Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2021:14753-1

Опубликовано: 21 июн. 2021
Источник: suse-cvrf

Описание

Security update for SUSE Manager Client Tools

This update fixes the following issues:

golang-github-wrouesnel-postgres_exporter:

  • Add support for aarch64

mgr-cfg:

  • SPEC: Updated Python definitions for RHEL8 and quoted text comparisons.

mgr-custom-info:

  • Update package version to 4.2.0

mgr-daemon:

  • Update translation strings
  • Update the translations from weblate
  • Added quotes around %{_vendor} token for the if statements in spec file.
  • Fix removal of mgr-deamon with selinux enabled (bsc#1177928)
  • Updating translations from weblate

mgr-osad:

  • Change the log file permissions as expected by logrotate (bsc#1177884)
  • Change deprecated path /var/run into /run for systemd (bsc#1185178)
  • Python fixes
  • Removal of RHEL5

mgr-push:

  • Defined __python for python2.
  • Excluded RHEL8 for Python 2 build.

mgr-virtualization:

  • Update package version to 4.2.0

rhnlib:

  • Update package version to 4.2.0

salt:

  • Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)

spacecmd:

  • Rename system migration to system transfer
  • Rename SP to product migration
  • Update translation strings
  • Add group_addconfigchannel and group_removeconfigchannel
  • Add group_listconfigchannels and configchannel_listgroups
  • Fix spacecmd compat with Python 3
  • Deprecated 'Software Crashes' feature
  • Document advanced package search on '--help' (bsc#1180583)
  • Fixed advanced search on 'package_listinstalledsystems'
  • Fixed duplicate results when using multiple search criteria (bsc#1180585)
  • Fixed 'non-advanced' package search when using multiple package names (bsc#1180584)
  • Update translations
  • Fix: make spacecmd build on Debian
  • Add Service Pack migration operations (bsc#1173557)

spacewalk-client-tools:

  • Update the translations from weblate
  • Drop the --noSSLServerURL option
  • Updated RHEL Python requirements.
  • Added quotes around %{_vendor}.

spacewalk-koan:

  • Fix for spacewalk-koan test

spacewalk-oscap:

  • Update package version to 4.2.0

spacewalk-remote-utils:

  • Update package version to 4.2.0

supportutils-plugin-susemanager-client:

  • Update package version to 4.2.0

suseRegisterInfo:

  • Add support for Amazon Linux 2
  • Add support for Alibaba Cloud Linux 2
  • Adapted for RHEL build.

uyuni-base:

  • Added Apache as prerequisite for RHEL and Fedora (due to required users).
  • Removed RHEL specific folder rights from SPEC file.
  • Added RHEL8 compatibility.

uyuni-common-libs:

  • Cleaning up unused Python 2 build leftovers.
  • Disabled debug package build.

Список пакетов

SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS
golang-github-wrouesnel-postgres_exporter-0.4.7-5.12.1
mgr-cfg-4.2.2-5.15.2
mgr-cfg-actions-4.2.2-5.15.2
mgr-cfg-client-4.2.2-5.15.2
mgr-cfg-management-4.2.2-5.15.2
mgr-custom-info-4.2.1-5.9.2
mgr-daemon-4.2.7-5.26.1
mgr-osad-4.2.5-5.27.2
mgr-push-4.2.2-5.9.2
mgr-virtualization-host-4.2.1-5.17.3
python2-mgr-cfg-4.2.2-5.15.2
python2-mgr-cfg-actions-4.2.2-5.15.2
python2-mgr-cfg-client-4.2.2-5.15.2
python2-mgr-cfg-management-4.2.2-5.15.2
python2-mgr-osa-common-4.2.5-5.27.2
python2-mgr-osad-4.2.5-5.27.2
python2-mgr-push-4.2.2-5.9.2
python2-mgr-virtualization-common-4.2.1-5.17.3
python2-mgr-virtualization-host-4.2.1-5.17.3
python2-rhnlib-4.2.3-12.31.1
python2-spacewalk-check-4.2.10-27.50.1
python2-spacewalk-client-setup-4.2.10-27.50.1
python2-spacewalk-client-tools-4.2.10-27.50.1
python2-spacewalk-koan-4.2.3-9.21.1
python2-spacewalk-oscap-4.2.1-6.15.3
python2-suseRegisterInfo-4.2.3-6.15.1
python2-uyuni-common-libs-4.2.3-5.12.1
salt-2016.11.10-43.75.1
salt-doc-2016.11.10-43.75.1
salt-minion-2016.11.10-43.75.1
spacecmd-4.2.8-18.84.1
spacewalk-check-4.2.10-27.50.1
spacewalk-client-setup-4.2.10-27.50.1
spacewalk-client-tools-4.2.10-27.50.1
spacewalk-koan-4.2.3-9.21.1
spacewalk-oscap-4.2.1-6.15.3
spacewalk-remote-utils-4.2.1-6.18.2
supportutils-plugin-susemanager-client-4.2.2-9.21.1
suseRegisterInfo-4.2.3-6.15.1
SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS
golang-github-wrouesnel-postgres_exporter-0.4.7-5.12.1
mgr-cfg-4.2.2-5.15.2
mgr-cfg-actions-4.2.2-5.15.2
mgr-cfg-client-4.2.2-5.15.2
mgr-cfg-management-4.2.2-5.15.2
mgr-custom-info-4.2.1-5.9.2
mgr-daemon-4.2.7-5.26.1
mgr-osad-4.2.5-5.27.2
mgr-push-4.2.2-5.9.2
mgr-virtualization-host-4.2.1-5.17.3
python2-mgr-cfg-4.2.2-5.15.2
python2-mgr-cfg-actions-4.2.2-5.15.2
python2-mgr-cfg-client-4.2.2-5.15.2
python2-mgr-cfg-management-4.2.2-5.15.2
python2-mgr-osa-common-4.2.5-5.27.2
python2-mgr-osad-4.2.5-5.27.2
python2-mgr-push-4.2.2-5.9.2
python2-mgr-virtualization-common-4.2.1-5.17.3
python2-mgr-virtualization-host-4.2.1-5.17.3
python2-rhnlib-4.2.3-12.31.1
python2-spacewalk-check-4.2.10-27.50.1
python2-spacewalk-client-setup-4.2.10-27.50.1
python2-spacewalk-client-tools-4.2.10-27.50.1
python2-spacewalk-koan-4.2.3-9.21.1
python2-spacewalk-oscap-4.2.1-6.15.3
python2-suseRegisterInfo-4.2.3-6.15.1
python2-uyuni-common-libs-4.2.3-5.12.1
salt-2016.11.10-43.75.1
salt-doc-2016.11.10-43.75.1
salt-minion-2016.11.10-43.75.1
spacecmd-4.2.8-18.84.1
spacewalk-check-4.2.10-27.50.1
spacewalk-client-setup-4.2.10-27.50.1
spacewalk-client-tools-4.2.10-27.50.1
spacewalk-koan-4.2.3-9.21.1
spacewalk-oscap-4.2.1-6.15.3
spacewalk-remote-utils-4.2.1-6.18.2
supportutils-plugin-susemanager-client-4.2.2-9.21.1
suseRegisterInfo-4.2.3-6.15.1

Описание

In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely).


Затронутые продукты
SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:golang-github-wrouesnel-postgres_exporter-0.4.7-5.12.1
SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:mgr-cfg-4.2.2-5.15.2
SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:mgr-cfg-actions-4.2.2-5.15.2
SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:mgr-cfg-client-4.2.2-5.15.2

Ссылки
Уязвимость SUSE-SU-2021:14753-1