CVE-2019-14900

Hibernate is a powerful, high-performance, feature-rich and very popular ORM solution for Java. Hibernate facilitates development of persistent objects based on the common Java object model to mirror the underlying database structure. This approach progresses the business performance to some extent, advances development efficiency exceedingly and obtains preferable economical efficiency and practicability. Provides: hibernate-core = 5.0.10-6.oe1 Provides: hibernate-c3p0 = 5.0.10-6.oe1 Provides: hibernate-ehcache = 5.0.10-6.oe1 Provides: hibernate-entitymanager = 5.0.10-6.oe1 Provides: hibernate-envers = 5.0.10-6.oe1 Provides: hibernate-hikaricp = 5.0.10-6.oe1 Provides: hibernate-infinispan = 5.0.10-6.oe1 Provides: hibernate-java8 = 5.0.10-6.oe1 Provides: hibernate-osgi = 5.0.10-6.oe1 Provides: hibernate-parent = 5.0.10-6.oe1 Provides: hibernate-proxool = 5.0.10-6.oe1 Provides: hibernate-spatial = 5.0.10-6.oe1 Provides: hibernate-testing = 5.0.10-6.oe1 Provides: hibernate-javadoc = 5.0.10-6.oe1 Obsoletes: hibernate-core < 5.0.10-6.oe1 Obsoletes: hibernate-c3p0 < 5.0.10-6.oe1 Obsoletes: hibernate-ehcache < 5.0.10-6.oe1 Obsoletes: hibernate-entitymanager < 5.0.10-6.oe1 Obsoletes: hibernate-envers < 5.0.10-6.oe1 Obsoletes: hibernate-hikaricp < 5.0.10-6.oe1 Obsoletes: hibernate-infinispan < 5.0.10-6.oe1 Obsoletes: hibernate-java8 < 5.0.10-6.oe1 Obsoletes: hibernate-osgi < 5.0.10-6.oe1 Obsoletes: hibernate-parent < 5.0.10-6.oe1 Obsoletes: hibernate-proxool < 5.0.10-6.oe1 Obsoletes: hibernate-spatial < 5.0.10-6.oe1 Obsoletes: hibernate-testing < 5.0.10-6.oe1 Obsoletes: hibernate-javadoc < 5.0.10-6.oe1

Security Fix(es):

A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.(CVE-2019-14900)

Security Fix(es):

A flaw was found in Hibernate ORM. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.(CVE-2019-14900)

Hibernate is a powerful, ultra-high performance object/relational persistence and query service for Java. Hibernate lets you develop persistent objects following common Java idiom - including association, inheritance, polymorphism, composition and the Java collections framework. Extremely fine-grained, richly typed object models are possible. The Hibernate Query Language, designed as a "minimal" object-oriented extension to SQL, provides an elegant bridge between the object and relational worlds. Hibernate is now the most popular ORM solution for Java.

Security Fix(es):

A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.(CVE-2019-14900)

TuxCare rebuilt org.hibernate:hibernate-core to address 1 CVE. Fixed in 4.3.11.Final-tuxcare.1.

TuxCare rebuilt org.hibernate:hibernate-core to address 1 CVE. Fixed in 5.4.3.Final-tuxcare.3.

This update fixes the following issues:

hibernate5:

• Address CVE-2019-14900 (bsc#1172079)

image-sync-formula:

• Allow image-sync state on regular minion. Image sync state requires branch-network pillars to get the directory where to sync images. Use default /srv/saltboot if that pillar is missing so image-sync can be applied on non branch minions as well.

openvpn-formula:

• Add hint that ssl certs must be on system (bsc#1172279)

prometheus-exporters-formula:

• Bugfix: Handle exporters proxy for unsupported distros (bsc#1175555)
• Add support for exporters proxy (exporter_exporter)
• Update the apache exporter config file for Debian

salt-netapi-client:

• Refresh authentication module list to newer Salt versions

saltboot-formula:

• Better fix for rounding errors (bsc#1136857)

spacecmd:

• Python3 fixes for errata in spacecmd (bsc#1169664)
• Python3 fix for sorted usage (bsc#1167907)
• Fix softwarechannel_listlatestpackages throwing error on empty channels (bsc#1175889)
• Fix escaping of package names (bsc#1171281)

spacewalk-admin:

• Use the Salt API in authenticated and encrypted form (bsc#1175884, CVE-2020-8028)

spacewalk-certs-tools:

• Add option --nostricthostkeychecking to spacewalk-ssh-push-init
• Strip SSL Certificate Common Name after 63 Characters (bsc#1173535)

spacewalk-java:

• Use the Salt API in authenticated and encrypted form (bsc#1175884, CVE-2020-8028)
• Fix EntityExistsException on migration from traditional to salt minion via proxy (bsc#1175556)
• Use media.1/products from media when not specified different (bsc#1175558)
• Fix: use quiet API method when using spacewalk-common-channels (bsc#1175529)
• Fix alignment on icon on entitlement page
• Reset the server path on minion registration (bsc#1174254)
• Upgrade jQuery and adapt the code - CVE-2020-11022 (bsc#1172831)
• Fix error when rolling back a system to a snapshot (bsc#1173997)
• Avoid deadlock when syncing channels and registering minions at the same time (bsc#1173566)
• Provide comps.xml and modules.yaml when using onlinerepo for kickstart
• Set CPU and memory info for virtual instances (bsc#1170244)
• Change system list header text to something better (bsc#1173982)

spacewalk-setup:

• Use the Salt API in authenticated and encrypted form (bsc#1175884, CVE-2020-8028)

spacewalk-utils:

• Avoid exceptions on the logs when looking for channels that do not exist (bsc#1175529)

spacewalk-web:

• Fix login page after jQuery upgrade (bsc#1175224)
• Upgrade jQuery and adapt the code - CVE-2020-11022 (bsc#1172831)
• Warn when a system is in multiple groups that configure the same formula in the system formula's UI (bsc#1173554)

susemanager:

• Define bootstrap repo data for SUSE Manager Proxies (bsc#1174470)

susemanager-frontend-libs:

• Upgrade jquery to 3.5.1 - CVE-2020-11022 (bsc#1172831)

susemanager-schema:

• Prevent a deadlock error involving delete_server and update_needed_cache (bsc#1173073)

susemanager-sls:

• Fix the dnf plugin to add the token to the HTTP header (bsc#1175724)
• Fix reporting of missing products in product.all_installed (bsc#1165829)
• Require PyYAML version >= 5.1
• Get redhat-release only when it is not a symlink
• Fix: supply a dnf base when dealing w/repos (bsc#1172504)
• Fix: autorefresh in repos is zypper-only

susemanager-sync-data:

• Remove version from centos and oracle linux identifier (bsc#1173584)

virtualization-host-formula:

• Update to version 0.5
  • Ensure kernel-default and libvirt-python3 are installed
  • Set bridge network as default
  • Fix conditionals (bsc#1175791)

How to apply this update:

1. Log in as root user to the SUSE Manager server.
2. Stop the Spacewalk service: spacewalk-service stop
3. Apply the patch using either zypper patch or YaST Online Update.
4. Upgrade the database schema: spacewalk-schema-upgrade
5. Start the Spacewalk service: spacewalk-service start

This update fixes the following issues:

golang-github-QubitProducts-exporter_exporter:

• Pin Golang version to 1.14

golang-github-prometheus-node_exporter:

• Update to 1.0.1
  • Changes to build specification
    • Modify spec: update golang version to 1.14
    • Remove update tarball script
    • Add _service file to allow for updates via osc service disabledrun
  • Bug fixes
    • [BUGFIX] filesystem_freebsd: Fix label values #1728
    • [BUGFIX] Update prometheus/procfs to fix log noise #1735
    • [BUGFIX] Fix build tags for collectors #1745
    • [BUGFIX] Handle no data from powersupplyclass #1747, #1749
• Update to 1.0.0
  • Bug fixes
    • [BUGFIX] Read /proc/net files with a single read syscall #1380
    • [BUGFIX] Renamed label state to name on node_systemd_service_restart_total. #1393
    • [BUGFIX] Fix netdev nil reference on Darwin #1414
    • [BUGFIX] Strip path.rootfs from mountpoint labels #1421
    • [BUGFIX] Fix seconds reported by schedstat #1426
    • [BUGFIX] Fix empty string in path.rootfs #1464
    • [BUGFIX] Fix typo in cpufreq metric names #1510
    • [BUGFIX] Read /proc/stat in one syscall #1538
    • [BUGFIX] Fix OpenBSD cache memory information #1542
    • [BUGFIX] Refactor textfile collector to avoid looping defer #1549
    • [BUGFIX] Fix network speed math #1580
    • [BUGFIX] collector/systemd: use regexp to extract systemd version #1647
    • [BUGFIX] Fix initialization in perf collector when using multiple CPUs #1665
    • [BUGFIX] Fix accidentally empty lines in meminfo_linux #1671
  • Several enhancements
    • See https://github.com/prometheus/node_exporter/releases/tag/v1.0.0
• Update to 1.0.0-rc.0
  • The netdev collector CLI argument --collector.netdev.ignored-devices was renamed to --collector.netdev.device-blacklist in order to conform with the systemd collector. #1279
  • The label named state on node_systemd_service_restart_total metrics was changed to name to better describe the metric. #1393
  • Refactoring of the mdadm collector changes several metrics node_md_disks_active is removed node_md_disks now has a state label for 'fail', 'spare', 'active' disks. node_md_is_active is replaced by node_md_state with a state set of 'active', 'inactive', 'recovering', 'resync'.
  • Additional label mountaddr added to NFS device metrics to distinguish mounts from the same URL, but different IP addresses. #1417
  • Metrics node_cpu_scaling_frequency_min_hrts and node_cpu_scaling_frequency_max_hrts of the cpufreq collector were renamed to node_cpu_scaling_frequency_min_hertz and node_cpu_scaling_frequency_max_hertz. #1510
  • Collectors that are enabled, but are unable to find data to collect, now return 0 for node_scrape_collector_success.
• Add missing sysconfig file in rpm bsc#1151557

hibernate5:

• Address CVE-2019-14900 (bsc#1172079)
• Add patch:

hub-xmlrpc-api:

• One configuration flag was renamed for clarity
• Added USE_SSL flag to https insted of plain http
• Updated docs
• Bugfixes
• Changed configuration to plain variables
• Bugfixes

patterns-suse-manager:

• Change PostgreSQL requirements to require at least PostgreSQL 12

prometheus-exporters-formula:

• Bugfix: More robust handling of NoneType arguments (bsc#1176844)
• Bugfix: Handle <NoneType> arguments (bsc#1176844)

salt-netapi-client:

• Fix text resource usage

spacecmd:

• Fix softwarechannel_listlatestpackages throwing error on empty channels (bsc#1175889)

spacewalk-backend:

• Fix strings (mentions of Satellite, replace SUSE Manager with PRODUCT_NAME, etc)
• Only regenerate bootstrap repositories when linking new packages (bsc#1174636)
• Support installer_updates flag in ISS
• Remove duplicate languages and update translation strings

spacewalk-branding:

• Re-enable language picker for user creation

spacewalk-certs-tools:

• Add option --nostricthostkeychecking to spacewalk-ssh-push-init
• Fix the fallback to RES bootstrap repo for…