Описание
Security update for SUSE Manager Client Tools
This update fixes the following issues:
ansible:
- The support level for ansible is l2, not l3
dracut-saltboot:
- Force installation of libexpat.so.1 (bsc#1188846)
- Use kernel parameters from PXE formula also for local boot
golang-github-prometheus-prometheus:
- Provide and reload firewalld configuration only for:
- openSUSE Leap 15.0, 15.1, 15.2
- SUSE Linux Enterprise 15, 15 SP1, 15 SP2
- Upgrade to upstream version 2.27.1 (jsc#SLE-18254)
- Bugfix:
- SECURITY: Fix arbitrary redirects under the /new endpoint (CVE-2021-29622, bsc#1186242)
- UI: Provide errors instead of blank page on TSDB Status Page. #8654 #8659
- TSDB: Do not panic when writing very large records to the WAL. #8790
- TSDB: Avoid panic when mmaped memory is referenced after the file is closed. #8723
- Scaleway Discovery: Fix nil pointer dereference. #8737
- Consul Discovery: Restart no longer required after config update with no targets. #8766
- Features:
- Promtool: Retroactive rule evaluation functionality.
- Configuration: Environment variable expansion for external labels. Behind '--enable-feature=expand-external-labels' flag.
- Add a flag '--storage.tsdb.max-block-chunk-segment-size' to control the max chunks file size of the blocks for small Prometheus instances.
- UI: Add a dark theme.
- AWS Lightsail Discovery: Add AWS Lightsail Discovery.
- Docker Discovery: Add Docker Service Discovery.
- OAuth: Allow OAuth 2.0 to be used anywhere an HTTP client is used.
- Remote Write: Send exemplars via remote write. Experimental and disabled by default.
- Enhancements:
- Digital Ocean Discovery: Add '__meta_digitalocean_vpc' label.
- Scaleway Discovery: Read Scaleway secret from a file.
- Scrape: Add configurable limits for label size and count.
- UI: Add 16w and 26w time range steps.
- Templating: Enable parsing strings in humanize functions.
- Update package with changes from
server:monitoring
(bsc#1175478) Left out removal of 'firewalld' related configuration files as SUSE Linux Enterprise 15-SP1'sfirewalld
package does not contain 'prometheus' configuration yet.
mgr-cfg:
- No visible impact for the user
mgr-custom-info:
- No visible impact for the user
mgr-osad:
- No visible impact for the user
mgr-push:
- No visible impact for the user
mgr-virtualization:
- No visible impact for the user
rhnlib:
- No visible impact for the user
spacecmd:
- Make spacecmd aware of retracted patches/packages
- Enhance help for installation types when creating distributions (bsc#1186581)
- Parse empty argument when nothing in between the separator
spacewalk-client-tools:
- Update translation strings
spacewalk-koan:
- Fix for spacewalk-koan tests after switching to the new Docker images
spacewalk-oscap:
- No visible impact for the user
suseRegisterInfo:
- No visible impact for the user
uyuni-common-libs:
- Handle broken RPM packages to prevent exceptions causing fails on repository synchronization (bsc#1186650)
- Maintainer field in debian packages are only recommended (bsc#1186508)
Список пакетов
openSUSE Leap 15.3
Ссылки
- E-Mail link for openSUSE-SU-2021:2675-1
- SUSE Security Ratings
- SUSE Bug 1175478
- SUSE Bug 1186242
- SUSE Bug 1186508
- SUSE Bug 1186581
- SUSE Bug 1186650
- SUSE Bug 1188846
- SUSE CVE CVE-2021-27962 page
- SUSE CVE CVE-2021-28146 page
- SUSE CVE CVE-2021-28147 page
- SUSE CVE CVE-2021-28148 page
- SUSE CVE CVE-2021-29622 page
Описание
Grafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x before 7.4.5 allows a dashboard editor to bypass a permission check concerning a data source they should not be able to access.
Затронутые продукты
Ссылки
- CVE-2021-27962
- SUSE Bug 1184371
Описание
The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service, this vulnerability allows any authenticated user to add external groups to existing teams. This can be used to grant a user team permissions that the user isn't supposed to have.
Затронутые продукты
Ссылки
- CVE-2021-28146
- SUSE Bug 1183811
Описание
The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service and having the EditorsCanAdmin feature enabled, this vulnerability allows any authenticated user to add external groups to any existing team. This can be used to grant a user team permissions that the user isn't supposed to have.
Затронутые продукты
Ссылки
- CVE-2021-28147
- SUSE Bug 1183809
Описание
One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is accessible without any authentication. This allows any unauthenticated user to send an unlimited number of requests to the endpoint, leading to a denial of service (DoS) attack against a Grafana Enterprise instance.
Затронутые продукты
Ссылки
- CVE-2021-28148
- SUSE Bug 1183813
Описание
Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus.
Затронутые продукты
Ссылки
- CVE-2021-29622
- SUSE Bug 1186242