CVE-2019-10088

A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Users should upgrade to 1.22 or later.

A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Users should upgrade to 1.22 or later.

A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Users should upgrade to 1.22 or later.

A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Users should upgrade to 1.22 or later.

A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Users should upgrade to 1.22 or later.

A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Users should upgrade to 1.22 or later.

A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Users should upgrade to 1.22 or later.

This update fixes the following issues:

cobbler:

• Jinja2 template library fix (bsc#1141661)

pgjdbc-ng:

• Allow dots in database name (bsc#1146416)

py26-compat-salt:

• Get tornado dependency from the system on SLE12 (bsc#1149409)
• Catch SSLError for TLS 1.2 bootstraps with RES/RHEL6 and SLE11 (bsc#1147126)

spacecmd:

• Check that a channel doesn't have clones before deleting it (bsc#1138454)

spacewalk-backend:

• Remove credentials also from potential rhn.conf backup files in spacewalk-debug (bsc#1146419)
• Do not make 'rhn-satellite-exporter' to crash with 'AttributeError' (bsc#1146869)
• Spacewalk-remove-channel check that channel doesn't have cloned channels before deleting it (bsc#1138454)
• Prevent duplicate changelog entries due VARCHAR(3000) db text column (bsc#1144889)
• Avoid traceback on mgr-inter-sync when exception message contains UTF8 characters or there are problems with the package cache (bsc#1143016) registered guest (bsc#1093381)

spacewalk-branding:

• Add missing strings for task status page

spacewalk-client-tools:

• Invalidate cache 5 minutes before actual expiration(bsc#1143562)

spacewalk-java:

• Add UI message when salt-formulas system folders are unreachable (bsc#1142309)
• Don't convert localhost repositories URL in mirror case (bsc#1135957)
• Check that a channel doesn't have clones before deleting it (bsc#1138454)
• Improve websocket authentication to prevent errors in logs (bsc#1138454)
• Normalize date formats for actions, notifications and clm (bsc#1142774)
• Cloning Errata from a specific channel should not take packages from other channels (bsc#1142764)
• Add susemanager as prerequired for spacewalk-java
• Improve performance for retrieving the user permissions on channels (bsc#1140644)
• Prerequire salt package to avoid not existing user issues
• Support partly patched CVEs in CVE audit (bsc#1137229)

spacewalk-setup:

• Configure 150 Tomcat workers by default, matching httpds MaxClients

spacewalk-utils:

• Common-channels: Fix repo type assignment for type YUM
• Adds support for Ubuntu and Debian channels to spacewalk-common-channels.

spacewalk-web:

• Fix the 'include recommended' button on channels selection in SSM (bsc#1145086)
• Normalize date formats for actions, notifications and clm (bsc#1142774)
• Add unsupported browser warning when using Internet Explorer

susemanager:

• Dmidecode does not exist on s390x (bsc#1145119)

susemanager-docs_en:

• Add link to the creation of the bootstrap script (bsc#1146895).
• Improve adoc tagging.
• LimitNOFILE back-port.
• Fix command-line error (bsc#1096426).

susemanager-schema:

• Improve performance for retrieving the user permissions on channels (bsc#1140644)

susemanager-sls:

• Bootstrapping RES6/RHEL6/SLE11 with TLS1.2 now shows error message. (bsc#1147126)
• Dmidecode does not exist on ppc64le and s390x (bsc#1145119)
• Update susemanager.conf to use adler32 for computing the server_id for new minions

tika-core:

New upstream version 1.2.2. Fixes security issues:

• CVE-2019-10088: Fixed an OOM from a crafted Zip File in Apache Tika's RecursiveParserWrapper (bsc#1144500).
• CVE-2019-10093: Fixed a Denial of Service in Apache Tika's 2003ml and 2006ml Parsers (bsc#1144510).
• CVE-2019-10094: Fixed a stack overflow from crafted compressed files in Apache Tika's RecursiveParserWrapper (bsc#1144515).

This update fixes the following issues:

cobbler:

• Fix for install loop caused autoinstallation profiles (bsc#1151875)
• Update module config description to match new parameters
• Add config migration script and runs it in post-install script
• Fix for config backups in post install script (bsc#1149075)
• Move apache config file cobbler.conf to conf.d directory and remove the VirtualHost container as it overwrite rules already set in conf.d
• Realignment with Cobbler 3.0.0 release candidate.
• Fix for typo in settings for scm_track module.
• Optimization for settings loading in scm_track module.

cpu-mitigations-formula:

• Fix grub entry changed for sle12* so it matches sle15* (bsc#1145873)

mgr-osad:

• Obsolete all old python2-osa* packages to avoid conflicts (bsc#1152290)

patterns-suse-manager:

• Add recommends for cpu-mitigations-formula

pgjdbc-ng:

• Allow dots in database name (bsc#1146416)

prometheus-exporters-formula:

• Allow to configure arbitrary arguments when running exporters
• Add support for Debian/Ubuntu and Red Hat systems (RHEL/CentOS)
• Install the LICENSE together with the package

py26-compat-salt:

• Get tornado dependency from the system on SLE12 (bsc#1149409)

python-susemanager-retail:

• Update to version 0.1.1568808472.be9f236
• Parse parition type 82 as swap in SLEPOS migration (bsc#1136959)
• Allow kernel command line for branches to be set as an option to retail_branch_init CLI
• Automatically calculate dhcp dynamic range from branch ip if not set

python-urlgrabber:

• Allow non-integer values for URLGRABBER_DEBUG env variable (bsc#1152514)
• Fixes usage of log level lookup for Python3 (bsc#1146683)

spacecmd:

• Java api expects content as encoded string instead of encode bytes like before (bsc#1153277)
• Fix building and installing on CentOS8/RES8/RHEL8
• Check that a channel doesn't have clones before deleting it (bsc#1138454)

spacewalk-admin:

• Avoid a 'Permission denied' salt error when publisher_acl is set (bsc#1150154)

spacewalk-backend:

• Fix re-registration with re-activation key (bsc#1154275)
• Change the default value of taskomatic maxmemory to 4GB
• Add basic support for importing modular repositories
• Import additional fields for Deb packages
• Add script to update additional fields in the DB for existing Deb packages
• Use active values for diskchecker mails
• Parse restart_suggested flag from patches and set it as keywords (bsc#1151467)
• Improve error message when deleting channel that's in a content lifecycle project (bsc#1145769)
• Prevent 'reposync' crash when handling metadata on RPM repos (bsc#1138358)
• Do not show expected WARNING messages from 'c_rehash'
• Fix misspelling in spacewalk-repo-sync (bsc#1149633)
• Remove credentials also from potential rhn.conf backup files in spacewalk-debug (bsc#1146419)
• Do not crash 'rhn-satellite-exporter' with ModuleNotFound error (bsc#1146869)
• Spacewalk-remove-channel check that channel doesn't have cloned channels before deleting it (bsc#1138454)
• Fix broken spacewalk-data-fsck utility
• Add '--latest' support for reposync on DEB based repositories
• Do not try to download RPMs from the unresolved mirrorlist URL
• Fix encoding issues with DB bytes values (bsc#1144300)
• Fix import of rhnAuthPAM to avoid issues when using rhnpush.
• Avoid traceback on mgr-inter-sync when there are problems with cache of packages (bsc#1143016)

spacewalk-branding:

• Improve menu scrollbar style for firefox
• Add UI message when salt-formulas system folders are unreachable (bsc#1142309)

spacewalk-certs-tools:

• Require mgr-daemon (new name of spacewalksd) so we systems with spacewalksd get always the new package installed (bsc#1149353)

spacewalk-client-tools:

• Require mgr-daemon (new name of spacewalksd) so we systems with spacewalksd get always the new package installed (bsc#1149353)
• Enable spacewalk-update-service on package installation (bsc#1143789)
• Invalidate cache 5 minutes before actual…