Описание
Security update for SUSE Manager Client Tools
This update fixes the following issues:
golang-github-wrouesnel-postgres_exporter:
- Add support for aarch64
mgr-cfg:
- SPEC: Updated Python definitions for RHEL8 and quoted text comparisons.
mgr-custom-info:
- Update package version to 4.2.0
mgr-daemon:
- Update translation strings
- Update the translations from weblate
- Added quotes around %{_vendor} token for the if statements in spec file.
- Fix removal of mgr-deamon with selinux enabled (bsc#1177928)
- Updating translations from weblate
mgr-osad:
- Change the log file permissions as expected by logrotate (bsc#1177884)
- Change deprecated path /var/run into /run for systemd (bsc#1185178)
- Python fixes
- Removal of RHEL5
mgr-push:
- Defined __python for python2.
- Excluded RHEL8 for Python 2 build.
mgr-virtualization:
- Update package version to 4.2.0
rhnlib:
- Update package version to 4.2.0
salt:
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
spacecmd:
- Rename system migration to system transfer
- Rename SP to product migration
- Update translation strings
- Add group_addconfigchannel and group_removeconfigchannel
- Add group_listconfigchannels and configchannel_listgroups
- Fix spacecmd compat with Python 3
- Deprecated 'Software Crashes' feature
- Document advanced package search on '--help' (bsc#1180583)
- Fixed advanced search on 'package_listinstalledsystems'
- Fixed duplicate results when using multiple search criteria (bsc#1180585)
- Fixed 'non-advanced' package search when using multiple package names (bsc#1180584)
- Update translations
- Fix: make spacecmd build on Debian
- Add Service Pack migration operations (bsc#1173557)
spacewalk-client-tools:
- Update the translations from weblate
- Drop the --noSSLServerURL option
- Updated RHEL Python requirements.
- Added quotes around %{_vendor}.
spacewalk-koan:
- Fix for spacewalk-koan test
spacewalk-oscap:
- Update package version to 4.2.0
spacewalk-remote-utils:
- Update package version to 4.2.0
supportutils-plugin-susemanager-client:
- Update package version to 4.2.0
suseRegisterInfo:
- Add support for Amazon Linux 2
- Add support for Alibaba Cloud Linux 2
- Adapted for RHEL build.
uyuni-base:
- Added Apache as prerequisite for RHEL and Fedora (due to required users).
- Removed RHEL specific folder rights from SPEC file.
- Added RHEL8 compatibility.
uyuni-common-libs:
- Cleaning up unused Python 2 build leftovers.
- Disabled debug package build.
Список пакетов
SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS
golang-github-wrouesnel-postgres_exporter-0.4.7-5.12.1
mgr-cfg-4.2.2-5.15.2
mgr-cfg-actions-4.2.2-5.15.2
mgr-cfg-client-4.2.2-5.15.2
mgr-cfg-management-4.2.2-5.15.2
mgr-custom-info-4.2.1-5.9.2
mgr-daemon-4.2.7-5.26.1
mgr-osad-4.2.5-5.27.2
mgr-push-4.2.2-5.9.2
mgr-virtualization-host-4.2.1-5.17.3
python2-mgr-cfg-4.2.2-5.15.2
python2-mgr-cfg-actions-4.2.2-5.15.2
python2-mgr-cfg-client-4.2.2-5.15.2
python2-mgr-cfg-management-4.2.2-5.15.2
python2-mgr-osa-common-4.2.5-5.27.2
python2-mgr-osad-4.2.5-5.27.2
python2-mgr-push-4.2.2-5.9.2
python2-mgr-virtualization-common-4.2.1-5.17.3
python2-mgr-virtualization-host-4.2.1-5.17.3
python2-rhnlib-4.2.3-12.31.1
python2-spacewalk-check-4.2.10-27.50.1
python2-spacewalk-client-setup-4.2.10-27.50.1
python2-spacewalk-client-tools-4.2.10-27.50.1
python2-spacewalk-koan-4.2.3-9.21.1
python2-spacewalk-oscap-4.2.1-6.15.3
python2-suseRegisterInfo-4.2.3-6.15.1
python2-uyuni-common-libs-4.2.3-5.12.1
salt-2016.11.10-43.75.1
salt-doc-2016.11.10-43.75.1
salt-minion-2016.11.10-43.75.1
spacecmd-4.2.8-18.84.1
spacewalk-check-4.2.10-27.50.1
spacewalk-client-setup-4.2.10-27.50.1
spacewalk-client-tools-4.2.10-27.50.1
spacewalk-koan-4.2.3-9.21.1
spacewalk-oscap-4.2.1-6.15.3
spacewalk-remote-utils-4.2.1-6.18.2
supportutils-plugin-susemanager-client-4.2.2-9.21.1
suseRegisterInfo-4.2.3-6.15.1
SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS
golang-github-wrouesnel-postgres_exporter-0.4.7-5.12.1
mgr-cfg-4.2.2-5.15.2
mgr-cfg-actions-4.2.2-5.15.2
mgr-cfg-client-4.2.2-5.15.2
mgr-cfg-management-4.2.2-5.15.2
mgr-custom-info-4.2.1-5.9.2
mgr-daemon-4.2.7-5.26.1
mgr-osad-4.2.5-5.27.2
mgr-push-4.2.2-5.9.2
mgr-virtualization-host-4.2.1-5.17.3
python2-mgr-cfg-4.2.2-5.15.2
python2-mgr-cfg-actions-4.2.2-5.15.2
python2-mgr-cfg-client-4.2.2-5.15.2
python2-mgr-cfg-management-4.2.2-5.15.2
python2-mgr-osa-common-4.2.5-5.27.2
python2-mgr-osad-4.2.5-5.27.2
python2-mgr-push-4.2.2-5.9.2
python2-mgr-virtualization-common-4.2.1-5.17.3
python2-mgr-virtualization-host-4.2.1-5.17.3
python2-rhnlib-4.2.3-12.31.1
python2-spacewalk-check-4.2.10-27.50.1
python2-spacewalk-client-setup-4.2.10-27.50.1
python2-spacewalk-client-tools-4.2.10-27.50.1
python2-spacewalk-koan-4.2.3-9.21.1
python2-spacewalk-oscap-4.2.1-6.15.3
python2-suseRegisterInfo-4.2.3-6.15.1
python2-uyuni-common-libs-4.2.3-5.12.1
salt-2016.11.10-43.75.1
salt-doc-2016.11.10-43.75.1
salt-minion-2016.11.10-43.75.1
spacecmd-4.2.8-18.84.1
spacewalk-check-4.2.10-27.50.1
spacewalk-client-setup-4.2.10-27.50.1
spacewalk-client-tools-4.2.10-27.50.1
spacewalk-koan-4.2.3-9.21.1
spacewalk-oscap-4.2.1-6.15.3
spacewalk-remote-utils-4.2.1-6.18.2
supportutils-plugin-susemanager-client-4.2.2-9.21.1
suseRegisterInfo-4.2.3-6.15.1
Ссылки
- Link for SUSE-SU-2021:14753-1
- E-Mail link for SUSE-SU-2021:14753-1
- SUSE Security Ratings
- SUSE Bug 1173557
- SUSE Bug 1177884
- SUSE Bug 1177928
- SUSE Bug 1180583
- SUSE Bug 1180584
- SUSE Bug 1180585
- SUSE Bug 1185178
- SUSE Bug 1185281
- SUSE CVE CVE-2021-31607 page
Описание
In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely).
Затронутые продукты
SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:golang-github-wrouesnel-postgres_exporter-0.4.7-5.12.1
SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:mgr-cfg-4.2.2-5.15.2
SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:mgr-cfg-actions-4.2.2-5.15.2
SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:mgr-cfg-client-4.2.2-5.15.2
Ссылки
- CVE-2021-31607
- SUSE Bug 1185281
- SUSE Bug 1210934