{"id":"CVE-2018-1077","aliases":["EUVD-2018-11729","GHSA-c447-rp4f-fgvj","SUSE-RU-2020:0671-1","SUSE-SU-2020:0671-1","SUSE-SU-2020:0856-1"],"status":"published","title":"Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially...","description":"Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01043,"percentile":0.64295,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-611"],"published":"2018-03-14T18:00:00Z","modified":"2026-10-24T10:31:02Z","affected":[{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"mgr-osad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.11-3.9.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"patterns-suse-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-9.10.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.18-3.13.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.30-3.23.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.15-3.15.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.12-3.13.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.19-3.18.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"supportutils-plugin-susemanager-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-3.3.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"supportutils-plugin-susemanager-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-3.3.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"mgr-osad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.11-3.9.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"patterns-suse-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-9.10.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.18-3.13.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.30-3.23.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.15-3.15.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.12-3.13.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.19-3.18.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"supportutils-plugin-susemanager-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-3.3.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"supportutils-plugin-susemanager-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-3.3.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"branch-network-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1580471316.1839544-3.10.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"image-sync-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1579102150.4716559-3.11.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"mgr-osad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.11-3.9.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"patterns-suse-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-9.10.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"prometheus-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1-4.7.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"pxe-default-image-sle15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.1-20200305173027"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"pxe-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1580384994.6076a7e-3.11.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"py26-compat-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.10-10.11.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"python-susemanager-retail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1580471316.1839544-3.13.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"redstone-xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1_20071120-0.11.3.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"salt-netapi-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0-4.3.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.18-3.13.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-3.6.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.30-3.23.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.15-3.15.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.12-3.13.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.31-3.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-search","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-3.11.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-setup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.13-3.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.16-3.15.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.19-3.18.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"subscription-matcher","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-3.3.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.22-3.20.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"susemanager-doc-indexes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-10.18.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-10.18.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.18-3.17.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.24-3.17.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"susemanager-sync-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.16-3.15.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"system-lock-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2-4.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"virtualization-host-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2-4.3.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"py26-compat-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.10-6.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"redstone-xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1_20071120-0.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.25.14-3.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.4.6-3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.57.22-3.48.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.8.14-3.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.22.7-3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.78.28-3.47.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-setup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.7.10-3.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.18.6-3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.7.23-3.45.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"subscription-matcher","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-4.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.23-3.40.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.30-3.44.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"susemanager-sync-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.19-3.35.1"}]}],"bundled":2}],"products":[{"vendor":"red hat","product":"spacewalk"},{"vendor":"redhat","product":"satellite"},{"vendor":"redhat","product":"spacewalk"},{"vendor":"spacewalk","product":"spacewalk"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1555429","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1077"},{"url":"https://github.com/advisories/GHSA-c447-rp4f-fgvj"},{"url":"https://www.suse.com/support/update/announcement/-2020-671/suse-ru-20200671-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1083326","tags":["report"]},{"url":"https://bugzilla.suse.com/1085414","tags":["report"]},{"url":"https://bugzilla.suse.com/1121640","tags":["report"]},{"url":"https://bugzilla.suse.com/1123274","tags":["report"]},{"url":"https://bugzilla.suse.com/1137248","tags":["report"]},{"url":"https://bugzilla.suse.com/1140332","tags":["report"]},{"url":"https://bugzilla.suse.com/1144176","tags":["report"]},{"url":"https://bugzilla.suse.com/1152673","tags":["report"]},{"url":"https://bugzilla.suse.com/1152795","tags":["report"]},{"url":"https://bugzilla.suse.com/1153269","tags":["report"]},{"url":"https://bugzilla.suse.com/1154246","tags":["report"]},{"url":"https://bugzilla.suse.com/1154590","tags":["report"]},{"url":"https://bugzilla.suse.com/1154599","tags":["report"]},{"url":"https://bugzilla.suse.com/1155281","tags":["report"]},{"url":"https://bugzilla.suse.com/1155372","tags":["report"]},{"url":"https://bugzilla.suse.com/1156751","tags":["report"]},{"url":"https://bugzilla.suse.com/1157317","tags":["report"]},{"url":"https://bugzilla.suse.com/1157346","tags":["report"]},{"url":"https://bugzilla.suse.com/1157447","tags":["report"]},{"url":"https://bugzilla.suse.com/1157700","tags":["report"]},{"url":"https://bugzilla.suse.com/1157975","tags":["report"]},{"url":"https://bugzilla.suse.com/1158178","tags":["report"]},{"url":"https://bugzilla.suse.com/1158181","tags":["report"]},{"url":"https://bugzilla.suse.com/1158283","tags":["report"]},{"url":"https://bugzilla.suse.com/1158480","tags":["report"]},{"url":"https://bugzilla.suse.com/1158564","tags":["report"]},{"url":"https://bugzilla.suse.com/1158672","tags":["report"]},{"url":"https://bugzilla.suse.com/1158697","tags":["report"]},{"url":"https://bugzilla.suse.com/1158754","tags":["report"]},{"url":"https://bugzilla.suse.com/1158818","tags":["report"]},{"url":"https://bugzilla.suse.com/1158899","tags":["report"]},{"url":"https://bugzilla.suse.com/1158943","tags":["report"]},{"url":"https://bugzilla.suse.com/1159012","tags":["report"]},{"url":"https://bugzilla.suse.com/1159023","tags":["report"]},{"url":"https://bugzilla.suse.com/1159076","tags":["report"]},{"url":"https://bugzilla.suse.com/1159184","tags":["report"]},{"url":"https://bugzilla.suse.com/1159492","tags":["report"]},{"url":"https://bugzilla.suse.com/1159553","tags":["report"]},{"url":"https://bugzilla.suse.com/1160184","tags":["report"]},{"url":"https://bugzilla.suse.com/1160940","tags":["report"]},{"url":"https://bugzilla.suse.com/1161755","tags":["report"]},{"url":"https://bugzilla.suse.com/1161862","tags":["report"]},{"url":"https://bugzilla.suse.com/1162609","tags":["report"]},{"url":"https://bugzilla.suse.com/1162683","tags":["report"]},{"url":"https://bugzilla.suse.com/1164120","tags":["report"]},{"url":"https://bugzilla.suse.com/1164309","tags":["report"]},{"url":"https://bugzilla.suse.com/1164452","tags":["report"]},{"url":"https://bugzilla.suse.com/1164649","tags":["report"]},{"url":"https://bugzilla.suse.com/1164875","tags":["report"]},{"url":"https://bugzilla.suse.com/1165425","tags":["report"]},{"url":"https://bugzilla.suse.com/1165541","tags":["report"]},{"url":"https://bugzilla.suse.com/1165927","tags":["report"]},{"url":"https://bugzilla.suse.com/1166061","tags":["report"]},{"url":"https://bugzilla.suse.com/1166388","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1077","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16769","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1693","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200671-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200856-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1160246","tags":["report"]},{"url":"https://bugzilla.suse.com/1163001","tags":["report"]},{"url":"https://bugzilla.suse.com/1163538","tags":["report"]},{"url":"https://bugzilla.suse.com/1164563","tags":["report"]},{"url":"https://bugzilla.suse.com/1164771","tags":["report"]},{"url":"https://bugzilla.suse.com/1165921","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-1077","description":"Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server.","status":"published","published":"2018-03-14T18:00:00Z","modified":"2024-09-17T01:21:18.539Z","cwes":["CWE-611"],"updated_at":"2026-11-02T14:35:08.701206Z"}],"euvd":[{"id":"EUVD-2018-11729","description":"Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server.","status":"published","published":"2018-03-14T18:00:00Z","modified":"2024-09-17T01:21:18Z","updated_at":"2026-11-03T00:28:50.234993Z"}],"ghsa":[{"id":"GHSA-c447-rp4f-fgvj","title":"Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially...","description":"Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server.","status":"published","published":"2022-05-13T01:33:34Z","modified":"2023-02-01T05:08:35Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:50:48.372333Z"}],"nvd":[{"id":"CVE-2018-1077","description":"Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server.","status":"published","published":"2018-03-14T18:29:00.42Z","modified":"2026-06-17T01:50:25.75Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:04:24.264003Z"}],"osv":[{"id":"CVE-2018-1077","description":"Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server.","status":"published","published":"2018-03-14T18:29:00.42Z","modified":"2026-10-24T10:31:02.527026454Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:07.641418Z"},{"id":"SUSE-RU-2020:0671-1","title":"Recommended update for SUSE Manager Proxy 4.0","description":"\nThis update fixes the following issues:\n\nmgr-osad:\n\n- Take care that osad is not disabled nor deactivated during update\n  (bsc#1157700, bsc#1158697)\n\npatterns-suse-manager:\n\n- Add recommends for virtualization-host-formula to suma_server pattern\n- Add recommends for virtualization-host-formula to retail\n\nspacecmd:\n\n- Bugfix: attempt to purge SSM when it is empty (bsc#1155372)\n\nspacewalk-backend:\n\n- Fix mgrcfg-client python3 breakage (bsc#1164309)\n- Update doc link to point to new documentation server\n- Prevent timestamp format exception on mgr-inter-sync while processing comps (bsc#1157346)\n- When downloading repo metadata, don't add '/' to the repo url if it already ends with one (bsc#1158899)\n- Use HTTP proxy settings when fetching the mirrorlist on spacewalk-repo-sync (bsc#1159076)\n- Enhance suseProducts via ISS to fix SP migration on slave server (bsc#1159184)\n- Prevent a traceback when reposyncing openSUSE 15.1 (bsc#1158672)\n- Close config files after reading them (bsc#1158283)\n- Associate VMs and systems with the same machine ID at bootstrap (bsc#1144176)\n\nspacewalk-certs-tools:\n\n- Add 'start_event_grains' minion option to configfile when generated by bootstrap script\n- Forbid multiple activation keys for salt minions during bootstrap (bsc#1164452)\n- Add additional minion options to configfile when generated by\n  bootstrap script (bsc#1159492)\n- Change the order to check the version correctly for RES (bsc#1152795)\n\nspacewalk-client-tools:\n\n- Spell correctly 'successful' and 'successfully'\n\nspacewalk-web:\n\n- Don't validate mandatory fields that are not visible (bsc#1158943)\n- Fix count of changes to build (bsc#1160940)\n- Report merge_subscriptions message in a readable way (bsc#1140332)\n- Fix ordering by date (bsc#1158818)\n\nsupportutils-plugin-susemanager-client:\n\n- Rename rhncfg-actions to mgr-cfg-actions\n\nsupportutils-plugin-susemanager-proxy:\n\n- Rename rhncfg-actions to mgr-cfg-actions\n\nHow to apply this update:\n1. Log in as root user to the SUSE Manager proxy.\n2. Stop the proxy service:\nspacewalk-proxy stop\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Start the Spacewalk service:\nspacewalk-proxy start\n","status":"published","published":"2020-03-13T12:32:42Z","modified":"2026-02-04T03:46:42.929436Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2020:0671-1","title":"Security update for SUSE Manager Server 4.0","description":"\nThis update fixes the following issues:\n\nbranch-network-formula:\n\n- Update formula to include terminal naming and identification\n\nimage-sync-formula:\n\n- Prevent installing xdelta3 package and disable delta functionality\n  on SLE12 branch servers (bsc#1159553)\n\nmgr-osad:\n\n- Take care that osad is not disabled nor deactivated during update\n  (bsc#1157700, bsc#1158697)\n\npatterns-suse-manager:\n\n- Add recommends for virtualization-host-formula to suma_server pattern\n- Add recommends for virtualization-host-formula to retail\n\nprometheus-formula:\n\n- Bugfix: disabled fields not enabled when checkbox is checked\n\npxe-default-image-sle15:\n\n- Adapt to new kiwi version to fix pre registration in\n  the bare-metal image (bsc#1153269)\n\npxe-formula:\n\n- Add support for new features in terminal naming\n- Remove branch_id from pxe form, moved to branch-network form\n\npy26-compat-salt:\n\n- Replace pycrypto with M2Crypto as dependency for SLE15+\n\npython-susemanager-retail:\n\n- Add support for terminal naming block\n- Add delta support for SLE15 tar.xz bundles\n\nredstone-xmlrpc:\n\n- Disable external entity parsing (1790381, bsc#1164120, CVE-2020-1693)\n- Do not download external entities (1555429, bsc#1085414, CVE-2018-1077)\n\nsalt-netapi-client:\n\n- Version 0.17.0\n  See: https://github.com/SUSE/salt-netapi-client/releases/tag/v0.17.0\n\nspacecmd:\n\n- Bugfix: attempt to purge SSM when it is empty (bsc#1155372)\n\nspacewalk-admin:\n\n- Spell correctly 'successful' and 'successfully'\n\nspacewalk-backend:\n\n- Fix mgrcfg-client python3 breakage (bsc#1164309)\n- Update doc link to point to new documentation server\n- Prevent timestamp format exception on mgr-inter-sync while processing comps (bsc#1157346)\n- When downloading repo metadata, don't add '/' to the repo url if it already ends with one (bsc#1158899)\n- Use HTTP proxy settings when fetching the mirrorlist on spacewalk-repo-sync (bsc#1159076)\n- Enhance suseProducts via ISS to fix SP migration on slave server (bsc#1159184)\n- Prevent a traceback when reposyncing openSUSE 15.1 (bsc#1158672)\n- Close config files after reading them (bsc#1158283)\n- Associate VMs and systems with the same machine ID at bootstrap (bsc#1144176)\n\nspacewalk-certs-tools:\n\n- Add 'start_event_grains' minion option to configfile when generated by bootstrap script\n- Forbid multiple activation keys for salt minions during bootstrap (bsc#1164452)\n- Add additional minion options to configfile when generated by\n  bootstrap script (bsc#1159492)\n- Change the order to check the version correctly for RES (bsc#1152795)\n\nspacewalk-client-tools:\n\n- Spell correctly 'successful' and 'successfully'\n\nsystem-lock-formula:\n    \n- Clarified terms along documentation and product (bsc#1166061)\n    \nspacewalk-java:\n\n- Feat: enable Salt system lock when CaaSP node is onboarded and add\n  depedency to 'system-lock-formula' (bsc#1165541)\n- Support non discoverable fqdns via custom grain (bsc#1155281)\n- Handle the non-existent requested grains gracefully\n- Get the machineid grain from the minion startup event\n- Use term 'patch' instead of 'errata' (bsc#1164649)\n- Enable provisioning API with salt and bootstrap entitled systems\n- Fix a problem with removing the monitoring entitlement from a system\n- Improve performance when adding systems to system groups (bsc#1158754)\n- Migrate pillar and formula data on minion id change (bsc#1161755)\n- Change doc links pointing to new documentation server\n- Call saltutil.sync_all before calling highstate (bsc#1152673)\n- Exclude base products from PAYG (Pay-As-You-Go) instances when doing subscription matching\n- Show additional headers and dependencies for deb packages\n- Show adequate message on saving formulas that change only pillar data\n- Fix mgr-sync add channel when fromdir is configured (bsc#1160184)\n- Handle not found re-activation key (bsc#1159012)\n- Write a list of formulas sorted by execution order (bsc#1083326)\n- Use channel name from product tree instead of constructing it (bsc#1157317)\n- Read the subscriptions from the output instead of input (bsc#1140332)\n- Rename rhncfg-actions to mgr-cfg-actions in UI advice (bsc#1137248)\n- Fix container image import (bsc#1154246)\n- Add missing permission checks on formula api (bsc#1123274)\n- Generate metadata with empty vendor (bsc#1158480)\n- Remove undefined variable from redhat_register snippet\n- Add a method in API to check if the provided session key is a valid one.\n- Associate VMs and systems with the same machine ID at bootstrap (bsc#1144176)\n- Fix minion id when applying engine-events state (bsc#1158181)\n- Remove unnecessary WARN log entries from Kubernetes integration\n- Fix for pillar not being refreshed when CaaSP pattern is detected\n  upon software profile update (bsc#1166061)\n\nspacewalk-search:\n\n- Make rhn-search log to correct file (bsc#1156751)\n\nspacewalk-setup:\n\n- Spell correctly 'successful' and 'successfully'\n- create AJP connector for tomcat if it does not exist\n  (bsc#1165927, bsc#1166388)\n\nspacewalk-utils:\n\n- Spell 'successfully' correctly\n\nspacewalk-web:\n\n- Don't validate mandatory fields that are not visible (bsc#1158943)\n- Fix count of changes to build (bsc#1160940)\n- Report merge_subscriptions message in a readable way (bsc#1140332)\n- Fix ordering by date (bsc#1158818)\n\nsubscription-matcher:\n\n- Add missing library for SLE15 SP2 (slf4j-log4j12)\n- Make the code usable with Math3 on SLES\n- Use log4j12 package on newer SLE versions\n- Aggregate stackable subscriptions with same parameters\n- Implement new 'swap move' used in optaplanner (bsc#1140332)\n- Enable aarch64 builds, except for SLE \u003c 15 \n\nsusemanager:\n\n- Add missing python libraries to RES8/RHEL8/CentOS 8 boostrap repos (bsc#1164875)\n- Add bootstrap-repo data for OES 2018 SP2 (bsc#1161862)\n- Add bootstrap-repo data for SLE15 SP2 Family\n- Fix documentation URL in installer (bsc#1154590)\n- Update requirements to match documented values (bsc#1154599)\n\nsusemanager-doc-indexes:\n\n- Adding Additional FQDNS for Proxies with Salt\n- Reference guide review and update moving content into tabular format\n- Autogenerate pdf index from antora html nav lists\n- Documentation needs to address using RHEL8 in the correct way (bsc#1159023)\n- Traditional clients bootstrap, the example applies to SLES ES 7 only (bsc#1158564)\n- Remove auditlog-keeper from list\n- Removed duplicate client requirements entries\n- Fix missing spaces throughout docs\n- Added the complete path for using manager-setup\n- Fix typo in vhm-kubernetes\n- Cleaned up client registration documents\n- Improved ubuntu instructions\n- Explain how to compose a DSN string for monitoring\n- Added publishing dates to individual book intros\n- Updated common spacewalk-common-channels usage\n- Adding Additional FQDNS for Proxies with Salt\n- Reference guide review and update moving content into tabular format\n- Autogenerate pdf index from antora html nav lists\n- Documentation needs to address using RHEL8 in the correct way (bsc#1159023)\n- Traditional clients bootstrap, the example applies to SLES ES 7 only (bsc#1158564)\n- Remove auditlog-keeper from list\n- Removed duplicate client requirements entries\n- Fix missing spaces throughout docs\n- Added the complete path for using manager-setup\n- Fix typo in vhm-kubernetes\n- Cleaned up client registration documents\n- Improved ubuntu instructions\n- Explain how to compose a DSN string for monitoring\n- Added publishing dates to individual book intros\n- Updated common spacewalk-common-channels usage\n\nsusemanager-docs_en:\n\n- Adding Additional FQDNS for Proxies with Salt\n- Reference guide review and update moving content into tabular format\n- Autogenerate pdf index from antora html nav lists\n- Documentation needs to address using RHEL8 in the correct way (bsc#1159023)\n- Traditional clients bootstrap, the example applies to SLES ES 7 only (bsc#1158564)\n- Remove auditlog-keeper from list\n- Removed duplicate client requirements entries\n- Fix missing spaces throughout docs\n- Added the complete path for using manager-setup\n- Fix typo in vhm-kubernetes\n- Cleaned up client registration documents\n- Improved ubuntu instructions\n- Explain how to compose a DSN string for monitoring\n- Added publishing dates to individual book intros\n- Updated common spacewalk-common-channels usage\n- Adding Additional FQDNS for Proxies with Salt\n- Reference guide review and update moving content into tabular format\n- Autogenerate pdf index from antora html nav lists\n- Documentation needs to address using RHEL8 in the correct way (bsc#1159023)\n- Traditional clients bootstrap, the example applies to SLES ES 7 only (bsc#1158564)\n- Remove auditlog-keeper from list\n- Removed duplicate client requirements entries\n- Fix missing spaces throughout docs\n- Added the complete path for using manager-setup\n- Fix typo in vhm-kubernetes\n- Cleaned up client registration documents\n- Improved ubuntu instructions\n- Explain how to compose a DSN string for monitoring\n- Added publishing dates to individual book intros\n- Updated common spacewalk-common-channels usage\n\nsusemanager-schema:\n\n- Add new 'payg' attribute to rhnServer table\n- Enable re-activation keys for salt managed systems (bsc#1159012)\n- Generate metadata with empty vendor (bsc#1158480)\n- Fix rhnActionVirtDelete when migrating from 3.2 to 4.0 (bsc#1158178)\n\nsusemanager-sls:\n\n- Install dmidecode before HW profile update when missing\n- Add mgr_start_event_grains.sls to update minion config\n- Add 'product' custom state module to handle installation of\n  SUSE products at client side (bsc#1157447)\n- Support reading of pillar data for minions from multiple files (bsc#1158754)\n- Do not workaround util.syncmodules for SSH minions (bsc#1162609)\n- Force to run util.synccustomall when triggering action chains on SSH minions (bsc#1162683).\n- Add custom 'is_payg_instance' grain when instance is PAYG and not BYOS.\n- Adapt sls file for pre-downloading in Ubuntu minions\n- Sort formulas by execution order (bsc#1083326)\n- Split remove_traditional_stack into two parts. One for all systems and\n  another for clients not being a Uyuni Server or Proxy (bsc#1121640)\n- Change the order to check the version correctly for RES (bsc#1152795)\n- Do not break Servers registering to a Server\n- Remove the virt-poller cache when applying Virtualization entitlement\n- Force HTTP request timeout on public cloud grain (bsc#1157975)\n\nsusemanager-sync-data:\n\n- Add OES 2018 SP2 (bsc#1161862)\n- Rename RHEL 8 Base product\n- Change channel family name according to SCC data\n\nHow to apply this update:\n1. Log in as root user to the SUSE Manager server.\n2. Stop the Spacewalk service:\nspacewalk-service stop\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Upgrade the database schema:\nspacewalk-schema-upgrade\n5. Start the Spacewalk service:\nspacewalk-service start\n","status":"published","published":"2020-03-13T12:32:44Z","modified":"2026-02-04T02:41:08.685397Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0856-1","title":"Security update for SUSE Manager Server 3.2","description":"\nThis update fixes the following issues:\n\npy26-compat-salt:\n\n- Replace pycrypto with M2Crypto as dependency for SLE15+ (bsc#1165425)\n\nredstone-xmlrpc:\n\n- Disable external entity parsing (1790381, bsc#1164120, CVE-2020-1693)\n- Do not download external entities (1555429, bsc#1085414, CVE-2018-1077)\n\nspacecmd:\n\n- Bugfix: attempt to purge SSM when it is empty (bsc#1155372)\n\nspacewalk-admin:\n\n- Spell correctly 'successful' and 'successfully'\n\nspacewalk-backend:\n\n- When downloading repo metadata, don't add '/' to the repo url if it already ends with one (bsc#1158899)\n- Enhance suseProducts via ISS to fix SP migration on slave server (bsc#1159184)\n\nspacewalk-certs-tools:\n\n- Add minion option in config file to disable salt mine when generated by\n  bootstrap script (bsc#1163001)\n\nspacewalk-client-tools:\n\n- Do not crash 'mgr-update-status' because 'long' type is not defined in Python 3\n- Add workaround for uptime overflow to spacewalk-update-status as well (bsc#1165921)\n- Spell correctly 'successful' and 'successfully'\n\nspacewalk-java:\n\n- Fix error when adding systems to ssm with 'add to ssm' button (bsc#1160246)\n- Validate the suseproductchannel table and update missing date when running mgr-sync refresh (bsc#1163538)\n- Read the subscriptions from the output instead of input (bsc#1140332)\n- Show additional headers and dependencies for deb packages\n- Use channel name from product tree instead of constructing it (bsc#1157317)\n\nspacewalk-setup:\n\n- Spell correctly 'successful' and 'successfully'\n\nspacewalk-utils:\n\n- Check for delimiter as well when detecting current phase (bsc#1164771)\n\nspacewalk-web:\n\n- Report merge_subscriptions message in a readable way (bsc#1140332)\n\nsubscription-matcher:\n\n- Add missing library for SLE15 SP2 (slf4j-log4j12)\n- Make the code usable with Math3 on SLES\n- Use log4j12 package on newer SLE versions\n- Aggregate stackable subscriptions with same parameters\n- Implement new 'swap move' used in optaplanner (bsc#1140332)\n- Enable aarch64 builds, except for SLE \u003c 15 \n\nsusemanager:\n\n- Fix salt bootstrapping on SLE15 (require python3-pycrypto or\n  python3-M2Crypto to support all variants) (bsc#1164563)\n- Add bootstrap-repo data for OES 2018 SP2 (bsc#1161862)\n- Add bootstrap-repo data for SLE15 SP2 Family\n\nsusemanager-sls:\n\n- Adapt 'mgractionchains' module to work with Salt 3000\n- Do not workaround util.syncmodules for SSH minions (bsc#1162609)\n- Force to run util.synccustomall when triggering action chains on SSH minions (bsc#1162683).\n\nsusemanager-sync-data:\n\n- Add OES 2018 SP2 (bsc#1161862)\n- Rename RHEL 8 Base product\n- Change channel family name according to SCC data\n\nHow to apply this update:\n1. Log in as root user to the SUSE Manager server.\n2. Stop the Spacewalk service:\nspacewalk-service stop\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Upgrade the database schema:\nspacewalk-schema-upgrade\n5. Start the Spacewalk service:\nspacewalk-service start\n","status":"published","published":"2020-04-02T14:48:30Z","modified":"2026-02-04T02:19:22.191698Z","updated_at":"2026-11-02T15:53:47.634847Z"}]}}