{"id":"CVE-2017-10807","aliases":["DEBIAN-CVE-2017-10807","DSA-3902-1","EUVD-2017-2451","GHSA-cv95-3vq8-8f64","SUSE-SU-2017:2257-1","SUSE-SU-2017:2266-1","SUSE-SU-2017:2267-1","UBUNTU-CVE-2017-10807","USN-8984-1"],"status":"published","title":"JabberD 2.x (aka jabberd2) before 2.6.1 allows anyone to authenticate using SASL ANONYMOUS, even...","description":"JabberD 2.x (aka jabberd2) before 2.6.1 allows anyone to authenticate using SASL ANONYMOUS, even when the sasl.anonymous c2s.xml option is not enabled.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02812,"percentile":0.86618,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2017-07-04T15:00:00Z","modified":"2026-11-04T03:43:11Z","fixes":[{"ecosystem":"Debian:12","package":"jabberd2","fixed_in":["2.6.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"jabberd2","fixed_in":["2.6.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jabberd2","fixed_in":["2.6.1-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"jabberd2","fixed_in":["2.4.0-3+deb9u1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 3.1","package":"jabberd","fixed_in":["2.6.1-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 3.1","package":"osad","fixed_in":["5.11.80.3-2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 3.1","package":"rhnpush","fixed_in":["5.5.104.3-2.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 3.1","package":"spacewalk-backend","fixed_in":["2.7.73.7-2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 3.1","package":"spacewalk-certs-tools","fixed_in":["2.7.0.7-2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 3.1","package":"spacewalk-proxy","fixed_in":["2.7.1.4-2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 3.1","package":"spacewalk-web","fixed_in":["2.7.1.10-2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 3.1","package":"spacewalksd","fixed_in":["5.0.26.3-2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 3.1","package":"supportutils-plugin-susemanager-client","fixed_in":["3.1.2-2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 3.1","package":"zypp-plugin-spacewalk","fixed_in":["0.9.16-2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 3.0","package":"jabberd","fixed_in":["2.6.1-4.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.0","package":"jabberd","fixed_in":["2.6.1-4.6.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"jabberd2","fixed_in":["2.3.4-1ubuntu2+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"jabberd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"jabberd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"jabberd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"jabberd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-3+deb9u1"}]}],"versions":["2.4.0-3"]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-5.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"jabberd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"osad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.11.80.3-2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"rhnpush","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.104.3-2.3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"salt-netapi-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0-3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"smdba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.8-0.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.8.6-2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.73.7-2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"spacewalk-branding","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.2.7-2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0.7-2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.46.5-2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"spacewalk-search","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.3.2-2.3.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"spacewalk-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.10.5-2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1.10-2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.8-2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3-10.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.9-2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"susemanager-sync-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.1","package":"jabberd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.1","package":"osad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.11.80.3-2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.1","package":"rhnpush","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.104.3-2.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.1","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.73.7-2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.1","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0.7-2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.1","package":"spacewalk-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1.4-2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.1","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1.10-2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.1","package":"spacewalksd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.26.3-2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.1","package":"supportutils-plugin-susemanager-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.1","package":"zypp-plugin-spacewalk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.16-2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.0","package":"jabberd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-4.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.0","package":"jabberd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-4.6.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"jabberd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.4-1ubuntu2+esm1"}]}],"versions":["2.3.3-3ubuntu1","2.3.4-1ubuntu1","2.3.4-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"jabberd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.4-1ubuntu2+esm1"}]}],"versions":["2.3.3-3ubuntu1","2.3.4-1ubuntu1","2.3.4-1ubuntu2"]}],"products":[{"vendor":"jabberd2","product":"jabberd2"}],"references":[{"url":"https://github.com/jabberd2/jabberd2/commit/8416ae54ecefa670534f27a31db71d048b9c7f16","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.debian.org/security/2017/dsa-3902","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://github.com/jabberd2/jabberd2/releases/tag/jabberd-2.6.1","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","report"]},{"url":"http://www.securityfocus.com/bid/99511","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://bugs.debian.org/867032","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-10807"},{"url":"https://github.com/advisories/GHSA-cv95-3vq8-8f64"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-10807","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172257-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1009118","tags":["report"]},{"url":"https://bugzilla.suse.com/1017513","tags":["report"]},{"url":"https://bugzilla.suse.com/1019759","tags":["report"]},{"url":"https://bugzilla.suse.com/1028098","tags":["report"]},{"url":"https://bugzilla.suse.com/1030898","tags":["report"]},{"url":"https://bugzilla.suse.com/1031143","tags":["report"]},{"url":"https://bugzilla.suse.com/1031602","tags":["report"]},{"url":"https://bugzilla.suse.com/1032324","tags":["report"]},{"url":"https://bugzilla.suse.com/1032350","tags":["report"]},{"url":"https://bugzilla.suse.com/1033999","tags":["report"]},{"url":"https://bugzilla.suse.com/1035728","tags":["report"]},{"url":"https://bugzilla.suse.com/1037609","tags":["report"]},{"url":"https://bugzilla.suse.com/1038321","tags":["report"]},{"url":"https://bugzilla.suse.com/1039458","tags":["report"]},{"url":"https://bugzilla.suse.com/1039579","tags":["report"]},{"url":"https://bugzilla.suse.com/1039913","tags":["report"]},{"url":"https://bugzilla.suse.com/1042199","tags":["report"]},{"url":"https://bugzilla.suse.com/1042552","tags":["report"]},{"url":"https://bugzilla.suse.com/1042846","tags":["report"]},{"url":"https://bugzilla.suse.com/1042975","tags":["report"]},{"url":"https://bugzilla.suse.com/1043143","tags":["report"]},{"url":"https://bugzilla.suse.com/1043430","tags":["report"]},{"url":"https://bugzilla.suse.com/1043795","tags":["report"]},{"url":"https://bugzilla.suse.com/1043831","tags":["report"]},{"url":"https://bugzilla.suse.com/1044719","tags":["report"]},{"url":"https://bugzilla.suse.com/1045152","tags":["report"]},{"url":"https://bugzilla.suse.com/1045266","tags":["report"]},{"url":"https://bugzilla.suse.com/1045981","tags":["report"]},{"url":"https://bugzilla.suse.com/1046176","tags":["report"]},{"url":"https://bugzilla.suse.com/1046218","tags":["report"]},{"url":"https://bugzilla.suse.com/1046314","tags":["report"]},{"url":"https://bugzilla.suse.com/1046865","tags":["report"]},{"url":"https://bugzilla.suse.com/1047282","tags":["report"]},{"url":"https://bugzilla.suse.com/1047352","tags":["report"]},{"url":"https://bugzilla.suse.com/1047513","tags":["report"]},{"url":"https://bugzilla.suse.com/1047641","tags":["report"]},{"url":"https://bugzilla.suse.com/1047656","tags":["report"]},{"url":"https://bugzilla.suse.com/1047680","tags":["report"]},{"url":"https://bugzilla.suse.com/1047707","tags":["report"]},{"url":"https://bugzilla.suse.com/1048183","tags":["report"]},{"url":"https://bugzilla.suse.com/1048968","tags":["report"]},{"url":"https://bugzilla.suse.com/1049162","tags":["report"]},{"url":"https://bugzilla.suse.com/1049425","tags":["report"]},{"url":"https://bugzilla.suse.com/1049471","tags":["report"]},{"url":"https://bugzilla.suse.com/1049575","tags":["report"]},{"url":"https://bugzilla.suse.com/1049664","tags":["report"]},{"url":"https://bugzilla.suse.com/1049665","tags":["report"]},{"url":"https://bugzilla.suse.com/1050385","tags":["report"]},{"url":"https://bugzilla.suse.com/1051518","tags":["report"]},{"url":"https://bugzilla.suse.com/1051719","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7538","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172266-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1036260","tags":["report"]},{"url":"https://bugzilla.suse.com/1049936","tags":["report"]},{"url":"https://bugzilla.suse.com/1052039","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172267-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-10807","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-10807","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8984-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2017-10807","description":"JabberD 2.x (aka jabberd2) before 2.6.1 allows anyone to authenticate using SASL ANONYMOUS, even when the sasl.anonymous c2s.xml option is not enabled.","status":"published","published":"2017-07-04T15:00:00Z","modified":"2024-08-05T17:50:11.702Z","updated_at":"2026-11-02T14:33:13.27226Z"}],"euvd":[{"id":"EUVD-2017-2451","description":"JabberD 2.x (aka jabberd2) before 2.6.1 allows anyone to authenticate using SASL ANONYMOUS, even when the sasl.anonymous c2s.xml option is not enabled.","status":"published","published":"2017-07-04T15:00:00Z","modified":"2024-08-05T17:50:11Z","updated_at":"2026-11-03T02:23:25.703104Z"}],"ghsa":[{"id":"GHSA-cv95-3vq8-8f64","title":"JabberD 2.x (aka jabberd2) before 2.6.1 allows anyone to authenticate using SASL ANONYMOUS, even...","description":"JabberD 2.x (aka jabberd2) before 2.6.1 allows anyone to authenticate using SASL ANONYMOUS, even when the sasl.anonymous c2s.xml option is not enabled.","status":"published","published":"2022-05-17T00:27:17Z","modified":"2023-02-03T05:01:43Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:53:01.625617Z"}],"nvd":[{"id":"CVE-2017-10807","description":"JabberD 2.x (aka jabberd2) before 2.6.1 allows anyone to authenticate using SASL ANONYMOUS, even when the sasl.anonymous c2s.xml option is not enabled.","status":"published","published":"2017-07-04T15:29:00.187Z","modified":"2026-06-17T01:00:44.65Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:03:51.893212Z"}],"osv":[{"id":"CVE-2017-10807","description":"JabberD 2.x (aka jabberd2) before 2.6.1 allows anyone to authenticate using SASL ANONYMOUS, even when the sasl.anonymous c2s.xml option is not enabled.","status":"published","published":"2017-07-04T15:29:00.187Z","modified":"2026-10-20T13:13:03.543070276Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:03.851821Z"},{"id":"DEBIAN-CVE-2017-10807","description":"JabberD 2.x (aka jabberd2) before 2.6.1 allows anyone to authenticate using SASL ANONYMOUS, even when the sasl.anonymous c2s.xml option is not enabled.","status":"published","published":"2017-07-04T15:29:00.187Z","modified":"2026-09-01T20:03:40.883516253Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:28.207321Z"},{"id":"UBUNTU-CVE-2017-10807","description":"JabberD 2.x (aka jabberd2) before 2.6.1 allows anyone to authenticate using SASL ANONYMOUS, even when the sasl.anonymous c2s.xml option is not enabled.","status":"published","published":"2017-07-04T15:29:00Z","modified":"2026-11-04T03:30:06.668581313Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-04T03:56:45.249606Z"},{"id":"DSA-3902-1","title":"jabberd2 - security update","status":"published","published":"2017-07-05T00:00:00Z","modified":"2026-03-09T01:18:05.437528Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"SUSE-SU-2017:2257-1","title":"Security update for SUSE Manager Server 3.1","description":"This update for the SUSE Manager Server 3.1 provides several fixes and improvements.\n\nThe following security issues have been fixed:\n\njabberd:\n\n- Fix offered SASL mechanism check. (bsc#1047282, CVE-2017-10807)\n\nspacewalk-java:\n\n- Do not allow XSS as Organization name. (bsc#1048968, CVE-2017-7538)\n\nAdditionally, the following non-security issues have been fixed:\n\ncobbler:\n\n- Fix missing arguments and location for Xen. (bsc#1048183)\n\njabberd:\n\n- Fix memory leak in pgsql storage driver.\n- Fix two double-frees caused by dangling pointers.\n- wss:// (WebSocket over SSL) support in c2s.\n- Allow BareJID S10N packets.\n- SQLite postconnect SQL support.\n- Support WebSocket fragmented packets.\n- Module to verify users using e-mail.\n- Use OpenSSL functions for base64 en/decoding when available.\n- Option to dump packet-filter matched packets to file.\n- bcrypt support for PostgreSQL and MySQL storage.\n- Option to set authreg module per realm.\n- WebSocket C2S SX plugin.\n- Support for RSA/DH/ECDH key agreement.\n- For a detailed description of all fixes, please refer to the changelog.\n\nosad:\n\n- Reduce maximal size of osad log before rotating.\n- Perform osad restart in posttrans. (bsc#1039913)\n\nsalt-netapi-client:\n\n- Fix date format for Schedule.\n- Fix sending kwarg in payload in RunnerCall.\n- Better error handling in Runner and Wheel calls.\n- Increase the default SOCKET_TIMEOUT to 20 seconds.\n\nsmdba:\n\n- Add support for postgresql96. (bsc#1045152)\n\nspacecmd:\n\n- Configchannel export binary flag to json. (bsc#1044719)\n\nspacewalk-backend:\n\n- Make master_label static to keep its value when retrying. (bsc#1038321)\n- Adapt for the new gpgcheck flag for the channels.\n\nspacewalk-branding:\n\n- Fix overlapping of elements. (bsc#1031143)\n- Fix overlapping text narrow window. (bsc#1009118) \n- Fix formulas action buttons position. (bsc#1047513)\n- Fix broken link. (bsc#1033999)\n- Alphabar: Change title to 'Select first character'. (bsc#1042199)\n\nspacewalk-certs-tools:\n\n- Improve text for bootstrap. (bsc#1032324)\n\nspacewalk-java:\n\n- Don't add default channel if AK is not valid. (bsc#1047656)\n- Add 'Enable GPG check' function for channels.\n- No legend icon for Activity Ocurring. (bsc#1051719)\n- Implement API call for bootstrapping systems.\n- Fix product ids reported for SUSE Manager Server to the subscription matcher.\n- Fix adding products when assigning channels. (bsc#1049664)\n- Set default memory size for SLES 12 installations to 1024MB. (bsc#1047707)\n- Enable remote-command for Salt clients in SSM. (bsc#1050385)\n- Add missing help icons/links. (bsc#1049425)\n- Fix invalid help links. (bsc#1049425) \n- Fix wrong openscap xid. (bsc#1030898)\n- Fix overlapping text narrow window. (bsc#1009118) \n- Fixes alignment on the orgdetails. (bsc#1017513)\n- Fix text for activation key buttons. (bsc#1042975) \n- Correctly set, check and cut textarea maxlength. (bsc#1043430)\n- MinionActionExecutor: Raise skip timeout. (bsc#1046865)\n- Update channels.xml with OpenStack Cloud Continuous Delivery 6. (bsc#1039458)\n- Do not create VirtualInstance duplicates for the same 'uuid'.\n- Add taskomatic task to cleanup duplicated uuids for same system id.\n- Handle possible wrong UUIDs on SLE11 minions. (bsc#1046218)\n- Removed duplicate overview menu item. (bsc#1045981) \n- Enable act-key name empty on creation. (bsc#1032350)\n- Fix NPE when there's not udev results. (bsc#1042552)\n- Alphabar: Change title to 'Select first character'. (bsc#1042199)\n- Duplicate Systems: Correct language not to mention 'profiles'. (bsc#1035728)\n- Fix list filters to work with URL special characters. (bsc#1042846)\n- Use getActive() instead of isActive() for JavaBeans compliance. (bsc#1043143)\n- Fix hide non-org event details. (bsc#1039579)\n\nspacewalk-search:\n\n- Remove executable bit from service files. (bsc#1051518)\n\nspacewalk-utils:\n\n- Don't show password on input in spacewalk-manage-channel-lifecycle. (bsc#1043795)\n\nspacewalk-web:\n\n- Fix overlapping of elements. (bsc#1031143)\n- Fix formulas action buttons position. (bsc#1047513)\n- Do not show old messages. (bsc#1043831)\n- Add a dynamic counter of the remaining textarea length.\n- Confirm if navigating away while bootstrapping.\n\nsusemanager:\n\n- Assert correct java version. (bsc#1049575)\n- Create bootstrap repository for SLES for SAP 11 SP1. (bsc#1049471)\n- Adjust the bootstrap repository with SLE 12 SP3 repositories.\n\nsusemanager-docs_en:\n\n- Improve Icinga services example. (bsc#1019759)\n- Make Section reference Configuration Management more clear. (bsc#1047352)\n- Add missing 'host_name' in service definition example for Icinga. (bsc#1049162)\n- Fix documentation on moving database. (bsc#1031602)\n- Add missing Autoinstallation page in Advanced Topics guide. (bsc#1047680)\n- Make API documentation available online. (bsc#1047641)\n- Fix Reference Guide Documentation issues. (bsc#1045266)\n- Update online documentation components. (bsc#1046314)\n- Update online documentation. (bsc#1046176)\n\nsusemanager-schema:\n\n- Adapt for the new gpgcheck flag for the channels.\n\nsusemanager-sync-data:\n\n- Add support for SLE 12 SP3 product family, SUSE Enterprise Storage 5, OpenStack Cloud 6 Continuous Delivery\n  and Public Cloud for ppc64le. (bsc#1028098, bsc#1039458, bsc#1037609, bsc#1049665)\n\nHow to apply this update:\n1. Log in as root user to the SUSE Manager server.\n2. Stop the Spacewalk service:\nspacewalk-service stop\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Upgrade the database schema:\nspacewalk-schema-upgrade\n5. Start the Spacewalk service:\nspacewalk-service start\n","status":"published","published":"2017-08-25T11:42:16Z","modified":"2026-02-04T03:19:23.211028Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:2266-1","title":"Security update for SUSE Manager Proxy 3.1","description":"This update for SUSE Manager Proxy 3.1 provides several fixes and improvements:\n\nThe following security issues have been fixed:\n\njabberd:\n\n- Fix offered SASL mechanism check. (bsc#1047282, CVE-2017-10807)\n\nAdditionally, the following non-security issues have been fixed:\n\njabberd:\n\n- Fix memory leak in pgsql storage driver.\n- Fix two double-frees caused by dangling pointers.\n- wss:// (WebSocket over SSL) support in c2s.\n- Allow BareJID S10N packets.\n- SQLite postconnect SQL support.\n- Support WebSocket fragmented packets.\n- Module to verify users using e-mail.\n- Use OpenSSL functions for base64 en/decoding when available.\n- Option to dump packet-filter matched packets to file.\n- bcrypt support for PostgreSQL and MySQL storage.\n- Option to set authreg module per realm.\n- WebSocket C2S SX plugin.\n- Support for RSA/DH/ECDH key agreement.\n- For a detailed description of all fixes, please refer to the changelog.\n\nosad:\n\n- Reduce maximal size of osad log before rotating.\n- Perform osad restart in posttrans. (bsc#1039913)\n\nspacewalk-backend:\n\n- Make master_label static to keep its value when retrying. (bsc#1038321)\n- Adapt for the new gpgcheck flag for the channels.\n\nspacewalk-certs-tools:\n\n- Improve text for bootstrap. (bsc#1032324)\n\nspacewalk-proxy:\n\n- Use query string in upstream HEAD requests. (bsc#1036260)\n\nspacewalk-web:\n\n- Fix overlapping of elements. (bsc#1031143)\n- Fix formulas action buttons position. (bsc#1047513)\n- Do not show old messages. (bsc#1043831)\n- Add a dynamic counter of the remaining textarea length.\n- Confirm if navigating away while bootstrapping.\n\nspacewalksd:\n\n- Fix permissions of PID files in spacewalksd. (bsc#1049936)\n\nzypp-plugin-spacewalk:\n\n- Fix setting pkg_gpgcheck.\n- Make pkg_gpgcheck configurable.\n\nHow to apply this update:\n1. Log in as root user to the SUSE Manager proxy.\n2. Stop the proxy service:\nspacewalk-proxy stop\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Start the Spacewalk service:\nspacewalk-proxy start\n","status":"published","published":"2017-08-25T11:42:12Z","modified":"2026-02-04T02:26:44.43528Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:2267-1","title":"Security update for jabberd","description":"This update for jabberd fixes the following issues:\n\n  - CVE-2017-10807: SASLANONYMOUS authentication method allowed anyone to authentication even if option was disabled (bsc#1047282)\n\n","status":"published","published":"2017-08-25T13:26:50Z","modified":"2026-02-04T04:00:04.246546Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"USN-8984-1","title":"jabberd2 vulnerability","description":"It was discovered that jabberd2 allowed SASL ANONYMOUS authentication even\nwhen it was not enabled in the configuration. A remote attacker could\npossibly use this issue to bypass authentication.","status":"published","published":"2026-11-03T17:35:55Z","modified":"2026-11-04T03:43:11.862598367Z","updated_at":"2026-11-04T03:56:18.279609Z"}]}}