{"id":"CVE-2021-40348","aliases":["EUVD-2021-27526","GHSA-h847-jmmj-x7rc","SUSE-RU-2021:3551-1","SUSE-SU-2021:3561-1","SUSE-SU-2021:3562-1"],"status":"published","title":"Spacewalk 2.10, and derivatives such as Uyuni 2021.08, allows code injection. rhn-config...","description":"Spacewalk 2.10, and derivatives such as Uyuni 2021.08, allows code injection. rhn-config-satellite.pl doesn't sanitize the configuration filename used to append Spacewalk-specific key-value pair. The script is intended to be run by the tomcat user account with Sudo, according to the installation setup. This can lead to the ability of an attacker to use --option to append arbitrary code to a root-owned file that eventually will be executed by the system. This is fixed in Uyuni spacewalk-admin 4.3.2-1.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01799,"percentile":0.78627,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2021-10-27T13:28:00Z","modified":"2026-10-20T10:55:34Z","fixes":[{"ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-admin","fixed_in":["4.1.10-3.15.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"release-notes-susemanager-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.2","package":"release-notes-susemanager-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"release-notes-susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-3.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-5.11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"hub-xmlrpc-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-3.3.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"inter-server-sync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.5-8.6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"patterns-suse-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2-4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"py26-compat-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.10-11.28.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"py26-compat-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"py27-compat-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000.3-7.7.11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.13-4.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-3.6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.17-4.9.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.13-3.9.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.14-4.9.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.30-3.14.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.14-3.9.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.23-3.9.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"subscription-matcher","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27-6.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"supportutils-plugin-susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-3.3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.25-3.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-doc-indexes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2-12.11.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2-12.11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.18-3.9.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.18-3.11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-sync-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"virtualization-formulas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-8.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.10-3.15.1"}]}]}],"products":[{"vendor":"spacewalk_project","product":"spacewalk"},{"vendor":"uyuni-project","product":"uyuni"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2021/10/28/4","tags":["x_refsource_MISC","x_transferred","Exploit","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/uyuni-project/uyuni/commit/790c7388efac6923c5475e01c1ff718dffa9f052","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-40348"},{"url":"https://github.com/advisories/GHSA-h847-jmmj-x7rc"},{"url":"https://www.suse.com/support/update/announcement/-2021-3551/suse-ru-20213551-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1171520","tags":["report"]},{"url":"https://bugzilla.suse.com/1181223","tags":["report"]},{"url":"https://bugzilla.suse.com/1187572","tags":["report"]},{"url":"https://bugzilla.suse.com/1187998","tags":["report"]},{"url":"https://bugzilla.suse.com/1188315","tags":["report"]},{"url":"https://bugzilla.suse.com/1188977","tags":["report"]},{"url":"https://bugzilla.suse.com/1189260","tags":["report"]},{"url":"https://bugzilla.suse.com/1189422","tags":["report"]},{"url":"https://bugzilla.suse.com/1189609","tags":["report"]},{"url":"https://bugzilla.suse.com/1189799","tags":["report"]},{"url":"https://bugzilla.suse.com/1189818","tags":["report"]},{"url":"https://bugzilla.suse.com/1189933","tags":["report"]},{"url":"https://bugzilla.suse.com/1190040","tags":["report"]},{"url":"https://bugzilla.suse.com/1190123","tags":["report"]},{"url":"https://bugzilla.suse.com/1190151","tags":["report"]},{"url":"https://bugzilla.suse.com/1190164","tags":["report"]},{"url":"https://bugzilla.suse.com/1190166","tags":["report"]},{"url":"https://bugzilla.suse.com/1190265","tags":["report"]},{"url":"https://bugzilla.suse.com/1190275","tags":["report"]},{"url":"https://bugzilla.suse.com/1190276","tags":["report"]},{"url":"https://bugzilla.suse.com/1190300","tags":["report"]},{"url":"https://bugzilla.suse.com/1190396","tags":["report"]},{"url":"https://bugzilla.suse.com/1190405","tags":["report"]},{"url":"https://bugzilla.suse.com/1190455","tags":["report"]},{"url":"https://bugzilla.suse.com/1190512","tags":["report"]},{"url":"https://bugzilla.suse.com/1190602","tags":["report"]},{"url":"https://bugzilla.suse.com/1190751","tags":["report"]},{"url":"https://bugzilla.suse.com/1190820","tags":["report"]},{"url":"https://bugzilla.suse.com/1191123","tags":["report"]},{"url":"https://bugzilla.suse.com/1191139","tags":["report"]},{"url":"https://bugzilla.suse.com/1191348","tags":["report"]},{"url":"https://bugzilla.suse.com/1191551","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-40348","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213561-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1191898","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213562-1/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-40348","description":"Spacewalk 2.10, and derivatives such as Uyuni 2021.08, allows code injection. rhn-config-satellite.pl doesn't sanitize the configuration filename used to append Spacewalk-specific key-value pair. The script is intended to be run by the tomcat user account with Sudo, according to the installation setup. This can lead to the ability of an attacker to use --option to append arbitrary code to a root-owned file that eventually will be executed by the system. This is fixed in Uyuni spacewalk-admin 4.3.2-1.","status":"published","published":"2021-11-01T04:32:06Z","modified":"2024-08-04T02:44:09.485Z","updated_at":"2026-11-02T14:33:01.495293Z"}],"euvd":[{"id":"EUVD-2021-27526","description":"Spacewalk 2.10, and derivatives such as Uyuni 2021.08, allows code injection. rhn-config-satellite.pl doesn't sanitize the configuration filename used to append Spacewalk-specific key-value pair. The script is intended to be run by the tomcat user account with Sudo, according to the installation setup. This can lead to the ability of an attacker to use --option to append arbitrary code to a root-owned file that eventually will be executed by the system. This is fixed in Uyuni spacewalk-admin 4.3.2-1.","status":"published","published":"2021-11-01T04:32:06Z","modified":"2024-08-04T02:44:09Z","updated_at":"2026-11-03T03:24:20.862157Z"}],"ghsa":[{"id":"GHSA-h847-jmmj-x7rc","title":"Spacewalk 2.10, and derivatives such as Uyuni 2021.08, allows code injection. rhn-config...","description":"Spacewalk 2.10, and derivatives such as Uyuni 2021.08, allows code injection. rhn-config-satellite.pl doesn't sanitize the configuration filename used to append Spacewalk-specific key-value pair. The script is intended to be run by the tomcat user account with Sudo, according to the installation setup. This can lead to the ability of an attacker to use --option to append arbitrary code to a root-owned file that eventually will be executed by the system. This is fixed in Uyuni spacewalk-admin 4.3.2-1.","status":"published","published":"2022-05-24T19:19:21Z","modified":"2023-02-02T05:08:43Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:52:45.777625Z"}],"nvd":[{"id":"CVE-2021-40348","description":"Spacewalk 2.10, and derivatives such as Uyuni 2021.08, allows code injection. rhn-config-satellite.pl doesn't sanitize the configuration filename used to append Spacewalk-specific key-value pair. The script is intended to be run by the tomcat user account with Sudo, according to the installation setup. This can lead to the ability of an attacker to use --option to append arbitrary code to a root-owned file that eventually will be executed by the system. This is fixed in Uyuni spacewalk-admin 4.3.2-1.","status":"published","published":"2021-11-01T05:15:07.007Z","modified":"2026-06-17T04:06:46.47Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:07:00.549994Z"}],"osv":[{"id":"CVE-2021-40348","description":"Spacewalk 2.10, and derivatives such as Uyuni 2021.08, allows code injection. rhn-config-satellite.pl doesn't sanitize the configuration filename used to append Spacewalk-specific key-value pair. The script is intended to be run by the tomcat user account with Sudo, according to the installation setup. This can lead to the ability of an attacker to use --option to append arbitrary code to a root-owned file that eventually will be executed by the system. This is fixed in Uyuni spacewalk-admin 4.3.2-1.","status":"published","published":"2021-11-01T05:15:07.007Z","modified":"2026-10-20T10:55:34.430866594Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:21.249056Z"},{"id":"SUSE-RU-2021:3551-1","title":"Recommended update for SUSE Manager 4.2.3 Release Notes","description":"This update for SUSE Manager 4.2.3 Release Notes provides the following additions:\n\nRelease notes for SUSE Manager:\n\n- Update to 4.2.3 \n  - aarch64 support for CentOS 7/8, Oracle Linux 7/8, Rocky Linux 8, AlmaLinux 8, Amazon Linux 2 and openSUSE Leap 15.3\n  - Package Locking features is now available for Salt Minions\n  - New XMLRPC API methods for SaltKey\n  - Bugs mentioned:\n    bsc#1171520, bsc#1181223, bsc#1187572, bsc#1187998, \n    bsc#1188315, bsc#1188977, bsc#1189260, bsc#1189422, \n    bsc#1189609, bsc#1189799, bsc#1189818, bsc#1189933, \n    bsc#1190040, bsc#1190123, bsc#1190151, bsc#1190164, \n    bsc#1190166, bsc#1190265, bsc#1190275, bsc#1190276, \n    bsc#1190300, bsc#1190396, bsc#1190405, bsc#1190455, \n    bsc#1190512, bsc#1190602, bsc#1190751, bsc#1190820, \n    bsc#1191123, bsc#1191139, bsc#1191348, bsc#1191551, \n    CVE-2021-40348, CVE-2021-21996\n\nRelease notes for SUSE Manager proxy:\n\n- Update to 4.2.3\n  - Bugs mentioned:\n    bsc#1171520, bsc#1181223, bsc#1187998, bsc#1188315,\n    bsc#1188977, bsc#1190405, bsc#1190512, bsc#1190602,\n    bsc#1190751, bsc#1190820, bsc#1191348\n","status":"published","published":"2021-10-27T13:28:00Z","modified":"2026-02-04T03:38:10.97717Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2021:3561-1","title":"Security update for SUSE Manager Server 4.2","description":"This update fixes the following issues:\n\ncobbler:\n\n- Fixed modify_setting test to complete successfully\n\nhub-xmlrpc-api:\n\n- Use rpm systemd macro to restart service in replace of systemctl\n\npatterns-suse-manager:\n\n- Virtualization-host-formula was renamed to virtualization-formulas \n\npy26-compat-salt:\n\n- Exclude the full path of a download URL to prevent injection of malicious code (bsc#1190265, CVE-2021-21996)\n\npy26-compat-tornado:\n\n- Added compatibility to Enterprise Linux 8\n\npy27-compat-salt:\n\n- Fix the regression of docker_container state module\n- Support querying for JSON data in external sql pillar\n- Exclude the full path of a download URL to prevent injection of malicious code (bsc#1190265, CVE-2021-21996)\n- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories\n\nspacecmd:\n\n- Version 4.2.13-1\n  * Update translation strings\n  * configchannel_updatefile handles directory properly (bsc#1190512)\n  * Add schedule_archivecompleted to mass archive actions (bsc#1181223)\n  * Remove whoami from the list of unauthenticated commands (bsc#1188977)\n\nspacewalk-admin:\n\n- Version 4.2.9-1\n  * Fix setup with rhn-config-satellite (bsc#1190300)\n  * Allow admins to modify only spacewalk config files with\n    rhn-config-satellite.pl (bsc#1190040) (CVE-2021-40348)\n\nspacewalk-backend:\n\n- Version 4.2.17-1\n  * Update translations strings\n  * handle download of metadata filesnames with checksums (bsc#1188315)\n  * Sanitize cached filename for custom SSL certs used by reposync (bsc#1190751)\n\nspacewalk-certs-tools:\n\n- Version 4.2.13-1\n  * add GPG keys using apt-key on debian machines (bsc#1187998)\n\nspacewalk-client-tools:\n\n- Version 4.2.14-1\n  * Update translation strings\n\nspacewalk-java:\n\n- Version 4.2.30-1\n  * Fix datetime format parsing with moment (bsc#1191348)\n- Version 4.2.29-1\n  * Update translation strings\n  * fix logging of the spark framework and map requests to media.1\n    directory in the download controller (bsc#1189933)\n  * Add 'Last build date' column to CLM project list (jsc#PM-2644)\n    (jsc#SUMA-61)\n  * Improve exception handling and logging for mgr-libmod calls\n  * Add checksums to repository metadata filenames (bsc#1188315)\n  * Fix ISE in product migration if base product is missing (bsc#1190151)\n  * use TLSv1.3 if it is a supported Protocol\n  * Adapt auto errata update to respect maintenance windows\n  * Adapt auto errata update to skip during CLM build (bsc#1189609)\n  * add CentOS 7/8 aarch64\n  * add Oracle Linux 7/8 aarch64\n  * add Rocky Linux 8 aarch64\n  * add AlmaLinux 8 aarch64\n  * add Amazon Linux 2 aarch64\n  * Add new endpoints to saltkeys API: acceptedList, pendingList, rejectedList,\n    deniedList, accept and reject\n  * fix ISE in SSM when scheduling patches on multiple systems (bsc#1190396, bsc#1190275)\n  * Add 'Flush cache' option to Ansible playbook execution\n    (bsc#1190405)\n  * Update kernel live patch version on minion startup (bsc#1190276)\n  * Allow getting all completed actions via XMLRPC without display limit (bsc#1181223)\n  * Support syncing patches with advisory status 'pending' (bsc#1190455)\n  * Add XMLRPC API to force refreshing pillar data (bsc#1190123)\n  * Add missing string on XCCDF scan results (bsc#1190164)\n  * Ignore duplicates in 'pkg.installed' result when applying patches (bsc#1187572)\n  * Improved timezone support\n  * implement package locking for salt minions\n\nspacewalk-utils:\n\n- Version 4.2.14-1\n  * When renaming: don't regenerate CA, allow using third-party\n    certificate and trigger pillar refresh (bsc#1190123)\n\nspacewalk-web:\n\n- Version 4.2.23-1\n  * Fix datetime format parsing with moment (bsc#1191348)\n- Version 4.2.22-1\n  * Add 'Last build date' column to CLM project list (jsc#PM-2644)\n    (jsc#SUMA-61)\n  * Fix 'Type' input in CLM source edit form (bsc#1190820)\n  * Add 'Flush cache' checkbox to Ansible playbook execution page\n    (bsc#1190405)\n  * Fix the VM creation and editing submit button action (bsc#1190602)\n  * Improved timezone support\n  * Enhance the default base channel help message (bsc#1171520)\n\nsubscription-matcher:\n\n- Version 0.27\n  * update subscription rules for new SKUs (bsc#1189818)\n\nsupportutils-plugin-susemanager:\n\n- Version 4.2.3-1\n  * detect broken symlinks in tomcat, taskomatic and search daemon\n\nsusemanager:\n\n- Version 4.2.25-1\n  * Add python-mako, python-gnupg and gnupg1 to the Debian 9 bootstrap repository\n    so bootstrapping without any enabled repositories is possible (bsc#1191898)\n  * Fix syntax error on migration script (bsc#1191551)\n  * Add aarch64 bootstrap repositories for CentOS 7/8, Oracle Linux 7/8,\n    Rocky Linux8, AlmaLinux8, Amazon Linux 2 and openSUSE Leap 15.3\n  * Add the gnupg package for ubuntu which is then needed by apt-key (bsc#1187998)\n  * Add SLE 15 SAP Product ID to SLE15 bootstrap repositories, as\n    it is required to get python3-M2Crypto (bsc#1189422)\n\nsusemanager-doc-indexes:\n\n- Added aarch64 support for selection of clients in the Installation\n  Guide and Client Configuration Guide\n- Documented Amazon Web Services permissions for Virtual Host Manager\n  in the Virtual Host Manager and Amazon Web Service chapters in the\n  Client Configuration Guide\n- Fixed unpublished patches note in the server update chapter of the\n  Upgrade Guide\n- Updated Proxy installation screenshots to reflect SUSE Manager 4.2 \n  version in the Installation Guide\n- Updated migration instructions to help avoid migration from Proxy 4.0 \n  to 4.1 if 4.2 is already available to the Upgrade Guide\n- Fixed mgr-cfg-* issues in appendix of the Reference Guide. Run the\n  commands on the client (bsc#1190166)\n- Removed Portus and CaaSP references from the image management chapter\n  of the Administration Guide\n- Documented package lock as a supported feature for some Salt clients\n  in the Client Configuration Guide.\n\nsusemanager-docs_en:\n\n- Added aarch64 support for selection of clients in the Installation\n  Guide and Client Configuration Guide\n- Documented Amazon Web Services permissions for Virtual Host Manager \n  in the Virtual Host Manager and Amazon Web Service chapters in the \n  Client Configuration Guide\n- Fixed unpublished patches note in the server update chapter of the\n  Upgrade Guide\n- Updated Proxy installation screenshots to reflect SUSE Manager 4.2 \n  version in the Installation Guide\n- Updated migration instructions to help avoid migration from Proxy 4.0 \n  to 4.1 if 4.2 is already available to the Upgrade Guide\n- Fixed mgr-cfg-* issues in appendix of the Reference Guide. Run the\n  commands on the client (bsc#1190166)\n- Removed Portus and CaaSP references from the image management chapter\n  of the Administration Guide\n- Documented package lock as a supported feature for some Salt clients\n  in the Client Configuration Guide. \n\nsusemanager-schema:\n\n- Version 4.2.18-1\n  * create unique index on package details action id (bsc#1190396, bsc#1190275)\n  * Add 'flush_cache' flag to Ansible playbook execution action\n    (bsc#1190405)\n  * Support syncing patches with advisory status 'pending' (bsc#1190455)\n  * allow Ansible Control Node entitlement for aarch64, ppc64le and\n    s390x (bsc#1189799)\n  * implement package locking for salt minions\n\nsusemanager-sls:\n\n- Version 4.2.18-1\n  * Fix cpuinfo grain and virt_utils state python2 compatibility (bsc#1191139, bsc#1191123)\n  * deploy certificate on SLE Micro 5.1\n  * Realign pkgset cookie path for Salt Bundle changes\n  * Fix pkgset beacon to work with salt-minion 2016.11.10 (bsc#1189260)\n  * Fix virt grain python2 compatibility\n  * Fix mgrcompat state module to work with Salt 3003 and 3004\n  * Add 'flush_cache' flag to 'ansible.playbooks' call (bsc#1190405)\n  * Update kernel live patch version on minion startup (bsc#1190276)\n  * don't use libvirt API to get its version for the virt features grain\n  * implement package locking for salt minions\n\nsusemanager-sync-data:\n\n- Version 4.2.9-1\n  * add CentOS 7/8 aarch64\n  * add Oracle Linux 7/8 aarch64\n  * add Rocky Linux 8 aarch64\n  * add AlmaLinux 8 aarch64\n  * add Amazon Linux 2 aarch64\n\nHow to apply this update:\n1. Log in as root user to the SUSE Manager server.\n2. Stop the Spacewalk service:\n`spacewalk-service stop`\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Start the Spacewalk service:\n`spacewalk-service start`\n","status":"published","published":"2021-10-27T13:30:01Z","modified":"2026-02-04T03:39:51.974399Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3562-1","title":"Security update for SUSE Manager Server 4.1","description":"\nThis update fixes the following issues:\n\nspacewalk-admin:\n\n- Version 4.1.10-1\n  * Fix setup with rhn-config-satellite (bsc#1190300)\n  * Allow admins to modify only spacewalk config files with\n    rhn-config-satellite.pl (bsc#1190040) (CVE-2021-40348)\n\nHow to apply this update:\n1. Log in as root user to the SUSE Manager server.\n2. Stop the Spacewalk service:\n`spacewalk-service stop`\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Start the Spacewalk service:\n`spacewalk-service start`\n","status":"published","published":"2021-10-27T13:34:39Z","modified":"2026-02-04T03:00:14.984955Z","updated_at":"2026-11-02T15:53:49.605187Z"}]}}