SUSE-SU-2019:1790-1

Details

This update fixes the following issues:

release-notes-susemanager:

Fix invalid characters in ncurses mode (bsc#1102770)

spacewalk-backend:

Fix for CVE-2019-10136. An attacker with a valid, but expired, authenticated set of headers could move some digits around, artificially extending the session validity without modifying the checksum. (bsc#1136480)

spacewalk-web:

Change WebUI string version to 3.2.9

Affected Packages(32 packages)

release-notes-susemanager-proxy

SUSE Manager Proxy 3.2

Fixed in:

3.2.9-0.16.27.1

spacewalk-backend

SUSE Manager Proxy 3.2SUSE Manager Server 3.2

Fixed in:

2.8.57.17-3.33.1

spacewalk-backend-libs

SUSE Manager Proxy 3.2SUSE Manager Server 3.2

Fixed in:

2.8.57.17-3.33.1

spacewalk-base-minimal

SUSE Manager Proxy 3.2SUSE Manager Server 3.2

Fixed in:

2.8.7.17-3.30.1

spacewalk-base-minimal-config

SUSE Manager Proxy 3.2SUSE Manager Server 3.2

Fixed in:

2.8.7.17-3.30.1

spacewalk-proxy

SUSE Manager Proxy 3.2

Fixed in:

2.8.5.6-3.11.1

spacewalk-proxy-broker

SUSE Manager Proxy 3.2

Fixed in:

2.8.5.6-3.11.1

spacewalk-proxy-common

SUSE Manager Proxy 3.2

Fixed in:

2.8.5.6-3.11.1

spacewalk-proxy-management

SUSE Manager Proxy 3.2

Fixed in:

2.8.5.6-3.11.1

spacewalk-proxy-package-manager

SUSE Manager Proxy 3.2

Fixed in:

2.8.5.6-3.11.1

References

REPORT

https://bugzilla.suse.com/1102770

REPORT

https://bugzilla.suse.com/1136476

REPORT

https://bugzilla.suse.com/1136480

WEB

https://www.suse.com/security/cve/CVE-2019-10136

WEB

https://www.suse.com/security/cve/CVE-2019-10137

ADVISORY

https://www.suse.com/support/update/announcement/2019/suse-su-20191790-1/