CVE-2023-32189

Insecure handling of ssh keys used to bootstrap clients allows local attackers to potentially gain access to the keys

Insecure handling of ssh keys used to bootstrap clients allows local attackers to potentially gain access to the keys

Insecure handling of ssh keys used to bootstrap clients allows local attackers to potentially gain access to the keys

Insecure handling of ssh keys used to bootstrap clients allows local attackers to potentially gain access to the keys

This update fixes the following issues:

cobbler:

• Build the appendline correctly for RHEL-family <= 9 (bsc#1216437)
• Notify to 'systemd' when cobblerd startup is finished (bsc#1215982)
• Enable ppc64(le) buildiso support (bsc#1214077)

grafana-formula:

• Version 0.10.0
  • Replace legacy message queue metrics with Salt queue metrics
  • Grafana formula should not be supported in a Proxy/Retail

inter-server-sync:

• Version 0.3.2-1
  • Fix conflict in rhndistchannelmap (bsc#1216114)

jose4j:

• CVE-2023-31582: Insecure Password-Based Encryption Iteration Count (bsc#1216609)

liberate-formula:

• Version 0.1.0
  • Provide liberate-formula, a formula for converting a system to SUSE Liberty Linux

patterns-suse-manager:

• Add liberate-formula to the required packages for the server to get it installed by default

prometheus-formula:

• Version 0.8.0
  • Fix federation endpoint
  • Add remote write configuration
  • Add group filtering for service discovery relabeling configuration
• Version 0.7.1
  • Fix PrometheusNotIngestingSamples false positive alerts (bsc#1216550)

prometheus-postgres_exporter:

• Do not build debug if RHEL >= 8
• Do not strip if SUSE Linux Enterprise 15 SP3
• Build at least with with Go >= 1.18 on RHEL
• Build with Go >= 1.20 elsewhere

saltboot-formula:

• Update to version 0.1.1701196218.b6b8ca1
  • Remove f-formating to be compatible with python < 3.6
  • Update packaging not to package salt directories
• Update to version 0.1.1692188980.9aa0455

spacecmd:

• Version 4.3.26-1
  • Update translation strings

spacewalk-backend:

• Version 4.3.27-1
  • Fix issue in 'spacewalk-repo-sync' when RPM packages contains files with size greater than 4GB (bsc#1219151)
• Version 4.3.26-1
  • Fix decompressing and renaming bzip2 comps files in reposync
  • Update query to the new credentials structure
  • Remove normalize_orphan_vendor_packages and move it to taskomatic (bsc#1216781)
  • Skip syncing packages with incorrect metadata (bsc#1213738)
  • Update translation strings

spacewalk-certs-tools:

• version 4.3.22-1
  • Skip deploying the CA into the Salt directory on proxies (bsc#1219850)
• Version 4.3.21-1
  • Deploy the CA certificate also into the Salt filesystem (bsc#1219577)
• Version 4.3.20-1
  • Handle server keys in PKCS8 format in mgr-ssl-cert-setup (bsc#1218615)
  • Include reboot info beacon in the bootstrap script for transactional systems (bsc#1217588)

spacewalk-client-tools:

• Version 4.3.18-1
  • Update translation strings

spacewalk-java:

• Version 4.3.71-1
  • Generate server SSH key also when bootstrapping regular Minions (bsc#1219449)
• Version 4.3.70-1
  • Fix the use of page size preference in systems and packages lists (bsc#1217209)
  • Fix issue with disabling token check not working (bsc#1218669)
  • Enforce snakeyaml version requirement (bsc#1215166)
  • Improve the performance of paginated queries when syncing the reporting database (bsc#1211912, bsc#1213079)
  • Do not require entitlement for Pay-as-you-go SUSE Linux Enterprise Server for SAP (bsc#1217069)
  • Use the base product file to show the correct SUSE Manager product in the subscription matching results page
  • Do not require entitlements if SUSE Manager is Pay-as-you-go
  • Exclude SUSE Manager from subscription matching if it's Pay-as-you-go
  • Refactor Credentials to a proper class hierarchy
  • Fix unit test about duplicated packages
  • Prevent installation of packages with same name in a single action (bsc#1214791)
  • When canceling an action which has prerequisites, return hints to get the first action id which can be canceled (bsc#1216988)
  • Fix exception when removing a Debian package (bsc#1216781)
  • Fix XSS in taskomatic XML RPC handler (bsc#1210911)
  • Improve logging for Product Migration (bsc#1218490)
  • Add only 1 IP for Cloud RMT Host in /etc/hosts
  • Change org for orphan vendor packages that an admin can delete (bsc#1216781)
  • Expose the monitoring data for…

This update fixes the following issues:

release-notes-susemanager:

• Update to SUSE Manager 4.3.11
  • Migrate from RHEL and its clones to SUSE Liberty Linux
  • Reboot required indication for non-SUSE distributions
  • SSH key rotation for enhanced security
  • Configure remote command execution
  • End of Debian 10 support
  • CVEs fixed: CVE-2023-32189, CVE-2024-22231, CVE-2024-22232
  • Bugs mentioned:
    bsc#1170848, bsc#1210911, bsc#1211254, bsc#1211560, bsc#1211912 bsc#1213079, bsc#1213507, bsc#1213738, bsc#1213981, bsc#1214077 bsc#1214791, bsc#1215166, bsc#1215514, bsc#1215769, bsc#1215810 bsc#1215813, bsc#1215982, bsc#1216114, bsc#1216394, bsc#1216437 bsc#1216550, bsc#1216657, bsc#1216753, bsc#1216781, bsc#1216988 bsc#1217069, bsc#1217209, bsc#1217588, bsc#1217784, bsc#1217869 bsc#1218019, bsc#1218074, bsc#1218075, bsc#1218089, bsc#1218094 bsc#1218490, bsc#1218615, bsc#1218669, bsc#1218849, bsc#1219577 bsc#1219850, bsc#1218146