grabber (bsc#1205523)
  • Updated logrotate configuration (bsc#1206470)
  • Add rhel_9 as Salt-enabled kickstart installation
  • do not fetch mirrorlist when a file url is given

spacewalk-certs-tools:

• Version 4.3.17-1
  • Backport SLE Micro bootstrap fixes

spacewalk-client-tools:

• Version 4.3.14-1
  • Update translation strings

spacewalk-java:

• Version 4.3.46-1
  • action chains: recognize transactional_update.reboot as a reboot action
• Version 4.3.45-1
  • Improve logs when sls action chain file is missing
• Version 4.3.44-1
  • Add reboot needed indicator to systems list
  • Fix transaction commit behavior for Spark routes
  • Fix modular channel check during system update via XMLRPC (bsc#1206613)
  • Fix CVE Audit ignoring errata in parent channels if patch in successor product exists (bsc#1206168)
  • Fix CVE Audit incorrectly displaying predecessor product (bsc#1205663)
  • Improve automatic dependency selection for vendor clones
  • Optimize the number of salt calls on minion startup (bsc#1203532)
  • Fix name for autoinstall snippets after Cobbler 3.3.3
  • prevent ISE on activation key page when selected base channel value is null
  • Trigger a package profile update when a new live-patch is installed (bsc#1206249)
  • Fix HTTP API login status code when using wrong credentials (bsc#1206666) *…

This update fixes the following issues:

release-notes-susemanager:

• Update to SUSE Manager 4.3.4
  • SUSE Liberty Linux 9 support as client
  • SUSE Linux Enterprise Micro support as client
  • Indications for systems requiring reboot or with a scheduled reboot
  • Notification messages via email
  • Grafana update to 8.5.15
  • Subscription warning notification
  • Changelogs at repositories metadata has been limited the last 20 entries
  • Drop legacy way to prevent disabling local repositories
  • CVEs fixed CVE-2022-1415
  • Bugs mentioned bsc#1172110, bsc#1195979, bsc#1200801, bsc#1202150, bsc#1203478 bsc#1203532, bsc#1203826, bsc#1204032, bsc#1204126, bsc#1204186 bsc#1204235, bsc#1204270, bsc#1204330, bsc#1204712, bsc#1204715 bsc#1204879, bsc#1204932, bsc#1205012, bsc#1205040, bsc#1205207 bsc#1205255, bsc#1205350, bsc#1205489, bsc#1205523, bsc#1205644 bsc#1205663, bsc#1205749, bsc#1205754, bsc#1205890, bsc#1205919 bsc#1205943, bsc#1206055, bsc#1206160, bsc#1206168, bsc#1206186 bsc#1206249, bsc#1206276, bsc#1206294, bsc#1206336, bsc#1206375 bsc#1206470, bsc#1206613, bsc#1206666, bsc#1206799, bsc#1207136

This update fixes the following issues:

cobbler:

• Fix improper authorization (bsc#1197027, CVE-2022-0860)
• Prevent error when starting up logrotate.service (bsc#1188191)

drools:

• Deserialization of Untrusted Data: unsafe data deserialization in DroolsStreamUtils.java (bsc#1204879, CVE-2022-1415)

grafana-formula:

• Version 0.8.1
  • Fix Uyuni/SUMA dashboard names
• Version 0.8.0
  • Set dashboard names depending on project
  • Update dashboards to use new JSON schema
  • Fix PostgreSQL dashboard queries
  • Migrate deprecated panels to their current replacements
• Version 0.7.1
  • Fix default password field description (bsc#1203698)
  • Do not require default admin and password fields

inter-server-sync:

• Version 0.2.7
  • Do not update pillars table if it does not exists like in 4.2
• Version 0.2.6
  • Export package extra tags for complete debian repo metatdata (bsc#1206375)
  • Replace URLs in OS Images pillars when exporting and importing images
• Version 0.2.5
  • Correct error when importing without debug log level (bsc#1204699)

mgr-osad:

• Version 4.2.9-1
  • Updated logrotate configuration (bsc#1206470)

prometheus-formula:

• Version 0.7.0
  • Switch from basic authentication to TLS certificate client authentication for Blackbox exporter
  • Fix scheme label in clients targets configration
  • Add README.md

py27-compat-salt:

• Ignore extend declarations from excluded SLS files (bsc#1203886)
• Enhance capture of error messages for Zypper calls in zypperpkg module

rhnlib:

• Version 4.2.7-1
  • Don't get stuck at the end of SSL transfers (bsc#1204032)

saltboot-formula:

• Update to version 0.1.1676908681.e90e0b1
  • Add failsafe stop file when salt-minion does not stop (bsc#1208418)
  • Support salt bundle (bsc#1208499)

salt-netapi-client:

• Version 0.21.0
  • See: https://github.com/SUSE/salt-netapi-client/releases/tag/v0.21.0
• Add transactional_update module
• Improve logging when creating salt exception

smdba:

• Version 1.7.11
  • fix config update from wal_keep_segments to wal_keep_size for newer postgresql versions (bsc#1204519)

spacecmd:

• Version 4.2.21-1
  • Prevent string api parameters to be parsed as dates if not in ISO-8601 format (bsc#1205759)
  • Add python-dateutil dependency, required to process date values in spacecmd api calls
  • Correctly understand 'ssm' keyword on scap scheduling
  • Fix dict_keys not supporting indexing in systems_setconfigchannelorger

spacewalk-admin:

• Version 4.2.13-1
  • Generate uyuni_roster.conf with salt-secrets-config (bsc#1200096)

spacewalk-backend:

• Version 4.2.26-1
  • Fix reposync error about missing 'content-type' key when syncing certain channels
  • Compute headers as list of two-tuples to be used by url grabber (bsc#1205523)
  • Updated logrotate configuration (bsc#1206470)
  • Add 'octet-stream' to accepted content-types for reposync mirrorlists
  • Exclude invalid mirror urls for reposync (bsc#1203826)
  • do not fetch mirrorlist when a file url is given
  • Keep older module metadata files in database (bsc#1201893)
  • Removed the activation keys report from the debug information

spacewalk-certs-tools:

• Version 4.2.19-1
  • some i18n functions moved to new module which needs to be loaded (bsc#1201142)
  • Generated bootstrap scripts installs all needed Salt 3004 dependencies for Ubuntu 18.04 (bsc#1204517)

spacewalk-client-tools:

• Version 4.2.22-1
  • Update translation strings

spacewalk-java:

• Version 4.2.47-1
  • Use uyuni roster salt module instead of flat roster files (bsc#1200096)
• Version 4.2.46-1
  • Fix registration with proxy and tunnel SSH (bsc#1200096)
• Version 4.2.45-1
  • Add 'none' matcher to CLM AppStream filters (bsc#1206817)
  • Improve logs when sls action chain file is missing
  • Do not forward ssh command if proxy and tunnel are present (bsc#1200096)
  • Fix not being able to delete CLM environment if there are custom child channels that where not built by the environment…