CVE-2022-21952

A Missing Authentication for Critical Function vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to easily exhaust available disk resources leading to DoS. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46. SUSE Manager Server 4.2 spacewalk-java versions prior to 4.2.37.

A Missing Authentication for Critical Function vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to easily exhaust available disk resources leading to DoS. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46. SUSE Manager Server 4.2 spacewalk-java versions prior to 4.2.37.

An Uncontrolled Resource Consumption vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to easily exhaust available disk resources leading to DoS. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46. SUSE Manager Server 4.2 spacewalk-java versions prior to 4.2.37.

A Missing Authentication for Critical Function vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to easily exhaust available disk resources leading to DoS. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46. SUSE Manager Server 4.2 spacewalk-java versions prior to 4.2.37.

This update for SUSE Manager 4.1.15 Release Notes provides the following additions:

Release notes for SUSE Manager:

• Update to 4.1.15
  • Salt has been upgraded to 3004 version
  • Grafana has been upgraded to 8.3.5
  • Postgres exporter has been upgraded to 0.10.0
  • Alertmanager has been upgraded to 0.23.0
  • Node exporter has been upgraded 1.3.0
  • CVEs fixed: CVE-2022-21724, CVE-2022-21952, CVE-2022-31248, CVE-2022-26520
  • Bugs mentioned: bsc#1182742, bsc#1189501, bsc#1190535, bsc#1192850, bsc#1193032 bsc#1193238, bsc#1193707, bsc#1194262, bsc#1194447, bsc#1194594 bsc#1194909, bsc#1195561, bsc#1196338, bsc#1196407, bsc#1196702 bsc#1196704, bsc#1197356, bsc#1197429, bsc#1197438, bsc#1197488 bsc#1198221, bsc#1198356, bsc#1198686, bsc#1198914, bsc#1199036 bsc#1199142, bsc#1199149, bsc#1199512, bsc#1199528, bsc#1199629 bsc#1199677, bsc#1199888

Release notes for SUSE Manager proxy:

• Update to 4.1.15
  • Salt has been upgraded to 3004 version
  • Bugs mentioned: bsc#1190535, bsc#1193238, bsc#1194447, bsc#1194594, bsc#1194909 bsc#1196338, bsc#1196704, bsc#1199142, bsc#1199528

This update fixes the following issues:

inter-server-sync:

• version 0.2.2
  • Parameter --channel-with-children didn't export data (bsc#1199089)
  • Clean rhnchannelcloned table to rebuild hierarchy (bsc#1197400)
• Version 0.2.1
  • Correct sequence in use for table rhnpackagekey(bsc#1197400)
  • Make Docker image export compatible with Suse Manager 4.2
• Version 0.2.0
  • Allow images export and import (os based and Docker)

prometheus-formula:

• Version 0.6.2
  • Allow prometheus-formula only for SUSE systems (bsc#1199149)

salt-netapi-client:

• Improve the hotfix for bsc#1192550 (bsc#1197449):

smdba:

• Don't package egg-info file for Enterprise Linux.

spacecmd:

• Version 4.2.17-1
  • parse boolean paramaters correctly (bsc#1197689)

spacewalk-backend:

• version 4.2.22-1
  • Do not raise error on file:// based DEB repo when looking for alternative Release files (bsc#1199142)
• Version 4.2.21-1
  • Improve parsing deb packages dependencies (bsc#1194594)

spacewalk-certs-tools:

• Version 4.2.16-1
  • Add Salt Bundle support to bootstrap script generator

spacewalk-java:

• version 4.2.38-1
  • Remove unused gson-extras.jar during build
• version 4.2.37-1
  • CVE-2022-31248: User enumeration via weak error message. (bsc#1199629)
• version 4.2.36-1
  • CVE-2022-21952: Unauthenticated remote Denial of Service via resource exhaustion. (bsc#1199512)
• Version 4.2.35-1
  • faster display installable packages list (bsc#1187333)
  • Pass ssh_salt_pre_flight_script and ssh_use_salt_thin parameters to the generated roster files to enable optional Salt Bundle support with Salt SSH
  • Fix reboot time on salt-ssh client(bsc#1197591)
  • detect free products in Alpha and Beta stage and prevent checks on openSUSE products (bsc#1197488)
  • Allow monitoring entitlement for debian 11 and 10
  • Hide private methods in XMLRPC handlers
  • Warning log when hardware refresh result is not serializable
  • Optimize adding new products function (bsc#1193707)

spacewalk-utils:

• Version 4.2.16-1
  • Add Debian 11 repositories

spacewalk-web:

• Version 4.2.27-1
  • increase web page default timeout (bsc#1187333)
  • Add ssh_salt_pre_flight_script and ssh_use_salt_thin parameters to default rhn_web.conf
  • Upgrade minimist to fix CVE-2021-44906
  • susemanager-nodejs-sdk-devel is now provided by spacewalk-web
  • Resolve race conditions in CLM (bsc#1195710)

susemanager:

• version 4.2.32-1
  • Add python3-contextvars and python3-immutables to missing bootstrap repos (bsc#1200606)
• version 4.2.31-1
  • Add python3-gnupg to bootstrap repo definition for Ubuntu 20.04 (bsc#1200212)
• version 4.2.30-1
  • Fix a syntax problem at the bootstrap repository definitions
• Version 4.2.29-1
  • Add Salt Bundle support to mgr-create-bootstrap-repo
  • Enable bootstrapping for Debian 11
  • fix SLE15 bootstrap repo definition (bsc#1197438)
  • Add SLES15SP4 and SUMA Proxy 4.3 to bootstrap repo definitions (bsc#1196702)
  • Add missing dependencies for Salt 3004 into bootstrap repository for SLE15 family (bsc#1198221)

susemanager-doc-indexes:

• Updated Salt version for Server and Proxy to 3004
• Added details to Client Configuration Guide on using Salt Bundle as optional
• Updated saltversion attribute from 3002 to 3004
• In the Administration Guide, documented that monitoring tools are available in SUSE Linux Enterprise 12 and 15 and openSUSE Leap 15, but Grafana is not available on Proxy (bsc#1191143)
• Documented Autoyast installation features in Autoyast section of the Client Configuration Guide
• In Client Configuration Guide document Debian 11 as a supported OS as a client
• In Client Configuration Guide, clarified client upgrade issues
• In Client Configuration Guide, added information about registration of version 12 of SUSE Linux Enterprise clients
• In Client Configuration Guide, mark the applying patches features as supported on Ubuntu
• SLE Micro in Client Configuration Guide: Update version…

This update fixes the following issues:

golang-github-QubitProducts-exporter_exporter:

• Adapted to build on Enterprise Linux.
• Fix build for RedHat 7
• Require Go >= 1.14 also for CentOS
• Add support for CentOS
• Replace %{?systemd_requires} with %{?systemd_ordering}

golang-github-lusitaniae-apache_exporter:

• Require building with Go 1.15
• Add %license macro for LICENSE file

golang-github-prometheus-node_exporter:

• CVE-2022-21698: Update vendor tarball with prometheus/client_golang 1.11.1 (bsc#1196338, jsc#SLE-24238, jsc#SLE-24239)
• Update to 1.3.0
  • [CHANGE] Add path label to rapl collector #2146
  • [CHANGE] Exclude filesystems under /run/credentials #2157
  • [CHANGE] Add TCPTimeouts to netstat default filter #2189
  • [FEATURE] Add lnstat collector for metrics from /proc/net/stat/ #1771
  • [FEATURE] Add darwin powersupply collector #1777
  • [FEATURE] Add support for monitoring GPUs on Linux #1998
  • [FEATURE] Add Darwin thermal collector #2032
  • [FEATURE] Add os release collector #2094
  • [FEATURE] Add netdev.address-info collector #2105
  • [FEATURE] Add clocksource metrics to time collector #2197
  • [ENHANCEMENT] Support glob textfile collector directories #1985
  • [ENHANCEMENT] ethtool: Expose node_ethtool_info metric #2080
  • [ENHANCEMENT] Use include/exclude flags for ethtool filtering #2165
  • [ENHANCEMENT] Add flag to disable guest CPU metrics #2123
  • [ENHANCEMENT] Add DMI collector #2131
  • [ENHANCEMENT] Add threads metrics to processes collector #2164
  • [ENHANCMMENT] Reduce timer GC delays in the Linux filesystem collector #2169
  • [ENHANCMMENT] Add TCPTimeouts to netstat default filter #2189
  • [ENHANCMMENT] Use SysctlTimeval for boottime collector on BSD #2208
  • [BUGFIX] ethtool: Sanitize metric names #2093
  • [BUGFIX] Fix ethtool collector for multiple interfaces #2126
  • [BUGFIX] Fix possible panic on macOS #2133
  • [BUGFIX] Collect flag_info and bug_info only for one core #2156
  • [BUGFIX] Prevent duplicate ethtool metric names #2187
• Update to 1.2.2
  • Bug fixes Fix processes collector long int parsing #2112
• Update to 1.2.1
  • Removed Remove obsolete capture permission denied error patch already included upstream Fix zoneinfo parsing prometheus/procfs#386 Fix nvme collector log noise #2091 Fix rapl collector log noise #2092
• Update to 1.2.0
  • Changes Rename filesystem collector flags to match other collectors #2012 Make node_exporter print usage to STDOUT #203
  • Features Add conntrack statistics metrics #1155 Add ethtool stats collector #1832 Add flag to ignore network speed if it is unknown #1989 Add tapestats collector for Linux #2044 Add nvme collector #2062
  • Enhancements Add ErrorLog plumbing to promhttp #1887 Add more Infiniband counters #2019 netclass: retrieve interface names and filter before parsing #2033 Add time zone offset metric #2060 Handle errors from disabled PSI subsystem #1983 Fix panic when using backwards compatible flags #2000 Fix wrong value for OpenBSD memory buffer cache #2015 Only initiate collectors once #2048 Handle small backwards jumps in CPU idle #2067
• Capture permission denied error for 'energy_uj' file (bsc#1190535)

patterns-suse-manager:

• Golang-github-wrouesnel-postgres_exporter was renamed to prometheus-postgres_exporter

postgresql-jdbc:

• CVE-2022-26520: Address Arbitrary File Write Vulnerability (bsc#1197356)
• CVE-2022-21724: Address unchecked class instantiation when loading plugins based on class names (bsc#1195561)

prometheus-exporters-formula:

• Version 0.9.5
  • Postgres exporter package was renamed for Red Hat
• Version 0.9.4
  • Postgres exporter package was renamed for SUSE Linux Enterprise Server and openSUSE

prometheus-formula:

• Version 0.3.7
  • Allow prometheus-formula only for SUSE systems (bsc#1199149)

py27-compat-salt:

• Remove redundant overrides causing confusing DEBUG logging…

This update for release-notes-susemanager, release-notes-susemanager-proxy fixes the following issues:

Release notes for SUSE Manager:

• Update to 4.2.7
  • Salt has been upgraded to 3004 version
  • Enabled salt bundle as optional
  • Debian 11 client support has been added
  • Alertmanager has been upgraded to 0.23.0
  • Node exporter has been upgraded 1.3.0
  • CVEs fixed: CVE-2021-44906, CVE-2022-21952, CVE-2022-31248
  • Bugs mentioned: bsc#1187333, bsc#1191143, bsc#1192550, bsc#1193707, bsc#1194594 bsc#1195710, bsc#1196702, bsc#1197400, bsc#1197438, bsc#1197449 bsc#1197488, bsc#1197591, bsc#1197689, bsc#1198221

Release notes for SUSE Manager proxy:

• Update to 4.2.7
  • Salt has been upgraded to 3004 version
  • Bugs mentioned: bsc#1187333, bsc#1194594, bsc#1195710, bsc#1197689