CVE-2023-22644

These are all security issues fixed in the govulncheck-vulndb-0.0.20241030T212825-1.1 package on the GA media of openSUSE Tumbleweed.

This update fixes the following issues:

branch-network-formula:

• Update to version 0.1.1680167239.23f2fec
  • Remove unnecessary import of 'salt.ext.six'

cobbler:

• Fix cobbler buildiso so that the artifact can be booted by EFI firmware. (bsc#1206060)
• Switch packaging from patch based to Git tree based development
• S390X systems require their kernel options to have a linebreak at 79 characters (bsc#1207595)
• Settings-migration-v1-to-v2.sh will now handle paths with whitespace correctly
• Fix renaming Cobbler items (bsc#1204900, bsc#1209149)
• 'cobbler buildiso' arguments '--system' and '--profile' are now accepted in the right order (bsc#1210776)

cpu-mitigations-formula:

• Update to version 0.5.0:
  • Mark all SUSE Linux Enterprise 15 SP4 and newer and openSUSE 15.4 and newer as supported (bsc#1210835)

hub-xmlrpc-api:

• Do not strictly require Go 1.18 on SUSE Linux Enterprise 15 SP3 (bsc#1203599)

perl-Satcon:

• Version 4.3.2-1
  • Accept keys with dots

python-urlgrabber:

• Raise proper exception from urlgrab() when local file is not found (bsc#1208288)

spacecmd:

• Version 4.3.21-1
  • Fix argument parsing of distribution_update (bsc#1210458)
• Version 4.3.20-1
  • Display activation key details after executing the corresponding command (bsc#1208719)
  • Show targetted packages before actually removing them (bsc#1207830)

spacewalk-admin:

• Version 4.3.11-1
  • change backup file extension from .orig to .current_time (bsc#1206783)

spacewalk-backend:

• Version 4.3.21-1
  • Add package details to reposync error logging
  • Fix the mgr-inter-sync not creating valid repository metadata when dealing with empty channels (bsc#1207829)
  • Filter CLM modular packages using release strings (bsc#1207814)
  • Fix issues with kickstart syncing on mirrorlist repositories
  • Do not sync .mirrorlist and other non needed files
  • reposync: catch local file not found urlgrabber error properly (bsc#1208288)
• Version 4.3.20-1
  • Fix repo sync for cloud payg connected repositories (bsc#1208772)

spacewalk-config:

• Version 4.3.10-1
  • Add /saltboot directory
  • Mark /os-images and /tftp as static content

spacewalk-java:

• Security fixes included in this version update from 4.3.52-1 to 4.3.58-1:
  • CVE-2023-22644: Fix session information leak (bsc#1210107)
  • CVE-2023-22644: Do not output cobbler xmlrpc token in debug logs (bsc#1210162)
  • CVE-2023-22644: fix credentials and other secrets disclosure when debug log is enabled (bsc#1210154)
  • CVE-2023-22644: Don't output URL parameters for tiny urls (bsc#1210101)
  • CVE-2023-22644: Do not log SSL certificate / key file content (bsc#1210094)
  • CVE-2023-22644: Remove web session swap secrets output in logs (bsc#1210086)
• Non-security bug fixes included in this version update from 4.3.52-1 to 4.3.58-1:
  • Version 4.3.58-1
    • Make sure that all hibernate connections are closed (bsc#1208687)
  • Version 4.3.57-1
    • Update version of tomcat build dependencies
  • Version 4.3.55-1
    • Fix breadcrumbs on recurring actions pages
  • Version 4.3.54-1
    • Kernel options: only add quotes if there is a space in the value (bsc#1209926)
  • Version 4.3.53-1
    • Update Cobbler profile when a new image is deployed
    • Add mapping of image URLs for containerized proxy
    • Remove channels from client after transfer to a different organization (bsc#1209220)
    • Fix RHEL9 / SLL9 product discovery (bsc#1209993)
    • Fix displaying system channels when no base product is installed (bsc#1206423)
    • Fix NPE in cobbler system sync when server has no creator set
    • Recurring custom states
    • Removed the expensive 'diff' column (bsc#1208427)
    • Fix possible 'NullPointerException' when clicking on the 'Create PXE installation configuration' button from Provising page
    • Fix possible 'NullPointerException' issues when running cobbler-sync-bunch
    • Do not trigger extra cobbler sync when changing kickstart data (bsc#1208536)
    • Set…

This update fixes the following issues:

release-notes-susemanager:

• Update to SUSE Manager 4.3.6

  • Salt has been upgraded to 3006.0

  • SUSE Linux Enterprise Server 15 SP5 Family support has been added

  • SUSE Linux Enterprise Server Micro 5.4 support has been added

  • openSUSE Leap 15.5 support has been added

  • Ability to install PTFs from SUSE Manager has been added

  • Scheduling Custom States on recurrent basis is now possible

  • Syncing optional channels from the webUI is now possible

  • All Tomcat logs are now rotated with logrotate

  • Grafana upgraded to 9.5.1

  • Node exporter upgraded to 1.5.0

  • Prometheus upgraded to 2.37.6

  • Postgres exporter upgraded to 0.10.1

  • CVEs fixed CVE-2023-22644, CVE-2022-46146

  • Bugs mentioned

    bsc#1201063, bsc#1203599, bsc#1204089, bsc#1204270, bsc#1204900 bsc#1205600, bsc#1206060, bsc#1206191, bsc#1206423, bsc#1206725 bsc#1206783, bsc#1207063, bsc#1207595, bsc#1207814, bsc#1207829 bsc#1207830, bsc#1208288, bsc#1208321, bsc#1208427, bsc#1208522 bsc#1208536, bsc#1208540, bsc#1208550, bsc#1208586, bsc#1208661 bsc#1208687, bsc#1208719, bsc#1208772, bsc#1209143, bsc#1209149 bsc#1209215, bsc#1209220, bsc#1209231, bsc#1209253, bsc#1209277 bsc#1209386, bsc#1209395, bsc#1209508, bsc#1209557, bsc#1209926 bsc#1209938, bsc#1209993, bsc#1210086, bsc#1210094, bsc#1210101 bsc#1210107, bsc#1210154, bsc#1210162, bsc#1210349, bsc#1210437 bsc#1210458, bsc#1210835, bsc#1211958, bsc#1210776, bsc#1209434 bsc#1208046, bsc#1212363, bsc#1212096, bsc#1212516

This update fixes the following issues:

branch-network-formula:

• Update to version 0.1.1680167239.23f2fec
  • Remove unnecessary import of 'salt.ext.six'

cpu-mitigations-formula:

• Update to version 0.5.0:
  • Mark all SUSE Linux Enterprise 15 SP4 and newer and openSUSE 15.4 and newer as supported (bsc#1210835)

hub-xmlrpc-api:

• Do not strictly require Go 1.18 on SUSE Linux Enterprise 15 SP3 (bsc#1203599)

inter-server-sync:

• Version 0.2.8
  • Correctly detect product name and product version number
  • Import image channel data only when related software channel is available (bsc#1211330)

perl-Satcon:

• Version 4.2.3-1
  • Accept keys with dots

spacecmd:

• Version 4.2.23-1
  • Fix argument parsing of distribution_update (bsc#1210458)

spacewalk-backend:

• Version 4.2.28-1
  • Filter CLM modular packages using release strings (bsc#1207814)
  • Add package details to reposync error logging

spacewalk-certs-tools:

• Version 4.2.20-1
  • Update translations

spacewalk-java:

• Security fixes in version 4.2.50-1:
  • CVE-2023-22644: Remove web session swap secrets output in logs (bsc#1210086)
  • CVE-2023-22644: Do not output URL parameters for tiny urls (bsc#1210101)
  • CVE-2023-22644: Fix session information leak (bsc#1210107)
  • CVE-2023-22644: Do not output Cobbler xmlrpc token in debug logs (bsc#1210162)
  • CVE-2023-22644: Fix credentials and other secrets disclosure when debug log is enabled (bsc#1210154)
  • CVE-2023-22644: Prevent logging formula data (bsc#1209386, bsc#1209434)
• Other non-security issues fixed in version 4.2.50-1:
  • Fix misleading error message regarding SCC credentials removal (bsc#1207941)
  • Fix issue with aclChannelTypeCapable that prevented errata view in deb arch
  • Refresh pillars after setting custom values via SSM (bsc#1210659)
  • Report SSM power management errors in 'rhn_web_ui' (bsc#1210406)
  • Filter CLM modular packages using release strings (bsc#1207814)
  • Allow processing big state results (bsc#1210957)
  • Use glassfish-activation-api instead of gnu-jaf
  • Fix Intenal Server Error when URI contains invalid sysid (bsc#1186011)
  • kernel options: only add quotes if there is a space in the value (bsc#1209926)
  • Fix link to Knowledge Base articles (bsc#1210311)
  • Remove channels from client after transfer to a different organization (bsc#1209220)
  • Fix displaying system channels when no base product is installed (bsc#1206423)
  • Fix broken ifcfg grub option on reinstallation (bsc#1210232)
  • Fix NPE in Cobbler system sync when server has no creator set
  • Add listSystemEvents missing API endpoint (bsc#1209877)

spacewalk-setup:

• Version 4.2.12-1
  • Enable netapi clients in master configuration (required for Salt 3006)

spacewalk-utils:

• Version 4.2.19-1
  • spacewalk-hostname-rename remains stuck at refreshing pillars (bsc#1207550)

spacewalk-web:

• Version 4.2.35-1
  • Show loading indicator on formula details pages (bsc#1179747)
  • Increase datetimepicker font sizes (bsc#1210437)
  • Fix an issue where the datetimepicker shows wrong date (bsc#1209231)

supportutils-plugin-susemanager:

• Version 4.2.7-1
  • Fix property name to tune for salt events queue processing

susemanager:

• version 4.3.27-1
  • Use newest venv-salt-minion version available to generate the venv-enabled-*.txt file in bootstrap repos (bsc#1211958)
• Version 4.2.41-1
  • Add bootstrap repository definitions for openSUSE Leap 15.5
  • Add bootstrap repository definitions for SUSE Linux Enterprise Server 15 SP5

susemanager-build-keys:

• Version 15.3.9
  • add SUSE Liberty v2 key (bsc#1212096)
  • add Debian 12 (bookworm) GPG keys (bsc#1212363)
  • add new 4096 bit RSA SUSE Package Hub key
• Version 15.3.8
  • Fix installation of SUSE Linux Enterprise 15 RSA reserve build key
  • Add new 4096 bit RSA openSUSE build key gpg-pubkey-29b700a4.asc

susemanager-sls:

• Version 4.2.34-1
  • Trust new Liberty Linux v2 key (bsc#1212096)

susemanager-doc-indexes:

• Salt version…

This update fixes the following issues:

release-notes-susemanager:

• Update to 4.2.13
  • Salt has been upgraded to 3006.0
  • SUSE Linux Enterprise Server 15 SP5 Family support has been added
  • openSUSE Leap 15.5 support has been added
  • Automatic migration from Salt 3000 to Salt bundle
  • Grafana upgraded to 9.5.1
  • Node exporter upgraded to 1.5.0
  • Prometheus upgraded to 2.37.6
  • Postgres exporter upgraded to 0.10.1
  • CVEs fixed: CVE-2023-22644, CVE-2022-46146
  • Bugs mentioned: bsc#1179747, bsc#1186011, bsc#1203599, bsc#1205600, bsc#1206423 bsc#1207550, bsc#1207814, bsc#1207941, bsc#1208984, bsc#1209220 bsc#1209231, bsc#1209277, bsc#1209386, bsc#1209434, bsc#1209508 bsc#1209877, bsc#1209915, bsc#1209926, bsc#1210011, bsc#1210086 bsc#1210101, bsc#1210107, bsc#1210154, bsc#1210162, bsc#1210232 bsc#1210311, bsc#1210406, bsc#1210437, bsc#1210458, bsc#1210659 bsc#1210835, bsc#1210957, bsc#1211330, bsc#1208046, bsc#1212517 bsc#1212096

This update fixes the following issues:

release-notes-susemanager:

• Update to SUSE Manager 4.3.10
  • SUSE Linux Enterprise Server Micro 5.5 support
  • CLM filter by package build date
  • Enhanced Errata.getDetails API endpoint
  • CVEs fixed: CVE-2023-22644
  • Bugs mentioned: bsc#1191143, bsc#1204235, bsc#1207012, bsc#1207532, bsc#1210928, bsc#1210930, bsc#1211355, bsc#1211560, bsc#1211649, bsc#1212695, bsc#1212904, bsc#1213469, bsc#1214186, bsc#1214471, bsc#1214601, bsc#1214759, bsc#1215209, bsc#1215514, bsc#1215949, bsc#1216030, bsc#1216041, bsc#1216085, bsc#1216128, bsc#1216380, bsc#1216506, bsc#1216555, bsc#1216690, bsc#1216754, bsc#1217038, bsc#1217223, bsc#1217224

This update for govulncheck-vulndb fixes the following issues:

Update to version 0.0.20241030T212825 2024-10-30T21:28:25Z ( jsc#PED-11136 )

• Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3230 CVE-2024-48921 GHSA-qjvc-p88j-j9rm
  • GO-2024-3232 CVE-2024-10241 GHSA-6mvp-gh77-7vwh

• Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3226 CVE-2024-47827 GHSA-ghjw-32xw-ffwr
  • GO-2024-3227 CVE-2024-10214 GHSA-hm57-h27x-599c
  • GO-2024-3228 GHSA-wcx9-ccpj-hx3c

• Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3207 GHSA-p5wf-cmr4-xrwr
  • GO-2024-3208 CVE-2024-47825 GHSA-3wwx-63fv-pfq6
  • GO-2024-3210 CVE-2024-8901
  • GO-2024-3211 CVE-2024-50312
  • GO-2024-3212 GHSA-rjfv-pjvx-mjgv
  • GO-2024-3213 CVE-2024-49380
  • GO-2024-3214 CVE-2024-49381
  • GO-2024-3215 CVE-2024-9264 GHSA-q99m-qcv4-fpm7
  • GO-2024-3216 CVE-2024-49753 GHSA-6cf5-w9h3-4rqv
  • GO-2024-3217 CVE-2024-49757 GHSA-3rmw-76m6-4gjc
  • GO-2024-3219 GHSA-7h65-4p22-39j6
  • GO-2024-3220 CVE-2023-32197 GHSA-7h8m-pvw3-5gh4
  • GO-2024-3221 CVE-2024-22036 GHSA-h99m-6755-rgwc
  • GO-2024-3222 GHSA-x7xj-jvwp-97rv
  • GO-2024-3223 CVE-2022-45157 GHSA-xj7w-r753-vj8v
  • GO-2024-3224 CVE-2024-39223 GHSA-8wxx-35qc-vp6r

• Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8
  • GO-2024-3203 CVE-2024-9486
  • GO-2024-3204 CVE-2024-9594

• Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8
  • GO-2024-3196 CVE-2024-47877 GHSA-8rm2-93mq-jqhc
  • GO-2024-3199 GHSA-vv6c-69r6-chg9
  • GO-2024-3200 CVE-2024-48909 GHSA-3c32-4hq9-6wgj
  • GO-2024-3201 CVE-2023-22644

• Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j
  • GO-2024-3171 CVE-2024-9341 GHSA-mc76-5925-c5p6

• Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3161 CVE-2024-22030 GHSA-h4h5-9833-v2p4
  • GO-2024-3162 CVE-2024-7594 GHSA-jg74-mwgw-v6x3
  • GO-2024-3163 CVE-2024-47182
  • GO-2024-3164 CVE-2024-47003 GHSA-59hf-mpf8-pqjh
  • GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j
  • GO-2024-3167 CVE-2024-9355 GHSA-3h3x-2hwv-hr52
  • GO-2024-3168 CVE-2024-8975 GHSA-chqx-36rm-rf8h
  • GO-2024-3169 CVE-2024-9407 GHSA-fhqq-8f65-5xfc
  • GO-2024-3170 CVE-2024-8996 GHSA-m5gv-m5f9-wgv4
  • GO-2024-3172 CVE-2024-33662 GHSA-9mjw-79r6-c9m8
  • GO-2024-3173 CVE-2024-7558 GHSA-mh98-763h-m9v4
  • GO-2024-3174 CVE-2024-8037 GHSA-8v4w-f4r9-7h6x
  • GO-2024-3175 CVE-2024-8038 GHSA-xwgj-vpm9-q2rq
  • GO-2024-3179 CVE-2024-47616 GHSA-r7rh-jww5-5fjr
  • GO-2024-3181 CVE-2024-9313 GHSA-x5q3-c8rm-w787
  • GO-2024-3182 GHSA-wpr2-j6gr-pjw9
  • GO-2024-3184 CVE-2024-36814 GHSA-9cp9-8gw2-8v7m
  • GO-2024-3185 CVE-2024-47832
  • GO-2024-3186 CVE-2024-9675 GHSA-586p-749j-fhwp
  • GO-2024-3188 CVE-2024-9312 GHSA-4gfw-wf7c-w6g2
  • GO-2024-3190 CVE-2024-47067 GHSA-8pph-gfhp-w226
  • GO-2024-3191 CVE-2024-9180 GHSA-rr8j-7w34-xp5j