CVE-2017-7538

A cross-site scripting (XSS) flaw was found in how an organization name is displayed in Satellite 5, before 5.8. A user able to change an organization's name could exploit this flaw to perform XSS attacks against other Satellite users.

A cross-site scripting (XSS) flaw was found in how an organization name is displayed in Satellite 5, before 5.8. A user able to change an organization's name could exploit this flaw to perform XSS attacks against other Satellite users.

A cross-site scripting (XSS) flaw was found in how an organization name is displayed in Satellite 5, before 5.8. A user able to change an organization's name could exploit this flaw to perform XSS attacks against other Satellite users.

A cross-site scripting (XSS) flaw was found in how an organization name is displayed in Satellite 5, before 5.8. A user able to change an organization's name could exploit this flaw to perform XSS attacks against other Satellite users.

This update for the SUSE Manager Server 3.1 provides several fixes and improvements.

The following security issues have been fixed:

jabberd:

• Fix offered SASL mechanism check. (bsc#1047282, CVE-2017-10807)

spacewalk-java:

• Do not allow XSS as Organization name. (bsc#1048968, CVE-2017-7538)

Additionally, the following non-security issues have been fixed:

cobbler:

• Fix missing arguments and location for Xen. (bsc#1048183)

jabberd:

• Fix memory leak in pgsql storage driver.
• Fix two double-frees caused by dangling pointers.
• wss:// (WebSocket over SSL) support in c2s.
• Allow BareJID S10N packets.
• SQLite postconnect SQL support.
• Support WebSocket fragmented packets.
• Module to verify users using e-mail.
• Use OpenSSL functions for base64 en/decoding when available.
• Option to dump packet-filter matched packets to file.
• bcrypt support for PostgreSQL and MySQL storage.
• Option to set authreg module per realm.
• WebSocket C2S SX plugin.
• Support for RSA/DH/ECDH key agreement.
• For a detailed description of all fixes, please refer to the changelog.

osad:

• Reduce maximal size of osad log before rotating.
• Perform osad restart in posttrans. (bsc#1039913)

salt-netapi-client:

• Fix date format for Schedule.
• Fix sending kwarg in payload in RunnerCall.
• Better error handling in Runner and Wheel calls.
• Increase the default SOCKET_TIMEOUT to 20 seconds.

smdba:

• Add support for postgresql96. (bsc#1045152)

spacecmd:

• Configchannel export binary flag to json. (bsc#1044719)

spacewalk-backend:

• Make master_label static to keep its value when retrying. (bsc#1038321)
• Adapt for the new gpgcheck flag for the channels.

spacewalk-branding:

• Fix overlapping of elements. (bsc#1031143)
• Fix overlapping text narrow window. (bsc#1009118)
• Fix formulas action buttons position. (bsc#1047513)
• Fix broken link. (bsc#1033999)
• Alphabar: Change title to 'Select first character'. (bsc#1042199)

spacewalk-certs-tools:

• Improve text for bootstrap. (bsc#1032324)

spacewalk-java:

• Don't add default channel if AK is not valid. (bsc#1047656)
• Add 'Enable GPG check' function for channels.
• No legend icon for Activity Ocurring. (bsc#1051719)
• Implement API call for bootstrapping systems.
• Fix product ids reported for SUSE Manager Server to the subscription matcher.
• Fix adding products when assigning channels. (bsc#1049664)
• Set default memory size for SLES 12 installations to 1024MB. (bsc#1047707)
• Enable remote-command for Salt clients in SSM. (bsc#1050385)
• Add missing help icons/links. (bsc#1049425)
• Fix invalid help links. (bsc#1049425)
• Fix wrong openscap xid. (bsc#1030898)
• Fix overlapping text narrow window. (bsc#1009118)
• Fixes alignment on the orgdetails. (bsc#1017513)
• Fix text for activation key buttons. (bsc#1042975)
• Correctly set, check and cut textarea maxlength. (bsc#1043430)
• MinionActionExecutor: Raise skip timeout. (bsc#1046865)
• Update channels.xml with OpenStack Cloud Continuous Delivery 6. (bsc#1039458)
• Do not create VirtualInstance duplicates for the same 'uuid'.
• Add taskomatic task to cleanup duplicated uuids for same system id.
• Handle possible wrong UUIDs on SLE11 minions. (bsc#1046218)
• Removed duplicate overview menu item. (bsc#1045981)
• Enable act-key name empty on creation. (bsc#1032350)
• Fix NPE when there's not udev results. (bsc#1042552)
• Alphabar: Change title to 'Select first character'. (bsc#1042199)
• Duplicate Systems: Correct language not to mention 'profiles'. (bsc#1035728)
• Fix list filters to work with URL special characters. (bsc#1042846)
• Use getActive() instead of isActive() for JavaBeans compliance. (bsc#1043143)
• Fix hide non-org event details. (bsc#1039579)

spacewalk-search:

• Remove executable bit from service files. (bsc#1051518)

spacewalk-utils:

• Don't show password on input in spacewalk-manage-channel-lifecycle. (bsc#1043795)

spacewalk-web:

• Fix overlapping of elements. (bsc#1031143)
• Fix formulas action buttons…

This update for the SUSE Manager Server 3.0 provides several fixes and improvements.

The following security issue has been fixed:

spacewalk-java:

• CVE-2017-7538: Do not allow HTML code injection via Cross Site Scripting (XSS) in the Organization Name. (bsc#1048968)

Additionally, the following non-security issues have been fixed:

salt-netapi-client:

• Fix date format for Schedule.
• Fix sending kwarg in payload in RunnerCall.
• Better error handling in Runner and Wheel calls.
• Increase the default SOCKET_TIMEOUT to 20 seconds

smdba:

• Do not set default_statistics_target. (bsc#1022286)
• Support postgresql96. (bsc#1045152)
• Prevent use of /var/lib/pgsql/data. (bsc#1024058)
• Remove copyright message every time shown.
• On systemd-enabled systems use it for start/stop PostgreSQL. (bsc#1024058)

spacewalk-backend:

• Increase rpclib timeout to 10 minutes. (bsc#1026930)
• Adapt for the new gpgcheck flag for the channels.

spacewalk-branding:

• Fix overlapping text narrow window. (bsc#1009118)

spacewalk-config:

• Resolve comps.xml file for repositories. (bsc#1048528)

spacewalk-java:

• Delete and create new ServerNetAddress if it already exists on Hardware refresh. (bsc#1054225)
• Fix enter key submit on ListTag filter input. (bsc#1048762)
• Create VirtpollerData object with JSON content instead null. (bsc#1049170)
• Prevent malformed XML if 'arch' is set to NULL. (bsc#1045575)
• Resolve comps.xml file for repositories. (bsc#1048528)
• Don't add default channel if AK is not valid. (bsc#1047656)
• Add 'Enable GPG check' function for channels.
• Regenerate pillar for the minions using the channel being modified.
• Remove executable bit from service files. (bsc#1051518)
• Fix wrong openscap xid. (bsc#1030898)
• Fix overlapping text narrow window. (bsc#1009118)
• Fix broken link. (bsc#1033999)
• Fix alignment on the org details. (bsc#1017513)
• Update channels.xml with OpenStack Cloud Continuous Delivery 6. (bsc#1039458)
• Handle possible wrong UUIDs on SLE 11 minions. (bsc#1046218)
• Allow blank key generation. (bsc#1032350)

spacewalk-search:

• Remove executable bit from service files. (bsc#1051518)

spacewalk-setup-jabberd:

• Change default backend for jabberd to sqlite. (bsc#1047155)

spacewalk-web:

• Fix enter key submit on ListTag filter input. (bsc#1048762)

susemanager:

• Do not use checkpoint_segments parameter during migrations.
• Enable migration from postgresql94 to postgresql96.
• Create bootstrap repository for SUSE Linux Enterprise Server for SAP 11 SP1. (bsc#1049471)
• Adjust the bootstrap repository with SUSE Linux Enterprise 12 SP3 repositories.

susemanager-docs_en:

• Update text and image files.

susemanager-schema:

• Adapt for the new gpgcheck flag for the channels.

susemanager-sync-data:

• Add SUSE Manager Proxy 3.0 channels for SUSE Linux Enterprise Server 12 SP3. (bsc#1053850)
• Support SUSE Enterprise Storage 5 and SUSE Linux Enterprise Server 12 SP3 for SAP Applications on ppc64le. (bsc#1028098)
• Update channels.xml with OpenStack Cloud Continuous Delivery 6. (bsc#1039458)
• Add SUSE Linux Enterprise 12 SP3 related products. (bsc#1037609)

virtual-host-gatherer:

• Implement kubernetes gatherer module.

How to apply this update:

1. Log in as root user to the SUSE Manager server.
2. Stop the Spacewalk service: spacewalk-service stop
3. Apply the patch using either zypper patch or YaST Online Update.
4. Upgrade the database schema: spacewalk-schema-upgrade
5. Start the Spacewalk service: spacewalk-service start