{"id":"CVE-2021-41411","aliases":["EUVD-2022-6146","GHSA-rc57-9r3x-98cq","SUSE-SU-2022:3313-1","SUSE-SU-2022:3314-1","SUSE-SU-2022:3750-1","SUSE-SU-2022:3761-1"],"status":"published","title":"XML External Entity Reference in drools","description":"drools \u003c=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01306,"percentile":0.70959,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-611"],"published":"2022-06-16T09:52:01Z","modified":"2026-10-24T10:30:41Z","fixes":[{"ecosystem":"Maven","package":"org.drools:drools-core","fixed_in":["7.60.0.Final"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.drools:drools-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"7.59.0.Final"},{"fixed":"7.60.0.Final"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.drools:drools-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0.Final"}]}],"versions":["5.0.0.CR1","5.0.0.M3","5.0.0.M4","5.0.0.M5","5.0.1","5.1.0","5.1.0.CR1","5.1.0.M1","5.1.0.M2","5.1.1","5.2.0.CR1","5.2.0.Final","5.2.0.M2","5.2.1.Final","5.3.0.Beta1","5.3.0.CR1","5.3.0.Final","5.3.1.Final","5.3.2.Final","5.3.3.Final","5.3.4.Final","5.3.5.Final","5.4.0.Beta1","5.4.0.Beta2","5.4.0.CR1","5.4.0.Final","5.5.0.Beta1","5.5.0.CR1","5.5.0.Final","5.6.0.CR1","5.6.0.Final","6.0.0.Alpha4","6.0.0.Alpha5","6.0.0.Alpha6","6.0.0.Alpha7","6.0.0.Alpha9","6.0.0.Beta1","6.0.0.Beta2","6.0.0.Beta3","6.0.0.Beta4","6.0.0.Beta5","6.0.0.CR1","6.0.0.CR2","6.0.0.CR3","6.0.0.CR4","6.0.0.CR4-Pre1","6.0.0.CR5","6.0.0.Final","6.0.1.Final","6.1.0.Beta1","6.1.0.Beta2","6.1.0.Beta3","6.1.0.Beta4","6.1.0.CR1","6.1.0.CR2","6.1.0.Final","6.2.0.Beta1","6.2.0.Beta2","6.2.0.Beta3","6.2.0.CR1","6.2.0.CR2","6.2.0.CR3","6.2.0.CR4","6.2.0.Final","6.3.0.Beta1","6.3.0.Beta2","6.3.0.CR1","6.3.0.CR2","6.3.0.Final","6.4.0.Beta1","6.4.0.Beta2","6.4.0.CR1","6.4.0.CR2","6.4.0.Final","6.5.0.Beta1","6.5.0.CR1","6.5.0.CR2","6.5.0.Final","7.0.0.Beta1","7.0.0.Beta2","7.0.0.Beta3","7.0.0.Beta4","7.0.0.Beta5","7.0.0.Beta6","7.0.0.Beta7","7.0.0.Beta8","7.0.0.CR1","7.0.0.CR2","7.0.0.CR3","7.0.0.Final","7.1.0.Beta1","7.1.0.Beta2","7.1.0.Beta3","7.1.0.Final","7.10.0.Final","7.11.0.Final","7.12.0.Final","7.13.0.Final","7.14.0.Final","7.15.0.Final","7.16.0.Final","7.17.0.Final","7.18.0.Final","7.19.0.Final","7.2.0.Final","7.20.0.Final","7.21.0.Final","7.22.0.Final","7.22.0.t042","7.23.0.Final","7.24.0.Final","7.24.0.t043","7.25.0.Final","7.26.0.Final","7.27.0.Final","7.28.0.Final","7.29.0.Final","7.3.0.Final","7.30.0.Final","7.31.0.Final","7.32.0.Final","7.32.0.k20191220","7.32.0.k20191223","7.33.0.Final","7.34.0.Final","7.35.0.Final","7.36.0.20200330","7.36.0.20200331","7.36.0.Final","7.36.1.Final","7.37.0.Final","7.38.0.Final","7.39.0.CR1","7.39.0.Final","7.4.0.Final","7.4.1.Final","7.40.0.20200703","7.40.0.Final","7.41.0.Final","7.41.0.t20200723","7.42.0.Final","7.43.0.Final","7.43.0.t20200824","7.43.1.Final","7.44.0.Final","7.45.0.Final","7.45.0.t20201009","7.45.0.t20201014","7.46.0.Beta1","7.46.0.Final","7.46.0.t20201030","7.47.0.Final","7.48.0.Final","7.49.0.Final","7.49.0.t20210118","7.5.0.Final","7.5.0.t018","7.50.0.Final","7.50.0.t20210209","7.51.0.Final","7.51.0.t20210303","7.52.0.Beta1","7.52.0.Final","7.52.0.t20210322","7.53.0.Final","7.53.1.Final","7.54.0.Beta1","7.54.0.Final","7.55.0.Beta1","7.55.0.Final","7.56.0.Final","7.57.0.Beta1","7.57.0.Final","7.58.0.Beta1","7.58.0.Final","7.59.0.Beta1","7.59.0.Final","7.6.0.Final","7.6.0.t022","7.7.0.Final","7.8.0.Final","7.9.0.Final"]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"release-notes-susemanager-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-150300.3.43.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.2","package":"release-notes-susemanager-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-150300.3.43.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"release-notes-susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-150300.3.54.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.2","package":"mgr-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.10-150300.2.9.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.2","package":"patterns-suse-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2-150300.4.12.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.2","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.19-150300.4.27.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.2","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.24-150300.4.29.5"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.2","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.18-150300.3.24.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.2","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.20-150300.4.24.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.2","package":"spacewalk-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.12-150300.3.21.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.2","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.29-150300.3.27.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.2","package":"susemanager-tftpsync-recv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.5-150300.3.6.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.2","package":"uyuni-common-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.7-150300.3.9.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"drools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.17.0-150300.4.6.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"httpcomponents-asyncclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.4-150300.3.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"image-sync-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1661440526.b08d95b-150300.3.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"inter-server-sync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.3-150300.8.22.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"patterns-suse-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2-150300.4.12.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"py27-compat-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000.3-150300.7.7.23.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"salt-netapi-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.0-150300.3.9.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"saltboot-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1661440526.b08d95b-150300.3.12.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.19-150300.4.27.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.12-150300.3.15.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.24-150300.4.29.5"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.18-150300.3.24.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.20-150300.4.24.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.41-150300.3.43.5"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-search","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8-150300.3.12.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.29-150300.3.27.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"subscription-matcher","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29-150300.6.12.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.37-150300.3.41.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-doc-indexes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2-150300.12.33.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2-150300.12.33.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.24-150300.3.27.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.27-150300.3.33.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"uyuni-common-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.7-150300.3.9.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"mgr-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.6-150400.3.6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.15-150400.3.6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.16-150400.3.6.8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.15-150400.3.6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.12-150400.3.6.6"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.24-150400.3.6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"susemanager-build-keys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.4.3-150400.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"susemanager-tftpsync-recv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.7-150400.3.3.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"uyuni-common-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.6-150400.3.6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-150400.5.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"drools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.17.0-150400.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"image-sync-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1661440542.6cbe0da-150400.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"inter-server-sync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.3-150400.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"locale-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3-150400.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"python-magic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.32-150000.7.16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"python-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.7-150400.10.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"python-urlgrabber","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0-150400.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"reprepro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-150400.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"saltboot-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1661440542.6cbe0da-150400.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.15-150400.3.6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.10-150400.3.3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.16-150400.3.6.8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.15-150400.3.6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.12-150400.3.6.6"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.38-150400.3.8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-search","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.7-150400.3.6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-setup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.12-150400.3.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.14-150400.3.6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.24-150400.3.6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"subscription-matcher","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29-150400.3.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.19-150400.3.6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-build-keys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.4.3-150400.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-150400.9.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.14-150400.3.6.5"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.25-150400.3.6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-sync-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.9-150400.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-tftpsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.2-150400.3.3.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"uyuni-common-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.6-150400.3.6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"uyuni-reportdb-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.6-150400.3.3.6"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"release-notes-susemanager-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.2-150400.3.9.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.3","package":"release-notes-susemanager-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.2-150400.3.9.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"release-notes-susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.2-150400.3.15.1"}]}],"bundled":5}],"products":[{"vendor":"redhat","product":"drools"}],"references":[{"url":"https://github.com/kiegroup/drools/pull/3808","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41411","tags":["advisory"]},{"url":"https://github.com/apache/incubator-kie-drools/pull/3808","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rc57-9r3x-98cq"},{"url":"https://github.com/kiegroup/drools","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223313-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1172705","tags":["report"]},{"url":"https://bugzilla.suse.com/1187028","tags":["report"]},{"url":"https://bugzilla.suse.com/1195455","tags":["report"]},{"url":"https://bugzilla.suse.com/1195895","tags":["report"]},{"url":"https://bugzilla.suse.com/1196729","tags":["report"]},{"url":"https://bugzilla.suse.com/1198168","tags":["report"]},{"url":"https://bugzilla.suse.com/1198489","tags":["report"]},{"url":"https://bugzilla.suse.com/1198738","tags":["report"]},{"url":"https://bugzilla.suse.com/1198903","tags":["report"]},{"url":"https://bugzilla.suse.com/1199372","tags":["report"]},{"url":"https://bugzilla.suse.com/1199659","tags":["report"]},{"url":"https://bugzilla.suse.com/1199913","tags":["report"]},{"url":"https://bugzilla.suse.com/1199950","tags":["report"]},{"url":"https://bugzilla.suse.com/1200276","tags":["report"]},{"url":"https://bugzilla.suse.com/1200296","tags":["report"]},{"url":"https://bugzilla.suse.com/1200480","tags":["report"]},{"url":"https://bugzilla.suse.com/1200532","tags":["report"]},{"url":"https://bugzilla.suse.com/1200573","tags":["report"]},{"url":"https://bugzilla.suse.com/1200591","tags":["report"]},{"url":"https://bugzilla.suse.com/1200629","tags":["report"]},{"url":"https://bugzilla.suse.com/1201142","tags":["report"]},{"url":"https://bugzilla.suse.com/1201189","tags":["report"]},{"url":"https://bugzilla.suse.com/1201210","tags":["report"]},{"url":"https://bugzilla.suse.com/1201220","tags":["report"]},{"url":"https://bugzilla.suse.com/1201224","tags":["report"]},{"url":"https://bugzilla.suse.com/1201527","tags":["report"]},{"url":"https://bugzilla.suse.com/1201606","tags":["report"]},{"url":"https://bugzilla.suse.com/1201607","tags":["report"]},{"url":"https://bugzilla.suse.com/1201626","tags":["report"]},{"url":"https://bugzilla.suse.com/1201753","tags":["report"]},{"url":"https://bugzilla.suse.com/1201913","tags":["report"]},{"url":"https://bugzilla.suse.com/1201918","tags":["report"]},{"url":"https://bugzilla.suse.com/1202142","tags":["report"]},{"url":"https://bugzilla.suse.com/1202272","tags":["report"]},{"url":"https://bugzilla.suse.com/1202464","tags":["report"]},{"url":"https://bugzilla.suse.com/1202724","tags":["report"]},{"url":"https://bugzilla.suse.com/1202728","tags":["report"]},{"url":"https://bugzilla.suse.com/1203287","tags":["report"]},{"url":"https://bugzilla.suse.com/1203288","tags":["report"]},{"url":"https://bugzilla.suse.com/1203449","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31129","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223314-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223750-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1191857","tags":["report"]},{"url":"https://bugzilla.suse.com/1195624","tags":["report"]},{"url":"https://bugzilla.suse.com/1197027","tags":["report"]},{"url":"https://bugzilla.suse.com/1199726","tags":["report"]},{"url":"https://bugzilla.suse.com/1201260","tags":["report"]},{"url":"https://bugzilla.suse.com/1201788","tags":["report"]},{"url":"https://bugzilla.suse.com/1202271","tags":["report"]},{"url":"https://bugzilla.suse.com/1202367","tags":["report"]},{"url":"https://bugzilla.suse.com/1202455","tags":["report"]},{"url":"https://bugzilla.suse.com/1202602","tags":["report"]},{"url":"https://bugzilla.suse.com/1202729","tags":["report"]},{"url":"https://bugzilla.suse.com/1202805","tags":["report"]},{"url":"https://bugzilla.suse.com/1202899","tags":["report"]},{"url":"https://bugzilla.suse.com/1203026","tags":["report"]},{"url":"https://bugzilla.suse.com/1203049","tags":["report"]},{"url":"https://bugzilla.suse.com/1203056","tags":["report"]},{"url":"https://bugzilla.suse.com/1203169","tags":["report"]},{"url":"https://bugzilla.suse.com/1203385","tags":["report"]},{"url":"https://bugzilla.suse.com/1203406","tags":["report"]},{"url":"https://bugzilla.suse.com/1203422","tags":["report"]},{"url":"https://bugzilla.suse.com/1203478","tags":["report"]},{"url":"https://bugzilla.suse.com/1203484","tags":["report"]},{"url":"https://bugzilla.suse.com/1203564","tags":["report"]},{"url":"https://bugzilla.suse.com/1203585","tags":["report"]},{"url":"https://bugzilla.suse.com/1203611","tags":["report"]},{"url":"https://bugzilla.suse.com/1204208","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0860","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223761-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1201589","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-41411","description":"drools \u003c=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.","status":"published","published":"2022-06-16T09:52:01Z","modified":"2024-08-04T03:08:32.436Z","updated_at":"2026-11-02T14:32:59.430294Z"}],"euvd":[{"id":"EUVD-2022-6146","description":"drools \u003c=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.","status":"published","published":"2022-06-16T09:52:01Z","modified":"2024-08-04T03:08:32Z","updated_at":"2026-11-03T03:24:17.663217Z"}],"ghsa":[{"id":"GHSA-rc57-9r3x-98cq","title":"XML External Entity Reference in drools","description":"drools \u003c=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.","status":"published","published":"2022-06-17T00:01:28Z","modified":"2024-07-05T14:26:31Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:37:55.455438Z"}],"nvd":[{"id":"CVE-2021-41411","description":"drools \u003c=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.","status":"published","published":"2022-06-16T10:15:09.007Z","modified":"2026-06-17T04:08:28.993Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:07:06.501652Z"}],"osv":[{"id":"CVE-2021-41411","description":"drools \u003c=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.","status":"published","published":"2022-06-16T10:15:09.007Z","modified":"2026-10-24T10:30:41.127140777Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:21.557945Z"},{"id":"GHSA-rc57-9r3x-98cq","title":"XML External Entity Reference in drools","description":"drools \u003c=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.","status":"published","published":"2022-06-17T00:01:28Z","modified":"2024-07-05T14:42:35.664383Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:46:55.877614Z"},{"id":"SUSE-SU-2022:3313-1","title":"Security update for release-notes-susemanager, release-notes-susemanager-proxy","description":"This update for release-notes-susemanager, release-notes-susemanager-proxy fixes the following issues:\n\nRelease notes for SUSE Manager:\n\n- Update to SUSE:Manager 4.2.9\n  * Notification about SUSE Manager end-of-life has been added\n  * CVEs fixed: CVE-2021-43138, CVE-2021-42740, CVE-2022-31129, CVE-2021-41411\n  * Bugs mentioned:\n    bsc#1172705, bsc#1187028, bsc#1195455, bsc#1195895, bsc#1196729\n    bsc#1198168, bsc#1198489, bsc#1198738, bsc#1198903, bsc#1199372\n    bsc#1199659, bsc#1199913, bsc#1199950, bsc#1200276, bsc#1200296\n    bsc#1200480, bsc#1200532, bsc#1200573, bsc#1200591, bsc#1200629\n    bsc#1201142, bsc#1201189, bsc#1201210, bsc#1201220, bsc#1201224\n    bsc#1201527, bsc#1201606, bsc#1201607, bsc#1201626, bsc#1201753\n    bsc#1201913, bsc#1201918, bsc#1202142, bsc#1202272, bsc#1202464\n    bsc#1202728, bsc#1203287, bsc#1203288, bsc#1203449\n\nRelease notes for SUSE Manager Proxy:\n\n- Update to SUSE Manager 4.2.9\n  * CVEs fixed: CVE-2021-43138, CVE-2021-42740, CVE-2022-31129\n  * Bugs mentioned:\n    bsc#1198168, bsc#1198903, bsc#1199659, bsc#1200480, bsc#1200591\n    bsc#1201142, bsc#1202142, bsc#1202724\n","status":"published","published":"2022-09-19T15:37:27Z","modified":"2026-02-04T03:49:16.811481Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3314-1","title":"Security update for SUSE Manager Server 4.2","description":"This update fixes the following issues:\n\ndrools:\n\n- CVE-2021-41411: XML External Entity injection in KieModuleModelImpl.java. (bsc#1200629)\n\nhttpcomponents-asyncclient:\n\n- Provide maven metadata needed by other packages to build\n\nimage-sync-formula:\n\n- Update to version 0.1.1661440526.b08d95b\n  * Add option to sort boot images by version (bsc#1196729)\n\ninter-server-sync:\n\n- Version 0.2.3\n  * Compress exported sql data #16631\n  * Add gzip dependency to decompress data file during import process\n\npatterns-suse-manager:\n\n- Strictly require OpenJDK 11 (bsc#1202142) \n\npy27-compat-salt:\n\n- Add support for gpgautoimport in zypperpkg module\n- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)\n- Add support for name, pkgs and diff_attr parameters to upgrade\n  function for zypper and yum (bsc#1198489)\n- Unify logic on using multiple requisites and add onfail_all (bsc#1198738)\n- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)\n\nsalt-netapi-client:\n\n- Declare the LICENSE file as license and not doc\n- Adapted for Enterprise Linux 9.\n- Version 0.20.0\n  * See: https://github.com/SUSE/salt-netapi-client/releases/tag/v0.20.0\n\nsaltboot-formula:\n\n- Update to version 0.1.1661440526.b08d95b\n  * Fallback to local boot if the configured image is not synced\n  * improve image url modifications - preparation for ftp/http changes\n\nspacecmd:\n\n- Version 4.2.19-1\n  * Process date values in spacecmd api calls (bsc#1198903)\n  * Show correct help on calling kickstart_importjson with no arguments\n  * Fix tracebacks on spacecmd kickstart_export (bsc#1200591)\n\nspacewalk-admin:\n\n- Version 4.2.12-1\n  * Add --help option to mgr-monitoring-ctl\n\nspacewalk-backend:\n\n- Version 4.2.24-1\n  * Make reposync use the configured http proxy with mirrorlist (bsc#1198168)\n  * Revert proxy listChannels token caching pr#4548\n  * cleanup leftovers from removing unused xmlrpc endpoint\n\nspacewalk-certs-tools:\n\n- Version 4.2.18-1\n  * traditional stack bootstrap: install product packages (bsc#1201142)\n\nspacewalk-client-tools:\n\n- Version 4.2.20-1\n  * Update translation strings\n\nspacewalk-java:\n\n- Version 4.2.41-1\n  * Fixed date format on scheduler related messages (bsc#1195455)\n  * Support inherited values for kernel options from Cobbler API (bsc#1199913)\n  * Add channel availability check for product migration (bsc#1200296)\n  * Check if system has all formulas correctly assigned (bsc#1201607)\n  * Remove group formula assignments and data on group delete (bsc#1201606)\n  * Fix sync for external repositories (bsc#1201753)\n  * fix state.apply result parsing in test mode (bsc#1201913)\n  * Reduce the length of image channel URL (bsc#1201220)\n  * Calculate dependencies between cloned channels of vendor channels (bsc#1201626)\n  * fix symlinks pointing to ongres-stringprep\n  * Modify parameter type when communicating with the search server (bsc#1187028)\n  * Fix initial profile and build host on Image Build page (bsc#1199659)\n  * Fix the confirm message on the refresh action by adding a link\n    to pending actions on it (bsc#1172705)\n  * require new salt-netapi-client version\n  * Clean grub2 reinstall entry in autoyast snippet (bsc#1199950)\n\nspacewalk-search:\n\n- Version 4.2.8-1\n  * Add methods to handle session id as String\n\nspacewalk-web:\n\n- Version 4.2.29-1\n  * CVE-2021-43138: Obtain privileges via the `mapValues()` method. (bsc#1200480)\n  * CVE-2021-42740: Command injection in the shell-quote package. (bsc#1203287) \n  * CVE-2022-31129: Denial-of-Service moment: inefficient parsing algorithm (bsc#1203288)\n  * Fix table header layout for unselectable tables\n  * Fix initial profile and build host on Image Build page (bsc#1199659)\n\nsubscription-matcher:\n\n- Added Guava maximum version requirement.\n\nsusemanager:\n    \n- Version 4.2.37-1\n  * mark new dependencies for python-py optional in bootstrap repo to fix generation for older service packs \n    (bsc#1203449)\n- Version 4.2.36-1\n  * add missing packages on SLES 15\n  * remove server-migrator.sh from SUSE Manager installations (bsc#1202728)\n  * mgr-create-bootstrap-repo: flush directory also when called for a specific label (bsc#1200573)\n  * add missing packages on SLES 12 SP5 bootstrap repo (bsc#1201918)\n  * remove python-tornado from bootstrap repo, since no longer required for salt version \u003e= 3000\n  * add openSUSE 15.4 product (bsc#1201527)\n  * add clients tool product to generate bootstrap repo on openSUSE 15.x (bsc#1201189)\n\nsusemanager-doc-indexes:\n\n- Documented mandatory channels in the Disconnected Setup chapter of the\n  Administration Guide (bsc#1202464)\n- Documented how to onboard Ubuntu clients with the Salt bundle as a\n  regular user\n- Documented how to onboard Debian clients with the Salt bundle or plain Salt\n  as a regular user\n- Fixed the names of updates channels for Leap\n- Fixed errors in OpenSCAP chapter of Administration Guide\n- Added exact command to create the bootstrap repo for Salt bundle and about how to disable salt-thin\n- Removed CentOS 8 from the list of supported client systems\n- Extend the notes about using noexec option for /tmp and /var/tmp (bsc#1201210)\n- Reverted single snippet change for two separate books\n- Added extend Salt Bundle functionality with Python packages using pip\n- Add missing part of the description to enable optional support of the Salt Bundle with Salt SSH\n- Added exact command to create the bootstrap repo for salt bundle and about how to disable salt-thin\n- Salt Configuration Modules are no longer Technology Preview in Salt Guide.\n- Fixed Ubuntu 18 Client registration in Client Configuration Guide (bsc#1201224)\n- Added ports 1232 and 1233 in the Ports section of the Installation and\n  Upgrade Guide; required for Salt SSH Push (bsc#1200532)\n- In the Custom Channel section of the Administration Guide add a note\n  about synchronizing repositories regularly.\n- Removed SUSE Linux Enterprise 11 from the list of supported client systems\n\nsusemanager-docs_en:\n\n- Documented mandatory channels in the Disconnected Setup chapter of the\n  Administration Guide (bsc#1202464)\n- Documented how to onboard Ubuntu clients with the Salt bundle as a\n  regular user\n- Documented how to onboard Debian clients with the Salt bundle or plain Salt\n  as a regular user\n- Fixed the names of updates channels for Leap\n- Fixed errors in OpenSCAP chapter of Administration Guide\n- Added exact command to create the bootstrap repo for Salt bundle and about how to disable salt-thin\n- Removed CentOS 8 from the list of supported client systems\n- Extend the notes about using noexec option for /tmp and /var/tmp (bsc#1201210)\n- Reverted single snippet change for two separate books\n- Added extend Salt Bundle functionality with Python packages using pip\n- Add missing part of the description to enable optional support of the Salt Bundle with Salt SSH\n- Added exact command to create the bootstrap repo for salt bundle and about how to disable salt-thin\n- Salt Configuration Modules are no longer Technology Preview in Salt Guide.\n- Fixed Ubuntu 18 Client registration in Client Configuration Guide (bsc#1201224)\n- Added ports 1232 and 1233 in the Ports section of the Installation and\n  Upgrade Guide; required for Salt SSH Push (bsc#1200532)\n- In the Custom Channel section of the Administration Guide add a note\n  about synchronizing repositories regularly.\n- Removed SUSE Linux Enterprise 11 from the list of supported client systems\n\nsusemanager-schema:\n\n- Version 4.2.24-1\n  * Fix migration of image actions (bsc#1202272)\n\nsusemanager-sls:\n\n- Version 4.2.27-1\n  * Copy grains file with util.mgr_switch_to_venv_minion state apply\n  * Remove the message 'rpm: command not found' on using Salt SSH\n    with Debian based systems which has no Salt Bundle\n  * Prevent possible tracebacks on calling module.run from mgrcompat\n    by setting proper globals with using LazyLoader\n  * Fix deploy of SLE Micro CA Certificate (bsc#1200276)\n\nuyuni-common-libs:\n\n- Version 4.2.7-1\n  * Do not allow creating path if nonexistent user or group in fileutils.\n\nHow to apply this update:\n\n1. Log in as root user to the SUSE Manager server.\n2. Stop the Spacewalk service:\n`spacewalk-service stop`\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Start the Spacewalk service:\n`spacewalk-service start`\n","status":"published","published":"2022-09-19T15:38:45Z","modified":"2026-02-04T04:02:47.076962Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3750-1","title":"Security update for SUSE Manager Server 4.3","description":"\nThis update fixes the following issues:\n\ncobbler:\n\n- Consider case of 'next_server' being a hostname during migration of Cobbler collections.\n- Fix problem with 'proxy_url_ext' setting being None type.\n- Fix settings migration schema to work while upgrading on existing running\n  Uyuni and SUSE Manager servers running with old Cobbler settings (bsc#1203478)\n- Do generate boot menus even if no profiles or systems - only local boot\n- Avoid crashing running buildiso in certain conditions.\n- Fix issue that a custom kernel with the extension '.kernel' is not\n  accepted by 'cobbler distro add'\n- Fix issue with 'get_item_resolved_value' that prevented it from\n  returning in cases where a complex object would have been returned\n- Fix issue where the logs would have been spammed with 'grab_tree'\n  messages that are meant for debugging\n- Buildiso - Fix DNS append line generation\n- Change apache2 conf dir for SUSE distros to allow integration with\n  Uyuni and SUSE Manager\n- Avoid permissions errors during cobbler sync\n- Update to version 3.3.3\n- Add UEFI capabilities to 'cobbler buildiso' (jsc#SUMA-112)\n- Relevant changes on this release:\n  * New:\n    * Uyuni Proxies can now be set with the schema validation.\n    * Cobbler should now build on AlmaLinux.\n    * The initrd is not required anymore as it is an optional file.\n    * XML-RPC: Added dump_vars endpoint. This is intended to replace get_blended_data as of 3.4.0.\n    * XML-RPC: Added get_item_resolved_value \u0026 set_item_resolved_value endpoints.\n  * Breaking Changes:\n    * The field virt_file_size is now a float and the related settings as well.\n  * Changes:\n    * The error messages for duplicated objects now contains the name of the duplicated object.\n  * Bugfixes:\n    * Dictionaries had the wrong value set for \u003c\u003cinherit\u003e\u003e.\n    * There were some cases in which the autoinstallation manager was handed the wrong object and then crashed.\n    * The inheritance of the owners field was fixed.\n    * Serial Console options should not contain bogous -1 value anymore.\n    * HTTP API should not throw permission errors anymore.\n    * During build the log was not visible due to a custom logger without output.\n    * cobbler mkloaders now also copies dependencies of menu.c32.\n    * We now generate the grub configuration for the architectures correct again.\n    * virt_file_size now is a float at all times.\n    * Cobbler should restart successfully now if you have attached an image to a system.\n    * If you have a system named default the bootloader was not removed properly before.\n    * cobbler buildiso: The isolinux.cfg was not properly formatted.\n    * There were unharmful templating errors in the log related to redhat_management_type. The parts depending on this\n      were removed.\n    * The DNS managers were non-functional before because of a not existing function call.\n    * cobbler buildiso failed with --tmpdirs that don't end in buildiso.\n    * cobbler buildiso had outdated docs and help messages for some parameters.\n    * cobbler import: It was impossible to import Rocky Linux 8.5 successfully.\n    * Cobbler created duplicated settings files before.\n    * cobbler sync was broken by refactoring to shell=False before.\n- CVE-2022-0860: Improper Authorization in Cobbler. (bsc#1197027)\n- Version 3.3.0 fixed jsc#SUMA-112\n- Update to version 3.3.2\n    * cobbler sync doesn't have to be executed no more after enable_ipxe was flipped\n    * Auth: Support for Global Secure Catalog via LDAP provider\n    * Reposync now deletes old metadata to prevent metadata merge conflicts\n    * The automigration of the settings is now not enabled per default.\n    * We removed ppc from RedHat EL 7 as it is not supported\n    * Network interface is not subscriptable errors were fixed\n    * The stacktraces related to the package and file pre \u0026 post triggers should no longer appear\n    * You should be able to add multiple initrds if needed again\n    * Debian: Fix regex for SHIM_FILE which now provides a working reasonable default\n\ndrools:\n\n- CVE-2021-41411: XML External Entity injection in KieModuleModelImpl.java (bsc#1200629)\n\nimage-sync-formula:\n\n- Update to version 0.1.1661440542.6cbe0da\n  * Sort boot images by version instead of name-version (bsc#1196729)\n  * Do not send events if syncing fails\n\ninter-server-sync:\n\n  * Compress exported sql data and decompress during import\n  * Add gzip dependency to decompress data file during import process\n\nlocale-formula:\n\n- Update to version 0.3\n  * Remove .map.gz from kb_map dictionary (bsc#1203406)\n\npython-urlgrabber:\n\n- Avoid crashing when setting URLGRABBER_DEBUG=1 environment variable\n\nreprepro:\n\n- Update from version 5.3.0 to version 5.4.0\n  * Add shunit2 based tests \n  * Support multiple versions\n  * Add the commands move, movesrc, movematched, movefilter\n  * Add Limit and Archive option\n  * fix manpage to add the behaviour if reprepro is linked against liblzma\n  * Mark 'dumpcontents' command as deprecated\n\nsaltboot-formula:\n\n- Update to version 0.1.1661440542.6cbe0da \n  * Fallback to local boot if the configured image is not synced\n  * Support salt bundle\n\nspacecmd:\n\n- Version 4.3.15-1\n  * Process date values in spacecmd api calls (bsc#1198903)\n\nspacewalk-admin:\n\n- Version 4.3.10-1\n  * Ensure 'cobbler mkloaders' is executed after restarting services\n  * Add --help option to mgr-monitoring-ctl\n  * reportdb access: force new report_db_sslrootcert if previous default is set\n\nspacewalk-backend:\n\n- Version 4.3.16-1\n  * Prevent mixing credentials for proxy and repository server\n    while using basic authentication and avoid hiding errors\n    i.e. timeouts while having proxy settings issues\n    with extra logging in verbose mode (bsc#1201788)\n  * Fix the condition of hiding the token from URL on logging\n  * export armored GPG key to salt filesystem as well\n  * Upgrade Cobbler requirement to 3.3.3 or later\n  * Make reposync use the configured http proxy with mirrorlist (bsc#1198168)\n\nspacewalk-certs-tools:\n\n- Version 4.3.15-1\n  * fix mgr-ssl-cert-setup for root CAs which do not set authorityKeyIdentifier (bsc#1203585)\n\nspacewalk-client-tools:\n\n- Version 4.3.12-1\n  * Update translation strings\n\nspacewalk-java:\n    \n- version 4.3.38-1\n  * delay hardware refresh action to avoid missing channels (bsc#1204208)\n- Version 4.3.37-1 \n  * Fix get_item_resolved_value call\n- Version 4.3.36-1\n  * Fix prerequisite action serialization (bsc#1202899, bsc#1203484)\n  * Fix hardware update where there is no DNS FQDN changes (bsc#1203611)\n  * Fix UI crash when filtering on systems list (bsc#1203169)\n  * Filter out successors that have no repositories on SP migration (bsc#1202367)\n  * Reduced the usage of deprecated Hibernate API\n  * Use mgrnet.dns_fqdns module to improve FQDN detection (bsc#1199726)\n  * Support Pay-as-you-go new CA location for SUSE Linux Enterprise Server 15 SP4 and higher (bsc#1202729)\n  * Fixed pagination for completed/failed systems in action details\n  * Add support in rhn.conf for smtp port, auth, ssl/tls config\n  * Calculate dependencies between cloned channels of vendor channels (bsc#1201626)\n  * Fix sync for external repositories (bsc#1201753)\n  * Detect the clients running on Amazon EC2 (bsc#1195624)\n  * Adjust cobbler requirement to version 3.3.3\n  * Support inherited values for kernel options from Cobbler API\n  * Fix virtFileSize type after cobbler upgrade\n  * Redefine available power_management.types for cobbler \u003e= 3.3.1\n  * fix state.apply result parsing in test mode (bsc#1201913)\n  * require tomcat native interface to prevent misleading warning\n    in tomcat startup log (bsc#1202455)\n  * Reduce the length of image channel URL (bsc#1201220)\n  * Fixed formula deselection in systemgroup (bsc#1202271)\n  * Added a new configuration property to allow custom channels to\n    be synced together with vendor channels.\n  * add onlyRelevant argument to addErrataUpdate API\n  * fix taskomatic task remain in progress\n\nspacewalk-search:\n\n- Version 4.3.7-1\n  * update dependencies after package rename\n\nspacewalk-setup:\n    \n- version 4.3.12\n  * Fix detected issues to perform migration of Cobbler settings\n    and collections.\n\n- Version 4.3.11-1\n  * Trigger migration of Cobbler settings and collections if necessary\n    during package installation (bsc#1203478)\n  * Execute 'cobbler mkloaders' when setting up cobbler\n  * Adjust next_server cobbler settings for cobbler \u003e= 3.3.1\n  * fix prototype missmatch in idn_to_ascii (bsc#1203385)\n\nspacewalk-utils:\n\n- Version 4.3.14-1\n  * Make spacewalk-hostname-rename working with settings.yaml cobbler config file (bsc#1203564)\n  * spacewalk-common-channels now syncs the channels automatically\n    on creation, if the new configuration property named\n    'unify_custom_channel_management' is enabled\n\nspacewalk-web:\n\n- Version 4.3.24-1\n  * Upgrade moment-timezone\n  * CVE-2021-43138: Obtain privileges via the `mapValues()` method. (bsc#1200480)\n  * CVE-2021-42740: Command injection in the shell-quote package. (bsc#1203287)\n  * CVE-2022-31129: Denial-of-Service moment: inefficient parsing algorithm (bsc#1203288)\n  * Fix table header layout for unselectable tables\n\nsubscription-matcher:\n\n- Added Guava maximum version requirement\n\nsusemanager:\n\n- Version 4.3.19-1\n  * mark new dependencies for python-py optional in bootstrap repo\n    to fix generation for older service packs (bsc#1203449)\n  * add bootstrap repository definition for OES2023 (bsc#1202602)\n  * add missing packages on SUSE Linux Enterprise Server 15\n  * remove server-migrator.sh from SUSE Manager installations (bsc#1202728)\n  * create bootstrap repository data for Ubuntu 22.04 Vendor Channels\n  * remove obsoleted sysv init script (bsc#1191857)\n  * mgr-create-bootstrap-repo: flush directory also when called\n    for a specific label (bsc#1200573)\n  * pg-migrate-x-to-y.sh: improve output (bsc#1201260)\n  * remove python-tornado from bootstrap repo, since no longer\n    required for salt version \u003e= 3000\n  * add missing packages on SUSE Linux Enterprise Server 12 SP5 bootstrap repo (bsc#1201918)\n  * revert 'bootstrap repo: set optional packages'\n\nsusemanager-build-keys:\n\n- Add release and auxiliary GPG keys for RedHat\n- Add keys for Rocky Linux 9\n  * RPM-GPG-KEY-redhat-release\n  * RPM-GPG-KEY-redhat-auxiliary\n  * RPM-GPG-KEY-Rocky-9\n\nsusemanager-docs_en:\n\n- Removed Debian 9 references due to end of life and added missing Debian 11 info\n- Fixed description of default notification settings (bsc#1203422)\n- Added missing Debian 11 references\n- Documented helm deployment of the proxy on k3s and MetalLB in \n  Installation and Upgrade Guide\n- Added secure mail communication settings in Administration Guide\n- Fixed path to state and pillar files\n- Documented how pxeboot works with Secure Boot enabled in Client\n  Configuration Guide\n- Add repository via proxy issues troubleshooting page\n- Change import GPG key description\n- Added SLE Micro 5.2 and 5.3 as available as a technology preview \n  in Client Configuration Guide, and the IBM Z architecture for 5.1, \n  5.2, and 5.3\n- Added command to remove the obsolete Python module on SUSE Manager \n  Server 4.1 in the Installation and Upgrade Guide (bsc#1203026)\n- Mention CA certificate directory in the proxy setup description in the\n  Installation and Upgrade Guide (bsc#1202805)\n- Documented mandatory channels in the Disconnected Setup chapter of the\n  Administration Guide (bsc#1202464)\n- Documented how to onboard Ubuntu clients with the Salt bundle as a\n  regular user\n- Documented how to onboard Debian clients with the Salt bundle or \n  plain Salt as a regular user\n- Fixed the names of updates channels for Leap\n- Fixed errors in OpenSCAP chapter of Administration Guide\n- Removed CentOS 8 from the list of supported client systems\n- Extend the notes about using noexec option for /tmp and /var/tmp \n  (bsc#1201210)\n- Added Extend Salt Bundle functionality with Python packages using pip\n- Salt Configuration Modules are no longer Technology Preview in \n  the Salt Guide\n\nsusemanager-schema:\n\n- Version 4.3.14-1\n  * Add subtypes for Amazon EC2 virtual instances (bsc#1195624)\n  * Fix migration of image actions (bsc#1202272)\n  * improve schema compatibility with Amazon RDS\n\nsusemanager-sls:\n\n- Version 4.3.25-1\n  * Fix mgrnet availability check\n  * Remove dependence on Kiwi libraries\n  * disable always the bootstrap repository also when\n    'mgr_disable_local_repos' is set to False\n  * Use mgrnet.dns_fqdns module to improve FQDN detection (bsc#1199726)\n  * fix syntax error - remove trailing colon (bsc#1203049)\n  * Add mgrnet salt module with mgrnet.dns_fqnd function implementation\n    allowing to get all possible FQDNs from DNS (bsc#1199726)\n  * Copy grains file with util.mgr_switch_to_venv_minion state apply (bsc#1203056)\n  * Remove the message 'rpm: command not found' on using Salt SSH\n    with Debian based systems which has no Salt Bundle\n\nsusemanager-sync-data:\n\n- Version 4.3.9-1\n  * add oes2023 (bsc#1202602)\n  * add Ubuntu 22.04 amd64\n\nsusemanager-tftpsync:\n\n- Version 4.3.2-1\n  * Adjust sync_post_tftpd_proxies module to cobbler \u003e= 3.3.1\n\nuyuni-common-libs:\n\n- Version 4.3.6-1\n  * Do not allow creating path if nonexistent user or group in fileutils.\n\nuyuni-reportdb-schema:\n\n- Version 4.3.6-1\n  * improve schema compatibility with Amazon RDS\n\nHow to apply this update:\n\n1. Log in as root user to the SUSE Manager server.\n2. Stop the Spacewalk service:\n`spacewalk-service stop`\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Start the Spacewalk service:\n`spacewalk-service start`\n","status":"published","published":"2022-10-26T08:45:32Z","modified":"2026-02-04T02:56:47.986153Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3761-1","title":"Security update for release-notes-susemanager, release-notes-susemanager-proxy","description":"This update for release-notes-susemanager, release-notes-susemanager-proxy fixes the following issues:\n\nRelease notes for SUSE Manager:\n\n- Update to SUSE Manager 4.3.2\n  * Containerized proxy and RBS are now fully supported\n  * HTTP API is now fully supported\n  * Ubuntu 22.04 is now supported as a client\n  * Cobbler has been upgraded to version 3.3.3 which also includes building ISOs with UEFI support\n  * pip support has been added for the Salt Bundle  \n  * Prometheus exporter for Apache has been upgraded to 0.10.0\n  * CVEs fixed: CVE-2021-41411, CVE-2021-42740, CVE-2021-43138, CVE-2022-0860, CVE-2022-31129\n  * Bugs mentioned:\n    bsc#1191857, bsc#1195624, bsc#1196729, bsc#1197027, bsc#1198168\n    bsc#1198903, bsc#1199726, bsc#1200480, bsc#1200573, bsc#1200629\n    bsc#1201210, bsc#1201220, bsc#1201260, bsc#1201626, bsc#1201753\n    bsc#1201788, bsc#1201913, bsc#1201918, bsc#1202271, bsc#1202272\n    bsc#1202367, bsc#1202455, bsc#1202464, bsc#1202602, bsc#1202728\n    bsc#1202729, bsc#1202805, bsc#1202899, bsc#1203026, bsc#1203049\n    bsc#1203056, bsc#1203169, bsc#1203287, bsc#1203288, bsc#1203385\n    bsc#1203406, bsc#1203422, bsc#1203449, bsc#1203478, bsc#1203484\n    bsc#1203564, bsc#1203585, bsc#1203611 \n\nRelease notes for SUSE Manager Proxy:\n\n- Update to SUSE Manager 4.3.2\n  * Containerized proxy and RBS are now fully supported\n  * CVEs fixed: CVE-2021-42740, CVE-2021-43138, CVE-2022-31129\n  * Bugs mentioned:\n    bsc#1198168, bsc#1198903, bsc#1200480, bsc#1201589, bsc#1201788\n    bsc#1203287, bsc#1203288, bsc#1203585 \n","status":"published","published":"2022-10-26T08:58:54Z","modified":"2026-02-04T02:31:49.884657Z","updated_at":"2026-11-02T15:53:51.440565Z"}]}}