CVE-2022-31248

This update fixes the following issues:

golang-github-QubitProducts-exporter_exporter:

• Adapted to build on Enterprise Linux.
• Fix build for RedHat 7
• Require Go >= 1.14 also for CentOS
• Add support for CentOS
• Replace %{?systemd_requires} with %{?systemd_ordering}

golang-github-lusitaniae-apache_exporter:

• Require building with Go 1.15
• Add %license macro for LICENSE file

golang-github-prometheus-node_exporter:

• CVE-2022-21698: Update vendor tarball with prometheus/client_golang 1.11.1 (bsc#1196338, jsc#SLE-24238, jsc#SLE-24239)
• Update to 1.3.0
  • [CHANGE] Add path label to rapl collector #2146
  • [CHANGE] Exclude filesystems under /run/credentials #2157
  • [CHANGE] Add TCPTimeouts to netstat default filter #2189
  • [FEATURE] Add lnstat collector for metrics from /proc/net/stat/ #1771
  • [FEATURE] Add darwin powersupply collector #1777
  • [FEATURE] Add support for monitoring GPUs on Linux #1998
  • [FEATURE] Add Darwin thermal collector #2032
  • [FEATURE] Add os release collector #2094
  • [FEATURE] Add netdev.address-info collector #2105
  • [FEATURE] Add clocksource metrics to time collector #2197
  • [ENHANCEMENT] Support glob textfile collector directories #1985
  • [ENHANCEMENT] ethtool: Expose node_ethtool_info metric #2080
  • [ENHANCEMENT] Use include/exclude flags for ethtool filtering #2165
  • [ENHANCEMENT] Add flag to disable guest CPU metrics #2123
  • [ENHANCEMENT] Add DMI collector #2131
  • [ENHANCEMENT] Add threads metrics to processes collector #2164
  • [ENHANCMMENT] Reduce timer GC delays in the Linux filesystem collector #2169
  • [ENHANCMMENT] Add TCPTimeouts to netstat default filter #2189
  • [ENHANCMMENT] Use SysctlTimeval for boottime collector on BSD #2208
  • [BUGFIX] ethtool: Sanitize metric names #2093
  • [BUGFIX] Fix ethtool collector for multiple interfaces #2126
  • [BUGFIX] Fix possible panic on macOS #2133
  • [BUGFIX] Collect flag_info and bug_info only for one core #2156
  • [BUGFIX] Prevent duplicate ethtool metric names #2187
• Update to 1.2.2
  • Bug fixes Fix processes collector long int parsing #2112
• Update to 1.2.1
  • Removed Remove obsolete capture permission denied error patch already included upstream Fix zoneinfo parsing prometheus/procfs#386 Fix nvme collector log noise #2091 Fix rapl collector log noise #2092
• Update to 1.2.0
  • Changes Rename filesystem collector flags to match other collectors #2012 Make node_exporter print usage to STDOUT #203
  • Features Add conntrack statistics metrics #1155 Add ethtool stats collector #1832 Add flag to ignore network speed if it is unknown #1989 Add tapestats collector for Linux #2044 Add nvme collector #2062
  • Enhancements Add ErrorLog plumbing to promhttp #1887 Add more Infiniband counters #2019 netclass: retrieve interface names and filter before parsing #2033 Add time zone offset metric #2060 Handle errors from disabled PSI subsystem #1983 Fix panic when using backwards compatible flags #2000 Fix wrong value for OpenBSD memory buffer cache #2015 Only initiate collectors once #2048 Handle small backwards jumps in CPU idle #2067
• Capture permission denied error for 'energy_uj' file (bsc#1190535)

patterns-suse-manager:

• Golang-github-wrouesnel-postgres_exporter was renamed to prometheus-postgres_exporter

postgresql-jdbc:

• CVE-2022-26520: Address Arbitrary File Write Vulnerability (bsc#1197356)
• CVE-2022-21724: Address unchecked class instantiation when loading plugins based on class names (bsc#1195561)

prometheus-exporters-formula:

• Version 0.9.5
  • Postgres exporter package was renamed for Red Hat
• Version 0.9.4
  • Postgres exporter package was renamed for SUSE Linux Enterprise Server and openSUSE

prometheus-formula:

• Version 0.3.7
  • Allow prometheus-formula only for SUSE systems (bsc#1199149)

py27-compat-salt:

• Remove redundant overrides causing confusing DEBUG logging…

This update for release-notes-susemanager, release-notes-susemanager-proxy fixes the following issues:

Release notes for SUSE Manager:

• Update to 4.2.7
  • Salt has been upgraded to 3004 version
  • Enabled salt bundle as optional
  • Debian 11 client support has been added
  • Alertmanager has been upgraded to 0.23.0
  • Node exporter has been upgraded 1.3.0
  • CVEs fixed: CVE-2021-44906, CVE-2022-21952, CVE-2022-31248
  • Bugs mentioned: bsc#1187333, bsc#1191143, bsc#1192550, bsc#1193707, bsc#1194594 bsc#1195710, bsc#1196702, bsc#1197400, bsc#1197438, bsc#1197449 bsc#1197488, bsc#1197591, bsc#1197689, bsc#1198221

Release notes for SUSE Manager proxy:

• Update to 4.2.7
  • Salt has been upgraded to 3004 version
  • Bugs mentioned: bsc#1187333, bsc#1194594, bsc#1195710, bsc#1197689

This update for SUSE Manager 4.2.8 Release Notes provides the following additions:

Release notes for SUSE Manager:

• Update to 4.2.8
  • Notification about SUSE Manager end-of-life has been added
  • CVEs fixed CVE-2022-31248
  • Bugs mentioned bsc#1179962, bsc#1182742, bsc#1189501, bsc#1192850, bsc#1193032 bsc#1193238, bsc#1194262, bsc#1196977, bsc#1197429, bsc#1197507 bsc#1198191, bsc#1198356, bsc#1198358, bsc#1198429, bsc#1198646 bsc#1198686, bsc#1198914, bsc#1198944, bsc#1198999, bsc#1199019 bsc#1199036, bsc#1199049, bsc#1199438, bsc#1199466, bsc#1199523 bsc#1199528, bsc#1199577, bsc#1199596, bsc#1199629, bsc#1199646 bsc#1199656, bsc#1199677, bsc#1199679, bsc#1199727, bsc#1199874 bsc#1199888, bsc#1200087, bsc#1200703, bsc#1200707, bsc#1200863 bsc#1194394, bsc#1201842, bsc#1201782

Release notes for SUSE Manager Proxy:

• Update to 4.2.8
  • Bugs mentioned bsc#1193238, bsc#1197507, bsc#1199019, bsc#1199401, bsc#1199528 bsc#1199679, bsc#1200087

This update fixes the following issues:

apache-commons-csv:

• Fix the URL for the package
• Declare the LICENSE file as license and not doc

apache-commons-math3:

• Fix the URL for the package
• Declare the LICENSE file as license and not doc

drools:

• Declare the LICENSE file as license and not doc

jakarta-commons-validator:

• Declare the LICENSE file as license and not doc

jose4j:

• Declare the LICENSE file as license and not doc

kie-api:

• Declare the LICENSE file as license and not doc

mvel2:

• Declare the LICENSE file as license and not doc

optaplanner:

• Declare the LICENSE file as license and not doc

py27-compat-salt:

• Remove redundant overrides causing confusing DEBUG logging (bsc#1189501)

python-susemanager-retail:

• Update to version 1.0.1653987003.92d4870
  • Fix messages and logging in retail_create_delta (bsc#1199727)

smdba:

• Declare the LICENSE file as license and not doc
• Make EL egginfo removal more generic

spacecmd:

• Version 4.2.18-1
  • on full system update call schedulePackageUpdate API (bsc#1197507)

spacewalk-admin:

• Version 4.2.11-1
  • clarify schema upgrade check message (bsc#1198999)

spacewalk-backend:

• Version 4.2.23-1
  • Fix traceback on calling spacewalk-repo-sync --show-packages (bsc#1193238)
  • Fix virt_notify SQL syntax error (bsc#1199528)
  • store create-bootstrap logs in spacewalk-debug

spacewalk-branding:

• Version 4.2.14-1
  • Stylesheets and relevant assets are now provided by spacewalk-web

spacewalk-certs-tools:

• Version 4.2.17-1
  • use RES bootstrap repo as a fallback for Red Hat downstream OS (bsc#1200087)

spacewalk-client-tools:

• Version 4.2.19-1
  • Update translation strings

spacewalk-java:

• version 4.2.40-1

  • Fix conflict when system is assigned to multiple instances of the same formula (bsc#1194394)

• Version 4.2.39-1

  • Keep the websocket connections alive with ping/pong frames (bsc#1199874)
  • Fix missing remote command history events for big output (bsc#1199656)
  • Improve CLM channel cloning performance (bsc#1199523)
  • fix api log message references the wrong user (bsc#1179962)
  • Show patch as installed in CVE Audit even if successor patch affects additional packages (bsc#1199646)
  • fix download of packages with caret sign in the version due to missing url decode
  • Prefer the Salt Bundle with Cobbler snippets configuration (minion_script and redhat_register_using_salt) (bsc#1198646)
  • During re-activation, recalculate grains if contact method has been changed (bsc#1199677)
  • Hide authentication data in PAYG UI (bsc#1199679)
  • autoinstallation: missing whitespace after install URL (bsc#1199888)
  • Improved handling of error messages during bootstrapping
  • skip forwarding data to scc if no credentials are available
  • Change system details lock tab name to lock/unlock (bsc#1193032)
  • Added a notification to inform the administrators about the product end-of-life
  • Set profile tag has no-mandatory in XCCDF result (bsc#1194262)
  • provisioning thought proxy should use proxy for self_update (bsc#1199036)
  • Allow removing duplicated packages names in the same Salt action (bsc#1198686)
  • fix NoSuchElementException when pkg install date is missing
  • Improve API documentation
  • Fix outdated documentation and release notes links
  • Fix error message in Kubernetes VHM creation dialog
  • Add createAppStreamFilters() XMLRPC function
  • Correct concurrency error on payg taskomatic task for updating certificates (#17783)
  • Fix ACL rules for config diff download for SLS files (bsc#1198914)
  • fix package selection for ubuntu errata install (bsc#1199049)
  • fix invalid link to action schedule
  • add schedulePackageUpdate() XMLRPC function (bsc#1197507)
  • update server needed cache after adding Ubuntu Errata (bsc#1196977)
  • check if file exists before sending it to xsendfile (bsc#1198191)
  • Display usertime instead of server time for clm issue date filter (bsc#1198429) …

This update fixes the following issues:

apache-commons-csv:

• Fix the URL for the package
• Declare the LICENSE file as license and not doc

apache-commons-math3:

• Fix the URL for the package
• Declare the LICENSE file as license and not doc

drools:

• Declare the LICENSE file as license and not doc

image-sync-formula:

• Update to version 0.1.1658330139.861779d
  • Fix deleting of unused boot images
  • Support deltas for system images (bsc#1201498)
  • Do not try to show changes in images (bsc#1199998)

inter-server-sync:

• Version 0.2.3
  • Compress exported sql data #16631

jakarta-commons-validator:

• Declare the LICENSE file as license and not doc

jose4j:

• Declare the LICENSE file as license and not doc

kie-api:

• Declare the LICENSE file as license and not doc

mvel2:

• Declare the LICENSE file as license and not doc

optaplanner:

• Declare the LICENSE file as license and not doc

python-susemanager-retail:

• Update to version 0.1.1658330139.861779d
  • Support deltas for system images (bsc#1201498)
  • Fix error message on incorrect --log-level arg (bsc#1199727)

python-urlgrabber:

• Fix wrong logic on find_proxy method causing proxy not being used

reprepro:

• Bump up the maxsize on a fixed-size C buffer to avoid breaking on some autogenerated rust packages
• Flush stdout and stderr before execv of an end hook
• Add support for Zstd compressed debs
• Added alternative package name for db4-devel.

salt-netapi-client:

• Declare the LICENSE file as license and not doc

smdba:

• Declare the LICENSE file as license and not doc

spacecmd:

• Version 4.3.14-1
  • Fix missing argument on system_listmigrationtargets (bsc#1201003)
  • Show correct help on calling kickstart_importjson with no arguments
  • Fix tracebacks on spacecmd kickstart_export (bsc#1200591)
  • Change proxy container config default filename to end with tar.gz

spacewalk:

• Version 4.3.5-1
  • Simplified PostgreSQL14 requirement.
  • Update server-migrator to dist-upgrade to openSUSE 15.4

spacewalk-backend:

• Version 4.3.15-1
  • cleanup leftovers from removing unused xmlrpc endpoint
  • Fix issues with 'http proxy' not being used by reposync in some cases

spacewalk-certs-tools:

• Version 4.3.14-1
  • traditional stack bootstrap: install product packages (bsc#1201142)
  • display messages to restart services after certificate change
  • improve CA Chain checking by comparing authorityKeyIdentifier with subjectKeyIdentifier

spacewalk-client-tools:

• Version 4.3.11-1
  • Update translation strings

spacewalk-config:

• Version 4.3.9-1
  • fix posttrans error 'RHN-ORG-TRUSTED-SSL-CERT' not found

spacewalk-java:

• Version 4.3.35-1
  • Modify parameter type when communicating with the search server (bsc#1187028)
  • Fix hibernate error on deleting an image with delta
  • Changed logout method to POST on HTTP API (bsc#1199663)
  • Turned API information endpoints public (bsc#1199817)
  • Fix typo and ordering of JSON over HTTP API example scripts
  • Improved log handling in HTTP API (bsc#1199662)
  • set Channel GPG Key info from SCC data
  • set GPG Key Url as channel pillar data (bsc#1199984)
  • new API endpoint for addErrataUpdate, that take multiple servers as argument
  • Move ImageSync pillars to database (bsc#1199157)
  • Fix conflict when system is assigned to multiple instances of the same formula (bsc#1194394)
  • Fix initial profile and build host on Image Build page (bsc#1199659)
  • Convert formula integer values when upgrading (bsc#1200347)
  • Cleanup salt known_hosts when generating proxy containers config
  • Modify proxy containers configuration files set output
  • Change proxy containers config to tarball with yaml files
  • Fixed date format on scheduler related messages (bsc#1195455)
  • Improved dropdown layout handling
  • Fix download CSV
  • Hide authentication data in PAYG UI (bsc#1199679)
  • Clean grub2 reinstall entry in autoyast snippet (bsc#1199950)
  • Show reboot alert message on…