SUSE-SU-2019:1789-1

Dashboard / Vulnerabilities / SUSE-SU-2019:1789-1

SUSE-SU-2019:1789-1

Summary: Security update for SUSE Manager Server 4.0

Details: This update fixes the following issues: spacewalk-backend: - Do not duplicate 'http://' protocol when using proxies with 'deb' repositories (bsc#1138313) - Fix reposync when dealing with RedHat CDN (bsc#1138358) - Fix for CVE-2019-10136. An attacker with a valid, but expired, authenticated set of headers could move some digits around, artificially extending the session validity without modifying the checksum. (bsc#1136480) spacewalk-web: - Change WebUI version 4.0.1 susemanager-doc-indexes: - Updated wording for prometheus section - Jeos VM update - Port 8050 for graphical console display - Content life-cycle docs are not enough for customer to understand (bsc#1137955) - Salt boot formula fails for SLES11 SP3 terminal (bsc#1136857) - Certificate verify failed when using vmware esxi virtual host gatherer (bsc#1136561) susemanager-docs_en: - Updated wording for prometheus section - Jeos VM update - Port 8050 for graphical console display - Content life-cycle docs are not enough for customer to understand (bsc#1137955) - Salt boot formula fails for SLES11 SP3 terminal (bsc#1136857) - Certificate verify failed when using vmware esxi virtual host gatherer (bsc#1136561) susemanager-sync-data: - Add channel family definitions for SLES12 SP3 LTSS (bsc#1139693) - Add OPENSUSE to allowed channel_families to make openSUSE Leap product visible in the product list (bsc#1138364)

References: https://www.suse.com/support/update/announcement/2019/suse-su-20191789-1/, https://bugzilla.suse.com/1136476, https://bugzilla.suse.com/1136480, https://bugzilla.suse.com/1136561, https://bugzilla.suse.com/1136857, https://bugzilla.suse.com/1137955, https://bugzilla.suse.com/1138313, https://bugzilla.suse.com/1138358, https://bugzilla.suse.com/1138364, https://bugzilla.suse.com/1139693, https://www.suse.com/security/cve/CVE-2019-10136, https://www.suse.com/security/cve/CVE-2019-10137