CVE-2022-43754

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spacewalk/Uyuni of SUSE Linux Enterprise Module for SUSE Manager Server 4.2, SUSE Linux Enterprise Module for SUSE Manager Server 4.3, SUSE Manager Server 4.2 allows remote attackers to embed Javascript code via /rhn/audit/scap/Search.do This issue affects: SUSE Linux Enterprise Module for SUSE Manager Server 4.2 hub-xmlrpc-api-0.7-150300.3.9.2, inter-server-sync-0.2.4-150300.8.25.2, locale-formula-0.3-150300.3.3.2, py27-compat-salt-3000.3-150300.7.7.26.2, python-urlgrabber-3.10.2.1py2_3-150300.3.3.2, spacecmd-4.2.20-150300.4.30.2, spacewalk-backend-4.2.25-150300.4.32.4, spacewalk-client-tools-4.2.21-150300.4.27.3, spacewalk-java-4.2.43-150300.3.48.2, spacewalk-utils-4.2.18-150300.3.21.2, spacewalk-web-4.2.30-150300.3.30.3, susemanager-4.2.38-150300.3.44.3, susemanager-doc-indexes-4.2-150300.12.36.3, susemanager-docs_en-4.2-150300.12.36.2, susemanager-schema-4.2.25-150300.3.30.3, susemanager-sls versions prior to 4.2.28. SUSE Linux Enterprise Module for SUSE Manager Server 4.3 spacewalk-java versions prior to 4.3.39. SUSE Manager Server 4.2 release-notes-susemanager versions prior to 4.2.10.

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spacewalk/Uyuni of SUSE Linux Enterprise Module for SUSE Manager Server 4.2, SUSE Linux Enterprise Module for SUSE Manager Server 4.3, SUSE Manager Server 4.2 allows remote attackers to embed Javascript code via /rhn/audit/scap/Search.do This issue affects: SUSE Linux Enterprise Module for SUSE Manager Server 4.2 hub-xmlrpc-api-0.7-150300.3.9.2, inter-server-sync-0.2.4-150300.8.25.2, locale-formula-0.3-150300.3.3.2, py27-compat-salt-3000.3-150300.7.7.26.2, python-urlgrabber-3.10.2.1py2_3-150300.3.3.2, spacecmd-4.2.20-150300.4.30.2, spacewalk-backend-4.2.25-150300.4.32.4, spacewalk-client-tools-4.2.21-150300.4.27.3, spacewalk-java-4.2.43-150300.3.48.2, spacewalk-utils-4.2.18-150300.3.21.2, spacewalk-web-4.2.30-150300.3.30.3, susemanager-4.2.38-150300.3.44.3, susemanager-doc-indexes-4.2-150300.12.36.3, susemanager-docs_en-4.2-150300.12.36.2, susemanager-schema-4.2.25-150300.3.30.3, susemanager-sls versions prior to 4.2.28. SUSE Linux Enterprise Module for SUSE Manager Server 4.3 spacewalk-java versions prior to 4.3.39. SUSE Manager Server 4.2 release-notes-susemanager versions prior to 4.2.10.

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spacewalk/Uyuni of SUSE Linux Enterprise Module for SUSE Manager Server 4.2, SUSE Linux Enterprise Module for SUSE Manager Server 4.3, SUSE Manager Server 4.2 allows remote attackers to embed Javascript code via /rhn/audit/scap/Search.do This issue affects: SUSE Linux Enterprise Module for SUSE Manager Server 4.2 hub-xmlrpc-api-0.7-150300.3.9.2, inter-server-sync-0.2.4-150300.8.25.2, locale-formula-0.3-150300.3.3.2, py27-compat-salt-3000.3-150300.7.7.26.2, python-urlgrabber-3.10.2.1py2_3-150300.3.3.2, spacecmd-4.2.20-150300.4.30.2, spacewalk-backend-4.2.25-150300.4.32.4, spacewalk-client-tools-4.2.21-150300.4.27.3, spacewalk-java-4.2.43-150300.3.48.2, spacewalk-utils-4.2.18-150300.3.21.2, spacewalk-web-4.2.30-150300.3.30.3, susemanager-4.2.38-150300.3.44.3, susemanager-doc-indexes-4.2-150300.12.36.3, susemanager-docs_en-4.2-150300.12.36.2, susemanager-schema-4.2.25-150300.3.30.3, susemanager-sls versions prior to 4.2.28. SUSE Linux Enterprise Module for SUSE Manager Server 4.3 spacewalk-java versions prior to 4.3.39. SUSE Manager Server 4.2 release-notes-susemanager versions prior to 4.2.10.

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spacewalk/Uyuni of SUSE Linux Enterprise Module for SUSE Manager Server 4.2, SUSE Linux Enterprise Module for SUSE Manager Server 4.3, SUSE Manager Server 4.2 allows remote attackers to embed Javascript code via /rhn/audit/scap/Search.do This issue affects: SUSE Linux Enterprise Module for SUSE Manager Server 4.2 hub-xmlrpc-api-0.7-150300.3.9.2, inter-server-sync-0.2.4-150300.8.25.2, locale-formula-0.3-150300.3.3.2, py27-compat-salt-3000.3-150300.7.7.26.2, python-urlgrabber-3.10.2.1py2_3-150300.3.3.2, spacecmd-4.2.20-150300.4.30.2, spacewalk-backend-4.2.25-150300.4.32.4, spacewalk-client-tools-4.2.21-150300.4.27.3, spacewalk-java-4.2.43-150300.3.48.2, spacewalk-utils-4.2.18-150300.3.21.2, spacewalk-web-4.2.30-150300.3.30.3, susemanager-4.2.38-150300.3.44.3, susemanager-doc-indexes-4.2-150300.12.36.3, susemanager-docs_en-4.2-150300.12.36.2, susemanager-schema-4.2.25-150300.3.30.3, susemanager-sls versions prior to 4.2.28. SUSE Linux Enterprise Module for SUSE Manager Server 4.3 spacewalk-java versions prior to 4.3.39. SUSE Manager Server 4.2 release-notes-susemanager versions prior to 4.2.10.

This update fixes the following issues:

hub-xmlrpc-api:

• Use golang(API) = 1.18 for building on SUSE (bsc#1203599) This source fails to build with the current go1.19 on SUSE and we need to use go1.18 instead.

inter-server-sync:

• Version 0.2.4
  • Improve memory usage and log information #17193
  • Conditional insert check for FK reference exists (bsc#1202785)
  • Correct navigation path for table rhnerratafilechannel (bsc#1202785)

locale-formula:

• Update to version 0.3
  • Remove .map.gz from kb_map dictionary (bsc#1203406)

py27-compat-salt:

• Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
• Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)

python-urlgrabber:

• Fix wrong logic on find_proxy method causing proxy not being used (bsc#1201788)

spacecmd:

• Version 4.2.20-1
  • Remove 'Undefined return code' from debug messages (bsc#1203283)

spacewalk-backend:

• Version 4.2.25-1
  • Enhance passwords cleanup and add extra files in spacewalk-debug (bsc#1201059)
  • Prevent mixing credentials for proxy and repository server while using basic authentication and avoid hiding errors i.e. timeouts while having proxy settings issues with extra logging in verbose mode (bsc#1201788)

spacewalk-client-tools:

• Version 4.2.21-1
  • Update translation strings

spacewalk-java:

• Version 4.2.43-1
  • CVE-2022-31255: Fix directory path traversal vulnerability (bsc#1204543)
  • CVE-2022-43754: Fix reflected cross site scripting vulnerability (bsc#1204741)
  • CVE-2022-43753: Fix arbitrary file disclosure vulnerability (bsc#1204716)
• Version 4.2.42-1
  • Properly pass allow vendor change to salt state (bsc#1204203)
  • add ongres requirements to spec file (bsc#1203898)
  • Refresh pillar data (bsc#1197724)
  • Fix hardware update where there is no DNS FQDN changes (bsc#1203611)
  • Use mgrnet.dns_fqdns module to improve FQDN detection (bsc#1199726)
  • Support Pay-as-you-go new CA location for SLES15SP4 and higher (bsc#1202729)
  • Detect the clients running on Amazon EC2 (bsc#1195624)

spacewalk-utils:

• Version 4.2.18-1
  • Make spacewalk-hostname-rename working with settings.yaml cobbler config file (bsc#1203564)

spacewalk-web:

• Version 4.2.30-1
  • Upgrade moment-timezone

susemanager:

• Version 4.2.38-1
  • add venv-salt-minion to bootstrap repo (bsc#1204146)

susemanager-doc-indexes:

• Documented that only SUSE clients are supported as monitoring servers in the Administration Guide
• Fixed description of default notification settings (bsc#1203422)
• Added missing Debian 11 references
• Removed references to Debian 9, as it is EoL, and therefore unsupported by SUSE Manager
• Document Helm deployment of the proxy on k3s and MetalLB in Installation and Upgrade Guide
• Added secure mail communication settings in Administration Guide
• Fixed the incorrect path to state and pillar files in Salt Guide
• Documented how pxeboot works with Secure Boot enabled in Client Configuration Guide
• Added SLE Micro 5.2 and 5.3 as available as a technology preview in the Client Configuration Guide, and the IBM Z architecture for 5.1, 5.2, and 5.3

susemanager-docs_en:

• Documented that only SUSE clients are supported as monitoring servers in the Administration Guide
• Fixed description of default notification settings (bsc#1203422)
• Added missing Debian 11 references
• Removed references to Debian 9, as it is EoL, and therefore unsupported by SUSE Manager
• Document Helm deployment of the proxy on k3s and MetalLB in Installation and Upgrade Guide
• Added secure mail communication settings in Administration Guide
• Fixed the incorrect path to state and pillar files in Salt Guide
• Documented how pxeboot works with Secure Boot enabled in Client Configuration Guide
• Added SLE Micro 5.2 and 5.3 as available as a technology preview in the Client Configuration Guide, and the IBM Z architecture for 5.1, 5.2, and…

This update for release-notes-susemanager, release-notes-susemanager-proxy fixes the following issues:

Release notes for SUSE Manager:

• Update to SUSE Manager 4.2.10
  • Apache exporter has been upgraded to version 0.11.0
  • CVEs fixed: CVE-2022-43753, CVE-2022-43754, CVE-2022-31255
  • Bugs mentioned: bsc#1195624, bsc#1197724, bsc#1199726, bsc#1200596, bsc#1201059 bsc#1201788, bsc#1202167, bsc#1202729, bsc#1202785, bsc#1203283 bsc#1203406, bsc#1203422, bsc#1203564, bsc#1203599, bsc#1203611 bsc#1203898, bsc#1204146, bsc#1204203, bsc#1195624, bsc#1197724 bsc#1199726, bsc#1200596, bsc#1201059, bsc#1201788, bsc#1202167 bsc#1202729, bsc#1202785, bsc#1203283, bsc#1203406, bsc#1203422 bsc#1203564, bsc#1203599, bsc#1203611, bsc#1203898, bsc#1204146 bsc#1204716, bsc#1204741, bsc#1204543

Release notes for SUSE Manager Proxy:

• Update to SUSE Manager 4.2.10
  • Bugs mentioned: bsc#1201059, bsc#1201788, bsc#1203283

This update for spacewalk-java fixes the following issues:

• CVE-2022-31255: Fix directory path traversal vulnerability (bsc#1204543)
• CVE-2022-43754: Fix reflected cross site scripting vulnerability (bsc#1204741)
• CVE-2022-43753: Fix arbitrary file disclosure vulnerability (bsc#1204716)