CVE-2024-49502

A Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in the Setup Wizard, HTTP Proxy credentials pane in spacewalk-web allows attackers to attack users by providing specially crafted URLs to click. This issue affects Container suse/manager/5.0/x86_64/server:5.0.2.7.8.1: before 5.0.15-150600.3.10.2; SUSE Manager Server Module 4.3: before 4.3.42-150400.3.52.1.

A Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in the Setup Wizard, HTTP Proxy credentials pane in spacewalk-web allows attackers to attack users by providing specially crafted URLs to click. This issue affects Container suse/manager/5.0/x86_64/server:5.0.2.7.8.1: before 5.0.15-150600.3.10.2; SUSE Manager Server Module 4.3: before 4.3.42-150400.3.52.1.

A Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in the Setup Wizard, HTTP Proxy credentials pane in spacewalk-web allows attackers to attack users by providing specially crafted URLs to click. This issue affects Container suse/manager/5.0/x86_64/server:5.0.2.7.8.1: before 5.0.15-150600.3.10.2; SUSE Manager Server Module 4.3: before 4.3.42-150400.3.52.1.

A Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in the Setup Wizard, HTTP Proxy credentials pane in spacewalk-web allows attackers to attack users by providing specially crafted URLs to click. This issue affects Container suse/manager/5.0/x86_64/server:5.0.2.7.8.1: before 5.0.15-150600.3.10.2; SUSE Manager Server Module 4.3: before 4.3.42-150400.3.52.1.

This update fixes the following issues:

cobbler:

• Security issues fixed:

  • CVE-2024-47533: Prevent privilege escalation from none to admin (bsc#1231332)

• Other bugs fixed:

  • Increase start timeout for cobblerd unit (bsc#1219450)
  • Provide sync_single_system for DHCP modules to improve performance (bsc#1219450)
  • Add input_string_*, input_boolean, input_int functions to public API
  • Add new setting for Uyuni authentication endpoint (bsc#1219887)

grafana-formula:

• Version 0.11.0
  • Add SLES 15 SP6 to supported versions (bsc#1228286)

inter-server-sync:

• Version 0.3.5-0
  • Decode boolean values for export (bsc#1228545)

saltboot-formula:

• Update to version 0.1.1723628891.ffb1da5
  • Rework request stop function to avoid unnecessary warnings (bsc#1212985)

spacecmd:

• Version 4.3.29-0
  • Speed up softwarechannel_removepackages (bsc#1227606)

spacewalk-backend:

• Version 4.3.30-0
  • Make ISSv1 timezone independent (bsc#1221505)
  • reposync: introduce timeout when syncing DEB channels (bsc#1225960)
  • yum_src: use proper name variable name for subprocess.TimeoutExpired
  • Check and populate PTF attributes at the time of importing packages (bsc#1225619)
  • reposync: import GPG keys to RPM DB individually (bsc#1217003)
  • Add log string to the journal when services are stopped because of insufficient disk space

spacewalk-certs-tools:

• Version 4.3.26-0
  • Fix private key format in jabberd certificate file (bsc#1228851)
  • Fix parsing Authority Key Identifier when keyid is not prefixed (bsc#1229079)
  • Support multiple certificates for root-ca-file and server-cert-file

spacewalk-client-tools:

• Version 4.3.21-0
  • Update translation strings

spacewalk-config:

• Version 4.3.14-0
  • Trust the Content-Length header from AJP (bsc#1226439)

spacewalk-java:

• Version 4.3.82-0
  • Limit frontend-log message size (bsc#1231900)
• Version 4.3.81-0
  • Add detection of Ubuntu 24.04
• Version 4.3.80-0
  • Use custom select instead of errata view for better performance (bsc#1225619)
• Version 4.3.79-0
  • Add info URL for cobbler to clean the system profile (bsc#1219645)
  • Require correct scap packages for Ubuntu
  • Require correct scap packages for Debian 12 (bsc#1227746)
  • Fix finding system_checkin_threshold configuration value on Sytems Overview page (bsc#1224108)
  • Allow changing base channel to SUSE Liberty Linux LTSS when the system is on Liberty (bsc#1228326)
  • Implement product migration from RHEL and Clones to SUSE Liberty Linux
  • Remove system also from proxy SSH known_hosts (bsc#1228345)
  • Fix NullPointerException when generating subscription matcher input (bsc#1228638)
  • Allow free products and SUSE Manager Proxy being managed by SUSE Manager Server PAYG
  • Open bootstrap script directory URL in a new page (bsc#1225603)
  • Delay package list refresh when Salt was updated (bsc#1217978)
  • Add SLE Micro 5 to the list of systems which support monitoring (bsc#1227334)
  • Add all SLE Micro systems to the list of systems which get PTF repositories
  • Update last sync refresh timestamp only when at least one time products were synced before
  • Prevent NullPointerException when listing history events without completion time (bsc#1146701)
  • Autoinstallation: prevent issues with duplicate IP address due to some networks (bsc#1226461)
  • Improve SQL queries and performance to check for PTF packages (bsc#1225619)
  • Check the correct Salt package before product migration (bsc#1224209)
  • Fix the date format output when using the HTTP API to use ISO 8601 format (bsc#1227543)
  • Fix transactional update check for SL Micro (bsc#1227406)
  • Improve score comparison in system search to fix ISE (bsc#1228412)
  • Fix package profile update on CentOS 7 when yum-utils is not installed (bsc#1227133)

spacewalk-utils:

• Version 4.3.22-0
  • Add repositories for Ubuntu 24.04 LTS
• Version 4.3.21-0
  • Drop unsupported tool…

This update fixes the following issues:

release-notes-susemanager:

• Update to SUSE Manager 4.3.14
  • Ubuntu 24.04 support as client
  • Product migration from RHEL and Clones to SUSE Liberty Linux
  • POS image templates now produce compressed images
  • Date format for API endpoints has been changed to ISO-8601 format
  • Security issues fixed: CVE-2024-47533, CVE-2024-49502, CVE-2024-49503
  • Bugs mentioned: bsc#1146701, bsc#1211899, bsc#1212985, bsc#1217003, bsc#1217338 bsc#1217978, bsc#1218090, bsc#1219450, bsc#1219645, bsc#1219887 bsc#1221435, bsc#1221505, bsc#1223312, bsc#1223988, bsc#1224108 bsc#1224209, bsc#1225603, bsc#1225619, bsc#1225960, bsc#1226090 bsc#1226439, bsc#1226461, bsc#1226478, bsc#1226687, bsc#1226917 bsc#1227133, bsc#1227334, bsc#1227406, bsc#1227526, bsc#1227543 bsc#1227599, bsc#1227606, bsc#1227746, bsc#1228036, bsc#1228101 bsc#1228130, bsc#1228147, bsc#1228286, bsc#1228326, bsc#1228345 bsc#1228412, bsc#1228545, bsc#1228638, bsc#1228851, bsc#1228945 bsc#1229079, bsc#1229178, bsc#1229260, bsc#1229339, bsc#1231332 bsc#1231852, bsc#1231922, bsc#1231900