SUSE-SU-2023:1830-1

Security update for SUSE Manager Server 4.3

No scoreFix available

SUSE-SU-2023:1830-1 is a vulnerability with no CVSS score yet in spacewalk-web, published April 13, 2023. No source lists public exploit code. Fixed in spacewalk-web 4.3.29-150400.3.18.1.

What does this mean?

Severity: UnratedNo CVSS score yet
Exploit chance: UnscoredNo EPSS score yet
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 4.3.29-150400.3.18.1spacewalk-web +2 more

Description

This update fixes the following issues:

spacewalk-java:

Version 4.3.52-1
- Add more restricted arguments to prevent HTTP API logging sensitive data (bsc#1209386, bsc#1209395)

spacewalk-web:

Version 4.3.29-1

Fix datepicker appearing behind modal edge (bsc#1209703)
Fix datepicker layout shift on Highstate pages

How to apply this update:

Log in as root user to the SUSE Manager Server.
Stop the Spacewalk service: spacewalk-service stop
Apply the patch using either zypper patch or YaST Online Update.
Start the Spacewalk service: spacewalk-service start

Affected packages

Affected packages
Package	Affected	Fixed
`spacewalk-web` SUSE:Manager Proxy Module 4.3	before 4.3.29-150400.3.18.1	4.3.29-150400.3.18.1
`spacewalk-java` SUSE:Manager Server Module 4.3	before 4.3.52-150400.3.41.3	4.3.52-150400.3.41.3
`spacewalk-web` SUSE:Manager Server Module 4.3	before 4.3.29-150400.3.18.1	4.3.29-150400.3.18.1

What each source reports

OSVNo score

Security update for SUSE Manager Server 4.3