CVE-2024-29371

In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.

Root has patched CVE-2024-29371 in the org.bitbucket.b_c:jose4j package for Root:Maven. Multiple fixed versions available.

In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.

TuxCare rebuilt org.bitbucket.b_c:jose4j to address 3 CVEs. Fixed in 0.8.0-tuxcare.1.

TuxCare rebuilt org.bitbucket.b_c:jose4j to address 2 CVEs. Fixed in 0.7.9-tuxcare.1.

This update fixes the following issues:

branch-network-formula:

• Update to version 1.1.0
  • Enable containers on SLE15SP7
  • Exclude podman interfaces from sysctl setting

cobbler:

• Compatibility fixes for tftpboot directory setup

inter-server-sync:

• Version 0.3.10-0
  • Write log to a rotated file without rsyslog and logrotate
  • Recreate cobbler entries on the import (bsc#1220899)
  • remove support for 4.2 file based pillars
  • use correct hostname detection for 5.x servers (bsc#1253322)

jose4j:

• CVE-2024-29371: Safeguard against excessive resource utilization by restricting the size of data during JWE payload decompression (bsc#1255298)

liberate-formula:

• Version 0.1.2
  • Add option to prevent logo packages from being installed

spacecmd:

• Version 5.0.15-0
  • Fix typo in spacecmd help ca-cert flag (bsc#1253174)
  • Convert cached IDs to int (bsc#1251995)
  • Fix spacecmd binary file upload (bsc#1253659)

spacewalk-backend:

• Version 5.0.17-0
  • Fix reposync mediaproduct fetch when URL contains auth token (bsc#1252388)

spacewalk-certs-tools:

• Version 5.0.13-0
  • Fix bootstrap script for SLM 6.2 (bsc#1257992)
  • Fix failing bootstrap with bootstrap script on SLES 16 and SL Micro 6.2 (bsc#1256991)

spacewalk-client-tools:

• Version 5.0.12-0
  • Update translation strings

spacewalk-config:

• Version 5.0.9-0
  • Enable HSTS in Apache config (bsc#1255176)
  • Force SameSite=Lax on all Set-Cookie headers (bsc#1253711)

spacewalk-java:

• Version 5.0.31-0
  • Commit DB changes before refreshing pillar for SSH push minions (bsc#1253712)
  • Fix http proxy verification (bsc#1253501)
  • Fix: Broken URL in API docs (bsc#1244177)
  • Fix crash in ubuntu errata sync on deleted channel ids (bsc#1250561)
  • Fix dnf updateinfo showing wrong severity for security updates (bsc#1252937)
  • Add details on config channels and state order in UI (bsc#1253285)
  • fix reposync crashing at metadata generation (bsc#1257538)
  • Block multiple versions of the same package from being locked (bsc#1246315)
  • Use PackageEvr instead of string for fix_version (bsc#1252638)
  • Add multi-thread support for message queue (bsc#1247722)
  • Fix ungrouped systems list menu item (bsc#1254251)

spacewalk-proxy:

• Version 5.0.8-0
  • Disable listing the content of /icons (bsc#1247544)

spacewalk-proxy-installer:

• Version 5.0.3-0
  • Configure squid replacement policy properly before cache dir (bsc#1253773)

spacewalk-web:

• Version 5.0.26-0
  • Update web UI dependencies
  • Add details on config channels and state order in UI (bsc#1253285)

susemanager:

• Version 5.0.17-0
  • Fix the product ids of client tools channels
  • Fixed the package name to correct one (bsc#1255089)

susemanager-build-keys:

• Add openSUSE Backports for SUSE Linux 16 key (bsc#1257255)

susemanager-docs_en:

• Updated the screenshots in multiple sections in Installation and Upgrade Guide
• Reformatted storage-scripts table to use plain paragraphs instead of bullet lists to fix po4a extraction issue causing missing bullets in CJK translations
• Added a warning for all instances where mgradm upgrade podman is used
• Added section about container-based Kiwi image build support to Administration guide (bsc#1251865)
• Included global GPG decryption for pillar data in specialized guide (bsc#1255743)
• CIS removed from list of supported OpenSCAP profiles
• Changes example for the third-party repository GPG keys (bsc#1255857)
• Added SLE16 and openSUSE Leap 16 as supported clients
• Explained how to generate the proxy certificates on a peripheral server (bsc#1249425)
• Improved procedure formatting for better clarity in Administration Guide (bsc#1253660)
• Added links to man pages for createrepo_c and reprepro to Administration Guide (bsc#1237181)
• Added missing options to command example in Installation and Upgrade Guide (bsc#1252908)
• Added non-SUSE URLs to requirements in installation and…

Maintenance update for Multi-Linux Manager 4.3 Release Notes Release Notes:

This is a codestream only update