⌘ + K

SUSE-SU-2017:1349-1

Dashboard / Vulnerabilities / SUSE-SU-2017:1349-1

SUSE-SU-2017:1349-1

Published: 18 May 2017Last Modified: 4 Feb 2026

Upstream:

CVE-2017-7470

Aliases:

CVE-2017-7470

Summary: Security update for SUSE Manager Server 3.0

Details: The following security issue in spacewalk-backend has been fixed: - Non admin or disabled user cannot make changes to a system anymore using spacewalk-channel. (bsc#1026633, CVE-2017-7470) Additionally, the following non-security issues have been fixed: rhnlib: - Support all TLS versions in rpclib. (bsc#1025312) salt-netapi-client: - Fix date format for Schedule module. (bsc#1034465) spacecmd: - Improve output on error for listrepo. (bsc#1027426) - Reword spacecmd removal message. (bsc#1024406) spacewalk-backend: - Do not fail with traceback when media.1 does not exist. (bsc#1032256) - Create scap files directory beforehand. (bsc#1029755) - Fix error if SPACEWALK_DEBUG_NO_REPORTS environment variable is not present. - Don't skip 'rhnErrataPackage' cleanup during an errata update. (bsc#1023233) - Add support for running spacewalk-debug without creating reports. (bsc#1024714) - Set scap store directory mod to 775 and group owner to susemanager. - incomplete_package_import: Do import rhnPackageFile as it breaks some package installations. - Added traceback printing to the exception block. - Change postgresql starting commands. spacewalk-certs-tools: - Always restart the minion regardless of its current state. (bsc#1034956) - Correctly honor disabling of SSL in bootstrap script. (bsc#1033383) - Add curl dependency and move mgr-proxy-ssh* to spacewalk-proxy package. - Exit for non-traditional bootstrap scripts. (bsc#1020904) - Rename mgr-ssh-proxy-force-cmd -> mgr-proxy-ssh-force-cmd. - Add mgr-proxy-ssh-force-cmd, mgr-proxy-ssh-push-init to rpm. - Add option to configure only sshd. - Restrictive ssh options for user mgrsshtunnel. spacewalk-client-tools: - Fix reboot message to use correct product name. (bsc#1031667) spacewalk-java: - Fix missing IPs in Overview tab. (bsc#1031453) - Fix scheduling VM deployment in future. (bsc#1034289) - Handle empty set to not produce invalid sql. (bsc#1033497) - Fix SSM group pagination. (bsc#1012784) - Create PooledExecutor with pre-filled queue. (bsc#1030716) - Make sure minion keys can only be seen/managed by appropriate user. (bsc#1025908) - Set action status to 'failed' on uncaught exceptions. (bsc#1013606) - Add missing library to taskomatic classpath. (bsc#1024066) - Set log level to DEBUG for EOFException when the Websocket connection is aborted by the client. (bsc#1031826) - Add a remote command with label as a script to the actionchain. (bsc#1011964) - Fix architecture for default channels lookup. (bsc#1025275) - Change required salt-netapi-client to >= 0.11. - Using stream() during collection processing. - Making salt presence timeouts configurable via rhn.conf. (bsc#1025761) - Avoid blocking synchronous calls if some minions are unreachable. (bsc#1025761) - Excludes unreachable minions from synchronous call to prevent blocking. (bsc#1025761) - Fix LocalDateTimeISOAdapter to parse date string with timezone. (bsc#1024966) - Create scap files directories beforehand. (bsc#1029755) - Make country, state/province and city searchable for system location. (bsc#1020659) - Change incorrect help link. (bsc#1017418) - Don't allow scheduling scap scan if openscap pkg missing from minion. - Make salt aware of rescheduled actions. (bsc#1027852) - Close hibernate session on async salt-ssh call. - Use a small fixed pool so we don't overwhelm the salt-api with salt-ssh executions - Fix remote cmd ui js err and timed out message. - Remote cmd UI changes for salt-ssh minions. - Add support for salt ssh minions to remote cmd UI. - Apply SessionFilter also for error pages. (bsc#1028062) - Use correct logging class. - Fix broken help link for taskstatus. (bsc#1017422) - Test errata not removed from origin. - Fix merge channels patches. (bsc#1025000) - Change XccdfIdent.identifier mapping length to 100. - Add xccdf result xslt. - Fix mainframesysinfo module to use /proc/sysinfo on SLES11. (bsc#1025758) - Use consistent spelling in UI. (bsc#1028306) - Rewording distchannelmap text. (bsc#1017772) - Javascript datepicker needs the timezone create a correct date object. (bsc#1024966) - Don't show audit tab for ssh-push minions. - Set scap store dir mod to 775 and group owner to susemanager. - Better error handling and more tests. - Store uploaded scap files. - Openscap action scheduling and handling. - Grant scap capability to minion on registration. - Enable audit tab for salt minions. - Scap inital xccdfEval and hibernate mappings. - Show proxy path in bootstrap UI. - AuthFilter tests: Update expectations to reflect cookie update at end of request. - AuthFilter: Update cookie expiry date at end of HTTP request. (bsc#1025775) - MinionActionCleanup: Only call list_jobs once per action id. (bsc#1025291) - MinionActionCleanupTest: Expect that list_jobs is only called once. - Feat: Allow salt-enabled bootstrap.sh via UI. - Catch and display all bootstrap errors. - Sync grains and beacons only for regular minions. - Add new channel tokens to minion.accessTokens. - Fix getting server path for a first level proxy. - Fix bootstrap err when proxy not selected. - Check if proxy hostname is FQDN not name in UI. - Utility for runner to generate ssh key and execute cmd via proxies. - Add proxy_pub_key to ssh bootstrap pillar. - Add ssh timeout to temporary roster. - Salt_ssh_connect_timeout configuration parameter. - Authorize parent salt-ssh key on proxy. - Java backend for salt ssh-push through proxy. - Avoid deadlock with spacewalk-repo-sync. (bsc#1022530) - Fix NPE when no SUSE Product was found for an installed product. (bsc#1029840) - Keep organization after migrating a system to salt. (bsc#1026301) - Fix glob only for noarch rpm(s). - Feat: Dynamically detect deployed CA certificate. - Fix restore original default (certificate). - Rename variable (cert provided by RPM). - Fix uniform bootstrap.sh. (bsc#1000762) spacewalk-reports: - Remove legacy audit logging reports. (bsc#1009545) spacewalk-setup: - Create /var/spacewalk/systems in spacewalk-setup and ensure perms on upgrade. - Add xccdf result xslt. - Authorize parent salt-ssh key on proxy. spacewalk-web: - Remote Commands: Allow Web Socket to be opened on non-standard port. - Improve remote cmd ui error handling. - Show message when waiting for ssh minions times out. - Fix remote cmd ui js err and timed out message. - Remote cmd UI changes for salt-ssh minions. - Fix broken help link for taskstatus. (bsc#1017422) - Add js utility function to create Date objects in different timezones. - Show proxy path in bootstrap UI. - Clear proxy selection when clicking clear fields button. - Check if proxy hostname is FQDN not name in UI. - Show warn in bootstrap UI if proxy hostname is not a FQDN. subscription-matcher: - Set -Xmx launch parameter based on customer data. (bsc#1024863) - Small bugfixes and logging improvements. susemanager: - Add bootstrap repo data for SLES for SAP 12 SP2 ppc64le. - Add python-setuptools to bootstrap repo. (bsc#1033731) - Create directory manually if mksubvolume fails, so we now support btrfs based systems with missing mksubvoume utility. (bsc#1031885) - Create /var/spacewalk/systems in spacewalk-setup and ensure perms on upgrade - Fix typo in comment noting option with-custom-channels. (bsc#1031092) - Pre require tomcat and salt. - Fix %%pre and %%post scripts in susemanager.spec. - Append salt,tomcat,wwwrung to susemanager group. - Susemanager group and change owner and permissions for /var/susemanager/systems. susemanager-schema: - Don't fail if capability already exists. - Show update message only when updating the schema package. (bsc#1024456) - Fix audit log disabling in Oracle. - Grant minions scap capability. - Clean up stale logging data and triggers. (bsc#1009545) - Fix deduplicate to work with more than two duplicates. susemanager-sls: - Add certificate state for CAASP. - Add certificate state for SLES for SAP. (bsc#1031659) - Pre-create empty top.sls with no-op. (bsc#1017754) - Add xccdf result xslt. - Fix mainframesysinfo module to use /proc/sysinfo on SLES11. (bsc#1025758) - Set scap store dir mod to 775 and group owner to susemanager. - Store uploaded scap files. - Set minion own key owner to bootstrap ssh_push_sudo_user. - Runner to generate ssh key and execute cmd via proxies. - Change ssh bootstrap state to generate and auth keys for salt-ssh push with tunnel. - Authorize parent salt-ssh key on proxy. susemanager-sync-data: - Support Cloud 7 - Magnum Orchestration (bsc#1026266) and SLES for SAP 12 SP2 ppc64le. virtual-host-gatherer: - Adding support for exploring 'vim.Folder'. (bsc#1025421) How to apply this update: 1. Log in as root user to the SUSE Manager server. 2. Stop the Spacewalk service: spacewalk-service stop 3. Apply the patch using either zypper patch or YaST Online Update. 4. Upgrade the database schema: spacewalk-schema-upgrade 5. Start the Spacewalk service: spacewalk-service start

Affected packages

Package

Name: rhnlib

Purl: pkg:rpm/suse/rhnlib&distro=SUSE%20Manager%20Server%203.0

Affected ranges

Type: ECOSYSTEM

Events:

Introduced- 0

Fixed -2.5.84.4-6.1

Affected versions

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High