{"id":"CVE-2023-22644","aliases":["EUVD-2023-26778","GHSA-6q6r-hx29-59m5","GO-2024-3201","SUSE-RU-2023:2566-1","SUSE-RU-2023:2592-1","SUSE-RU-2023:2595-1","SUSE-SU-2023:2594-1","SUSE-SU-2023:4758-1","SUSE-SU-2024:3911-1","openSUSE-SU-2024:0350-1","openSUSE-SU-2024:14447-1"],"status":"published","title":"JWT token compromise can allow malicious actions including Remote Code Execution (RCE)","description":"A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE.","severity":{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00456,"percentile":0.39835,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1270","CWE-287","CWE-532"],"published":"2023-06-21T11:19:37Z","modified":"2026-06-17T05:35:50Z","fixes":[{"ecosystem":"Go","package":"github.com/neuvector/neuvector","fixed_in":["0.0.0-20231003121714-be746957ee7c"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy Module 4.3","package":"mgr-daemon","fixed_in":["4.3.7-150400.3.9.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacecmd","fixed_in":["4.3.21-150400.3.18.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacewalk-backend","fixed_in":["4.3.21-150400.3.21.13"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacewalk-proxy","fixed_in":["4.3.16-150400.3.20.6"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacewalk-proxy-installer","fixed_in":["4.3.11-150400.3.6.4"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacewalk-web","fixed_in":["4.3.31-150400.3.21.7"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy Module 4.3","package":"susemanager-build-keys","fixed_in":["15.4.9-150400.3.20.2"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy Module 4.3","package":"uyuni-common-libs","fixed_in":["4.3.8-150400.3.12.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"branch-network-formula","fixed_in":["0.1.1680167239.23f2fec-150400.3.3.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"cobbler","fixed_in":["3.3.3-150400.5.25.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"cpu-mitigations-formula","fixed_in":["0.5.0-150400.3.3.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"hub-xmlrpc-api","fixed_in":["0.7-150400.5.6.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"perl-Satcon","fixed_in":["4.3.2-150400.3.3.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"python-urlgrabber","fixed_in":["4.1.0-150400.4.3.6.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"spacecmd","fixed_in":["4.3.21-150400.3.18.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-admin","fixed_in":["4.3.11-150400.3.6.6"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-backend","fixed_in":["4.3.21-150400.3.21.13"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-config","fixed_in":["4.3.10-150400.3.6.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-java","fixed_in":["4.3.58-150400.3.46.4"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-search","fixed_in":["4.3.9-150400.3.12.7"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-setup","fixed_in":["4.3.16-150400.3.21.6"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-web","fixed_in":["4.3.31-150400.3.21.7"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"supportutils-plugin-susemanager","fixed_in":["4.3.7-150400.3.9.6"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager","fixed_in":["4.3.27-150400.3.26.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-build-keys","fixed_in":["15.4.9-150400.3.20.2"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-docs_en","fixed_in":["4.3-150400.9.27.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-schema","fixed_in":["4.3.18-150400.3.18.7"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-sls","fixed_in":["4.3.33-150400.3.25.7"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-tftpsync","fixed_in":["4.3.4-150400.3.9.9"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"uyuni-common-libs","fixed_in":["4.3.8-150400.3.12.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"virtual-host-gatherer","fixed_in":["1.0.26-150400.3.12.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy Module 4.2","package":"spacecmd","fixed_in":["4.2.23-150300.4.39.4"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy Module 4.2","package":"spacewalk-backend","fixed_in":["4.2.28-150300.4.41.4"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy Module 4.2","package":"spacewalk-certs-tools","fixed_in":["4.2.20-150300.3.30.4"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy Module 4.2","package":"spacewalk-proxy-installer","fixed_in":["4.2.12-150300.3.17.2"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy Module 4.2","package":"spacewalk-ssl-cert-check","fixed_in":["4.2.3-150300.3.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy Module 4.2","package":"spacewalk-web","fixed_in":["4.2.35-150300.3.44.4"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy Module 4.2","package":"susemanager-build-keys","fixed_in":["15.3.9-150300.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.2","package":"branch-network-formula","fixed_in":["0.1.1680167239.23f2fec-150300.3.6.2"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.2","package":"cpu-mitigations-formula","fixed_in":["0.5.0-150300.3.6.2"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.2","package":"hub-xmlrpc-api","fixed_in":["0.7-150300.3.12.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.2","package":"inter-server-sync","fixed_in":["0.2.8-150300.8.31.2"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.2","package":"perl-Satcon","fixed_in":["4.2.3-150300.3.3.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.2","package":"spacecmd","fixed_in":["4.2.23-150300.4.39.4"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-backend","fixed_in":["4.2.28-150300.4.41.4"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-certs-tools","fixed_in":["4.2.20-150300.3.30.4"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-java","fixed_in":["4.2.50-150300.3.66.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-setup","fixed_in":["4.2.12-150300.3.18.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-utils","fixed_in":["4.2.19-150300.3.24.2"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-web","fixed_in":["4.2.35-150300.3.44.4"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.2","package":"supportutils-plugin-susemanager","fixed_in":["4.2.7-150300.3.15.4"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager","fixed_in":["4.2.42-150300.3.54.4"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-build-keys","fixed_in":["15.3.9-150300.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-doc-indexes","fixed_in":["4.2-150300.12.45.4"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-docs_en","fixed_in":["4.2-150300.12.45.2"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-schema","fixed_in":["4.2.28-150300.3.38.4"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-sls","fixed_in":["4.2.34-150300.3.51.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.2","package":"virtual-host-gatherer","fixed_in":["1.0.26-150300.3.15.2"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.3","package":"release-notes-susemanager-proxy","fixed_in":["4.3.10-150400.3.72.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.3","package":"release-notes-susemanager","fixed_in":["4.3.10-150400.3.93.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Go","package":"github.com/neuvector/neuvector","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20231003121714-be746957ee7c"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"mgr-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.7-150400.3.9.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.21-150400.3.18.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.21-150400.3.21.13"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacewalk-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.16-150400.3.20.6"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacewalk-proxy-installer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.11-150400.3.6.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.31-150400.3.21.7"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"susemanager-build-keys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.4.9-150400.3.20.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"uyuni-common-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.8-150400.3.12.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"branch-network-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1680167239.23f2fec-150400.3.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-150400.5.25.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"cpu-mitigations-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-150400.3.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"hub-xmlrpc-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-150400.5.6.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"perl-Satcon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.2-150400.3.3.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"python-urlgrabber","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0-150400.4.3.6.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.21-150400.3.18.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.11-150400.3.6.6"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.21-150400.3.21.13"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.10-150400.3.6.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.58-150400.3.46.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-search","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.9-150400.3.12.7"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-setup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.16-150400.3.21.6"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.31-150400.3.21.7"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"supportutils-plugin-susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.7-150400.3.9.6"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.27-150400.3.26.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-build-keys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.4.9-150400.3.20.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-150400.9.27.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.18-150400.3.18.7"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.33-150400.3.25.7"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-tftpsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.4-150400.3.9.9"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"uyuni-common-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.8-150400.3.12.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"virtual-host-gatherer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.26-150400.3.12.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"release-notes-susemanager-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.6-150400.3.55.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"release-notes-susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.6-150400.3.63.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.2","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.23-150300.4.39.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.2","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.28-150300.4.41.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.2","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.20-150300.3.30.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.2","package":"spacewalk-proxy-installer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.12-150300.3.17.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.2","package":"spacewalk-ssl-cert-check","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-150300.3.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.2","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.35-150300.3.44.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.2","package":"susemanager-build-keys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.3.9-150300.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"branch-network-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1680167239.23f2fec-150300.3.6.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"cpu-mitigations-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-150300.3.6.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"hub-xmlrpc-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-150300.3.12.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"inter-server-sync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.8-150300.8.31.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"perl-Satcon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-150300.3.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.23-150300.4.39.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.28-150300.4.41.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.20-150300.3.30.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.50-150300.3.66.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-setup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.12-150300.3.18.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.19-150300.3.24.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.35-150300.3.44.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"supportutils-plugin-susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.7-150300.3.15.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.42-150300.3.54.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-build-keys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.3.9-150300.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-doc-indexes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2-150300.12.45.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2-150300.12.45.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.28-150300.3.38.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.34-150300.3.51.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"virtual-host-gatherer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.26-150300.3.15.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"release-notes-susemanager-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.13-150300.3.64.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"release-notes-susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.13-150300.3.81.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"release-notes-susemanager-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.10-150400.3.72.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"release-notes-susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.10-150400.3.93.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241030T212825-150000.1.9.1"}]}],"bundled":44},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241030T212825-150000.1.9.1"}]}],"bundled":44},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241030T212825-150000.1.9.1"}]}],"bundled":44},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241030T212825-150000.1.9.1"}]}],"bundled":44},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241104T154416-5.1"}]}],"bundled":56},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241030T212825-1.1"}]}],"bundled":44}],"products":[{"vendor":"suse","product":"manager_server"},{"vendor":"suse","product":"neuvector"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32188","tags":["web"]},{"url":"https://github.com/neuvector/neuvector/security/advisories/GHSA-622h-h2p8-743x","tags":["web"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22644","tags":["x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22644","tags":["advisory"]},{"url":"https://github.com/rancher/rancher/security/advisories/GHSA-9ghh-mmcq-8phc"},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22650"},{"url":"https://github.com/advisories/GHSA-6q6r-hx29-59m5"},{"url":"https://www.suse.com/support/update/announcement/-2023-2566/suse-ru-20232566-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1201063","tags":["report"]},{"url":"https://bugzilla.suse.com/1203599","tags":["report"]},{"url":"https://bugzilla.suse.com/1204089","tags":["report"]},{"url":"https://bugzilla.suse.com/1204270","tags":["report"]},{"url":"https://bugzilla.suse.com/1204900","tags":["report"]},{"url":"https://bugzilla.suse.com/1205600","tags":["report"]},{"url":"https://bugzilla.suse.com/1206060","tags":["report"]},{"url":"https://bugzilla.suse.com/1206191","tags":["report"]},{"url":"https://bugzilla.suse.com/1206423","tags":["report"]},{"url":"https://bugzilla.suse.com/1206725","tags":["report"]},{"url":"https://bugzilla.suse.com/1206783","tags":["report"]},{"url":"https://bugzilla.suse.com/1207063","tags":["report"]},{"url":"https://bugzilla.suse.com/1207595","tags":["report"]},{"url":"https://bugzilla.suse.com/1207814","tags":["report"]},{"url":"https://bugzilla.suse.com/1207829","tags":["report"]},{"url":"https://bugzilla.suse.com/1207830","tags":["report"]},{"url":"https://bugzilla.suse.com/1208288","tags":["report"]},{"url":"https://bugzilla.suse.com/1208321","tags":["report"]},{"url":"https://bugzilla.suse.com/1208427","tags":["report"]},{"url":"https://bugzilla.suse.com/1208522","tags":["report"]},{"url":"https://bugzilla.suse.com/1208536","tags":["report"]},{"url":"https://bugzilla.suse.com/1208540","tags":["report"]},{"url":"https://bugzilla.suse.com/1208550","tags":["report"]},{"url":"https://bugzilla.suse.com/1208586","tags":["report"]},{"url":"https://bugzilla.suse.com/1208661","tags":["report"]},{"url":"https://bugzilla.suse.com/1208687","tags":["report"]},{"url":"https://bugzilla.suse.com/1208719","tags":["report"]},{"url":"https://bugzilla.suse.com/1208772","tags":["report"]},{"url":"https://bugzilla.suse.com/1208965","tags":["report"]},{"url":"https://bugzilla.suse.com/1209143","tags":["report"]},{"url":"https://bugzilla.suse.com/1209149","tags":["report"]},{"url":"https://bugzilla.suse.com/1209215","tags":["report"]},{"url":"https://bugzilla.suse.com/1209220","tags":["report"]},{"url":"https://bugzilla.suse.com/1209231","tags":["report"]},{"url":"https://bugzilla.suse.com/1209253","tags":["report"]},{"url":"https://bugzilla.suse.com/1209277","tags":["report"]},{"url":"https://bugzilla.suse.com/1209386","tags":["report"]},{"url":"https://bugzilla.suse.com/1209395","tags":["report"]},{"url":"https://bugzilla.suse.com/1209434","tags":["report"]},{"url":"https://bugzilla.suse.com/1209508","tags":["report"]},{"url":"https://bugzilla.suse.com/1209557","tags":["report"]},{"url":"https://bugzilla.suse.com/1209926","tags":["report"]},{"url":"https://bugzilla.suse.com/1209938","tags":["report"]},{"url":"https://bugzilla.suse.com/1209993","tags":["report"]},{"url":"https://bugzilla.suse.com/1210086","tags":["report"]},{"url":"https://bugzilla.suse.com/1210094","tags":["report"]},{"url":"https://bugzilla.suse.com/1210101","tags":["report"]},{"url":"https://bugzilla.suse.com/1210107","tags":["report"]},{"url":"https://bugzilla.suse.com/1210154","tags":["report"]},{"url":"https://bugzilla.suse.com/1210162","tags":["report"]},{"url":"https://bugzilla.suse.com/1210349","tags":["report"]},{"url":"https://bugzilla.suse.com/1210437","tags":["report"]},{"url":"https://bugzilla.suse.com/1210458","tags":["report"]},{"url":"https://bugzilla.suse.com/1210776","tags":["report"]},{"url":"https://bugzilla.suse.com/1210835","tags":["report"]},{"url":"https://bugzilla.suse.com/1211958","tags":["report"]},{"url":"https://bugzilla.suse.com/1212363","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-22644","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/-2023-2592/suse-ru-20232592-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1201059","tags":["report"]},{"url":"https://bugzilla.suse.com/1204186","tags":["report"]},{"url":"https://bugzilla.suse.com/1205011","tags":["report"]},{"url":"https://bugzilla.suse.com/1205088","tags":["report"]},{"url":"https://bugzilla.suse.com/1205759","tags":["report"]},{"url":"https://bugzilla.suse.com/1206146","tags":["report"]},{"url":"https://bugzilla.suse.com/1206520","tags":["report"]},{"url":"https://bugzilla.suse.com/1206562","tags":["report"]},{"url":"https://bugzilla.suse.com/1206800","tags":["report"]},{"url":"https://bugzilla.suse.com/1206817","tags":["report"]},{"url":"https://bugzilla.suse.com/1206861","tags":["report"]},{"url":"https://bugzilla.suse.com/1206932","tags":["report"]},{"url":"https://bugzilla.suse.com/1206963","tags":["report"]},{"url":"https://bugzilla.suse.com/1206973","tags":["report"]},{"url":"https://bugzilla.suse.com/1206979","tags":["report"]},{"url":"https://bugzilla.suse.com/1206981","tags":["report"]},{"url":"https://bugzilla.suse.com/1207087","tags":["report"]},{"url":"https://bugzilla.suse.com/1207141","tags":["report"]},{"url":"https://bugzilla.suse.com/1207297","tags":["report"]},{"url":"https://bugzilla.suse.com/1207352","tags":["report"]},{"url":"https://bugzilla.suse.com/1207792","tags":["report"]},{"url":"https://bugzilla.suse.com/1207799","tags":["report"]},{"url":"https://bugzilla.suse.com/1207838","tags":["report"]},{"url":"https://bugzilla.suse.com/1207867","tags":["report"]},{"url":"https://bugzilla.suse.com/1207883","tags":["report"]},{"url":"https://bugzilla.suse.com/1208046","tags":["report"]},{"url":"https://bugzilla.suse.com/1208119","tags":["report"]},{"url":"https://bugzilla.suse.com/1208325","tags":["report"]},{"url":"https://bugzilla.suse.com/1208611","tags":["report"]},{"url":"https://bugzilla.suse.com/1208908","tags":["report"]},{"url":"https://bugzilla.suse.com/1209119","tags":["report"]},{"url":"https://bugzilla.suse.com/1209259","tags":["report"]},{"url":"https://bugzilla.suse.com/1209369","tags":["report"]},{"url":"https://bugzilla.suse.com/1212096","tags":["report"]},{"url":"https://bugzilla.suse.com/1212516","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-46146","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/-2023-2595/suse-ru-20232595-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1179747","tags":["report"]},{"url":"https://bugzilla.suse.com/1186011","tags":["report"]},{"url":"https://bugzilla.suse.com/1207550","tags":["report"]},{"url":"https://bugzilla.suse.com/1207941","tags":["report"]},{"url":"https://bugzilla.suse.com/1208984","tags":["report"]},{"url":"https://bugzilla.suse.com/1209877","tags":["report"]},{"url":"https://bugzilla.suse.com/1209915","tags":["report"]},{"url":"https://bugzilla.suse.com/1210011","tags":["report"]},{"url":"https://bugzilla.suse.com/1210232","tags":["report"]},{"url":"https://bugzilla.suse.com/1210311","tags":["report"]},{"url":"https://bugzilla.suse.com/1210406","tags":["report"]},{"url":"https://bugzilla.suse.com/1210659","tags":["report"]},{"url":"https://bugzilla.suse.com/1210957","tags":["report"]},{"url":"https://bugzilla.suse.com/1211330","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232594-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1212517","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234758-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1191143","tags":["report"]},{"url":"https://bugzilla.suse.com/1204235","tags":["report"]},{"url":"https://bugzilla.suse.com/1207012","tags":["report"]},{"url":"https://bugzilla.suse.com/1207532","tags":["report"]},{"url":"https://bugzilla.suse.com/1210928","tags":["report"]},{"url":"https://bugzilla.suse.com/1210930","tags":["report"]},{"url":"https://bugzilla.suse.com/1211355","tags":["report"]},{"url":"https://bugzilla.suse.com/1211560","tags":["report"]},{"url":"https://bugzilla.suse.com/1211649","tags":["report"]},{"url":"https://bugzilla.suse.com/1212695","tags":["report"]},{"url":"https://bugzilla.suse.com/1212904","tags":["report"]},{"url":"https://bugzilla.suse.com/1213469","tags":["report"]},{"url":"https://bugzilla.suse.com/1214186","tags":["report"]},{"url":"https://bugzilla.suse.com/1214471","tags":["report"]},{"url":"https://bugzilla.suse.com/1214601","tags":["report"]},{"url":"https://bugzilla.suse.com/1214759","tags":["report"]},{"url":"https://bugzilla.suse.com/1215209","tags":["report"]},{"url":"https://bugzilla.suse.com/1215514","tags":["report"]},{"url":"https://bugzilla.suse.com/1215949","tags":["report"]},{"url":"https://bugzilla.suse.com/1216030","tags":["report"]},{"url":"https://bugzilla.suse.com/1216041","tags":["report"]},{"url":"https://bugzilla.suse.com/1216085","tags":["report"]},{"url":"https://bugzilla.suse.com/1216128","tags":["report"]},{"url":"https://bugzilla.suse.com/1216380","tags":["report"]},{"url":"https://bugzilla.suse.com/1216506","tags":["report"]},{"url":"https://bugzilla.suse.com/1216555","tags":["report"]},{"url":"https://bugzilla.suse.com/1216690","tags":["report"]},{"url":"https://bugzilla.suse.com/1216754","tags":["report"]},{"url":"https://bugzilla.suse.com/1217038","tags":["report"]},{"url":"https://bugzilla.suse.com/1217223","tags":["report"]},{"url":"https://bugzilla.suse.com/1217224","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243911-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-45157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-32197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-33662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47067","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-7558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-7594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9486","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9675","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-0132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-0133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8185","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-22644","title":"JWT token compromise can allow malicious actions including Remote Code Execution (RCE)","description":"A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE.","status":"published","published":"2023-09-20T08:12:34.13Z","modified":"2025-04-07T17:19:01.804Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna"}],"cwes":["CWE-1270"],"updated_at":"2026-11-02T14:35:15.779187Z"}],"euvd":[{"id":"EUVD-2023-26778","description":"A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE.","status":"published","published":"2023-09-20T08:12:34Z","modified":"2025-04-07T17:19:01Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"updated_at":"2026-11-02T20:52:41.16494Z"}],"ghsa":[{"id":"GHSA-6q6r-hx29-59m5","title":"An Innsertion of Sensitive Information into Log File vulnerability in SUSE SUSE Manager Server...","description":"An Innsertion of Sensitive Information into Log File vulnerability in SUSE SUSE Manager Server Module 4.2 spacewalk-java, SUSE SUSE Manager Server Module 4.3 spacewalk-java causes sensitive information to be logged.\nThis issue affects SUSE Manager Server Module 4.2: before 4.2.50-150300.3.66.5; SUSE Manager Server Module 4.3: before 4.3.58-150400.3.46.4.\n\n","status":"published","published":"2023-09-20T09:30:22Z","modified":"2024-11-18T16:26:33Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-287","CWE-532","CWE-1270"],"updated_at":"2026-11-02T14:58:52.476096Z"}],"nvd":[{"id":"CVE-2023-22644","description":"A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE.","status":"published","published":"2023-09-20T09:15:12.837Z","modified":"2026-06-17T05:35:50.143Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-1270"],"updated_at":"2026-11-02T14:08:29.595868Z"}],"osv":[{"id":"GO-2024-3201","title":"JWT token compromise can allow malicious actions including Remote Code Execution (RCE) in github.com/neuvector/neuvector","description":"JWT token compromise can allow malicious actions including Remote Code Execution (RCE) in github.com/neuvector/neuvector","status":"published","published":"2024-10-15T15:42:40Z","modified":"2026-05-04T08:57:06.352918879Z","updated_at":"2026-11-02T15:47:01.453823Z"},{"id":"openSUSE-SU-2024:0350-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20241104T154416 2024-11-04T15:44:16Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3233 CVE-2024-46872 GHSA-762g-9p7f-mrww\n  * GO-2024-3234 CVE-2024-47401 GHSA-762v-rq7q-ff97\n  * GO-2024-3235 CVE-2024-50052 GHSA-g376-m3h3-mj4r\n  * GO-2024-3237 CVE-2024-0133 GHSA-f748-7hpg-88ch\n  * GO-2024-3239 CVE-2024-0132 GHSA-mjjw-553x-87pq\n  * GO-2024-3240 CVE-2024-10452 GHSA-66c4-2g2v-54qw\n  * GO-2024-3241 CVE-2024-10006 GHSA-5c4w-8hhh-3c3h\n  * GO-2024-3242 CVE-2024-10086 GHSA-99wr-c2px-grmh\n  * GO-2024-3243 CVE-2024-10005 GHSA-chgm-7r52-whjj\n\n- Update to version 0.0.20241101T215616 2024-11-01T21:56:16Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3244 CVE-2024-50354 GHSA-cph5-3pgr-c82g\n  * GO-2024-3245 CVE-2024-39720\n  * GO-2024-3246 CVE-2024-8185 GHSA-g233-2p4r-3q7v\n\n- Update to version 0.0.20241030T212825 2024-10-30T21:28:25Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3230 CVE-2024-48921 GHSA-qjvc-p88j-j9rm\n  * GO-2024-3232 CVE-2024-10241 GHSA-6mvp-gh77-7vwh\n\n- Update to version 0.0.20241030T160108 2024-10-30T16:01:08Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3226 CVE-2024-47827 GHSA-ghjw-32xw-ffwr\n  * GO-2024-3227 CVE-2024-10214 GHSA-hm57-h27x-599c\n  * GO-2024-3228 GHSA-wcx9-ccpj-hx3c\n- Packaging improvments:\n  * Backfill CVE aliases in recent changelog entries\n\n- Update to version 0.0.20241028T152002 2024-10-28T15:20:02Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3207 GHSA-p5wf-cmr4-xrwr\n  * GO-2024-3208 CVE-2024-47825 GHSA-3wwx-63fv-pfq6\n  * GO-2024-3210 CVE-2024-8901\n  * GO-2024-3211 CVE-2024-50312\n  * GO-2024-3212 GHSA-rjfv-pjvx-mjgv\n  * GO-2024-3213 CVE-2024-49380\n  * GO-2024-3214 CVE-2024-49381\n  * GO-2024-3215 CVE-2024-9264 GHSA-q99m-qcv4-fpm7\n  * GO-2024-3216 CVE-2024-49753 GHSA-6cf5-w9h3-4rqv\n  * GO-2024-3217 CVE-2024-49757 GHSA-3rmw-76m6-4gjc\n  * GO-2024-3219 GHSA-7h65-4p22-39j6\n  * GO-2024-3220 CVE-2023-32197 GHSA-7h8m-pvw3-5gh4\n  * GO-2024-3221 CVE-2024-22036 GHSA-h99m-6755-rgwc\n  * GO-2024-3222 GHSA-x7xj-jvwp-97rv\n  * GO-2024-3223 CVE-2022-45157 GHSA-xj7w-r753-vj8v\n  * GO-2024-3224 CVE-2024-39223 GHSA-8wxx-35qc-vp6r\n\n- Update to version 0.0.20241017T153730 date 2024-10-17T15:37:30Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8\n  * GO-2024-3203 CVE-2024-9486\n  * GO-2024-3204 CVE-2024-9594\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8\n  * GO-2024-3196 CVE-2024-47877 GHSA-8rm2-93mq-jqhc\n  * GO-2024-3199 GHSA-vv6c-69r6-chg9\n  * GO-2024-3200 CVE-2024-48909 GHSA-3c32-4hq9-6wgj\n  * GO-2024-3201 CVE-2023-22644\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j\n  * GO-2024-3171 CVE-2024-9341 GHSA-mc76-5925-c5p6\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3161 CVE-2024-22030 GHSA-h4h5-9833-v2p4\n  * GO-2024-3162 CVE-2024-7594 GHSA-jg74-mwgw-v6x3\n  * GO-2024-3163 CVE-2024-47182\n  * GO-2024-3164 CVE-2024-47003 GHSA-59hf-mpf8-pqjh\n  * GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j\n  * GO-2024-3167 CVE-2024-9355 GHSA-3h3x-2hwv-hr52\n  * GO-2024-3168 CVE-2024-8975 GHSA-chqx-36rm-rf8h\n  * GO-2024-3169 CVE-2024-9407 GHSA-fhqq-8f65-5xfc\n  * GO-2024-3170 CVE-2024-8996 GHSA-m5gv-m5f9-wgv4\n  * GO-2024-3172 CVE-2024-33662 GHSA-9mjw-79r6-c9m8\n  * GO-2024-3173 CVE-2024-7558 GHSA-mh98-763h-m9v4\n  * GO-2024-3174 CVE-2024-8037 GHSA-8v4w-f4r9-7h6x\n  * GO-2024-3175 CVE-2024-8038 GHSA-xwgj-vpm9-q2rq\n  * GO-2024-3179 CVE-2024-47616 GHSA-r7rh-jww5-5fjr\n  * GO-2024-3181 CVE-2024-9313 GHSA-x5q3-c8rm-w787\n  * GO-2024-3182 GHSA-wpr2-j6gr-pjw9\n  * GO-2024-3184 CVE-2024-36814 GHSA-9cp9-8gw2-8v7m\n  * GO-2024-3185 CVE-2024-47832\n  * GO-2024-3186 CVE-2024-9675 GHSA-586p-749j-fhwp\n  * GO-2024-3188 CVE-2024-9312 GHSA-4gfw-wf7c-w6g2\n  * GO-2024-3190 CVE-2024-47067 GHSA-8pph-gfhp-w226\n  * GO-2024-3191 CVE-2024-9180 GHSA-rr8j-7w34-xp5j","status":"published","published":"2024-11-05T14:52:20Z","modified":"2026-02-04T12:23:04.839834Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:14447-1","title":"govulncheck-vulndb-0.0.20241030T212825-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20241030T212825-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-11-01T00:00:00Z","modified":"2026-02-04T03:23:32.319637Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-RU-2023:2566-1","title":"Security update for SUSE Manager Server 4.3","description":"This update fixes the following issues:\n\nbranch-network-formula:\n\n- Update to version 0.1.1680167239.23f2fec\n  * Remove unnecessary import of 'salt.ext.six'\n\ncobbler:\n\n- Fix cobbler buildiso so that the artifact can be booted by EFI firmware. (bsc#1206060)\n- Switch packaging from patch based to Git tree based development\n- S390X systems require their kernel options to have a linebreak at 79 characters (bsc#1207595)\n- Settings-migration-v1-to-v2.sh will now handle paths with whitespace correctly\n- Fix renaming Cobbler items (bsc#1204900, bsc#1209149)\n- 'cobbler buildiso' arguments '--system' and '--profile' are now accepted in the right order (bsc#1210776)\n\ncpu-mitigations-formula:\n\n- Update to version 0.5.0:\n  * Mark all SUSE Linux Enterprise 15 SP4 and newer and\n    openSUSE 15.4 and newer as supported (bsc#1210835)\n\nhub-xmlrpc-api:\n\n- Do not strictly require Go 1.18 on \n  SUSE Linux Enterprise 15 SP3 (bsc#1203599)\n\nperl-Satcon:\n\n- Version 4.3.2-1\n  * Accept keys with dots\n\npython-urlgrabber:\n\n- Raise proper exception from urlgrab() when local file is not found (bsc#1208288)\n\nspacecmd:\n\n- Version 4.3.21-1\n  * Fix argument parsing of distribution_update (bsc#1210458)\n- Version 4.3.20-1\n  * Display activation key details after executing the corresponding command (bsc#1208719)\n  * Show targetted packages before actually removing them (bsc#1207830)\n\nspacewalk-admin:\n\n- Version 4.3.11-1\n  * change backup file extension from .orig to .current_time (bsc#1206783)\n\nspacewalk-backend:\n\n- Version 4.3.21-1\n  * Add package details to reposync error logging\n  * Fix the mgr-inter-sync not creating valid repository metadata when dealing with empty channels (bsc#1207829)\n  * Filter CLM modular packages using release strings (bsc#1207814)\n  * Fix issues with kickstart syncing on mirrorlist repositories\n  * Do not sync .mirrorlist and other non needed files\n  * reposync: catch local file not found urlgrabber error properly (bsc#1208288)\n- Version 4.3.20-1\n  * Fix repo sync for cloud payg connected repositories (bsc#1208772)\n\nspacewalk-config:\n\n- Version 4.3.10-1\n  * Add /saltboot directory\n  * Mark /os-images and /tftp as static content\n\nspacewalk-java:\n    \n- Security fixes included in this version update from 4.3.52-1 to 4.3.58-1:\n  * CVE-2023-22644: Fix session information leak  (bsc#1210107)\n  * CVE-2023-22644: Do not output cobbler xmlrpc token in debug logs (bsc#1210162)\n  * CVE-2023-22644: fix credentials and other secrets disclosure when debug log is enabled (bsc#1210154)\n  * CVE-2023-22644: Don't output URL parameters for tiny urls (bsc#1210101)\n  * CVE-2023-22644: Do not log SSL certificate / key file content (bsc#1210094)\n  * CVE-2023-22644: Remove web session swap secrets output in logs (bsc#1210086)\n- Non-security bug fixes included in this version update from 4.3.52-1 to 4.3.58-1:\n  * Version 4.3.58-1\n    + Make sure that all hibernate connections are closed (bsc#1208687)\n  * Version 4.3.57-1\n    + Update version of tomcat build dependencies\n  * Version 4.3.55-1\n    + Fix breadcrumbs on recurring actions pages\n  * Version 4.3.54-1\n    + Kernel options: only add quotes if there is a space in the value (bsc#1209926)\n  * Version 4.3.53-1\n    + Update Cobbler profile when a new image is deployed\n    + Add mapping of image URLs for containerized proxy\n    + Remove channels from client after transfer to a different organization (bsc#1209220)\n    + Fix RHEL9 / SLL9 product discovery (bsc#1209993)\n    + Fix displaying system channels when no base product is installed (bsc#1206423)\n    + Fix NPE in cobbler system sync when server has no creator set\n    + Recurring custom states\n    + Removed the expensive 'diff' column (bsc#1208427)\n    + Fix possible 'NullPointerException' when clicking on the 'Create PXE installation configuration' button from\n      Provising page\n    + Fix possible 'NullPointerException' issues when running cobbler-sync-bunch\n    + Do not trigger extra cobbler sync when changing kickstart data (bsc#1208536)\n    + Set jasper development mode to false (bsc#1206191)\n    + Fixed select all for ptf packages list (bsc#1209143)\n    + Added SLES 12 support for ptf removal\n    + Fixed issue with checking ptf repositories on cloned channels\n    + Add support to add optional channels via webUI\n    + Added APIs to allow frontend to install and remove ptf\n    + Show the package summary where applicable to better describe PTF packages\n    + Added CLM filters to match product temporary fixes packages\n    + Restrict product temporary fixes visibility in the UI and in the APIs responses\n    + Fixed empty selection warning in the lock/unlock page\n    + Set GPG Key Url for PTF repositories\n    + Fix deleting custom info pillar (bsc#1209253)\n    + Update report outdated system query to de-duplicate errata id's\n    + Refactor Software / Manage / Packages to use SQL paging (bsc#1206725)\n    + Filter CLM modular packages using release strings (bsc#1207814)\n    + Fix systems subscribed to channel CSV download (bsc#1201063)\n    + Fix cobbler system entries for retail terminals (bsc#1208661)\n    + Make API method systemgroup.listSystemsMinimal read-only (bsc#1208550)\n    + Add missing text for user preferenaces page\n    + Do not include channels from different orgs when listing mandatory channels (bsc#1204270)\n    + Save scheduler user when creating Patch actions manually (bsc#1208321)\n  * Version 4.3.52-1\n    + Add more restricted arguments to prevent HTTP API logging sensitive data (bsc#1209386, bsc#1209395)\n  * Version 4.3.51-1\n    + Support multiple gpgkey urls for a channel (bsc#1208540)\n\nspacewalk-search:\n\n- Version 4.3.9-1\n  * Add maxPoolSize option  to search\n\nspacewalk-setup:\n\n- Version 4.3.16-1\n  * Enable netapi clients in master configuration (required for Salt 3006)\n  * Persist report_db_sslrootcert value (bsc#1210349)\n  * Fix migration test\n  * Escape `%` in spec file.\n  * remove useless tomcat configuration (bsc#1206191)\n  * use template for reportdb configuration (bsc#1206783)\n\nspacewalk-web:\n\n- Version 4.3.31-1\n  * Fix title on recurring actions edit page\n- Version 4.3.30-1\n  * Disable login button with empty password\n  * Ignore mandatory channels results that don't match list of channels (bsc#1204270)\n  * Increase datetimepicker font sizes (bsc#1210437)\n  * Recurring custom states\n  * fix an issue where the datetimepicker shows wrong date (bsc#1209231)\n  * Add support to add optional channels via webUI\n  * Added pages to install and remove ptf\n  * Added CLM filters to match product temporary fixes packages\n  * Refactor Software / Manage / Packages to use SQL paging (bsc#1206725)\n\nsubscription-matcher:\n\n- Relax antlr version requirement\n\nsupportutils-plugin-susemanager:\n\n- Version 4.3.7-1\n  * fix db connection check tool (bsc#1208586)\n\nsusemanager:\n\n- version 4.3.27-1\n  * Use newest venv-salt-minion version available to generate the venv-enabled-*.txt file in bootstrap repos \n    (bsc#1211958)\n- Version 4.3.26-1\n  * Add bootstrap repository definitions for SLE-Micro 5.4\n  * Make python3-ordered-set optional for the SLE15 bootstrap repo as it is\n    not required or present in SLE15SP3 or older\n  * Add bootstrap repository definitions for openSUSE Leap 15.5\n  * add bootstrap repository definitions for SLE-Micro 5.1 (bsc#1209557)\n  * Add SLES15SP5 to bootstrap repo definitions\n\nsusemanager-build-keys:\n\n- Version 15.4.9\n  * add Debian 12 (bookworm) GPG keys (bsc#1212363)\n  * add new 4096 bit RSA SUSE Package Hub key    \n- Version 15.4.8\n  * add new 4096 bit RSA openSUSE build key gpg-pubkey-29b700a4.asc\n\nsusemanager-docs_en:\n\n- Change cleanup Salt Client description\n- Documentation Salt version updated to 3006\n- Added SUSE Linux Enterprise Micro 5.4 support\n- Added openSUSE Leap version 15.5\n- Added SUSE Linux Enterprise version 15 SP5\n- Documented new Recurring Actions feature\n- Adjusted Single Sign-On example in Administration Guide\n  according to Keycloak 21.0.1 update\n- Add multiple GPG key url usage to Client Configuration Guide\n  to Keycloak 22.0.1 update\n- Documented custom info is available via pillars in Client \n  Configuration Guide (bsc#1209253)\n- Added updated options for rhn.conf file in the Administration \n  Guide (bsc#1209508)\n- Added instruction for Cobbler to use the correct label in \n  Client Config Guide distro label (bsc#1205600)\n- Adjusted python version and openSUSE Leap version in public cloud\n  document (bsc#1209938)\n- Fixed calculation of DB max-connections and align it with the \n  supportconfig checking tool in the Tuning Guide\n- Fixed Troubleshooting Corrupt Repositories procedure\n- Branding updated for 2023\n- New search engine optimization improvements for documentation\n- Translations are now included in the WebUI help documentation\n- Local search is now provided with the WebUI help documentation\n\nsusemanager-schema:\n\n- Version 4.3.18-1\n  * Recurring custom states\n  * Added view to handle ptf packages and updated the procedures\n    to refresh the updatable/installable packages\n  * Fix update of sql function create_new_org\n  * Filter CLM modular packages using release strings (bsc#1207814)\n\nsusemanager-sls:\n\n- Version 4.3.33-1\n  * fix duplicate packages in state\n- Version 4.3.32-1\n  * disable salt-minion and remove its config file on cleanup (bsc#1209277)\n  * Add kiwi supported disk images to be collectable (bsc#1208522)\n  * Rename internal state 'synccustomall' to 'syncall'\n  * Recurring custom states\n  * to update everything on a debian system, call dist-upgrade to\n    be able to install and remove packages\n  * Allow KiwiNG to be used on SLE12 buildhosts (bsc#1204089)\n  * Enforce installation of the PTF GPG key package\n  * Improve error handling in mgr_events.py (bsc#1208687)\n- Version 4.3.31-1\n  * support multiple gpgkey urls for a channel (bsc#1208540)\n  * make SUSE Addon GPG key available on all instance (bsc#1208540)\n\nsusemanager-tftpsync:\n\n- Version 4.3.4-1\n  * Fix server-side cache that's used for only pushing files to\n    proxies that need to be pushed, as well as propagating deletions\n    (bsc#1209215)\n  * Fix removal of proxies section in cobbler settings (bsc#1207063)\n\nuyuni-common-libs:\n\n- Version 4.3.8-1\n  * Allow default component for context manager\n\nvirtual-host-gatherer:\n\n- Version 1.0.26-1\n  * fix cpu calculation in the libvirt module and enhance the data\n    structure by os value\n\nHow to apply this update:\n\n1. Log in as root user to the SUSE Manager Server.\n2. Stop the Spacewalk service:\n`spacewalk-service stop`\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Start the Spacewalk service:\n`spacewalk-service start`\n","status":"published","published":"2023-06-21T11:19:37Z","modified":"2026-02-04T02:17:01.906226Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-RU-2023:2592-1","title":"Security update for SUSE Manager Server 4.3","description":"This update fixes the following issues:\n\nrelease-notes-susemanager:\n\n- Update to SUSE Manager 4.3.6\n  * Salt has been upgraded to 3006.0\n  * SUSE Linux Enterprise Server 15 SP5 Family support has been added\n  * SUSE Linux Enterprise Server Micro 5.4 support has been added\n  * openSUSE Leap 15.5 support has been added\n  * Ability to install PTFs from SUSE Manager has been added\n  * Scheduling Custom States on recurrent basis is now possible\n  * Syncing optional channels from the webUI is now possible\n  * All Tomcat logs are now rotated with logrotate\n  * Grafana upgraded to 9.5.1\n  * Node exporter upgraded to 1.5.0\n  * Prometheus upgraded to 2.37.6\n  * Postgres exporter upgraded to 0.10.1\n  * CVEs fixed\n    CVE-2023-22644, CVE-2022-46146\n  * Bugs mentioned\n    \n    bsc#1201063, bsc#1203599, bsc#1204089, bsc#1204270, bsc#1204900\n    bsc#1205600, bsc#1206060, bsc#1206191, bsc#1206423, bsc#1206725\n    bsc#1206783, bsc#1207063, bsc#1207595, bsc#1207814, bsc#1207829\n    bsc#1207830, bsc#1208288, bsc#1208321, bsc#1208427, bsc#1208522\n    bsc#1208536, bsc#1208540, bsc#1208550, bsc#1208586, bsc#1208661\n    bsc#1208687, bsc#1208719, bsc#1208772, bsc#1209143, bsc#1209149\n    bsc#1209215, bsc#1209220, bsc#1209231, bsc#1209253, bsc#1209277\n    bsc#1209386, bsc#1209395, bsc#1209508, bsc#1209557, bsc#1209926\n    bsc#1209938, bsc#1209993, bsc#1210086, bsc#1210094, bsc#1210101\n    bsc#1210107, bsc#1210154, bsc#1210162, bsc#1210349, bsc#1210437\n    bsc#1210458, bsc#1210835, bsc#1211958, bsc#1210776, bsc#1209434\n    bsc#1208046, bsc#1212363, bsc#1212096, bsc#1212516\n\n","status":"published","published":"2023-06-21T12:34:20Z","modified":"2026-02-04T04:13:14.825855Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-RU-2023:2595-1","title":"Security update for SUSE Manager Server 4.2","description":"This update fixes the following issues:\n\nbranch-network-formula:\n\n- Update to version 0.1.1680167239.23f2fec\n  * Remove unnecessary import of 'salt.ext.six'\n\ncpu-mitigations-formula:\n\n- Update to version 0.5.0:\n  * Mark all SUSE Linux Enterprise 15 SP4 and newer and openSUSE 15.4 and newer as supported (bsc#1210835)\n\nhub-xmlrpc-api:\n\n- Do not strictly require Go 1.18 on SUSE Linux Enterprise 15 SP3 (bsc#1203599)\n\ninter-server-sync:\n\n- Version 0.2.8 \n  * Correctly detect product name and product version number\n  * Import image channel data only when related software channel is available (bsc#1211330)\n\nperl-Satcon:\n\n- Version 4.2.3-1\n  * Accept keys with dots\n\nspacecmd:\n\n- Version 4.2.23-1\n  * Fix argument parsing of distribution_update (bsc#1210458)\n\nspacewalk-backend:\n\n- Version 4.2.28-1\n  * Filter CLM modular packages using release strings (bsc#1207814)\n  * Add package details to reposync error logging\n\nspacewalk-certs-tools:\n\n- Version 4.2.20-1\n  * Update translations\n\nspacewalk-java:\n\n- Security fixes in version 4.2.50-1:\n  * CVE-2023-22644: Remove web session swap secrets output in logs (bsc#1210086)\n  * CVE-2023-22644: Do not output URL parameters for tiny urls (bsc#1210101)\n  * CVE-2023-22644: Fix session information leak (bsc#1210107)\n  * CVE-2023-22644: Do not output Cobbler xmlrpc token in debug logs (bsc#1210162)\n  * CVE-2023-22644: Fix credentials and other secrets disclosure when debug log is enabled (bsc#1210154)\n  * CVE-2023-22644: Prevent logging formula data (bsc#1209386, bsc#1209434)\n- Other non-security issues fixed in version 4.2.50-1:\n  * Fix misleading error message regarding SCC credentials removal (bsc#1207941)\n  * Fix issue with `aclChannelTypeCapable` that prevented errata view in deb arch\n  * Refresh pillars after setting custom values via SSM (bsc#1210659)\n  * Report SSM power management errors in 'rhn_web_ui' (bsc#1210406)\n  * Filter CLM modular packages using release strings (bsc#1207814)\n  * Allow processing big state results (bsc#1210957)\n  * Use glassfish-activation-api instead of gnu-jaf\n  * Fix Intenal Server Error when URI contains invalid sysid (bsc#1186011)\n  * kernel options: only add quotes if there is a space in the value (bsc#1209926)\n  * Fix link to Knowledge Base articles (bsc#1210311)\n  * Remove channels from client after transfer to a different organization (bsc#1209220)\n  * Fix displaying system channels when no base product is installed (bsc#1206423)\n  * Fix broken ifcfg grub option on reinstallation (bsc#1210232)\n  * Fix NPE in Cobbler system sync when server has no creator set\n  * Add listSystemEvents missing API endpoint (bsc#1209877)\n\nspacewalk-setup:\n\n- Version 4.2.12-1\n  * Enable netapi clients in master configuration (required for Salt 3006)\n\nspacewalk-utils:\n\n- Version 4.2.19-1\n  * spacewalk-hostname-rename remains stuck at refreshing pillars (bsc#1207550)\n\nspacewalk-web:\n\n- Version 4.2.35-1\n  * Show loading indicator on formula details pages (bsc#1179747)\n  * Increase datetimepicker font sizes (bsc#1210437)\n  * Fix an issue where the datetimepicker shows wrong date (bsc#1209231)\n\nsupportutils-plugin-susemanager:\n\n- Version 4.2.7-1\n  * Fix property name to tune for salt events queue processing\n\nsusemanager:\n\n- version 4.3.27-1\n  * Use newest venv-salt-minion version available to generate the venv-enabled-*.txt file in bootstrap repos\n    (bsc#1211958)\n- Version 4.2.41-1\n  * Add bootstrap repository definitions for openSUSE Leap 15.5\n  * Add bootstrap repository definitions for SUSE Linux Enterprise Server 15 SP5\n\nsusemanager-build-keys:\n\n- Version 15.3.9\n  * add SUSE Liberty v2 key (bsc#1212096)\n  * add Debian 12 (bookworm) GPG keys (bsc#1212363)\n  * add new 4096 bit RSA SUSE Package Hub key\n- Version 15.3.8\n  * Fix installation of SUSE Linux Enterprise 15 RSA reserve build key\n  * Add new 4096 bit RSA openSUSE build key gpg-pubkey-29b700a4.asc\n\nsusemanager-sls: \n\n- Version 4.2.34-1\n  * Trust new Liberty Linux v2 key (bsc#1212096)\n\nsusemanager-doc-indexes:\n\n- Salt version changed to 3006.0\n- Added note for clarification between self-installed and cloud instances of Ubuntu\n- Improved pay-as-you-go documentation in the Install and Upgrade Guide (bsc#1208984)\n- Added comment about activation keys for LTSS clients in Client Configuration Guide (bsc#1210011)\n- Updated API script examples to Python 3 in Administration Guide and Large Deployment Guide\n- Change cleanup Salt Client description\n- Added instruction for Cobbler to use the correct label in Client Configuration Guide distro label (bsc#1205600)\n- Added updated options for rhn.conf file in the Administration Guide (bsc#1209508)\n- Fixed calculation of DB max-connections and align it with the supportconfig checking tool in the Tuning Guide\n\nsusemanager-docs_en:\n\n- Salt version changed to 3006.0\n- Added note for clarification between self-installed and cloud instances of Ubuntu\n- Improved Pay-as-you-go documentation in the Install and Upgrade Guide (bsc#1208984)\n- Added comment about activation keys for LTSS clients in Client Configuration Guide (bsc#1210011)\n- Updated API script examples to Python 3 in Administration Guide and Large Deployment Guide\n- Change cleanup Salt Client description\n- Added instruction for Cobbler to use the correct label in Client Configuration Guide distro label (bsc#1205600)\n- Added updated options for rhn.conf file in the Administration Guide (bsc#1209508)\n- Fixed calculation of DB max-connections and align it with the supportconfig checking tool in the Tuning Guide\n\nsusemanager-schema:\n\n- Version 4.2.28-1\n  * Filter CLM modular packages using release strings (bsc#1207814)\n  * Repeat schema migrations for module metadata storage (bsc#1209915)\n\nsusemanager-sls:\n\n- Version 4.2.33-1\n  * Include automatic migration from Salt 3000 to Salt bundle in highstate\n  * Disable salt-minion and remove its config file on cleanup (bsc#1209277)\n  * To update everything on a debian system, call dist-upgrade to be able to install and remove packages\n\nvirtual-host-gatherer:\n\n- Version 1.0.26-1\n  * Fix cpu calculation in the libvirt module and enhance the data structure by os value\n\nHow to apply this update:\n\n1. Log in as root user to the SUSE Manager Server.\n2. Stop the Spacewalk service:\n`spacewalk-service stop`\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Start the Spacewalk service:\n`spacewalk-service start`\n","status":"published","published":"2023-06-21T12:38:41Z","modified":"2026-02-04T04:10:21.085286Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2023:2594-1","title":"Security update for SUSE Manager Server 4.2","description":"This update fixes the following issues:\n\nrelease-notes-susemanager:\n\n- Update to 4.2.13\n  * Salt has been upgraded to 3006.0\n  * SUSE Linux Enterprise Server 15 SP5 Family support has been added\n  * openSUSE Leap 15.5 support has been added\n  * Automatic migration from Salt 3000 to Salt bundle\n  * Grafana upgraded to 9.5.1\n  * Node exporter upgraded to 1.5.0\n  * Prometheus upgraded to 2.37.6\n  * Postgres exporter upgraded to 0.10.1\n  * CVEs fixed:\n    CVE-2023-22644, CVE-2022-46146\n  * Bugs mentioned:\n    bsc#1179747, bsc#1186011, bsc#1203599, bsc#1205600, bsc#1206423\n    bsc#1207550, bsc#1207814, bsc#1207941, bsc#1208984, bsc#1209220\n    bsc#1209231, bsc#1209277, bsc#1209386, bsc#1209434, bsc#1209508\n    bsc#1209877, bsc#1209915, bsc#1209926, bsc#1210011, bsc#1210086\n    bsc#1210101, bsc#1210107, bsc#1210154, bsc#1210162, bsc#1210232\n    bsc#1210311, bsc#1210406, bsc#1210437, bsc#1210458, bsc#1210659\n    bsc#1210835, bsc#1210957, bsc#1211330, bsc#1208046, bsc#1212517\n    bsc#1212096\n\n","status":"published","published":"2023-06-21T12:36:48Z","modified":"2026-02-04T03:09:54.137313Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2023:4758-1","title":"Security update for SUSE Manager Server 4.3","description":"This update fixes the following issues:\n\nrelease-notes-susemanager:\n\n- Update to SUSE Manager 4.3.10\n  * SUSE Linux Enterprise Server Micro 5.5 support\n  * CLM filter by package build date\n  * Enhanced Errata.getDetails API endpoint\n  * CVEs fixed:\n    CVE-2023-22644\n  * Bugs mentioned:\n    bsc#1191143, bsc#1204235, bsc#1207012, bsc#1207532, bsc#1210928,\n    bsc#1210930, bsc#1211355, bsc#1211560, bsc#1211649, bsc#1212695,\n    bsc#1212904, bsc#1213469, bsc#1214186, bsc#1214471, bsc#1214601,\n    bsc#1214759, bsc#1215209, bsc#1215514, bsc#1215949, bsc#1216030,\n    bsc#1216041, bsc#1216085, bsc#1216128, bsc#1216380, bsc#1216506,\n    bsc#1216555, bsc#1216690, bsc#1216754, bsc#1217038, bsc#1217223,\n    bsc#1217224\n\n","status":"published","published":"2023-12-13T09:34:07Z","modified":"2026-02-04T04:10:18.521126Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2024:3911-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\nUpdate to version 0.0.20241030T212825 2024-10-30T21:28:25Z ( jsc#PED-11136 )\n\n- Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2024-3230 CVE-2024-48921 GHSA-qjvc-p88j-j9rm\n  * GO-2024-3232 CVE-2024-10241 GHSA-6mvp-gh77-7vwh\n\n- Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2024-3226 CVE-2024-47827 GHSA-ghjw-32xw-ffwr\n  * GO-2024-3227 CVE-2024-10214 GHSA-hm57-h27x-599c\n  * GO-2024-3228 GHSA-wcx9-ccpj-hx3c\n\n- Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2024-3207 GHSA-p5wf-cmr4-xrwr\n  * GO-2024-3208 CVE-2024-47825 GHSA-3wwx-63fv-pfq6\n  * GO-2024-3210 CVE-2024-8901\n  * GO-2024-3211 CVE-2024-50312\n  * GO-2024-3212 GHSA-rjfv-pjvx-mjgv\n  * GO-2024-3213 CVE-2024-49380\n  * GO-2024-3214 CVE-2024-49381\n  * GO-2024-3215 CVE-2024-9264 GHSA-q99m-qcv4-fpm7\n  * GO-2024-3216 CVE-2024-49753 GHSA-6cf5-w9h3-4rqv\n  * GO-2024-3217 CVE-2024-49757 GHSA-3rmw-76m6-4gjc\n  * GO-2024-3219 GHSA-7h65-4p22-39j6\n  * GO-2024-3220 CVE-2023-32197 GHSA-7h8m-pvw3-5gh4\n  * GO-2024-3221 CVE-2024-22036 GHSA-h99m-6755-rgwc\n  * GO-2024-3222 GHSA-x7xj-jvwp-97rv\n  * GO-2024-3223 CVE-2022-45157 GHSA-xj7w-r753-vj8v\n  * GO-2024-3224 CVE-2024-39223 GHSA-8wxx-35qc-vp6r\n\n- Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8\n  * GO-2024-3203 CVE-2024-9486\n  * GO-2024-3204 CVE-2024-9594\n\n- Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8\n  * GO-2024-3196 CVE-2024-47877 GHSA-8rm2-93mq-jqhc\n  * GO-2024-3199 GHSA-vv6c-69r6-chg9\n  * GO-2024-3200 CVE-2024-48909 GHSA-3c32-4hq9-6wgj\n  * GO-2024-3201 CVE-2023-22644\n- Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j\n  * GO-2024-3171 CVE-2024-9341 GHSA-mc76-5925-c5p6\n\n- Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2024-3161 CVE-2024-22030 GHSA-h4h5-9833-v2p4\n  * GO-2024-3162 CVE-2024-7594 GHSA-jg74-mwgw-v6x3\n  * GO-2024-3163 CVE-2024-47182\n  * GO-2024-3164 CVE-2024-47003 GHSA-59hf-mpf8-pqjh\n  * GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j\n  * GO-2024-3167 CVE-2024-9355 GHSA-3h3x-2hwv-hr52\n  * GO-2024-3168 CVE-2024-8975 GHSA-chqx-36rm-rf8h\n  * GO-2024-3169 CVE-2024-9407 GHSA-fhqq-8f65-5xfc\n  * GO-2024-3170 CVE-2024-8996 GHSA-m5gv-m5f9-wgv4\n  * GO-2024-3172 CVE-2024-33662 GHSA-9mjw-79r6-c9m8\n  * GO-2024-3173 CVE-2024-7558 GHSA-mh98-763h-m9v4\n  * GO-2024-3174 CVE-2024-8037 GHSA-8v4w-f4r9-7h6x\n  * GO-2024-3175 CVE-2024-8038 GHSA-xwgj-vpm9-q2rq\n  * GO-2024-3179 CVE-2024-47616 GHSA-r7rh-jww5-5fjr\n  * GO-2024-3181 CVE-2024-9313 GHSA-x5q3-c8rm-w787\n  * GO-2024-3182 GHSA-wpr2-j6gr-pjw9\n  * GO-2024-3184 CVE-2024-36814 GHSA-9cp9-8gw2-8v7m\n  * GO-2024-3185 CVE-2024-47832\n  * GO-2024-3186 CVE-2024-9675 GHSA-586p-749j-fhwp\n  * GO-2024-3188 CVE-2024-9312 GHSA-4gfw-wf7c-w6g2\n  * GO-2024-3190 CVE-2024-47067 GHSA-8pph-gfhp-w226\n  * GO-2024-3191 CVE-2024-9180 GHSA-rr8j-7w34-xp5j","status":"published","published":"2024-11-05T07:45:02Z","modified":"2026-02-05T08:02:05.10845Z","updated_at":"2026-11-02T15:53:55.639015Z"}]}}