CVE-2017-7470

It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks due to an incorrect authorization check in backend/server/rhnChannel.py.

It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks due to an incorrect authorization check in backend/server/rhnChannel.py.

It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks due to an incorrect authorization check in backend/server/rhnChannel.py.

It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks due to an incorrect authorization check in backend/server/rhnChannel.py.

The following security issue in spacewalk-backend has been fixed:

• Non admin or disabled user cannot make changes to a system anymore using spacewalk-channel. (bsc#1026633, CVE-2017-7470)

Additionally, the following non-security issues have been fixed:

rhnlib:

• Support all TLS versions in rpclib. (bsc#1025312)

spacewalk-backend:

• Do not fail with traceback when media.1 does not exist. (bsc#1032256)
• Create scap files dir beforehand. (bsc#1029755)
• Fix error if SPACEWALK_DEBUG_NO_REPORTS env variable is not present.
• Don't skip 'rhnErrataPackage' cleanup during an errata update. (bsc#1023233)
• Add support for running spacewalk-debug without creating reports. (bsc#1024714)
• Set scap store dir mod to 775 and group owner to susemanager.
• Incomplete_package_import: do import rhnPackageFile as it breaks some package installations.
• Added traceback printing to the exception block.
• Change postgresql starting commands.

spacewalk-certs-tools:

• Always restart the minion regardless of its current state. (bsc#1034956)
• Correctly honor disabling of SSL in bootstrap script. (bsc#1033383)
• Add curl dependency and move mgr-proxy-ssh* to spacewalk-proxy package.
• Exit for non-traditional bootstrap scripts. (bsc#1020904)
• Rename mgr-ssh-proxy-force-cmd -> mgr-proxy-ssh-force-cmd.
• Add mgr-proxy-ssh-force-cmd, mgr-proxy-ssh-push-init to rpm.
• Add option to configure only sshd.
• Restrictive ssh options for user mgrsshtunnel.

spacewalk-client-tools:

• Fix reboot message to use correct product name. (bsc#1031667)

spacewalk-proxy:

• Add curl dependency and move mgr-proxy-ssh* to spacewalk-proxy package.
• Lower the use-file-instead-of-memory treshold. (bsc#1030342)

spacewalk-proxy-installer:

• Do not start firewall on proxy during configuration if not already active. (bsc#1031338)
• Salt minions get repodata via a different URL; reflect by additional squid rule. (bsc#1027873)
• Only warn if parent ssh-push pub key could not be retrieved.
• Generate and auth ssh push keys for user mgrsshtunnel.
• Authorize parent salt-ssh key on proxy.
• Generate proxy ssh-push key and authorize the previous proxy in the chain.
• Generate own ssh-push key for proxy and authorize parent.

spacewalk-web:

• Remote Commands: Allow Web Socket to be opened on non-standard port.
• Improve remote cmd ui err handling.
• Show message when waiting for ssh minions times out.
• Fix remote cmd ui js err and timed out message.
• Remote cmd UI changes for salt-ssh minions.
• Fix broken help link for taskstatus. (bsc#1017422)
• Add js utility function to create Date objects in different timezones.
• Show proxy path in bootstrap UI.
• Clear proxy selection when clicking clear fields button.
• Check if proxy hostname is FQDN not name in UI.
• Show warn in bootstrap UI if proxy hostname is not a FQDN.

susemanager-sls:

• Add certificate state for CAASP.
• Add certificate state for SLES for SAP. (bsc#1031659)
• Pre-create empty top.sls with no-op. (bsc#1017754)
• Add xccdf result xslt.
• Fix mainframesysinfo module to use /proc/sysinfo on SLES11. (bsc#1025758)
• Set scap store dir mod to 775 and group owner to susemanager.
• Store uploaded scap files.
• Set minion own key owner to bootstrap ssh_push_sudo_user.
• Runner to generate ssh key and execute cmd via proxies.
• Change ssh bootstrap state to generate and auth keys for salt-ssh push with tunnel.
• Authorize parent salt-ssh key on proxy.

How to apply this update:

1. Log in as root user to the SUSE Manager proxy.
2. Stop the proxy service: spacewalk-proxy stop
3. Apply the patch using either zypper patch or YaST Online Update.
4. Start the Spacewalk service: spacewalk-proxy start

The following security issue in spacewalk-backend has been fixed:

• Non admin or disabled user cannot make changes to a system anymore using spacewalk-channel. (bsc#1026633, CVE-2017-7470)

Additionally, the following non-security issues have been fixed:

rhnlib:

• Support all TLS versions in rpclib. (bsc#1025312)

spacecmd:

• Improve output on error for listrepo. (bsc#1027426)
• Reword spacecmd removal message. (bsc#1024406)

spacewalk-backend:

• Do not fail with traceback when media.1 does not exist. (bsc#1032256)
• Create scap files directory beforehand. (bsc#1029755)
• Fix error if SPACEWALK_DEBUG_NO_REPORTS environment variable is not present.
• Don't skip 'rhnErrataPackage' cleanup during an errata update. (bsc#1023233)
• Add support for running spacewalk-debug without creating reports. (bsc#1024714)
• Set scap store directory mod to 775 and group owner to susemanager.
• incomplete_package_import: Do import rhnPackageFile as it breaks some package installations.
• Added traceback printing to the exception block.
• Change postgresql starting commands.

spacewalk-client-tools:

• Fix reboot message to use correct product name. (bsc#1031667)

The following security issue in spacewalk-backend has been fixed:

• Non admin or disabled user cannot make changes to a system anymore using spacewalk-channel. (bsc#1026633, CVE-2017-7470)

Additionally, the following non-security issues have been fixed:

rhnlib:

• Support all TLS versions in rpclib. (bsc#1025312)

salt-netapi-client:

• Fix date format for Schedule module. (bsc#1034465)

spacecmd:

• Improve output on error for listrepo. (bsc#1027426)
• Reword spacecmd removal message. (bsc#1024406)

spacewalk-backend:

• Do not fail with traceback when media.1 does not exist. (bsc#1032256)
• Create scap files directory beforehand. (bsc#1029755)
• Fix error if SPACEWALK_DEBUG_NO_REPORTS environment variable is not present.
• Don't skip 'rhnErrataPackage' cleanup during an errata update. (bsc#1023233)
• Add support for running spacewalk-debug without creating reports. (bsc#1024714)
• Set scap store directory mod to 775 and group owner to susemanager.
• incomplete_package_import: Do import rhnPackageFile as it breaks some package installations.
• Added traceback printing to the exception block.
• Change postgresql starting commands.

spacewalk-certs-tools:

• Always restart the minion regardless of its current state. (bsc#1034956)
• Correctly honor disabling of SSL in bootstrap script. (bsc#1033383)
• Add curl dependency and move mgr-proxy-ssh* to spacewalk-proxy package.
• Exit for non-traditional bootstrap scripts. (bsc#1020904)
• Rename mgr-ssh-proxy-force-cmd -> mgr-proxy-ssh-force-cmd.
• Add mgr-proxy-ssh-force-cmd, mgr-proxy-ssh-push-init to rpm.
• Add option to configure only sshd.
• Restrictive ssh options for user mgrsshtunnel.

spacewalk-client-tools:

• Fix reboot message to use correct product name. (bsc#1031667)

spacewalk-java:

• Fix missing IPs in Overview tab. (bsc#1031453)
• Fix scheduling VM deployment in future. (bsc#1034289)
• Handle empty set to not produce invalid sql. (bsc#1033497)
• Fix SSM group pagination. (bsc#1012784)
• Create PooledExecutor with pre-filled queue. (bsc#1030716)
• Make sure minion keys can only be seen/managed by appropriate user. (bsc#1025908)
• Set action status to 'failed' on uncaught exceptions. (bsc#1013606)
• Add missing library to taskomatic classpath. (bsc#1024066)
• Set log level to DEBUG for EOFException when the Websocket connection is aborted by the client. (bsc#1031826)
• Add a remote command with label as a script to the actionchain. (bsc#1011964)
• Fix architecture for default channels lookup. (bsc#1025275)
• Change required salt-netapi-client to >= 0.11.
• Using stream() during collection processing.
• Making salt presence timeouts configurable via rhn.conf. (bsc#1025761)
• Avoid blocking synchronous calls if some minions are unreachable. (bsc#1025761)
• Excludes unreachable minions from synchronous call to prevent blocking. (bsc#1025761)
• Fix LocalDateTimeISOAdapter to parse date string with timezone. (bsc#1024966)
• Create scap files directories beforehand. (bsc#1029755)
• Make country, state/province and city searchable for system location. (bsc#1020659)
• Change incorrect help link. (bsc#1017418)
• Don't allow scheduling scap scan if openscap pkg missing from minion.
• Make salt aware of rescheduled actions. (bsc#1027852)
• Close hibernate session on async salt-ssh call.
• Use a small fixed pool so we don't overwhelm the salt-api with salt-ssh executions
• Fix remote cmd ui js err and timed out message.
• Remote cmd UI changes for salt-ssh minions.
• Add support for salt ssh minions to remote cmd UI.
• Apply SessionFilter also for error pages. (bsc#1028062)
• Use correct logging class.
• Fix broken help link for taskstatus. (bsc#1017422)
• Test errata not removed from origin.
• Fix merge channels patches. (bsc#1025000)
• Change XccdfIdent.identifier mapping length to 100.
• Add xccdf result xslt.
• Fix mainframesysinfo module to use /proc/sysinfo on SLES11. (bsc#1025758)
• Use consistent spelling in UI. (bsc#1028306)
• Rewording distchannelmap text.…

The following security issue in spacewalk-backend has been fixed:

• Non admin or disabled user cannot make changes to a system anymore using spacewalk-channel. (bsc#1026633, CVE-2017-7470)

Additionally, the following non-security issues have been fixed:

cobbler:

• Support UEFI boot with cobbler generated tftp tree. (bsc#1020376)
• Refresh patch for fuzzless appliance.

rhnlib:

• Support all TLS versions in rpclib. (bsc#1025312)

spacecmd:

• Improve output on error for listrepo. (bsc#1027426)
• Reword spacecmd removal message. (bsc#1024406)

spacewalk-backend:

• Do not fail with traceback when media.1 does not exist. (bsc#1032256)
• Create scap files directory beforehand. (bsc#1029755)
• Fix error if SPACEWALK_DEBUG_NO_REPORTS env variable is not present.
• Don't skip 'rhnErrataPackage' cleanup during an errata update. (bsc#1023233)
• Add support for running spacewalk-debug without creating reports. (bsc#1024714)
• Set scap store directory mod to 775 and group owner to susemanager.
• incomplete_package_import: Do import rhnPackageFile as it breaks some package installations.
• Added traceback printing to the exception block.
• Change postgresql starting commands.

spacewalk-client-tools:

• Fix reboot message to use correct product name. (bsc#1031667)