SUSE-RU-2019:1006-1

Dashboard / Vulnerabilities / SUSE-RU-2019:1006-1

SUSE-RU-2019:1006-1

Summary: Security update for SUSE Manager Server 3.2

Details: This update includes the following new features: to the repository metadata (fate#325676) This update fixes the following issues: apache-commons-lang3: - Run fdupes on javadoc - Specify java target and source level 1.6 to make package compatible with JDK >= 1.8 cobbler: - Fixes case where distribution detection returns None (bsc#1130658) - SUSE texmode fix (bsc#1109316) drools: - Update Drools to 7.17.0 - Release Notes: https://issues.jboss.org/secure/ReleaseNote.jspa - Fixes for SLE 15 compatibility guava: - Updated from 13.0.1 to 27.0.1 - Changes between 13.0.1 and 23.0: https://github.com/google/guava/wiki/Release14 https://github.com/google/guava/wiki/Release15 https://github.com/google/guava/wiki/Release16 https://github.com/google/guava/wiki/Release17 https://github.com/google/guava/wiki/Release18 https://github.com/google/guava/wiki/Release19 https://github.com/google/guava/wiki/Release23 - Changes between 23.0 and 27.0.1: see https://github.com/google/guava/releases jade4j: - Conditional java/java-devel requires based on os version - Update dependency version for commons-lang3 to 3.4 - Fix building javadoc kie-api: - Update KIE to 7.17.0 - Release notes: https://issues.jboss.org/secure/ReleaseNote.jspa optaplanner: - Update Optaplanner to 7.17.0 py26-compat-salt: - Fix minion arguments assign via sysctl (bsc#1124290) smdba: - Make 'smdba space-overview' postgresql version agnostic (bsc#1129956) - Fix version mismatch spacecmd: - Fix system_delete with SSM (bsc#1125744) spacewalk-admin: - Fix encoding bug in salt event processing (bsc#1129851) spacewalk-backend: - Fix linking of packages in reposync (bsc#1131677) - Fix: handle non-standard filenames for comps.xml (bsc#1120242) - Mgr-sign-metadata can optionally clear-sign metadata files spacewalk-branding: - Introduce a description label for the new 'minion-checkin' Taskomatic job (bsc#1122837) spacewalk-certs-tools: - Add support for Ubuntu to bootstrap script - Clean up downloaded gpg keys after bootstrap (bsc#1126075) spacewalk-java: - Fix base channel selection for Ubuntu systems (bsc#1132579) - Fix retrieval of build time for .deb repositories (bsc#1131721) - Allow access to susemanager tools channels without res subscription (bsc#1127542) - Add support for SLES 15 live patches in CVE audit - Add a Taskomatic job to perform minion check-in regularly, drop use of Salt's Mine (bsc#1122837) - Fix errata_details to return details correctly (bsc#1128228) - Support ubuntu products and debian architectures in mgr-sync - Adapt check for available repositories to debian style repositories - Add support for custom username when bootstrapping with Salt-SSH - Read and update running kernel release value at each startup of minion (bsc#1122381) - Add error message on sync refresh when there are no scc credentials - Fix apidoc issues - Fix deleting server when minion_formulas.json is empty (bsc#1122230) - Minion-action-cleanup Taskomatic task: do not clean actions younger than one hour - Schedule full package refresh only once per action chain if needed (bsc#1126518) - Check and schedule package refresh in response to events independently of what originates them (bsc#1126099) - Add configuration option to limit the number of changelog entries added to the repository metadata (fate#325676) - Generate InRelease file for Debian/Ubuntu repos when metadata signing is enabled spacewalk-web: - Show undetected subscription-matching message object as a string anyway (bsc#1125600) - Fix action scheduler time picker prefill when the server is on 'UTC/GMT' timezone (bsc#1121195) - Allow username input on bootstrap page when using Salt-SSH - Add cache buster for static files (js/css) to fix caching issues after upgrading. subscription-matcher: - Update dependencies (Drools, Optaplanner, Guava, Xstream) - Make the java and java-devel requirements variable - Relax the requirement condition on apache-commons-lang3 susemanager: - Support creating bootstrap repos for Ubuntu 18.04 and 16.04. - Allow alternative names for bootstrap packages, to allow using old client tools after package renames - Feat: create Ubuntu empty repository - Fix creation of bootstrap repositories for SLE12 (no SP) by requiring python-setuptools only for SLE12 >= SP1 (bsc#1129765) - Add bootstrap repo definition for SLE15 SP1 susemanager-docs_en: - Update text and image files. - Fix bad link. - Update Manual Backup and smdba sections. - Troubleshooting Salt clients. - Fix package endpoint in salt pillar content. - Ubuntu Clients supported. - Change License to GFL 1.2, as it is the real license for the doc since 3.2.0 susemanager-schema: - Add a Taskomatic job to perform minion check-in regularly, drop use of Salt's Mine (bsc#1122837) - Fix performance regression in inter-server-sync (bsc#1128781) - Set minion-action-cleanup run frequency from hourly to daily at midnight susemanager-sls: - Update get_kernel_live_version module to support older Salt versions (bsc#1131490) - Update get_kernel_live_version module to support SLES 15 live patches - Do not configure Salt Mine in newly registered minions (bsc#1122837) - Fix Salt error related to remove_traditional_stack when bootstrapping an Ubuntu minion (bsc#1128724) - Automatically trust SUSE GPG key for client tools channels on Ubuntu systems - Util.systeminfo sls has been added to perform different actions at minion startup(bsc#1122381) susemanager-sync-data: - Allow access to susemanager tools channels without res subscription (bsc#1127542) - Add Ubuntu product definitions - Adapt to SCC changes - Add CaaSP 4 Toolchain xstream: - Update xstream to 1.4.10 - Major changes: - CVE-2017-7957: XStream could cause a Denial of Service when unmarshalling void. (bsc#1070731) - New XStream artifact with -java7 appended as version suffix for a library explicitly without the Java 8 stuff (lambda expression support, converters for java.time.* package). - Improve performance by minimizing call stack of mapper chain. - XSTR-774: Add converters for types of java.time, java.time.chrono, and java.time.temporal packages (converters for LocalDate, LocalDateTime, LocalTime, OffsetDateTime, and ZonedDateTime by Matej Cimbora). - JavaBeanConverter does not respect ignored unknown elements. - Add XStream.setupDefaultSecurity to initialize security framework with defaults of XStream 1.5.x. - Emit error warning if security framework has not been initialized and the XStream instance is vulnerable to known exploits. - Feat: modify patch to be compatible with JDK 11 building - Fixes for SLE 15 compatibility

References: https://www.suse.com/support/update/announcement/-2019-1006/suse-ru-20191006-1/, https://bugzilla.suse.com/1070731, https://bugzilla.suse.com/1109316, https://bugzilla.suse.com/1120242, https://bugzilla.suse.com/1121195, https://bugzilla.suse.com/1122230, https://bugzilla.suse.com/1122381, https://bugzilla.suse.com/1122837, https://bugzilla.suse.com/1124290, https://bugzilla.suse.com/1125600, https://bugzilla.suse.com/1125744, https://bugzilla.suse.com/1126075, https://bugzilla.suse.com/1126099, https://bugzilla.suse.com/1126518, https://bugzilla.suse.com/1127542, https://bugzilla.suse.com/1128228, https://bugzilla.suse.com/1128724, https://bugzilla.suse.com/1128781, https://bugzilla.suse.com/1129765, https://bugzilla.suse.com/1129851, https://bugzilla.suse.com/1129956, https://bugzilla.suse.com/1130658, https://bugzilla.suse.com/1131490, https://bugzilla.suse.com/1131677, https://bugzilla.suse.com/1131721, https://bugzilla.suse.com/1132579, https://www.suse.com/security/cve/CVE-2017-7957