SUSE-SU-2025:01989-1: moderate: Security update for Multi-Linux Manager Client Tools
SLE-SECURITY-UPDATES
null at suse.de
Wed Jun 18 08:30:40 UTC 2025
# Security update for Multi-Linux Manager Client Tools
Announcement ID: SUSE-SU-2025:01989-1
Release Date: 2025-06-18T02:11:30Z
Rating: moderate
References:
* bsc#1208752
* bsc#1231844
* bsc#1233343
* bsc#1236510
* bsc#1236515
* bsc#1236516
* bsc#1238680
* bsc#1238686
* bsc#1238703
* bsc#1241683
* bsc#1241687
* bsc#1241809
* bsc#1243672
* bsc#1243714
* jsc#MSQA-992
* jsc#PED-11740
* jsc#PED-12872
* jsc#PED-12918
Cross-References:
* CVE-2023-45288
* CVE-2024-9264
* CVE-2024-9476
* CVE-2025-22870
* CVE-2025-22872
* CVE-2025-2703
* CVE-2025-29923
* CVE-2025-3454
CVSS scores:
* CVE-2023-45288 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2023-45288 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2024-9264 ( SUSE ): 9.4
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2024-9264 ( SUSE ): 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
* CVE-2024-9264 ( NVD ): 9.4
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2024-9264 ( NVD ): 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
* CVE-2024-9264 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2024-9476 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
* CVE-2024-9476 ( NVD ): 5.1
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2024-9476 ( NVD ): 0.0 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:N
* CVE-2025-22870 ( SUSE ): 4.8
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2025-22870 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
* CVE-2025-22870 ( NVD ): 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
* CVE-2025-22872 ( SUSE ): 6.3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
* CVE-2025-22872 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
* CVE-2025-22872 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
* CVE-2025-2703 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
* CVE-2025-2703 ( NVD ): 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
* CVE-2025-29923 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
* CVE-2025-29923 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
* CVE-2025-3454 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
* CVE-2025-3454 ( NVD ): 5.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Affected Products:
* openSUSE Leap 15.3
* openSUSE Leap 15.4
* openSUSE Leap 15.5
* openSUSE Leap 15.6
* SUSE Linux Enterprise Desktop 15
* SUSE Linux Enterprise Desktop 15 SP1
* SUSE Linux Enterprise Desktop 15 SP2
* SUSE Linux Enterprise Desktop 15 SP3
* SUSE Linux Enterprise Desktop 15 SP4
* SUSE Linux Enterprise Desktop 15 SP5
* SUSE Linux Enterprise Desktop 15 SP6
* SUSE Linux Enterprise Desktop 15 SP7
* SUSE Linux Enterprise High Performance Computing 15
* SUSE Linux Enterprise High Performance Computing 15 SP1
* SUSE Linux Enterprise High Performance Computing 15 SP2
* SUSE Linux Enterprise High Performance Computing 15 SP3
* SUSE Linux Enterprise High Performance Computing 15 SP4
* SUSE Linux Enterprise High Performance Computing 15 SP5
* SUSE Linux Enterprise Micro 5.0
* SUSE Linux Enterprise Micro 5.1
* SUSE Linux Enterprise Micro 5.2
* SUSE Linux Enterprise Micro 5.3
* SUSE Linux Enterprise Micro 5.4
* SUSE Linux Enterprise Micro 5.5
* SUSE Linux Enterprise Real Time 15 SP1
* SUSE Linux Enterprise Real Time 15 SP2
* SUSE Linux Enterprise Real Time 15 SP3
* SUSE Linux Enterprise Real Time 15 SP4
* SUSE Linux Enterprise Real Time 15 SP5
* SUSE Linux Enterprise Real Time 15 SP6
* SUSE Linux Enterprise Real Time 15 SP7
* SUSE Linux Enterprise Server 15
* SUSE Linux Enterprise Server 15 SP1
* SUSE Linux Enterprise Server 15 SP2
* SUSE Linux Enterprise Server 15 SP3
* SUSE Linux Enterprise Server 15 SP4
* SUSE Linux Enterprise Server 15 SP5
* SUSE Linux Enterprise Server 15 SP6
* SUSE Linux Enterprise Server 15 SP7
* SUSE Linux Enterprise Server for SAP Applications 15
* SUSE Linux Enterprise Server for SAP Applications 15 SP1
* SUSE Linux Enterprise Server for SAP Applications 15 SP2
* SUSE Linux Enterprise Server for SAP Applications 15 SP3
* SUSE Linux Enterprise Server for SAP Applications 15 SP4
* SUSE Linux Enterprise Server for SAP Applications 15 SP5
* SUSE Linux Enterprise Server for SAP Applications 15 SP6
* SUSE Linux Enterprise Server for SAP Applications 15 SP7
* SUSE Manager Client Tools for SLE 15
* SUSE Manager Client Tools for SLE Micro 5
* SUSE Manager Proxy 4.3
* SUSE Manager Proxy 4.3 Module
* SUSE Manager Retail Branch Server 4.3
An update that solves eight vulnerabilities, contains four features and has six
security fixes can now be installed.
## Description:
This update fixes the following issues:
golang-github-prometheus-prometheus was updated to version 2.53.4:
* Security issues fixed:
* CVE-2023-45288: Require Go >= 1.23 for building (bsc#1236516)
* CVE-2025-22870: Bumped golang.org/x/net to version 0.39.0 (bsc#1238686)
* Other bugs fixes from version 2.53.4:
* Runtime: fixed GOGC being set to 0 when installed with empty prometheus.yml
file resulting high cpu usage
* Scrape: fixed dropping valid metrics after previous scrape failed
prometheus-blackbox_exporter was updated from version 0.24.0 to 0.26.0
(jsc#PED-12872):
* Security issues fixed:
* CVE-2025-22870: Fixed proxy bypassing using IPv6 zone IDs (bsc#1238680)
* CVE-2023-45288: Fixed closing connections when receiving too many headers
(bsc#1236515)
* Other changes from version 0.26.0:
* Changes:
* Replace go-kit/log with log/slog module.
* Features:
* Add metric to record tls ciphersuite negotiated during handshake.
* Add a way to export labels with content matched by the probe. Reports Certificate Serial number.
* Enhancement:
* Add stale workflow to start sync with stale.yaml in Prometheus.
* Bug fixes:
* Only register grpc TLS metrics on successful handshake.
* Other changes from version 0.25.0:
* Features:
* Allow to get Probe logs by target.
* Log errors from probe.
* Bug fixes:
* Prevent logging confusing error message.
* Explicit registration of internal exporter metrics.
grafana was updated from version 10.4.15 to 11.5.5 (jsc#PED-12918):
* Security issues fixed:
* CVE-2025-4123: Fix cross-site scripting vulnerability (bsc#1243714).
* CVE-2025-22872: Bump golang.org/x/net/html (bsc#1241809)
* CVE-2025-3580: Prevent unauthorized server admin deletion (bsc#1243672).
* CVE-2025-29923: Bump github.com/redis/go-redis/v9 to 9.6.3.
* CVE-2025-3454: Sanitize paths before evaluating access to route
(bsc#1241683).
* CVE-2025-2703: Fix built-in XY Chart plugin (bsc#1241687).
* CVE-2025-22870: Bump golang.org/x/net (bsc#1238703).
* CVE-2024-9476: Fix Migration Assistant issue (bsc#1233343)
* CVE-2024-9264: SQL Expressions (bsc#1231844)
* CVE-2023-45288: Bump golang.org/x/net (bsc#1236510)
* CVE-2025-22870: Bump golang.org/x/net to version 0.37.0 (bsc#1238686)
* Potential breaking changes in version 11.5.0:
* Loki: Default to /labels API with query param instead of /series API.
* Potential breaking changes in version 11.0.1:
* If you had selected your language as "Português Brasileiro" previously,
this will be reset. You have to select it again in your Preferences for the
fix to be applied and the translations will then be shown.
* Potential breaking changes in version 11.0.0:
* AngularJS support is turned off by default.
* Legacy alerting is entirely removed.
* Subfolders cause very rare issues with folders which have slashes in their
names.
* The input data source is removed.
* Data sources: Responses which are associated with hidden queries will be
removed (filtered) by Grafana.
* The URL which is generated when viewing an individual repeated panel has
changed.
* React Router is deprecated.
* The grafana/e2e testing tool is deprecated.
* This update brings many new features, enhancements and fixes highlighted at:
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-5/
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-4/
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-3/
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-2/
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-1/
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-0/
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* SUSE Manager Client Tools for SLE Micro 5
zypper in -t patch SUSE-SLE-Manager-Tools-For-Micro-5-2025-1989=1
* SUSE Manager Proxy 4.3 Module
zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Proxy-4.3-2025-1989=1
* openSUSE Leap 15.6
zypper in -t patch openSUSE-SLE-15.6-2025-1989=1
* SUSE Manager Client Tools for SLE 15
zypper in -t patch SUSE-SLE-Manager-Tools-15-2025-1989=1
## Package List:
* SUSE Manager Client Tools for SLE Micro 5 (aarch64 s390x x86_64)
* prometheus-blackbox_exporter-0.26.0-150000.1.27.1
* SUSE Manager Proxy 4.3 Module (aarch64 ppc64le s390x x86_64)
* prometheus-blackbox_exporter-0.26.0-150000.1.27.1
* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64)
* prometheus-blackbox_exporter-0.26.0-150000.1.27.1
* SUSE Manager Client Tools for SLE 15 (aarch64 ppc64le s390x x86_64)
* grafana-11.5.5-150000.1.79.1
* firewalld-prometheus-config-0.1-150000.3.62.2
* golang-github-prometheus-prometheus-2.53.4-150000.3.62.2
* prometheus-blackbox_exporter-0.26.0-150000.1.27.1
* grafana-debuginfo-11.5.5-150000.1.79.1
## References:
* https://www.suse.com/security/cve/CVE-2023-45288.html
* https://www.suse.com/security/cve/CVE-2024-9264.html
* https://www.suse.com/security/cve/CVE-2024-9476.html
* https://www.suse.com/security/cve/CVE-2025-22870.html
* https://www.suse.com/security/cve/CVE-2025-22872.html
* https://www.suse.com/security/cve/CVE-2025-2703.html
* https://www.suse.com/security/cve/CVE-2025-29923.html
* https://www.suse.com/security/cve/CVE-2025-3454.html
* https://bugzilla.suse.com/show_bug.cgi?id=1208752
* https://bugzilla.suse.com/show_bug.cgi?id=1231844
* https://bugzilla.suse.com/show_bug.cgi?id=1233343
* https://bugzilla.suse.com/show_bug.cgi?id=1236510
* https://bugzilla.suse.com/show_bug.cgi?id=1236515
* https://bugzilla.suse.com/show_bug.cgi?id=1236516
* https://bugzilla.suse.com/show_bug.cgi?id=1238680
* https://bugzilla.suse.com/show_bug.cgi?id=1238686
* https://bugzilla.suse.com/show_bug.cgi?id=1238703
* https://bugzilla.suse.com/show_bug.cgi?id=1241683
* https://bugzilla.suse.com/show_bug.cgi?id=1241687
* https://bugzilla.suse.com/show_bug.cgi?id=1241809
* https://bugzilla.suse.com/show_bug.cgi?id=1243672
* https://bugzilla.suse.com/show_bug.cgi?id=1243714
* https://jira.suse.com/browse/MSQA-992
* https://jira.suse.com/browse/PED-11740
* https://jira.suse.com/browse/PED-12872
* https://jira.suse.com/browse/PED-12918
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-security-updates/attachments/20250618/4c17883e/attachment.htm>
More information about the sle-security-updates
mailing list