{"id":"CVE-2024-49503","aliases":["EUVD-2024-43785","GHSA-966m-j2wr-w37h","SUSE-SU-2024:4006-1","SUSE-SU-2024:4007-1"],"status":"published","title":"Reflected XSS in Setup Wizard, Organization Credentials in  spacewalk-web","description":"A Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SUSE manager allows attackers to execute Javascript code in the organization credentials sub page.\nThis issue affects Container suse/manager/5.0/x86_64/server:5.0.2.7.8.1: before 5.0.15-150600.3.10.2; SUSE Manager Server Module 4.3: before 4.3.42-150400.3.52.1.","severity":{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00295,"percentile":0.22344,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2024-11-18T13:19:53Z","modified":"2026-06-17T07:59:53Z","affected":[{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"uyuni-proxy-systemd-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.14-150000.1.27.4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for SLE Micro 5","package":"uyuni-proxy-systemd-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.14-150000.1.27.4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"mgr-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.11-150400.3.21.6"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.29-150400.3.42.8"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.30-150400.3.47.16"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.26-150400.3.36.7"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.21-150400.3.33.11"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacewalk-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.19-150400.3.29.9"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.42-150400.3.52.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"susemanager-build-keys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.4.10-150400.3.29.4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"uyuni-common-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.11-150400.3.21.6"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"uyuni-proxy-systemd-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.14-150000.1.27.4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-150400.5.52.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"grafana-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0-150400.3.21.4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"inter-server-sync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.5-150400.3.36.13"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"saltboot-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1723628891.ffb1da5-150400.3.18.4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.29-150400.3.42.8"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.30-150400.3.47.16"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.26-150400.3.36.7"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.21-150400.3.33.11"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.14-150400.3.18.6"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.82-150400.3.96.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.22-150400.3.29.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.42-150400.3.52.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.39-150400.3.58.5"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-build-keys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.4.10-150400.3.29.4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.14-150400.9.66.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.27-150400.3.45.11"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.45-150400.3.55.4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-sync-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.21-150400.3.35.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"uyuni-common-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.11-150400.3.21.6"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"uyuni-reportdb-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.11-150400.3.18.12"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"release-notes-susemanager-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.14-150400.3.90.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"release-notes-susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.14-150400.3.122.1"}]}],"bundled":3}],"products":[{"vendor":"suse","product":"container suse/manager/5.0/x86_64/server:5.0.2.7.8.1"},{"vendor":"suse","product":"suse manager server module 4.3"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-49503"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49503"},{"url":"https://github.com/advisories/GHSA-966m-j2wr-w37h"},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244006-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1146701","tags":["report"]},{"url":"https://bugzilla.suse.com/1211899","tags":["report"]},{"url":"https://bugzilla.suse.com/1212985","tags":["report"]},{"url":"https://bugzilla.suse.com/1217003","tags":["report"]},{"url":"https://bugzilla.suse.com/1217338","tags":["report"]},{"url":"https://bugzilla.suse.com/1217978","tags":["report"]},{"url":"https://bugzilla.suse.com/1218090","tags":["report"]},{"url":"https://bugzilla.suse.com/1219450","tags":["report"]},{"url":"https://bugzilla.suse.com/1219645","tags":["report"]},{"url":"https://bugzilla.suse.com/1219887","tags":["report"]},{"url":"https://bugzilla.suse.com/1221435","tags":["report"]},{"url":"https://bugzilla.suse.com/1221505","tags":["report"]},{"url":"https://bugzilla.suse.com/1223312","tags":["report"]},{"url":"https://bugzilla.suse.com/1223988","tags":["report"]},{"url":"https://bugzilla.suse.com/1224108","tags":["report"]},{"url":"https://bugzilla.suse.com/1224209","tags":["report"]},{"url":"https://bugzilla.suse.com/1225603","tags":["report"]},{"url":"https://bugzilla.suse.com/1225619","tags":["report"]},{"url":"https://bugzilla.suse.com/1225960","tags":["report"]},{"url":"https://bugzilla.suse.com/1226090","tags":["report"]},{"url":"https://bugzilla.suse.com/1226439","tags":["report"]},{"url":"https://bugzilla.suse.com/1226461","tags":["report"]},{"url":"https://bugzilla.suse.com/1226478","tags":["report"]},{"url":"https://bugzilla.suse.com/1226687","tags":["report"]},{"url":"https://bugzilla.suse.com/1226917","tags":["report"]},{"url":"https://bugzilla.suse.com/1227133","tags":["report"]},{"url":"https://bugzilla.suse.com/1227334","tags":["report"]},{"url":"https://bugzilla.suse.com/1227406","tags":["report"]},{"url":"https://bugzilla.suse.com/1227526","tags":["report"]},{"url":"https://bugzilla.suse.com/1227543","tags":["report"]},{"url":"https://bugzilla.suse.com/1227599","tags":["report"]},{"url":"https://bugzilla.suse.com/1227606","tags":["report"]},{"url":"https://bugzilla.suse.com/1227746","tags":["report"]},{"url":"https://bugzilla.suse.com/1228036","tags":["report"]},{"url":"https://bugzilla.suse.com/1228101","tags":["report"]},{"url":"https://bugzilla.suse.com/1228130","tags":["report"]},{"url":"https://bugzilla.suse.com/1228147","tags":["report"]},{"url":"https://bugzilla.suse.com/1228286","tags":["report"]},{"url":"https://bugzilla.suse.com/1228326","tags":["report"]},{"url":"https://bugzilla.suse.com/1228345","tags":["report"]},{"url":"https://bugzilla.suse.com/1228412","tags":["report"]},{"url":"https://bugzilla.suse.com/1228545","tags":["report"]},{"url":"https://bugzilla.suse.com/1228638","tags":["report"]},{"url":"https://bugzilla.suse.com/1228851","tags":["report"]},{"url":"https://bugzilla.suse.com/1228945","tags":["report"]},{"url":"https://bugzilla.suse.com/1229079","tags":["report"]},{"url":"https://bugzilla.suse.com/1229178","tags":["report"]},{"url":"https://bugzilla.suse.com/1229260","tags":["report"]},{"url":"https://bugzilla.suse.com/1229339","tags":["report"]},{"url":"https://bugzilla.suse.com/1231332","tags":["report"]},{"url":"https://bugzilla.suse.com/1231852","tags":["report"]},{"url":"https://bugzilla.suse.com/1231900","tags":["report"]},{"url":"https://bugzilla.suse.com/1231922","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49503","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244007-1/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-49503","title":"Reflected XSS in Setup Wizard, Organization Credentials in  spacewalk-web","description":"A Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SUSE manager allows attackers to execute Javascript code in the organization credentials sub page.\nThis issue affects Container suse/manager/5.0/x86_64/server:5.0.2.7.8.1: before 5.0.15-150600.3.10.2; SUSE Manager Server Module 4.3: before 4.3.42-150400.3.52.1.","status":"published","published":"2024-11-28T09:20:03.366Z","modified":"2024-11-28T12:15:16.804Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:33:55.977982Z"}],"euvd":[{"id":"EUVD-2024-43785","description":"A Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SUSE manager allows attackers to execute Javascript code in the organization credentials sub page.\nThis issue affects Container suse/manager/5.0/x86_64/server:5.0.2.7.8.1: before 5.0.15-150600.3.10.2; SUSE Manager Server Module 4.3: before 4.3.42-150400.3.52.1.","status":"published","published":"2024-11-28T09:20:03Z","modified":"2024-11-28T12:15:16Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-03T00:04:45.257697Z"}],"ghsa":[{"id":"GHSA-966m-j2wr-w37h","title":"A Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')...","description":"A Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SUSE manager allows attackers to execute Javascript code in the organization credentials sub page.\nThis issue affects Container suse/manager/5.0/x86_64/server:5.0.2.7.8.1: before 5.0.15-150600.3.10.2; SUSE Manager Server Module 4.3: before 4.3.42-150400.3.52.1.","status":"published","published":"2024-11-28T18:38:36Z","modified":"2024-11-28T18:38:44Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:58:59.859228Z"}],"nvd":[{"id":"CVE-2024-49503","description":"A Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SUSE manager allows attackers to execute Javascript code in the organization credentials sub page.\nThis issue affects Container suse/manager/5.0/x86_64/server:5.0.2.7.8.1: before 5.0.15-150600.3.10.2; SUSE Manager Server Module 4.3: before 4.3.42-150400.3.52.1.","status":"published","published":"2024-11-28T10:15:08.22Z","modified":"2026-06-17T07:59:53.04Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:38.347238Z"}],"osv":[{"id":"SUSE-SU-2024:4006-1","title":"Security update for SUSE Manager Server 4.3","description":"This update fixes the following issues:\n\ncobbler:\n\n- Security issues fixed:\n\n  * CVE-2024-47533: Prevent privilege escalation from none to admin (bsc#1231332)\n\n- Other bugs fixed:\n\n  * Increase start timeout for cobblerd unit (bsc#1219450)\n  * Provide sync_single_system for DHCP modules to improve performance (bsc#1219450)\n  * Add input_string_*, input_boolean, input_int functions to public API\n  * Add new setting for Uyuni authentication endpoint (bsc#1219887)\n\ngrafana-formula:\n\n- Version 0.11.0\n  * Add SLES 15 SP6 to supported versions (bsc#1228286)\n\ninter-server-sync:\n\n- Version 0.3.5-0\n  * Decode boolean values for export (bsc#1228545)\n\nsaltboot-formula:\n\n- Update to version 0.1.1723628891.ffb1da5\n  * Rework request stop function to avoid unnecessary warnings\n    (bsc#1212985)\n\nspacecmd:\n\n- Version 4.3.29-0\n  * Speed up softwarechannel_removepackages (bsc#1227606)\n\nspacewalk-backend:\n\n- Version 4.3.30-0\n  * Make ISSv1 timezone independent (bsc#1221505)\n  * reposync: introduce timeout when syncing DEB channels (bsc#1225960)\n  * yum_src: use proper name variable name for subprocess.TimeoutExpired\n  * Check and populate PTF attributes at the time of importing\n    packages (bsc#1225619)\n  * reposync: import GPG keys to RPM DB individually (bsc#1217003)\n  * Add log string to the journal when services are stopped\n    because of insufficient disk space\n\nspacewalk-certs-tools:\n\n- Version 4.3.26-0\n  * Fix private key format in jabberd certificate file (bsc#1228851)\n  * Fix parsing Authority Key Identifier when keyid is not prefixed (bsc#1229079)\n  * Support multiple certificates for root-ca-file and server-cert-file\n\nspacewalk-client-tools:\n\n- Version 4.3.21-0\n  * Update translation strings\n\nspacewalk-config:\n\n- Version 4.3.14-0\n  * Trust the Content-Length header from AJP (bsc#1226439)\n\nspacewalk-java:\n\n- Version 4.3.82-0\n  * Limit frontend-log message size (bsc#1231900)\n- Version 4.3.81-0\n  * Add detection of Ubuntu 24.04\n- Version 4.3.80-0\n  * Use custom select instead of errata view for better performance\n    (bsc#1225619)\n- Version 4.3.79-0\n  * Add info URL for cobbler to clean the system profile (bsc#1219645)\n  * Require correct scap packages for Ubuntu\n  * Require correct scap packages for Debian 12 (bsc#1227746)\n  * Fix finding system_checkin_threshold configuration value on Sytems\n    Overview page (bsc#1224108)\n  * Allow changing base channel to SUSE Liberty Linux LTSS when the system is on\n    Liberty (bsc#1228326)\n  * Implement product migration from RHEL and Clones to SUSE Liberty\n    Linux\n  * Remove system also from proxy SSH known_hosts (bsc#1228345)\n  * Fix NullPointerException when generating subscription matcher\n    input (bsc#1228638)\n  * Allow free products and SUSE Manager Proxy being managed by SUSE Manager\n    Server PAYG\n  * Open bootstrap script directory URL in a new page (bsc#1225603)\n  * Delay package list refresh when Salt was updated (bsc#1217978)\n  * Add SLE Micro 5 to the list of systems which support monitoring (bsc#1227334)\n  * Add all SLE Micro systems to the list of systems which get PTF repositories\n  * Update last sync refresh timestamp only when at least one time products\n    were synced before\n  * Prevent NullPointerException when listing history events without completion\n    time (bsc#1146701)\n  * Autoinstallation: prevent issues with duplicate IP address due to some\n    networks (bsc#1226461)\n  * Improve SQL queries and performance to check for PTF packages (bsc#1225619)\n  * Check the correct Salt package before product migration (bsc#1224209)\n  * Fix the date format output when using the HTTP API to use ISO 8601\n    format (bsc#1227543)\n  * Fix transactional update check for SL Micro (bsc#1227406)\n  * Improve score comparison in system search to fix ISE (bsc#1228412)\n  * Fix package profile update on CentOS 7 when yum-utils is not\n    installed (bsc#1227133)\n\nspacewalk-utils:\n\n- Version 4.3.22-0\n  * Add repositories for Ubuntu 24.04 LTS\n- Version 4.3.21-0\n  * Drop unsupported tool spacewalk-final-archive as it is broken\n    and may disclose sensitive information (bsc#1228945)\n\nspacewalk-web:\n\n- Security issues fixed:\n\n  * Version 4.3.42-0\n    + CVE-2024-49503: Escape organization credentials username to\n      mitigate XSS vulnerability (bsc#1231922) \n  * Version 4.3.41-0\n    + CVE-2024-49502: Validate proxy hostname format and escape proxy\n      username to mitigate XSS vulnerabilities (bsc#1231852)\n\n- Bugs fixed:\n\n  * Version 4.3.40-0\n    + Fix channel selection using SSM (bsc#1226917)\n    + Fix datetime selection when using maintenance windows (bsc#1228036)\n \nsusemanager:\n\n- Version 4.3.39-0\n  * Enable bootstrapping for Ubuntu 24.04 LTS\n- Version 4.3.38-0\n  * Add missing package python3-ply to bootstrap repo definition (bsc#1228130)\n  * Create special bootstrap data for SUSE Manager Server 4.3 with LTSS\n    updates for Hub scenario (bsc#1211899)\n  * Add LTSS updates to SUSE Manager Proxy 4.3 bootstrap data\n  * Add traditional stack to boostrap repo on sles15sp6 (bsc#1228147)\n  * Change package to libdbus-glib-1-2 on sle15sp6 (bsc#1228147)\n\nsusemanager-build-keys:\n\n- Extended 2048 bit SUSE SLE 12, 15 GA-SP5 key until 2028. (bsc#1229339)\n\nsusemanager-docs_en:\n\n- Documented Ubuntu 24.04 LTS as a supported client OS in Client\n- SUSE Manager 4.3.14 documentation update\n- In network ports section, deleted partially outdated image, added\n  port 443 for clients, and removed Cobbler only used internally\n  (bsc#1217338)\n- Added installer-updates.suse.com to the list of URLs in Installation\n  and Upgrade Guide (bsc#1229178)\n- Enhanced instructions about the permissions for the IAM role\n  in Public Cloud Guide\n- Fixed OS minor number in Client Configuration Guide (bsc#1218090)\n- Added warning about Package Hub (bsc#1221435)\n- Removed Verify Packages section from Package Management chapter\n  in Client Configuration Guide\n- Added note about usernames in PAM section in Administration Guide\n  (bsc#1227599)\n- Updated Content Lifecycle Management (CLM) examples for Red Hat\n  Enterprise Linux 9 (bsc#1226687)\n- Added VM based proxy installation in Installation and Upgrade Guide\n- Fixed PostgreSQL name entity\n- Improved Large Deployments Guide with better tuning values and\n  extra parameters added\n- Updated lists of SUSE Linux Enterprise hardening profiles in openSCAP\n  chapter in the Administration Guide\n\nsusemanager-schema:\n\n- Version 4.3.27-0\n  * Introduce new attributes to detect PTF packages (bsc#1225619)\n\nsusemanager-sls:\n\n- Version 4.3.45-0\n  * Start using DEB822 format for repository sources beginning with Ubuntu 24.04\n- Version 4.3.44-0\n  * Speed-up mgrutil.remove_ssh_known_host runner (bsc#1223312)\n  * Implement product migration from RHEL and clones to SUSE Liberty Linux\n  * Disable transactional-update.timer on SLEM at bootstrap\n  * Explicitly remove old venv-minion environment when updating Python versions\n  * sumautil: properly detect bridge interfaces (bsc#1226461)\n  * Fix typo on directories to clean up when deleting a system (bsc#1228101)\n  * Translate GPG URL if it has server name and client behind proxy\n    (bsc#1223988)\n  * Fix yum-utils package missing on CentOS7 minions (bsc#1227133)\n  * Implement IMDSv2 for AWS instance detection (bsc#1226090)\n  * Fix package profile update on CentOS 7 when yum-utils is not\n    installed (bsc#1227133)\n  * Fix parsing passwords with special characters for PostgreSQL\n    exporter\n\nsusemanager-sync-data:\n\n- Version 4.3.21-0\n  * Add SLES15-SP5-LTSS channel families\n  * Add MicroOS PPC channel family\n- Version 4.3.20-0\n  * Add Ubuntu 24.04 support\n- Version 4.3.19-0\n  * Fix CentOS 7 repo urls (bsc#1227526)\n  * Add channel family for SLES 12 SP5 LTSS Extended Security\n  * Implement product migration from RHEL and clones to SUSE Liberty Linux\n\nuyuni-common-libs:\n\n- Version 4.3.11-0\n  * Enforce directory permissions at repo-sync when creating\n    directories (bsc#1229260)\n  * Make ISSv1 timezone independent (bsc#1221505)\n\nuyuni-reportdb-schema:\n\n- Version 4.3.11-0\n  * Change Errata CVE column to type text as a varchar reaches the\n    maximum (bsc#1226478)\n\nHow to apply this update:\n\n1. Log in as root user to the SUSE Manager Server.\n2. Stop the Spacewalk service:\n`spacewalk-service stop`\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Start the Spacewalk service:\n`spacewalk-service start`\n","status":"published","published":"2024-11-18T13:19:53Z","modified":"2025-05-02T04:37:09.133758Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:4007-1","title":"Security update for SUSE Manager Server 4.3","description":"This update fixes the following issues:\n\nrelease-notes-susemanager:\n\n- Update to SUSE Manager 4.3.14\n  * Ubuntu 24.04 support as client\n  * Product migration from RHEL and Clones to SUSE Liberty Linux\n  * POS image templates now produce compressed images\n  * Date format for API endpoints has been changed to ISO-8601 format\n  * Security issues fixed:\n    CVE-2024-47533, CVE-2024-49502, CVE-2024-49503\n  * Bugs mentioned:\n    bsc#1146701, bsc#1211899, bsc#1212985, bsc#1217003, bsc#1217338\n    bsc#1217978, bsc#1218090, bsc#1219450, bsc#1219645, bsc#1219887\n    bsc#1221435, bsc#1221505, bsc#1223312, bsc#1223988, bsc#1224108\n    bsc#1224209, bsc#1225603, bsc#1225619, bsc#1225960, bsc#1226090\n    bsc#1226439, bsc#1226461, bsc#1226478, bsc#1226687, bsc#1226917\n    bsc#1227133, bsc#1227334, bsc#1227406, bsc#1227526, bsc#1227543\n    bsc#1227599, bsc#1227606, bsc#1227746, bsc#1228036, bsc#1228101\n    bsc#1228130, bsc#1228147, bsc#1228286, bsc#1228326, bsc#1228345\n    bsc#1228412, bsc#1228545, bsc#1228638, bsc#1228851, bsc#1228945\n    bsc#1229079, bsc#1229178, bsc#1229260, bsc#1229339, bsc#1231332\n    bsc#1231852, bsc#1231922, bsc#1231900\n\n","status":"published","published":"2024-11-18T13:20:15Z","modified":"2025-05-02T04:37:09.194514Z","updated_at":"2026-11-02T15:53:55.639015Z"}]}}