CVE-2023-31582

jose4j before v0.9.3 allows attackers to set a low PBES2 iteration count of 1000 or less.

jose4j before v0.9.3 allows attackers to set a low iteration count of 1000 or less.

TuxCare rebuilt org.bitbucket.b_c:jose4j to address 3 CVEs. Fixed in 0.8.0-tuxcare.1.

TuxCare rebuilt org.bitbucket.b_c:jose4j to address 2 CVEs. Fixed in 0.7.9-tuxcare.1.

This update fixes the following issues:

cobbler:

• Build the appendline correctly for RHEL-family <= 9 (bsc#1216437)
• Notify to 'systemd' when cobblerd startup is finished (bsc#1215982)
• Enable ppc64(le) buildiso support (bsc#1214077)

grafana-formula:

• Version 0.10.0
  • Replace legacy message queue metrics with Salt queue metrics
  • Grafana formula should not be supported in a Proxy/Retail

inter-server-sync:

• Version 0.3.2-1
  • Fix conflict in rhndistchannelmap (bsc#1216114)

jose4j:

• CVE-2023-31582: Insecure Password-Based Encryption Iteration Count (bsc#1216609)

liberate-formula:

• Version 0.1.0
  • Provide liberate-formula, a formula for converting a system to SUSE Liberty Linux

patterns-suse-manager:

• Add liberate-formula to the required packages for the server to get it installed by default

prometheus-formula:

• Version 0.8.0
  • Fix federation endpoint
  • Add remote write configuration
  • Add group filtering for service discovery relabeling configuration
• Version 0.7.1
  • Fix PrometheusNotIngestingSamples false positive alerts (bsc#1216550)

prometheus-postgres_exporter:

• Do not build debug if RHEL >= 8
• Do not strip if SUSE Linux Enterprise 15 SP3
• Build at least with with Go >= 1.18 on RHEL
• Build with Go >= 1.20 elsewhere

saltboot-formula:

• Update to version 0.1.1701196218.b6b8ca1
  • Remove f-formating to be compatible with python < 3.6
  • Update packaging not to package salt directories
• Update to version 0.1.1692188980.9aa0455

spacecmd:

• Version 4.3.26-1
  • Update translation strings

spacewalk-backend:

• Version 4.3.27-1
  • Fix issue in 'spacewalk-repo-sync' when RPM packages contains files with size greater than 4GB (bsc#1219151)
• Version 4.3.26-1
  • Fix decompressing and renaming bzip2 comps files in reposync
  • Update query to the new credentials structure
  • Remove normalize_orphan_vendor_packages and move it to taskomatic (bsc#1216781)
  • Skip syncing packages with incorrect metadata (bsc#1213738)
  • Update translation strings

spacewalk-certs-tools:

• version 4.3.22-1
  • Skip deploying the CA into the Salt directory on proxies (bsc#1219850)
• Version 4.3.21-1
  • Deploy the CA certificate also into the Salt filesystem (bsc#1219577)
• Version 4.3.20-1
  • Handle server keys in PKCS8 format in mgr-ssl-cert-setup (bsc#1218615)
  • Include reboot info beacon in the bootstrap script for transactional systems (bsc#1217588)

spacewalk-client-tools:

• Version 4.3.18-1
  • Update translation strings

spacewalk-java:

• Version 4.3.71-1
  • Generate server SSH key also when bootstrapping regular Minions (bsc#1219449)
• Version 4.3.70-1
  • Fix the use of page size preference in systems and packages lists (bsc#1217209)
  • Fix issue with disabling token check not working (bsc#1218669)
  • Enforce snakeyaml version requirement (bsc#1215166)
  • Improve the performance of paginated queries when syncing the reporting database (bsc#1211912, bsc#1213079)
  • Do not require entitlement for Pay-as-you-go SUSE Linux Enterprise Server for SAP (bsc#1217069)
  • Use the base product file to show the correct SUSE Manager product in the subscription matching results page
  • Do not require entitlements if SUSE Manager is Pay-as-you-go
  • Exclude SUSE Manager from subscription matching if it's Pay-as-you-go
  • Refactor Credentials to a proper class hierarchy
  • Fix unit test about duplicated packages
  • Prevent installation of packages with same name in a single action (bsc#1214791)
  • When canceling an action which has prerequisites, return hints to get the first action id which can be canceled (bsc#1216988)
  • Fix exception when removing a Debian package (bsc#1216781)
  • Fix XSS in taskomatic XML RPC handler (bsc#1210911)
  • Improve logging for Product Migration (bsc#1218490)
  • Add only 1 IP for Cloud RMT Host in /etc/hosts
  • Change org for orphan vendor packages that an admin can delete (bsc#1216781)
  • Expose the monitoring data for…