CVE-2023-51775

The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.

The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.

TuxCare rebuilt org.bitbucket.b_c:jose4j to address 3 CVEs. Fixed in 0.8.0-tuxcare.1.

Root has patched CVE-2023-51775 in the io.root.org.bitbucket.b_c:jose4j package for Root:Maven. Multiple fixed versions available.

This update fixes the following issues:

cobbler:

• Provide option to use pre-built GRUB bootloader
• Prevent parallel executions of cobbler sync actions (bsc#1218764)

image-sync-formula:

• Update to version 0.1.1711646883.4a44375
  • Add missing URL tag
  • Update license to SPDX syntax

inter-server-sync:

• Version 0.3.3-1
  • Correct primary key export for table suseproductsccrepository (bsc#1220169)

jose4j:

• CVE-2023-51775: Fix denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value (bsc#1220726)

smdba:

• Version 1.7.13
  • postmaster no longer exists from >=16 and it's an alias for postgresql, using postgresql command

spacecmd:

• Version 4.3.27-0
  • Update translation strings

spacewalk-backend:

• Version 4.3.28-0
  • Strip whitespace from .deb package metadata (bsc#1214387)
  • Fix inserting NULL into some columns during ISSv1 sync (bsc#1220980)
  • Add support for package signature type V4 RSA/SHA512 (bsc#1221465)
  • Unquote HTML-encoded credentials before synchronizing repositories (bsc#1217204)

spacewalk-certs-tools:

• Version 4.3.23-0
  • Fix liberty bootstrapping when zypper is installed (bsc#1222347)
  • Apply reboot method changes for transactional systems in the bootstrap script

spacewalk-client-tools:

• Version 4.3.19-0
  • Update translation strings

spacewalk-config:

• Version 4.3.13-0
  • Be explicit about default Apache configs being overwritten on updates and point to making custom configs. (bsc#1219061)

spacewalk-java:

• Version 4.3.73-0
  • New API endpoint for getRelevantErrata. It takes multiple servers as argument and it returns an array of maps representing the errata that can be applied to each system
• Version 4.3.72-0
  • Use execution module call to detect client instance flavor (PAYG/BYOS) in public cloud (bsc#1218805)
  • Update help text for the custom repo filter field (bsc#1217874)
  • Fix issue where Salt cannot access autoinstallation files (bsc#1220221)
  • Fix issue when checking for credential duplication (bsc#1218957)
  • Fix matching epoch while creating Ubuntu erratas
  • When an action that belongs to an action chain is unscheduled, unschedule the action chain as well (bsc#1221784)
  • Reschedule failed SSH actions caused by a connection error due to a scheduled reboot
  • Fix removal of old IPv6 addresses (bsc#1214340)
  • Do not automatically add child channels outside of selected base channel (bsc#1220101)
  • Fix listProxies API call (bsc#1219233)
  • Fix system.provisionSystem when called via HTTP API (bsc#1219875)
  • Remove package sync not available message in Software > Packages > Profile since it is no longer available for supported clients (bsc#1221279)
  • Fix login for read-only users when using HTTP API (bsc#1221111)
  • Add one-shot action execution to recurring custom state create/edit
  • Fix a typo in 'Deploy Files' page
  • Drop system password as identifier on SCC system registration (bsc#1219634, bsc#1221182)
  • Fix memory size extraction in virtual instances (bsc#1219634)
  • Fix virtual systems filters (bsc#1208572)
  • Update license to include the year 2024
  • Add timeout for SMTP server connection (bsc#1218931)
  • Commit Salt event removal in case of process failure (bsc#1218931)
  • Users with API read only are only allowed to make GET requests
  • Ignore retry suffix when getting recurring action id from schedule name
  • Sort CLM project filters by filter name

spacewalk-web:

• Version 4.3.38-0
  • Upgrade json5 to 2.2.3
  • Upgrade semver to 7.6.0
  • Add one-shot action execution to recurring custom state create/edit
  • Fix virtual systems filters (bsc#1208572)
  • Improve CLM Create New Filter button
  • Bump the WebUI version to 4.3.12

subscription-matcher:

• Version 0.37
  • add missing part number (bsc#1221922)
  • Fix penalties logging by initializing the score director consistently
• Removed wrong apache-commons-lang dependency…

This update fixes the following issues:

release-notes-susemanager:

• Update to SUSE Manager 4.3.12
  • Monitoring: Node exporter upgraded to 1.7.0
  • Automatic migration from Salt 3000 to the Salt Bundle
  • New update-salt recurring state
  • uyuni-proxy-systemd-services package has been added to proxy channel
  • New Errata getRelevantErrata API endpoint
  • CVEs fixed: 2023-51775
  • Bugs mentioned:
    bsc#1170848, bsc#1208572, bsc#1214340, bsc#1214387, bsc#1216085 bsc#1217204, bsc#1217874, bsc#1218764, bsc#1218805, bsc#1218931 bsc#1218957, bsc#1219061, bsc#1219233, bsc#1219634, bsc#1219875 bsc#1220101, bsc#1220169, bsc#1220194, bsc#1220221, bsc#1220376 bsc#1220705, bsc#1220726, bsc#1220903, bsc#1220980, bsc#1221111 bsc#1221182, bsc#1221279, bsc#1221465, bsc#1221571, bsc#1221784 bsc#1221922, bsc#1222110, bsc#1222347