SUSE-SU-2022:4442-1

Security update for SUSE Manager Server 4.2

No scoreFix available

SUSE-SU-2022:4442-1 is a vulnerability with no CVSS score yet in spacewalk-web, published December 13, 2022. No source lists public exploit code. Fixed in spacewalk-web 4.2.31-150300.3.33.2.

What does this mean?

Severity: UnratedNo CVSS score yet
Exploit chance: UnscoredNo EPSS score yet
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 4.2.31-150300.3.33.2spacewalk-web +3 more

Description

This update fixes the following issues:

spacewalk-java:

Version 4.2.44-1
- Do not disclose Proxy password in browser console log. (bsc#1205339)

spacewalk-web:

Version 4.2.31-1
- Do not log Proxy password in browser console log. (bsc#1205339)

susemanager-sync-data:

Version 4.2.14-1
- Add SUSE Linux Enterprise Server 15 SP3 LTSS

How to apply this update:

Log in as root user to the SUSE Manager server.
Stop the Spacewalk service: spacewalk-service stop
Apply the patch using either zypper patch or YaST Online Update.
Start the Spacewalk service: spacewalk-service start

Affected packages

Affected packages
Package	Affected	Fixed
`spacewalk-web` SUSE:Manager Proxy Module 4.2	before 4.2.31-150300.3.33.2	4.2.31-150300.3.33.2
`spacewalk-java` SUSE:Manager Server Module 4.2	before 4.2.44-150300.3.51.3	4.2.44-150300.3.51.3
`spacewalk-web` SUSE:Manager Server Module 4.2	before 4.2.31-150300.3.33.2	4.2.31-150300.3.33.2
`susemanager-sync-data` SUSE:Manager Server Module 4.2	before 4.2.14-150300.3.24.1	4.2.14-150300.3.24.1

What each source reports

OSVNo score

Security update for SUSE Manager Server 4.2