Lucene search

K
suse
SuseSUSE-SU-2022:3178-1
HistorySep 08, 2022 - 12:00 a.m.

Important for SUSE Manager Client Tools (important)

2022-09-0800:00:00
lists.opensuse.org
21

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

An update that solves 7 vulnerabilities, contains three
features and has 10 fixes is now available.

Description:

This update fixes the following issues:

ansible:

  • Update to version 2.9.27 (jsc#SLE-23631, jsc#SLE-24133)
    • CVE-2021-3620 ansible-connection module discloses sensitive info in
      traceback error message (in 2.9.27) (bsc#1187725)
    • CVE-2021-3583 Template Injection through yaml multi-line strings with
      ansible facts used in template. (in 2.9.23) (bsc#1188061)
    • ansible module nmcli is broken in ansible 2.9.13 (in 2.9.15)
      (bsc#1176460)
  • Update to 2.9.22:
    • CVE-2021-3447 (bsc#1183684) multiple modules expose secured values
    • CVE-2021-20228 (bsc#1181935) basic.py no_log with fallback option
    • CVE-2021-20191 (bsc#1181119) multiple collections exposes secured
      values
    • CVE-2021-20180 (bsc#1180942) bitbucket_pipeline_variable exposes
      sensitive values
    • CVE-2021-20178 (bsc#1180816) user data leak in snmp_facts module

dracut-saltboot:

  • Require e2fsprogs (bsc#1202614)
  • Update to version 0.1.1657643023.0d694ce
    • Update dracut-saltboot dependencies (bsc#1200970)
    • Fix network loading when ipappend is used in pxe config
    • Add new information messages

golang-github-QubitProducts-exporter_exporter:

  • Remove license file from %doc

mgr-daemon:

  • Version 4.3.5-1
    • Update translation strings

mgr-virtualization:

  • Version 4.3.6-1
    • Report all VMs in poller, not only running ones (bsc#1199528)

prometheus-blackbox_exporter:

  • Exclude s390 arch

python-hwdata:

  • Declare the LICENSE file as license and not doc

spacecmd:

  • Version 4.3.14-1
    • Fix missing argument on system_listmigrationtargets (bsc#1201003)
    • Show correct help on calling kickstart_importjson with no arguments
    • Fix tracebacks on spacecmd kickstart_export (bsc#1200591)
    • Change proxy container config default filename to end with tar.gz
    • Update translation strings

spacewalk-client-tools:

  • Version 4.3.11-1
    • Update translation strings

uyuni-common-libs:

  • Version 4.3.5-1
    • Fix reposync issue about ‘rpm.hdr’ object has no attribute ‘get’

uyuni-proxy-systemd-services:

  • Version 4.3.6-1
    • Expose port 80 (bsc#1200142)
    • Use volumes rather than bind mounts
    • TFTPD to listen on udp port (bsc#1200968)
    • Add TAG variable in configuration
    • Fix containers namespaces in configuration

zypp-plugin-spacewalk:

  • 1.0.13
    • Log in before listing channels. (bsc#1197963, bsc#1193585)

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or “zypper patch”.

Alternatively you can run the command listed for your product:

  • openSUSE Leap 15.4:

    zypper in -t patch openSUSE-SLE-15.4-2022-3178=1

  • openSUSE Leap 15.3:

    zypper in -t patch openSUSE-SLE-15.3-2022-3178=1

  • SUSE Manager Tools 15:

    zypper in -t patch SUSE-SLE-Manager-Tools-15-2022-3178=1

  • SUSE Linux Enterprise Server for SAP 15:

    zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2022-3178=1

  • SUSE Linux Enterprise Server 15-LTSS:

    zypper in -t patch SUSE-SLE-Product-SLES-15-2022-3178=1

  • SUSE Linux Enterprise Module for SUSE Manager Server 4.3:

    zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Server-4.3-2022-3178=1

  • SUSE Linux Enterprise Module for SUSE Manager Server 4.2:

    zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Server-4.2-2022-3178=1

  • SUSE Linux Enterprise Module for SUSE Manager Server 4.1:

    zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Server-4.1-2022-3178=1

  • SUSE Linux Enterprise Module for SUSE Manager Proxy 4.3:

    zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Proxy-4.3-2022-3178=1

  • SUSE Linux Enterprise Module for SUSE Manager Proxy 4.2:

    zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Proxy-4.2-2022-3178=1

  • SUSE Linux Enterprise Module for SUSE Manager Proxy 4.1:

    zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Proxy-4.1-2022-3178=1

  • SUSE Linux Enterprise High Performance Computing 15-LTSS:

    zypper in -t patch SUSE-SLE-Product-HPC-15-2022-3178=1

  • SUSE Linux Enterprise High Performance Computing 15-ESPOS:

    zypper in -t patch SUSE-SLE-Product-HPC-15-2022-3178=1

Rows per page:
1-10 of 451
Use Vulners API to create your own security tool

API usage cases
  • Network scanning
  • Linux Patch management
  • Threat protection
  • No network audit solution

Ways of integration

Integrate Vulners API

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

Related for SUSE-SU-2022:3178-1