SUSE-SU-2017:1347-1: moderate: Security update for SUSE Manager Client Tools

[sle-security-updates at lists.suse.com]

   SUSE Security Update: Security update for SUSE Manager Client Tools
______________________________________________________________________________

Announcement ID:    SUSE-SU-2017:1347-1
Rating:             moderate
References:         #1023233 #1024406 #1024714 #1025312 #1026633 
                    #1027426 #1029755 #1031667 #1032256 
Cross-References:   CVE-2017-7470
Affected Products:
                    SUSE Linux Enterprise Server 11-SP4-CLIENT-TOOLS
                    SUSE Linux Enterprise Server 11-SP3-CLIENT-TOOLS
______________________________________________________________________________

   An update that solves one vulnerability and has 8 fixes is
   now available.

Description:


   The following security issue in spacewalk-backend has been fixed:

   - Non admin or disabled user cannot make changes to a system anymore using
     spacewalk-channel. (bsc#1026633, CVE-2017-7470)

   Additionally, the following non-security issues have been fixed:

   rhnlib:

   - Support all TLS versions in rpclib. (bsc#1025312)

   spacecmd:

   - Improve output on error for listrepo. (bsc#1027426)
   - Reword spacecmd removal message. (bsc#1024406)

   spacewalk-backend:

   - Do not fail with traceback when media.1 does not exist. (bsc#1032256)
   - Create scap files directory beforehand. (bsc#1029755)
   - Fix error if SPACEWALK_DEBUG_NO_REPORTS environment variable is not
     present.
   - Don't skip 'rhnErrataPackage' cleanup during an errata update.
     (bsc#1023233)
   - Add support for running spacewalk-debug without creating reports.
     (bsc#1024714)
   - Set scap store directory mod to 775 and group owner to susemanager.
   - incomplete_package_import: Do import rhnPackageFile as it breaks some
     package installations.
   - Added traceback printing to the exception block.
   - Change postgresql starting commands.

   spacewalk-client-tools:

   - Fix reboot message to use correct product name. (bsc#1031667)


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Server 11-SP4-CLIENT-TOOLS:

      zypper in -t patch slesctsp4-client-tools-201704-13115=1

   - SUSE Linux Enterprise Server 11-SP3-CLIENT-TOOLS:

      zypper in -t patch slesctsp3-client-tools-201704-13115=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Linux Enterprise Server 11-SP4-CLIENT-TOOLS (i586 ia64 ppc64 s390x x86_64):

      rhnlib-2.5.84.4-8.1
      spacecmd-2.5.5.5-14.1
      spacewalk-backend-libs-2.5.24.9-24.1

   - SUSE Linux Enterprise Server 11-SP4-CLIENT-TOOLS (noarch):

      spacewalk-check-2.5.13.8-23.1
      spacewalk-client-setup-2.5.13.8-23.1
      spacewalk-client-tools-2.5.13.8-23.1

   - SUSE Linux Enterprise Server 11-SP3-CLIENT-TOOLS (i586 ia64 ppc64 s390x x86_64):

      rhnlib-2.5.84.4-8.1
      spacecmd-2.5.5.5-14.1
      spacewalk-backend-libs-2.5.24.9-24.1

   - SUSE Linux Enterprise Server 11-SP3-CLIENT-TOOLS (noarch):

      spacewalk-check-2.5.13.8-23.1
      spacewalk-client-setup-2.5.13.8-23.1
      spacewalk-client-tools-2.5.13.8-23.1


References:

   https://www.suse.com/security/cve/CVE-2017-7470.html
   https://bugzilla.suse.com/1023233
   https://bugzilla.suse.com/1024406
   https://bugzilla.suse.com/1024714
   https://bugzilla.suse.com/1025312
   https://bugzilla.suse.com/1026633
   https://bugzilla.suse.com/1027426
   https://bugzilla.suse.com/1029755
   https://bugzilla.suse.com/1031667
   https://bugzilla.suse.com/1032256