{"id":"CVE-2025-46811","aliases":["EUVD-2025-23155","GHSA-hrrw-rc87-qggf","SUSE-SU-2025:02475-1","SUSE-SU-2025:02476-1"],"status":"published","title":"SUSE Multi Linux Manager allows code execution via unprotected websocket endpoint","description":"A Missing Authorization vulnerability in SUSE Linux Manager allows anyone with the ability to connect to port 443 of SUSE Manager is able to run any command as root on any client. This issue affects Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: from ? before 5.0.27-150600.3.33.1; Image SLES15-SP4-Manager-Server-4-3-BYOS: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE: from ? before 4.3.87-150400.3.110.2; SUSE Manager Server Module 4.3: from ? before 4.3.87-150400.3.110.2.","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.13608,"percentile":0.96517,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-306","CWE-862"],"published":"2025-07-23T12:36:44Z","modified":"2026-06-17T09:26:58Z","exploits":[{"source":"pocgithub","id":"b-L-x/CVE-2025-46811","title":"b-L-x/CVE-2025-46811","date":"2025-08-02","url":"https://github.com/b-L-x/CVE-2025-46811"},{"source":"pocgithub","id":"szachovy/CVE-2025-46811-challenge","title":"szachovy/CVE-2025-46811-challenge","date":"2025-12-05","url":"https://github.com/szachovy/CVE-2025-46811-challenge"},{"source":"exploitdb","id":"EDB-52527","title":"SUSE Manager 4.3.15 - Code Execution","type":"webapps","platform":"multiple","date":"2026-04-30","url":"https://www.exploit-db.com/exploits/52527"}],"affected":[{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"uyuni-proxy-systemd-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.16-150000.1.33.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for SLE Micro 5","package":"uyuni-proxy-systemd-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.16-150000.1.33.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"mgr-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.12-150400.3.24.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.31-150400.3.48.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.33-150400.3.55.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.23-150400.3.39.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacewalk-proxy-installer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.12-150400.3.9.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.45-150400.3.60.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"supportutils-plugin-susemanager-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.5-150400.3.9.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"supportutils-plugin-susemanager-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.5-150400.3.9.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"susemanager-build-keys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.4.11-150400.3.35.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"susemanager-tftpsync-recv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.10-150400.3.12.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"uyuni-proxy-systemd-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.16-150000.1.33.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-150400.5.58.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"grafana-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150400.3.24.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"inter-server-sync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.7-150400.3.39.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.31-150400.3.48.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.14-150400.3.15.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.33-150400.3.55.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.23-150400.3.39.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.16-150400.3.24.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.87-150400.3.110.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.24-150400.3.35.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.45-150400.3.60.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"subscription-matcher","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.40-150400.3.28.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"supportutils-plugin-susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.15-150400.3.33.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.42-150400.3.66.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-build-keys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.4.11-150400.3.35.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.16-150400.9.72.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.29-150400.3.51.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.47-150400.3.61.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-sync-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.24-150400.3.44.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"release-notes-susemanager-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.16-150400.3.98.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"release-notes-susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.16-150400.3.140.1"}]}],"bundled":15}],"products":[{"vendor":"suse","product":"container suse/manager/5.0/x86_64/server:5.0.5.7.30.1"},{"vendor":"suse","product":"image sles15-sp4-manager-server-4-3-byos"},{"vendor":"suse","product":"image sles15-sp4-manager-server-4-3-byos-azure"},{"vendor":"suse","product":"image sles15-sp4-manager-server-4-3-byos-ec2"},{"vendor":"suse","product":"image sles15-sp4-manager-server-4-3-byos-gce"},{"vendor":"suse","product":"suse manager server module 4.3"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-46811"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46811"},{"url":"https://github.com/advisories/GHSA-hrrw-rc87-qggf"},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502475-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1157520","tags":["report"]},{"url":"https://bugzilla.suse.com/1191142","tags":["report"]},{"url":"https://bugzilla.suse.com/1209060","tags":["report"]},{"url":"https://bugzilla.suse.com/1211373","tags":["report"]},{"url":"https://bugzilla.suse.com/1213952","tags":["report"]},{"url":"https://bugzilla.suse.com/1216187","tags":["report"]},{"url":"https://bugzilla.suse.com/1221031","tags":["report"]},{"url":"https://bugzilla.suse.com/1225740","tags":["report"]},{"url":"https://bugzilla.suse.com/1230403","tags":["report"]},{"url":"https://bugzilla.suse.com/1230908","tags":["report"]},{"url":"https://bugzilla.suse.com/1233371","tags":["report"]},{"url":"https://bugzilla.suse.com/1234608","tags":["report"]},{"url":"https://bugzilla.suse.com/1236635","tags":["report"]},{"url":"https://bugzilla.suse.com/1236779","tags":["report"]},{"url":"https://bugzilla.suse.com/1236810","tags":["report"]},{"url":"https://bugzilla.suse.com/1236877","tags":["report"]},{"url":"https://bugzilla.suse.com/1236910","tags":["report"]},{"url":"https://bugzilla.suse.com/1237060","tags":["report"]},{"url":"https://bugzilla.suse.com/1237082","tags":["report"]},{"url":"https://bugzilla.suse.com/1237294","tags":["report"]},{"url":"https://bugzilla.suse.com/1237403","tags":["report"]},{"url":"https://bugzilla.suse.com/1237581","tags":["report"]},{"url":"https://bugzilla.suse.com/1237694","tags":["report"]},{"url":"https://bugzilla.suse.com/1237770","tags":["report"]},{"url":"https://bugzilla.suse.com/1238922","tags":["report"]},{"url":"https://bugzilla.suse.com/1238924","tags":["report"]},{"url":"https://bugzilla.suse.com/1239102","tags":["report"]},{"url":"https://bugzilla.suse.com/1239154","tags":["report"]},{"url":"https://bugzilla.suse.com/1239604","tags":["report"]},{"url":"https://bugzilla.suse.com/1239743","tags":["report"]},{"url":"https://bugzilla.suse.com/1239826","tags":["report"]},{"url":"https://bugzilla.suse.com/1239868","tags":["report"]},{"url":"https://bugzilla.suse.com/1239907","tags":["report"]},{"url":"https://bugzilla.suse.com/1240038","tags":["report"]},{"url":"https://bugzilla.suse.com/1240386","tags":["report"]},{"url":"https://bugzilla.suse.com/1240666","tags":["report"]},{"url":"https://bugzilla.suse.com/1240842","tags":["report"]},{"url":"https://bugzilla.suse.com/1241239","tags":["report"]},{"url":"https://bugzilla.suse.com/1241286","tags":["report"]},{"url":"https://bugzilla.suse.com/1241455","tags":["report"]},{"url":"https://bugzilla.suse.com/1241490","tags":["report"]},{"url":"https://bugzilla.suse.com/1242004","tags":["report"]},{"url":"https://bugzilla.suse.com/1242030","tags":["report"]},{"url":"https://bugzilla.suse.com/1242148","tags":["report"]},{"url":"https://bugzilla.suse.com/1242554","tags":["report"]},{"url":"https://bugzilla.suse.com/1242911","tags":["report"]},{"url":"https://bugzilla.suse.com/1243239","tags":["report"]},{"url":"https://bugzilla.suse.com/1243460","tags":["report"]},{"url":"https://bugzilla.suse.com/1243724","tags":["report"]},{"url":"https://bugzilla.suse.com/1243825","tags":["report"]},{"url":"https://bugzilla.suse.com/1244065","tags":["report"]},{"url":"https://bugzilla.suse.com/1244290","tags":["report"]},{"url":"https://bugzilla.suse.com/1245005","tags":["report"]},{"url":"https://bugzilla.suse.com/1245027","tags":["report"]},{"url":"https://bugzilla.suse.com/1245222","tags":["report"]},{"url":"https://bugzilla.suse.com/1245368","tags":["report"]},{"url":"https://bugzilla.suse.com/1246119","tags":["report"]},{"url":"https://bugzilla.suse.com/1246788","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46811","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502476-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22242","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-46811","title":"SUSE Multi Linux Manager allows code execution via unprotected websocket endpoint","description":"A Missing Authorization vulnerability in SUSE Linux Manager allows anyone with the ability to connect to port 443 of SUSE Manager is able to run any command as root on any client. This issue affects Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: from ? before 5.0.27-150600.3.33.1; Image SLES15-SP4-Manager-Server-4-3-BYOS: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE: from ? before 4.3.87-150400.3.110.2; SUSE Manager Server Module 4.3: from ? before 4.3.87-150400.3.110.2.","status":"published","published":"2025-07-30T14:20:53.828Z","modified":"2026-02-26T17:50:03.837Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:32:36.706507Z"}],"euvd":[{"id":"EUVD-2025-23155","description":"A Missing Authorization vulnerability in SUSE Linux Manager allows anyone with the ability to connect to port 443 of SUSE Manager is able to run any command as root on any client. This issue affects Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: from ? before 5.0.27-150600.3.33.1; Image SLES15-SP4-Manager-Server-4-3-BYOS: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE: from ? before 4.3.87-150400.3.110.2; SUSE Manager Server Module 4.3: from ? before 4.3.87-150400.3.110.2.","status":"published","published":"2025-07-30T14:20:53Z","modified":"2026-02-26T17:50:03Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T19:48:19.878708Z"}],"ghsa":[{"id":"GHSA-hrrw-rc87-qggf","title":"A Missing Authentication for Critical Function vulnerability in SUSE Manager allows anyone with...","description":"A Missing Authentication for Critical Function vulnerability in SUSE Manager allows anyone with access to the websocket at /rhn/websocket/minion/remote-commands to execute arbitrary commands as root.\n\n\n\n\nThis issue affects Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: from ? before 0.3.7-150600.3.6.2; Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: from ? before 5.0.14-150600.4.17.1; Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: from ? before 5.0.14-150600.4.17.1; Image SLES15-SP4-Manager-Server-4-3-BYOS: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE: from ? before 4.3.33-150400.3.55.2; SUSE Manager Server Module 4.3: from ? before 0.3.7-150400.3.39.4; SUSE Manager Server Module 4.3: from ? before 4.3.33-150400.3.55.2; SUSE Manager Server Module 4.3: from ? before 4.3.33-150400.3.55.2.","status":"published","published":"2025-07-30T15:35:53Z","modified":"2025-07-30T15:36:04Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T15:03:08.457948Z"}],"nvd":[{"id":"CVE-2025-46811","description":"A Missing Authorization vulnerability in SUSE Linux Manager allows anyone with the ability to connect to port 443 of SUSE Manager is able to run any command as root on any client. This issue affects Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: from ? before 5.0.27-150600.3.33.1; Image SLES15-SP4-Manager-Server-4-3-BYOS: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE: from ? before 4.3.87-150400.3.110.2; SUSE Manager Server Module 4.3: from ? before 4.3.87-150400.3.110.2.","status":"published","published":"2025-07-30T15:15:33.737Z","modified":"2026-06-17T09:26:58.32Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:11:21.71471Z"}],"osv":[{"id":"SUSE-SU-2025:02475-1","title":"Security update 4.3.16 for Multi-Linux Manager Server","description":"This update fixes the following issues:\n\ncobbler:\n\n- Prevent crash during Cobbler startup on NFS environments (bsc#1240666)\n- Synchronize cobbler add and sync actions (bsc#1233371)\n- Exclude disabled profiles from buildiso gen (bsc#1230908)\n\ngrafana-formula:\n\n- Version 4.3.0:\n  * Added SUSE Linux Enterprise Server 15 SP7 to the supported versions (bsc#1245368)\n  * Dropped old unsupported SUSE versions from the supported versions list\n  * Migrated from deprecated Graph panels to new timeseries panels\n\ninter-server-sync:\n\n- Version 0.3.7-0:\n  * Added SSL signed export and import validation (bsc#1241239)\n- Version 0.3.6-0:\n  * Included /var/log/hub (bsc#1243724)\n\nspacecmd:\n\n- Version 4.3.31-0:\n  * Improved translation update process\n\nspacewalk-admin:\n    \n- Version 4.3.33-0\n  * Security issues fixed:\n    + CVE-2025-46809: Do not expose HTTP Proxy password when breaking URL format (bsc#1245005)\n  * Other bugs fixed:\n    + Enhance permissions for reposync zypper cache\n- Version 4.3.14-0:\n  * Added support for environment variables in rhn-config-satellite (bsc#1242148)\n  * mgr-monitoring-ctl: avoid possible errors due to non-ascii characters (bsc#1242030)\n\nspacewalk-backend:\n\n- Version 4.3.32-0\n  * Removed python3-simplejson use in spacewalk-repo-sync (bsc#1236635)\n  * Improved translation update process\n  * Make reposync allow commas as part of HTTP Proxy password (bsc#1243460)\n  * Removed bootloader linux and initrd files from spacewalk-debug\n  * Use libzypp's Curl2 backend during reposync (bsc#1245222)\n\nspacewalk-client-tools:\n\n- Version 4.3.23-0\n  * Improved translation update process\n\nspacewalk-config:\n\n- Version 4.3.16-0\n  * Allow passing environment variables to rhn-config-satellite (bsc#1242148)\n\nspacewalk-java:\n\n- Version 4.3.87-0\n  * Security issues fixed:\n    + CVE-2025-46811: Clean up stale sessions on websocket open (bsc#1246119)\n- Version 4.3.86-0:\n  * Security issues fixed:\n    + CVE-2025-23393: Filter user input in systems list page (bsc#1240386)\n  * Other bugs fixed:\n    + Fixed tooltip text for icons in the patches list (bsc#1234608)\n    + Fixed openscap audit is running immediately even when scheduled for next days (bsc#1239743)\n    + Adds calling a highstate in the API for actionchain (bsc#1157520)\n    + Fixed behavior of `reboot_suggested` or `restart_suggested` by API (bsc#1236910)\n    + Fixed action chain scheduled within SSM creates no link for the new action chain (bsc#1243825)\n    + Fixed severity levels missing in API output of errata.getDetails (bsc#1240038)\n    + Fixed internal server error when accessing groups in activation keys (bsc#1237581)\n    + Fixed http_proxy_password stored as clear text in /var/log/messages (bsc#1242148)\n    + Fixed `manage errors` in user-defined pillars (bsc#1230403)\n    + In CLM live-patching template form, show kernel versions from base product as well (bsc#1239907)\n    + Improved handling of system list filtering (bsc#1242004)\n    + Fixed issue preventing OES products from showing up (bsc#1237082)\n    + Fixed config channels not following priority in highstate (bsc#1237694)\n    + Improved performance when changing channels on multiple system through SSM (bsc#1239154)\n    + Fixed package locking for packages not available anymore in the assigned repositories (bsc#1236877)\n    + Do not show Vendor Advisory link for SL-Micro 6.0 and 6.1 products (bsc#1237770)\n    + Fixed API namespace for AdminPaygHandler\n    + Fixed CLM channel name definition (bsc#1239868)\n    + Fixed XMLRPC API endpoint updateRepoSsl repository property\n    + Fixed API documentation for system config listFiles (bsc#1245027)\n    + Fixed inconsistency in task schedule deactivation and add activation capability (bsc#1225740)\n\nspacewalk-utils:\n\n- Version 4.3.24-0:\n  * Removed spacewalk-clone-by-date dependency on python3-simplejson\n\nspacewalk-web:\n\n- Version 4.3.45-0:\n  * Security issues fixed:\n    + CVE-2025-23392, CVE-2025-23393: Filter user input in systems list page (bsc#1239826, bsc#1240386)\n  * Other bugs fixed:\n    + Fix: Filters of type Product Temporary Fix cannot be created (bsc#1238922)\n    + Improved handling of system list filtering (bsc#1242004)\n    + Improved translation update process\n\nsubscription-matcher:\n\n- Version 0.40:\n  * Fixed integer overflow which can cause a division by zero error (bsc#1243239)\n- Version 0.39:\n  * Fixed the wrong matching for 2 Sockets or 2 VMs subscription string (bsc#1238924)\n  * Fixed logging issues\n  * Updated runtime dependencies\n\nsupportutils-plugin-susemanager:\n\n- Version 4.3.15-0:\n  * Backported supportutils plugin resource functions, replacing the\n    removed supportutils `scplugin.rc` functions with those provided\n    by `supportconfig.rc`\n\nsusemanager:\n\n- Version 4.3.42-0:\n  * Fixed bootstrap repository definition for SLE 15 SP7 and\n    support only bootstrapping with salt-bundle (bsc#1246788)\n- Version 4.3.41-0:\n  * Improved translation update process\n\nsusemanager-build-keys:\n\n- Changed keys to use SHA256 UIDs instead of SHA1 (bsc#1237294, bsc#1236779, jsc#PED-12321)\n  * Renamed `build-alp-09d9ea69-645b99ce.asc` to `build-alp-09d9ea69.asc`\n  * Renamed `gpg-pubkey-3fa1d6ce-63c9481c.asc` to `gpg-pubkey-3fa1d6ce.asc`\n  * Adjusted `suse_ptf_key_2023.asc` and `suse_ptf_key.asc`\n\nsusemanager-docs_en:\n\n- SUSE Manager 4.3.16 Update\n- Added information about missing monitoring package to Administration Guide (bsc#1191142) \n- Added missing script parameters in Installation and Upgrade Guide (bsc#1216187)\n- Added reference to the list of supported SCAP profiles (bsc#1213952)\n- Extended information in an admonition in Specialized Guides  (bsc#1221031)\n- Added missing 4505 and 4506 Salt ports in network requirements in Installation and Upgrade Guide\n- Removed references to the methods no longer used from Reference Guide (bsc#1209060)\n- Fixed Python script in Administration Guide (bsc#1244290)\n- Extended troubleshooting section with a reposync example (bsc#1211373)\n- Added section about enabling SUSE Manager 4.3 LTS in Installation and Upgrade Guide\n- Added missing Task Schedules to the list and updated the Task Schedule page to reflect changes—now only\n  allowing disabling of tasks, not deletion in the Administration Guide\n- Added SUSE Linux Enterprise 15 SP7 as a supported client\n- Fixed asciidoc menu macro issue with duplicate css class, menu items now display correctly\n- Added note about autoyast profiles not having passwords\n- Added details about the behavior of the rescheduled failed action (bsc#1244065)\n- Updated Network Requirement section to add settings for server configuration behind HTTP OSI level 7 Proxy\n- Clarified that NFS with Cobbler is not supported (bsc#1240666)\n- Fixed a URL link in Common Workflows Guide (bsc#1242911)\n- Documented uptodate action in Common Workflows Guide as background information\n- Documented renaming the journal folder when changing machine ID in Administration Guide (bsc#1241286)\n- Fixed removing Salt bundle client procedure in Client Configuration Guide\n- Added referenced target and remove obsolete section in Common Workflows (bsc#1240842, bsc#1242554)\n- Fixed GPG key import command in Administration Guide (bsc#1239102)\n- Added java.smtp_server parameter for mail configuration in Administration Guide (bsc#1241490)\n- Added system_listeventhistory to spacecmd reference in Reference Guide (bsc#1239604)\n- Added links to supported features tables for third party operating systems (bsc#1236810)\n- Fixed typo in Installation and Upgrade Guide (bsc#1237403)\n- Added note to limit Squid's cache_dir size to 60% of available free space in Installation and Upgrade Guide \n\nsusemanager-schema:\n\n- Version 4.3.29-0:\n  * Fixed typo in OES 24.4 channel definition\n\nsusemanager-sls:\n\n- Version 4.3.47-0:\n  * Change uptodate recurring action to use dist-upgrade instead of upgrade for Debian systems (bsc#1237060)\n  * Adjust SLS files for SUSE Linux Enterprise SP7 and other systems running higher Python versions\n  * Optimize SAP module to prevent high IO workload (bsc#1241455)\n\nsusemanager-sync-data:\n\n- Version 4.3.24-0:\n  * Fixed typo in OES 24.4 product definition\n\nHow to apply this update:\n\n1. Log in as root user to the SUSE Multi-Linux Manager Server.\n2. Stop the Spacewalk service:\n`spacewalk-service stop`\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Start the Spacewalk service:\n`spacewalk-service start`\n","status":"published","published":"2025-07-23T12:36:44Z","modified":"2026-03-23T04:46:38.606362Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02476-1","title":"Security update 4.3.16 for Multi-Linux Manager Server","description":"This update fixes the following issues:\n    \nrelease-notes-susemanager:\n\n- Update to SUSE Manager 4.3.16\n  * Important Salt Security Update\n  * Added support for SUSE Linux Enterprise 15 SP7 as a client\n    using the Salt Bundle\n  * CVE Fixed\n    CVE-2025-23392, CVE-2025-23393, CVE-2024-38824, CVE-2025-22239\n    CVE-2025-22236, CVE-2025-22237, CVE-2024-38825, CVE-2025-22240\n    CVE-2024-38823, CVE-2025-22241, CVE-2025-22238, CVE-2025-22242\n    CVE-2024-38822, CVE-2025-46811, CVE-2025-46809\n  * Bugs mentioned:\n    bsc#1157520, bsc#1191142, bsc#1209060, bsc#1211373, bsc#1213952\n    bsc#1216187, bsc#1221031, bsc#1225740, bsc#1230403, bsc#1230908\n    bsc#1233371, bsc#1234608, bsc#1236635, bsc#1236779, bsc#1236810\n    bsc#1236877, bsc#1236910, bsc#1237060, bsc#1237082, bsc#1237294\n    bsc#1237403, bsc#1237581, bsc#1237694, bsc#1237770, bsc#1238922\n    bsc#1238924, bsc#1239102, bsc#1239154, bsc#1239604, bsc#1239743\n    bsc#1239826, bsc#1239868, bsc#1239907, bsc#1240038, bsc#1240386\n    bsc#1240666, bsc#1240842, bsc#1241239, bsc#1241286, bsc#1241455\n    bsc#1241490, bsc#1242004, bsc#1242030, bsc#1242148, bsc#1242554\n    bsc#1242911, bsc#1243239, bsc#1243460, bsc#1243724, bsc#1243825\n    bsc#1244065, bsc#1244290, bsc#1245027, bsc#1245222, bsc#1245368\n    bsc#1245005, bsc#1246119\n\n","status":"published","published":"2025-07-23T12:37:12Z","modified":"2026-03-23T04:46:38.275132Z","updated_at":"2026-11-02T15:53:56.647031Z"}]}}