CVE-2018-17197

A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser in versions 1.8-1.19.1 of Apache Tika.

A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser in versions 1.8-1.19.1 of Apache Tika.

This update fixes the following issues:

branch-network-formula:

• Netconfig update requires bind directory to exists for bind forward, ensure it (bsc#1116365)
• Rework network update in branch-network formula (bsc#1116365)

py26-compat-salt:

• Remove arch from name when pkg.list_pkgs is called with 'attr' (bsc#1114029)

python-susemanager-retail:

• Force one python version for SLE12 (python2) and SLE15 (python3)
• Add disklabel: none to migrated RAID

saltboot-formula:

• Use FTP active mode for image download
• Always deploy image when image is specified in partitioning pillar (bsc#1119807)
• Call blockdev.formatted with force=True
• Allow RAID images to be defined by saltboot formula
  • image information can be provided directly for disk
  • allow 'none' disk label in formula and in that case hide partitioning information

smdba:

• Tuning: add cpu_tuple_cost (bsc#1105791)

spacecmd:

• Fix importing state channels using configchannel_import
• Fix getting file info for latest revision (via configchannel_filedetails)
• Add functions to merge errata (softwarechannel_errata_merge) and packages (softwarechannel_mergepackages) through spacecmd (bsc#987798)

spacewalk-admin:

• Use a Salt engine to process return results (bsc#1099988)

spacewalk-backend:

• Move channel update close to commit to avoid long lock (bsc#1121424)
• Adapt Inter Server Sync code to new SCC sync backend
• Fix issue raising exceptions 'with_traceback' on Python 2
• Hide Python traceback and show only error message (bsc#1110427)
• Honor renamed postgresql10 log directory for supportconfig

spacewalk-branding:

• Better label visualization when the input is disabled. (bsc#1110772)

spacewalk-client-tools:

• Fix XML-RPC type serialization (bsc#1116610)

spacewalk-java:

• Improve salt events processing performance (bsc#1125097)
• Prevent an error when onboarding a RES 6 minion (bsc#1124794)
• Support products with multiple base channels
• Fix ordering of base channels to prevent synchronization errors (bsc#1123902)
• Support products with multiple base channels
• Avoid a NullPointerException error in Taskomatic (bsc#1119271)
• Reset channel assignments when base channel changes on registration (bsc#1118917)
• Allow bootstrapping minions with a pending minion key being present (bsc#1119727)
• Hide 'unknown virtual host manager' when virtual host manager of all hosts is known (bsc#1119320)
• Disable notification types with 'java.notifications_type_disabled' in rhn.conf (bsc#1111910)
• Change SCC sync backend to adapt quicker to SCC changes and improve speed of syncing metadata and checking for channel dependencies (bsc#1089121)
• Read OEM Orderitems from DB instead of create always new items (bsc#1098826)
• Fix mgr-sync refresh when subscription was removed (bsc#1105720)
• XMLRPC API: Include init.sls in channel file list (bsc#1111191)
• Fix the config channels assignment via SSM (bsc#1117759)
• Install product packages during bootstrapping minions (bsc#1104680)
• Fix cloning channels when managing the same errata for both vendor and private orgs (bsc#1111686)
• Introduce Loggerhead-module.js to store logs from the frontend
• Removed 'Manage Channels' shortcut for vendor channels (bsc#1115978)
• Hide already applied errata and channel entries from the output list in audit.listSystemsByPatchStatus (bsc#1111963)
• Prevent failing KickstartCommand when customPosition is null (bsc#1112121)
• Automatically schedule an Action to refresh minion repos after deletion of an assigned channel (bsc#1115029)
• Performance improvements in channel management functionalities (bsc#1114877)
• Handle with an error message if state file fails to render (bsc#1110757)
• When changing basechannel the compatible old childchannels are now selected by default. (bsc#1110772)
• Add check for yast autoinstall profiles when setting kickstartTree (bsc#1114115)
• Use a Salt engine to process return results (bsc#1099988)
• Fix handling of CVEs including multiple patches…

This update fixes the following issues:

cobbler:

• Fixes case where distribution detection returns None (bsc#1130658)
• SUSE texmode fix (bsc#1109316)
• Fix for SUSE distribution detection in ISO building (bsc#1123991)

py26-compat-salt:

• Remove arch from name when pkg.list_pkgs is called with 'attr' (bsc#1114029)

spacecmd:

• Fix importing state channels using configchannel_import
• Fix getting file info for latest revision (via configchannel_filedetails)

spacewalk-branding:

• Update jquery.timepicker dependency to 1.11.14 to allow parsing the time format without depending on the language. (bsc#1119081)

spacewalk-java:

• Fix a problem when cloning public child channels with a private base channel (bsc#1124639)
• Keep assigned channels on traditional to minion migration (bsc#1122836)
• Fix 'Add Selected to SSM' on System Groups -> systems page (bsc#1121856)
• Disable notification types with 'java.notifications_type_disabled' in rhn.conf (bsc#1111910)
• XMLRPC API: Include init.sls in channel file list (bsc#1111191)
• Fix the config channels assignment via SSM (bsc#1117759)

spacewalk-utils:

• Create /etc/rhn with correct ownership to prevent file conflicts

spacewalk-web:

• Fix action scheduler time picker prefill when the server is on 'UTC/GMT' timezone (bsc#1121195)
• Fix initializing of the datetime picker (bsc#1126862)
• Show feedback messages after using the retry option on the notification messages page

subscription-matcher:

• Old style hard bundle merging fix (bsc#1114059)

susemanager:

• Fix creation of bootstrap repositories for SLE12 (no SP) by requiring python-setuptools only for SLE12 >= SP1 (bsc#1129765)
• Add python-setuptools package dependency to SLES12 bootstrap repo (bsc#1119964)
• Rhnlib was renamed to python2-rhnlib. Change bootstrap data accordingly.

susemanager-schema:

• Fix performance regression in inter-server-sync (bsc#1128781)

susemanager-docs_en:

• Update text and image files
• 2.1 comparison: clarify profile syncing support
• Adjust documentation about notification settings
• Fix internal link (SMT documentation).
• Remove documentation about the 'mgr-sync enable-scc' subcommand. This subcommand is no longer available.

susemanager-frontend-libs:

• Update jquery.timepicker to 1.11.14 (bsc#1119081)

tika-core:

• New upstream version (1.20). Fixes infinite loop in SQLite3Parser (CVE-2018-17197) (bsc#1121038)

This update fixes the following issues:

branch-network-formula:

• Netconfig update requires bind directory to exists for bind forward, ensure it (bsc#1116365)
• Rework network update in branch-network formula (bsc#1116365)

py26-compat-salt:

• Remove arch from name when pkg.list_pkgs is called with 'attr' (bsc#1114029)

python-susemanager-retail:

• Force one python version for SLE12 (python2) and SLE15 (python3)
• Add disklabel: none to migrated RAID

saltboot-formula:

• Use FTP active mode for image download
• Always deploy image when image is specified in partitioning pillar (bsc#1119807)
• Call blockdev.formatted with force=True
• Allow RAID images to be defined by saltboot formula
  • image information can be provided directly for disk
  • allow 'none' disk label in formula and in that case hide partitioning information

smdba:

• Tuning: add cpu_tuple_cost (bsc#1105791)

spacecmd:

• Fix importing state channels using configchannel_import
• Fix getting file info for latest revision (via configchannel_filedetails)
• Add functions to merge errata (softwarechannel_errata_merge) and packages (softwarechannel_mergepackages) through spacecmd (bsc#987798)

spacewalk-admin:

• Use a Salt engine to process return results (bsc#1099988)

spacewalk-backend:

• Move channel update close to commit to avoid long lock (bsc#1121424)
• Adapt Inter Server Sync code to new SCC sync backend
• Fix issue raising exceptions 'with_traceback' on Python 2
• Hide Python traceback and show only error message (bsc#1110427)
• Honor renamed postgresql10 log directory for supportconfig

spacewalk-branding:

• Better label visualization when the input is disabled. (bsc#1110772)

spacewalk-client-tools:

• Fix XML-RPC type serialization (bsc#1116610)

spacewalk-java:

• Improve salt events processing performance (bsc#1125097)
• Prevent an error when onboarding a RES 6 minion (bsc#1124794)
• Support products with multiple base channels
• Fix ordering of base channels to prevent synchronization errors (bsc#1123902)
• Support products with multiple base channels
• Avoid a NullPointerException error in Taskomatic (bsc#1119271)
• Reset channel assignments when base channel changes on registration (bsc#1118917)
• Allow bootstrapping minions with a pending minion key being present (bsc#1119727)
• Hide 'unknown virtual host manager' when virtual host manager of all hosts is known (bsc#1119320)
• Disable notification types with 'java.notifications_type_disabled' in rhn.conf (bsc#1111910)
• Change SCC sync backend to adapt quicker to SCC changes and improve speed of syncing metadata and checking for channel dependencies (bsc#1089121)
• Read OEM Orderitems from DB instead of create always new items (bsc#1098826)
• Fix mgr-sync refresh when subscription was removed (bsc#1105720)
• XMLRPC API: Include init.sls in channel file list (bsc#1111191)
• Fix the config channels assignment via SSM (bsc#1117759)
• Install product packages during bootstrapping minions (bsc#1104680)
• Fix cloning channels when managing the same errata for both vendor and private orgs (bsc#1111686)
• Introduce Loggerhead-module.js to store logs from the frontend
• Removed 'Manage Channels' shortcut for vendor channels (bsc#1115978)
• Hide already applied errata and channel entries from the output list in audit.listSystemsByPatchStatus (bsc#1111963)
• Prevent failing KickstartCommand when customPosition is null (bsc#1112121)
• Automatically schedule an Action to refresh minion repos after deletion of an assigned channel (bsc#1115029)
• Performance improvements in channel management functionalities (bsc#1114877)
• Handle with an error message if state file fails to render (bsc#1110757)
• When changing basechannel the compatible old childchannels are now selected by default. (bsc#1110772)
• Add check for yast autoinstall profiles when setting kickstartTree (bsc#1114115)
• Use a Salt engine to process return results (bsc#1099988)
• Fix handling of CVEs including multiple patches…

This update fixes the following issues:

cobbler:

• Fixes case where distribution detection returns None (bsc#1130658)
• SUSE texmode fix (bsc#1109316)
• Fix for SUSE distribution detection in ISO building (bsc#1123991)

py26-compat-salt:

• Remove arch from name when pkg.list_pkgs is called with 'attr' (bsc#1114029)

spacecmd:

• Fix importing state channels using configchannel_import
• Fix getting file info for latest revision (via configchannel_filedetails)

spacewalk-branding:

• Update jquery.timepicker dependency to 1.11.14 to allow parsing the time format without depending on the language. (bsc#1119081)

spacewalk-java:

• Fix a problem when cloning public child channels with a private base channel (bsc#1124639)
• Keep assigned channels on traditional to minion migration (bsc#1122836)
• Fix 'Add Selected to SSM' on System Groups -> systems page (bsc#1121856)
• Disable notification types with 'java.notifications_type_disabled' in rhn.conf (bsc#1111910)
• XMLRPC API: Include init.sls in channel file list (bsc#1111191)
• Fix the config channels assignment via SSM (bsc#1117759)

spacewalk-utils:

• Create /etc/rhn with correct ownership to prevent file conflicts

spacewalk-web:

• Fix action scheduler time picker prefill when the server is on 'UTC/GMT' timezone (bsc#1121195)
• Fix initializing of the datetime picker (bsc#1126862)
• Show feedback messages after using the retry option on the notification messages page

subscription-matcher:

• Old style hard bundle merging fix (bsc#1114059)

susemanager:

• Fix creation of bootstrap repositories for SLE12 (no SP) by requiring python-setuptools only for SLE12 >= SP1 (bsc#1129765)
• Add python-setuptools package dependency to SLES12 bootstrap repo (bsc#1119964)
• Rhnlib was renamed to python2-rhnlib. Change bootstrap data accordingly.

susemanager-schema:

• Fix performance regression in inter-server-sync (bsc#1128781)

susemanager-docs_en:

• Update text and image files
• 2.1 comparison: clarify profile syncing support
• Adjust documentation about notification settings
• Fix internal link (SMT documentation).
• Remove documentation about the 'mgr-sync enable-scc' subcommand. This subcommand is no longer available.

susemanager-frontend-libs:

• Update jquery.timepicker to 1.11.14 (bsc#1119081)

tika-core:

• New upstream version (1.20). Fixes infinite loop in SQLite3Parser (CVE-2018-17197) (bsc#1121038)