{"id":"CVE-2022-21952","aliases":["EUVD-2022-27108","GHSA-99mv-pfx6-v678","SUSE-SU-2022:2143-1","SUSE-SU-2022:2144-1","SUSE-SU-2022:2145-1","SUSE-SU-2022:2146-1"],"status":"published","title":"SUMA unauthenticated remote DoS via resource exhaustion","description":"A Missing Authentication for Critical Function vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to easily exhaust available disk resources leading to DoS. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46. SUSE Manager Server 4.2 spacewalk-java versions prior to 4.2.37.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01546,"percentile":0.7519,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-306","CWE-400","CWE-770"],"published":"2022-06-20T14:10:44Z","modified":"2026-07-07T18:51:22Z","affected":[{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"release-notes-susemanager-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.15-150200.3.56.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"release-notes-susemanager-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.15-150200.3.56.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"release-notes-susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.15-150200.3.80.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.2","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.17-150300.4.21.4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.2","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.22-150300.4.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.2","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.16-150300.3.18.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.2","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.27-150300.3.21.7"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.2","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-150300.3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"inter-server-sync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.2-150300.8.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"prometheus-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.2-150300.3.14.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"salt-netapi-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-150300.3.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"smdba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.10-0.150300.3.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.17-150300.4.21.4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.22-150300.4.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.16-150300.3.18.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.38-150300.3.35.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.16-150300.3.15.5"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.27-150300.3.21.7"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-150300.3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.32-150300.3.31.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-doc-indexes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2-150300.12.27.6"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2-150300.12.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.22-150300.3.21.6"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.23-150300.3.25.4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-sync-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.12-150300.3.18.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"virtual-host-gatherer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.23-150300.3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"golang-github-QubitProducts-exporter_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-150200.6.12.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"golang-github-lusitaniae-apache_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-150200.2.6.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-150200.3.9.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"patterns-suse-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-150200.6.12.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.10-150200.3.8.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"prometheus-exporters-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5-150200.3.31.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"prometheus-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.7-150200.3.21.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"py27-compat-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000.3-150200.6.24.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.18-150200.4.39.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.31-150200.4.50.4"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.46-150200.3.71.5"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-setup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.11-150200.3.18.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.20-150200.3.30.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.34-150200.3.47.6"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"subscription-matcher","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28-150200.3.15.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.36-150200.3.52.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-doc-indexes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-150200.11.55.4"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-150200.11.55.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.26-150200.3.45.4"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.36-150200.3.64.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"release-notes-susemanager-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.7-150300.3.31.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.2","package":"release-notes-susemanager-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.7-150300.3.31.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"release-notes-susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.7-150300.3.44.1"}]}],"bundled":3}],"products":[{"vendor":"suse","product":"manager_server"},{"vendor":"suse","product":"suse manager server 4.1"},{"vendor":"suse","product":"suse manager server 4.2"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1199512","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21952"},{"url":"https://github.com/advisories/GHSA-99mv-pfx6-v678"},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222143-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1182742","tags":["report"]},{"url":"https://bugzilla.suse.com/1189501","tags":["report"]},{"url":"https://bugzilla.suse.com/1190535","tags":["report"]},{"url":"https://bugzilla.suse.com/1192850","tags":["report"]},{"url":"https://bugzilla.suse.com/1193032","tags":["report"]},{"url":"https://bugzilla.suse.com/1193238","tags":["report"]},{"url":"https://bugzilla.suse.com/1193707","tags":["report"]},{"url":"https://bugzilla.suse.com/1194262","tags":["report"]},{"url":"https://bugzilla.suse.com/1194447","tags":["report"]},{"url":"https://bugzilla.suse.com/1194594","tags":["report"]},{"url":"https://bugzilla.suse.com/1194909","tags":["report"]},{"url":"https://bugzilla.suse.com/1195561","tags":["report"]},{"url":"https://bugzilla.suse.com/1196338","tags":["report"]},{"url":"https://bugzilla.suse.com/1196407","tags":["report"]},{"url":"https://bugzilla.suse.com/1196702","tags":["report"]},{"url":"https://bugzilla.suse.com/1196704","tags":["report"]},{"url":"https://bugzilla.suse.com/1197356","tags":["report"]},{"url":"https://bugzilla.suse.com/1197429","tags":["report"]},{"url":"https://bugzilla.suse.com/1197438","tags":["report"]},{"url":"https://bugzilla.suse.com/1197488","tags":["report"]},{"url":"https://bugzilla.suse.com/1198221","tags":["report"]},{"url":"https://bugzilla.suse.com/1198356","tags":["report"]},{"url":"https://bugzilla.suse.com/1198686","tags":["report"]},{"url":"https://bugzilla.suse.com/1198914","tags":["report"]},{"url":"https://bugzilla.suse.com/1199036","tags":["report"]},{"url":"https://bugzilla.suse.com/1199142","tags":["report"]},{"url":"https://bugzilla.suse.com/1199149","tags":["report"]},{"url":"https://bugzilla.suse.com/1199512","tags":["report"]},{"url":"https://bugzilla.suse.com/1199528","tags":["report"]},{"url":"https://bugzilla.suse.com/1199629","tags":["report"]},{"url":"https://bugzilla.suse.com/1199677","tags":["report"]},{"url":"https://bugzilla.suse.com/1199888","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-26520","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31248","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222144-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1187333","tags":["report"]},{"url":"https://bugzilla.suse.com/1191143","tags":["report"]},{"url":"https://bugzilla.suse.com/1192550","tags":["report"]},{"url":"https://bugzilla.suse.com/1195710","tags":["report"]},{"url":"https://bugzilla.suse.com/1197400","tags":["report"]},{"url":"https://bugzilla.suse.com/1197449","tags":["report"]},{"url":"https://bugzilla.suse.com/1197591","tags":["report"]},{"url":"https://bugzilla.suse.com/1197689","tags":["report"]},{"url":"https://bugzilla.suse.com/1199089","tags":["report"]},{"url":"https://bugzilla.suse.com/1200212","tags":["report"]},{"url":"https://bugzilla.suse.com/1200606","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-44906","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222145-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1173527","tags":["report"]},{"url":"https://bugzilla.suse.com/1196067","tags":["report"]},{"url":"https://bugzilla.suse.com/1199577","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21698","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222146-1/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-21952","title":"SUMA unauthenticated remote DoS via resource exhaustion","description":"A Missing Authentication for Critical Function vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to easily exhaust available disk resources leading to DoS. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46. SUSE Manager Server 4.2 spacewalk-java versions prior to 4.2.37.","status":"published","published":"2022-06-22T10:05:11.864Z","modified":"2026-07-07T09:28:04.536Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-306","CWE-770"],"updated_at":"2026-11-02T14:34:29.057251Z"}],"euvd":[{"id":"EUVD-2022-27108","description":"A Missing Authentication for Critical Function vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to easily exhaust available disk resources leading to DoS. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46. SUSE Manager Server 4.2 spacewalk-java versions prior to 4.2.37.","status":"published","published":"2022-06-22T10:05:11Z","modified":"2026-07-07T09:28:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:12.41351Z"}],"ghsa":[{"id":"GHSA-99mv-pfx6-v678","title":"An Uncontrolled Resource Consumption vulnerability in spacewalk-java of SUSE Manager Server 4.1,...","description":"An Uncontrolled Resource Consumption vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to easily exhaust available disk resources leading to DoS. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46. SUSE Manager Server 4.2 spacewalk-java versions prior to 4.2.37.","status":"published","published":"2022-06-23T00:00:35Z","modified":"2023-07-26T15:30:56Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-306","CWE-400"],"updated_at":"2026-11-02T14:54:43.067561Z"}],"nvd":[{"id":"CVE-2022-21952","description":"A Missing Authentication for Critical Function vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to easily exhaust available disk resources leading to DoS. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46. SUSE Manager Server 4.2 spacewalk-java versions prior to 4.2.37.","status":"published","published":"2022-06-22T10:15:07.917Z","modified":"2026-07-07T18:51:22.293Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-306","CWE-770"],"updated_at":"2026-11-02T14:07:22.613788Z"}],"osv":[{"id":"SUSE-SU-2022:2143-1","title":"Recommended update for SUSE Manager 4.1.15 Release Notes","description":"This update for SUSE Manager 4.1.15 Release Notes provides the following additions:\n\nRelease notes for SUSE Manager:\n\n- Update to 4.1.15\n  * Salt has been upgraded to 3004 version\n  * Grafana has been upgraded to 8.3.5\n  * Postgres exporter has been upgraded to 0.10.0\n  * Alertmanager has been upgraded to 0.23.0\n  * Node exporter has been upgraded 1.3.0\n  * CVEs fixed: CVE-2022-21724, CVE-2022-21952, CVE-2022-31248, CVE-2022-26520\n  * Bugs mentioned:\n    bsc#1182742, bsc#1189501, bsc#1190535, bsc#1192850, bsc#1193032\n    bsc#1193238, bsc#1193707, bsc#1194262, bsc#1194447, bsc#1194594\n    bsc#1194909, bsc#1195561, bsc#1196338, bsc#1196407, bsc#1196702\n    bsc#1196704, bsc#1197356, bsc#1197429, bsc#1197438, bsc#1197488\n    bsc#1198221, bsc#1198356, bsc#1198686, bsc#1198914, bsc#1199036\n    bsc#1199142, bsc#1199149, bsc#1199512, bsc#1199528, bsc#1199629\n    bsc#1199677, bsc#1199888\n\nRelease notes for SUSE Manager proxy:\n\n- Update to 4.1.15\n  * Salt has been upgraded to 3004 version\n  * Bugs mentioned:\n    bsc#1190535, bsc#1193238, bsc#1194447, bsc#1194594, bsc#1194909\n    bsc#1196338, bsc#1196704, bsc#1199142, bsc#1199528\n","status":"published","published":"2022-06-20T14:10:44Z","modified":"2026-02-04T03:03:40.133294Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:2144-1","title":"Security update for SUSE Manager Server 4.2","description":"\nThis update fixes the following issues:\n\ninter-server-sync:\n\n- version 0.2.2\n  * Parameter --channel-with-children didn't export data (bsc#1199089)\n  * Clean rhnchannelcloned table to rebuild hierarchy (bsc#1197400)\n- Version 0.2.1\n  * Correct sequence in use for table rhnpackagekey(bsc#1197400)\n  * Make Docker image export compatible with Suse Manager 4.2\n- Version 0.2.0\n  * Allow images export and import (os based and Docker)\n\nprometheus-formula:\n\n- Version 0.6.2\n  * Allow prometheus-formula only for SUSE systems (bsc#1199149)\n\nsalt-netapi-client:\n\n- Improve the hotfix for bsc#1192550 (bsc#1197449):\n\nsmdba:\n\n- Don't package egg-info file for Enterprise Linux.\n\nspacecmd:\n\n- Version 4.2.17-1\n  * parse boolean paramaters correctly (bsc#1197689)\n\nspacewalk-backend:\n\n- version 4.2.22-1\n  * Do not raise error on file:// based DEB repo when looking for alternative Release files (bsc#1199142)\n- Version 4.2.21-1\n  * Improve parsing deb packages dependencies (bsc#1194594)\n\nspacewalk-certs-tools:\n\n- Version 4.2.16-1\n  * Add Salt Bundle support to bootstrap script generator\n\nspacewalk-java:\n\n- version 4.2.38-1\n  * Remove unused gson-extras.jar during build \n- version 4.2.37-1\n  * CVE-2022-31248: User enumeration via weak error message. (bsc#1199629)\n- version 4.2.36-1\n  * CVE-2022-21952: Unauthenticated remote Denial of Service via resource exhaustion. (bsc#1199512)\n- Version 4.2.35-1\n  * faster display installable packages list (bsc#1187333)\n  * Pass ssh_salt_pre_flight_script and ssh_use_salt_thin parameters\n    to the generated roster files to enable optional Salt Bundle\n    support with Salt SSH\n  * Fix reboot time on salt-ssh client(bsc#1197591)\n  * detect free products in Alpha and Beta stage and prevent checks\n    on openSUSE products (bsc#1197488)\n  * Allow monitoring entitlement for debian 11 and 10\n  * Hide private methods in XMLRPC handlers\n  * Warning log when hardware refresh result is not serializable\n  * Optimize adding new products function (bsc#1193707)\n\nspacewalk-utils:\n\n- Version 4.2.16-1\n  * Add Debian 11 repositories\n\nspacewalk-web:\n\n- Version 4.2.27-1\n  * increase web page default timeout (bsc#1187333)\n  * Add ssh_salt_pre_flight_script and ssh_use_salt_thin parameters\n    to default rhn_web.conf\n  * Upgrade minimist to fix CVE-2021-44906\n  * susemanager-nodejs-sdk-devel is now provided by spacewalk-web\n  * Resolve race conditions in CLM (bsc#1195710)\n\nsusemanager:\n\n- version 4.2.32-1\n  * Add python3-contextvars and python3-immutables to missing bootstrap repos (bsc#1200606)\n- version 4.2.31-1\n  * Add python3-gnupg to bootstrap repo definition for Ubuntu 20.04 (bsc#1200212)\n- version 4.2.30-1\n  * Fix a syntax problem at the bootstrap repository definitions\n- Version 4.2.29-1\n  * Add Salt Bundle support to mgr-create-bootstrap-repo\n  * Enable bootstrapping for Debian 11\n  * fix SLE15 bootstrap repo definition (bsc#1197438)\n  * Add SLES15SP4 and SUMA Proxy 4.3 to bootstrap\n    repo definitions (bsc#1196702)\n  * Add missing dependencies for Salt 3004 into bootstrap repository\n    for SLE15 family (bsc#1198221)\n\nsusemanager-doc-indexes:\n\n- Updated Salt version for Server and Proxy to 3004\n- Added details to Client Configuration Guide on using Salt Bundle as optional\n- Updated saltversion attribute from 3002 to 3004 \n- In the Administration Guide, documented that monitoring tools are \n  available in SUSE Linux Enterprise 12 and 15 and openSUSE Leap 15, \n  but Grafana is not available on Proxy (bsc#1191143)\n- Documented Autoyast installation features in Autoyast section of \n  the Client Configuration Guide\n- In Client Configuration Guide document Debian 11 as a supported OS \n  as a client\n- In Client Configuration Guide, clarified client upgrade issues\n- In Client Configuration Guide, added information about registration \n  of version 12 of SUSE Linux Enterprise clients\n- In Client Configuration Guide, mark the applying patches features as \n  supported on Ubuntu\n- SLE Micro in Client Configuration Guide: Update version number from\n  5.0 to 5.1, and warn about Salt installation. \n\nsusemanager-docs_en:\n\n- Updated Salt version for Server and Proxy to 3004\n- Added details to Client Configuration Guide on using Salt Bundle as optional\n- In the Administration Guide, documented that monitoring tools are \n  available in SUSE Linux Enterprise 12 and 15 and openSUSE Leap 15, \n  but Grafana is not available on Proxy (bsc#1191143)\n- Documented Autoyast installation features in Autoyast section of \n  the Client Configuration Guide\n- In Client Configuration Guide document Debian 11 as a supported OS \n  as a client\n- In Client Configuration Guide, clarified client upgrade issues\n- In Client Configuration Guide, added information about registration \n  of version 12 of SUSE Linux Enterprise clients\n- In Client Configuration Guide, mark the applying patches features as \n  supported on Ubuntu\n- SLE Micro in Client Configuration Guide: Update version number from\n  5.0 to 5.1, and warn about Salt installation. \n\nsusemanager-schema:\n\n- Version 4.2.22-1\n  * Add schema directory for susemanager-schema-4.2.21\n\nsusemanager-sls:\n\n- version 4.2.23-1\n  * Fix bootstrap repository URL resolution for Yum based clients with preflight script for Salt SSH\n- Version 4.2.22-1\n  * Add Salt Bundle support on bootstrapping\n  * Add Salt SSH with Salt Bundle support\n  * Add util.mgr_switch_to_venv_minion state to switch salt minions\n    to use the Salt Bundle\n  * Fix bootstrap repository path resolution for Oracle Linux\n  * Handle salt bundle in set_proxy.sls\n\nsusemanager-sync-data:\n\n- Version 4.2.12-1\n  * change release status of EL 7 and 8 aarch64 to released\n  * change release status of Rocky Linux 8 x86_64 to released\n  * add Debian 11 amd64\n\nsupportutils-plugin-salt:\n\n- Update to version 1.2.0\n  * Add support for Salt Bundle\n\nvirtual-host-gatherer:\n\n- Version 1.0.23-1\n  * reformat the first 3 groups of the UUID for hardware versions \u003e=13\n    in VMWare environment.\n  * Fix shebangs to use python3\n  * Implement libvirt module\n\nHow to apply this update:\n\n1. Log in as root user to the SUSE Manager server.\n2. Stop the Spacewalk service:\n`spacewalk-service stop`\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Start the Spacewalk service:\n`spacewalk-service start`\n","status":"published","published":"2022-06-20T14:11:52Z","modified":"2026-02-04T02:56:37.568729Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:2145-1","title":"Security update for SUSE Manager Server 4.1","description":"This update fixes the following issues:\n\ngolang-github-QubitProducts-exporter_exporter:\n\n- Adapted to build on Enterprise Linux.\n- Fix build for RedHat 7\n- Require Go \u003e= 1.14 also for CentOS\n- Add support for CentOS\n- Replace %{?systemd_requires} with %{?systemd_ordering}\n\ngolang-github-lusitaniae-apache_exporter:\n\n- Require building with Go 1.15\n- Add %license macro for LICENSE file \n\ngolang-github-prometheus-node_exporter:\n\n- CVE-2022-21698: Update vendor tarball with prometheus/client_golang 1.11.1\n  (bsc#1196338, jsc#SLE-24238, jsc#SLE-24239)\n- Update to 1.3.0\n  * [CHANGE] Add path label to rapl collector #2146\n  * [CHANGE] Exclude filesystems under /run/credentials #2157\n  * [CHANGE] Add TCPTimeouts to netstat default filter #2189\n  * [FEATURE] Add lnstat collector for metrics from /proc/net/stat/ #1771\n  * [FEATURE] Add darwin powersupply collector #1777\n  * [FEATURE] Add support for monitoring GPUs on Linux #1998\n  * [FEATURE] Add Darwin thermal collector #2032\n  * [FEATURE] Add os release collector #2094\n  * [FEATURE] Add netdev.address-info collector #2105\n  * [FEATURE] Add clocksource metrics to time collector #2197\n  * [ENHANCEMENT] Support glob textfile collector directories #1985\n  * [ENHANCEMENT] ethtool: Expose node_ethtool_info metric #2080\n  * [ENHANCEMENT] Use include/exclude flags for ethtool filtering #2165\n  * [ENHANCEMENT] Add flag to disable guest CPU metrics #2123\n  * [ENHANCEMENT] Add DMI collector #2131\n  * [ENHANCEMENT] Add threads metrics to processes collector #2164\n  * [ENHANCMMENT] Reduce timer GC delays in the Linux filesystem collector #2169\n  * [ENHANCMMENT] Add TCPTimeouts to netstat default filter #2189\n  * [ENHANCMMENT] Use SysctlTimeval for boottime collector on BSD #2208\n  * [BUGFIX] ethtool: Sanitize metric names #2093\n  * [BUGFIX] Fix ethtool collector for multiple interfaces #2126\n  * [BUGFIX] Fix possible panic on macOS #2133\n  * [BUGFIX] Collect flag_info and bug_info only for one core #2156\n  * [BUGFIX] Prevent duplicate ethtool metric names #2187\n- Update to 1.2.2\n  * Bug fixes\n     Fix processes collector long int parsing #2112\n- Update to 1.2.1\n  * Removed\n     Remove obsolete capture permission denied error patch already included upstream\n     Fix zoneinfo parsing prometheus/procfs#386\n     Fix nvme collector log noise #2091\n     Fix rapl collector log noise #2092\n- Update to 1.2.0\n  * Changes\n     Rename filesystem collector flags to match other collectors #2012\n     Make node_exporter print usage to STDOUT #203\n  * Features\n     Add conntrack statistics metrics #1155\n     Add ethtool stats collector #1832\n     Add flag to ignore network speed if it is unknown #1989\n     Add tapestats collector for Linux #2044\n     Add nvme collector #2062\n  * Enhancements\n     Add ErrorLog plumbing to promhttp #1887\n     Add more Infiniband counters #2019\n     netclass: retrieve interface names and filter before parsing #2033\n     Add time zone offset metric #2060\n     Handle errors from disabled PSI subsystem #1983\n     Fix panic when using backwards compatible flags #2000\n     Fix wrong value for OpenBSD memory buffer cache #2015\n     Only initiate collectors once #2048\n     Handle small backwards jumps in CPU idle #2067\n- Capture permission denied error for 'energy_uj' file (bsc#1190535)\n\npatterns-suse-manager:\n\n- Golang-github-wrouesnel-postgres_exporter was renamed to prometheus-postgres_exporter\n\npostgresql-jdbc:\n\n- CVE-2022-26520: Address Arbitrary File Write Vulnerability (bsc#1197356)\n- CVE-2022-21724: Address unchecked class instantiation when loading plugins based on class names (bsc#1195561)\n\nprometheus-exporters-formula:\n\n- Version 0.9.5\n  * Postgres exporter package was renamed for Red Hat\n- Version 0.9.4\n  * Postgres exporter package was renamed for SUSE Linux Enterprise Server and openSUSE\n\nprometheus-formula:\n\n- Version 0.3.7\n  * Allow prometheus-formula only for SUSE systems (bsc#1199149)\n\npy27-compat-salt:\n\n- Remove redundant overrides causing confusing DEBUG logging (bsc#1189501)\n\nspacecmd:\n\n- Version 4.1.18-1\n  * implement system.bootstrap (bsc#1194909)\n\nspacewalk-backend:\n\n- Version 4.1.31-1\n  * Fix traceback on calling spacewalk-repo-sync --show-packages (bsc#1193238)\n  * Fix virt_notify SQL syntax error (bsc#1199528)\n  * Do not raise error on file:// based DEB repo when looking\n    for alternative Release files (bsc#1199142)\n  * Improve parsing deb packages dependencies (bsc#1194594)\n  * Fix reposync update notice formatting and date parsing (bsc#1194447)\n  * implement more decompression algorithms for reposync (bsc#1196704)\n\nspacewalk-java:\n\n- Version 4.1.46-1\n  * Fix changelog to include the reference to CVE-2022-31248\n- Version 4.1.45-1\n  * CVE-2022-31248: User enumeration via weak error message (bsc#1199629)\n  * CVE-2022-21952: Unauthenticated remote Denial of Service via resource exhaustion. (bsc#1199512)\n  * During re-activation, recalculate grains if contact method has been changed (bsc#1199677)\n  * autoinstallation: missing whitespace after install URL (bsc#1199888)\n  * Change system details lock tab name to lock/unlock (bsc#1193032)\n  * Set profile tag has no-mandatory in XCCDF result (bsc#1194262)\n  * Added a notification to inform the administrators about the product end-of-life\n  * provisioning thought proxy should use proxy for self_update (bsc#1199036)\n  * Allow removing duplicated packages names in the same Salt action (bsc#1198686)\n  * Fix ACL rules for config diff download for SLS files (bsc#1198914)\n  * fix invalid link to action schedule\n  * Redesign the auto errata task to schedule combined actions (bsc#1197429)\n  * detect free products in Alpha and Beta stage and prevent checks on openSUSE products (bsc#1197488)\n  * Optimize adding new products function (bsc#1193707)\n  * change directory owner and permissions only when needed\n  * Fixed broken help link for system overview\n  * Finding empty profiles by mac address must be case insensitive (bsc#1196407)\n  * generate the system ssh key when bootstrapping a salt-ssh client (bsc#1194909)\n\nspacewalk-setup:\n\n- Version 4.1.11-1\n  * spacewalk-setup-cobbler assumes /etc/apache2/conf.d now as a\n    default instead of /etc/httpd/conf.d (bsc#1198356)\n\nspacewalk-utils:\n\n- Version 4.1.20-1\n  * spacewalk-hostname-rename now correctly replaces the hostname for\n    the mgr-sync configuration file (bsc#1198356)\n  * spacewalk-hostname-rename now utilizes the '--apache2-conf-dir'\n    flag for spacewalk-setup-cobbler (bsc#1198356)\n\nspacewalk-web:\n\n- Version 4.1.34-1\n  * Update Web UI version to 4.1.15\n- Version 4.1.33-1\n  * Added support for end of life notifications\n\nsubscription-matcher:\n\n- Version 0.28\n  * Support both antlr3-java and antlr3-runtime as dependencies\n  * Make it obvious that log4j12 is used\n\nsusemanager:\n\n- version 4.1.36-1\n  * Add python3-contextvars and python3-immutables to missing bootstrap repos (bsc#1200606)\n- version 4.1.35-1\n  * Add python3-gnupg to bootstrap repo definition for Ubuntu 20.04 (bsc#1200212)\n- Version 4.1.34-1\n  * mgr-sync: Raise a proper exception when duplicated lines exist in a config file (bsc#1182742)\n  * fix SLE15 bootstrap repo definition (bsc#1197438)\n  * Add SLES15SP4 and SUMA Proxy 4.3 to bootstrap\n    repo definitions (bsc#1196702)\n  * Add missing dependencies for Salt 3004 into bootstrap repository\n    for SLE15 family (bsc#1198221)\n\nsusemanager-doc-indexes:\n\n- The Large deployments Guide now includes a mention of the proxy (bsc#1199577)\n- In the Administration Guide, documented that monitoring tools are \n  now available on SUSE Linux Enterprise 12, 15 and openSUSE Leap 15, \n  however, Grafana is not available on Proxy (bsc#1191143)\n- In the Administration Guide, renamed the \n  golang-github-wrouesnel-postgres_exporter to prometheus-postgres_exporter\n- In the Client Configuration and Retail Guides clarified that mandatory \n  channels are automatically checked (bsc#1173527)\n- In the Client Configuration Guide, marked Yomi as unsupported on \n  SUSE Linux Enterprise Server 11 and 12\n- Clarified channel label name in Registering Clients with RHUI \n  section of the Client Configuration Guide (bsc#1196067)\n\nsusemanager-docs_en:\n\n- The Large deployments Guide now includes a mention of the proxy \n  (bsc#1199577)\n- In the Administration Guide, documented that monitoring tools are \n  now available on SUSE Linux Enterprise 12, 15 and openSUSE Leap 15,\n  however, Grafana is not available on Proxy (bsc#1191143)\n- In the Administration Guide, renamed the \n  golang-github-wrouesnel-postgres_exporter to prometheus-postgres_exporter\n- In the Client Configuration and Retail Guides clarified that mandatory \n  channels are automatically checked (bsc#1173527)\n- In the Client Configuration Guide, marked Yomi as unsupported on \n  SUSE Linux Enterprise Server 11 and 12\n- Clarified channel label name in Registering Clients with RHUI \n  section of the Client Configuration Guide (bsc#1196067)\n\nsusemanager-schema:\n\n- Version 4.1.26-1\n  * add schema update directory from 4.1.25 to 4.1.26\n\nsusemanager-sls:\n\n- version 4.1.36-1\n  * Prevent possible tracebacks on calling module.run from mgrcompat by setting proper globals with using LazyLoader\n\n- Version 4.1.35-1\n  * Add support to packages.pkgremove to deal with duplicated pkg names (bsc#1198686)\n  * Fix bootstrap repository path resolution for Oracle Linux\n  * Fix deprecated warning when getting pillar data (bsc#1192850)\n  * fixing how the return code is returned in mgrutil runner (bsc#1194909)\n\nHow to apply this update:\n\n1. Log in as root user to the SUSE Manager server.\n2. Stop the Spacewalk service:\n`spacewalk-service stop`\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Start the Spacewalk service:\n`spacewalk-service start`\n","status":"published","published":"2022-06-20T14:12:59Z","modified":"2026-02-04T03:40:29.79401Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:2146-1","title":"Security update for release-notes-susemanager, release-notes-susemanager-proxy","description":"This update for release-notes-susemanager, release-notes-susemanager-proxy fixes the following issues:\n\nRelease notes for SUSE Manager: \n\n- Update to 4.2.7\n  * Salt has been upgraded to 3004 version\n  * Enabled salt bundle as optional\n  * Debian 11 client support has been added\n  * Alertmanager has been upgraded to 0.23.0\n  * Node exporter has been upgraded 1.3.0\n  * CVEs fixed: CVE-2021-44906, CVE-2022-21952, CVE-2022-31248\n  * Bugs mentioned: \n    bsc#1187333, bsc#1191143, bsc#1192550, bsc#1193707, bsc#1194594\n    bsc#1195710, bsc#1196702, bsc#1197400, bsc#1197438, bsc#1197449\n    bsc#1197488, bsc#1197591, bsc#1197689, bsc#1198221\n\nRelease notes for SUSE Manager proxy:\n\n- Update to 4.2.7\n  * Salt has been upgraded to 3004 version\n  * Bugs mentioned: \n    bsc#1187333, bsc#1194594, bsc#1195710, bsc#1197689\n","status":"published","published":"2022-06-20T14:15:02Z","modified":"2026-02-04T04:17:21.661161Z","updated_at":"2026-11-02T15:53:50.513981Z"}]}}