<div class="container">
<h1>Security Beta update for SUSE Manager Client Tools</h1>
<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-SU-2024:1815-1</td>
</tr>
<tr>
<th>Rating:</th>
<td>moderate</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1221465">bsc#1221465</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1222155">bsc#1222155</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1222277">bsc#1222277</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1222731">bsc#1222731</a>
</li>
<li style="display: inline;">
<a href="https://jira.suse.com/browse/MSQA-775">jsc#MSQA-775</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>
Cross-References:
</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2024-1313.html">CVE-2024-1313</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>CVSS scores:</th>
<td>
<ul class="list-group">
<li class="list-group-item">
<span class="cvss-reference">CVE-2024-1313</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N</span>
</li>
</ul>
</td>
</tr>
<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">
<li class="list-group-item">SUSE Linux Enterprise Desktop 12</li>
<li class="list-group-item">SUSE Linux Enterprise Desktop 12 SP1</li>
<li class="list-group-item">SUSE Linux Enterprise Desktop 12 SP2</li>
<li class="list-group-item">SUSE Linux Enterprise Desktop 12 SP3</li>
<li class="list-group-item">SUSE Linux Enterprise Desktop 12 SP4</li>
<li class="list-group-item">SUSE Linux Enterprise High Performance Computing 12 SP2</li>
<li class="list-group-item">SUSE Linux Enterprise High Performance Computing 12 SP3</li>
<li class="list-group-item">SUSE Linux Enterprise High Performance Computing 12 SP4</li>
<li class="list-group-item">SUSE Linux Enterprise High Performance Computing 12 SP5</li>
<li class="list-group-item">SUSE Linux Enterprise Server 12</li>
<li class="list-group-item">SUSE Linux Enterprise Server 12 SP1</li>
<li class="list-group-item">SUSE Linux Enterprise Server 12 SP2</li>
<li class="list-group-item">SUSE Linux Enterprise Server 12 SP3</li>
<li class="list-group-item">SUSE Linux Enterprise Server 12 SP4</li>
<li class="list-group-item">SUSE Linux Enterprise Server 12 SP5</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 12</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 12 SP1</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 12 SP2</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 12 SP3</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 12 SP4</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 12 SP5</li>
<li class="list-group-item">SUSE Linux Enterprise Server for the Raspberry Pi 12-SP2</li>
<li class="list-group-item">SUSE Manager Client Tools Beta for SLE 12</li>
</ul>
</td>
</tr>
</tbody>
</table>
<p>An update that solves one vulnerability, contains one feature and has three security fixes can now be installed.</p>
<h2>Description:</h2>
<p>This update fixes the following issues:</p>
<p>grafana:</p>
<ul>
<li>Packaging improvements:</li>
<li>Changed deprecated <code>disabled</code> service mode to <code>manual</code></li>
<li>Drop golang-packaging macros</li>
<li>Drop explicit mod=vendor as it is enabled automatically</li>
<li>Update to version 9.5.18:</li>
<li>[SECURITY] CVE-2024-1313: Require same organisation when
deleting snapshots (bsc#1222155)</li>
<li>Update to version 9.5.17:</li>
<li>[FEATURE] Alerting: Backport use Alertmanager API v2</li>
</ul>
<p>mgr-push:</p>
<ul>
<li>Version 5.0.2-0</li>
<li>Remove unused code from the traditional stack</li>
<li>Use bundle CA certificate in rhnpush (bsc#1222731)</li>
</ul>
<p>spacecmd:</p>
<ul>
<li>Version 5.0.6-0</li>
<li>Update translations</li>
</ul>
<p>uyuni-common-libs:</p>
<ul>
<li>Version 5.0.3-0</li>
<li>Add support for package signature type V4 RSA/SHA384</li>
<li>Add support for package signature type V4 RSA/SHA512
(bsc#1221465)</li>
</ul>
<p>uyuni-tools:</p>
<ul>
<li>Version 0.1.9-0</li>
<li>Redact passwords from the API payload in traces</li>
<li>Fix build on Ubuntu 20.04 due to version change</li>
<li>Version 0.1.8-0</li>
<li>Add 'mgradm support sql' command</li>
<li>Improve GPG help</li>
<li>podman-mount* flag should be used only on Server installation
and migration</li>
<li>Add flag groups in help text</li>
<li>Attach Proxy pod to our Podman network</li>
<li>Create support ptf commands</li>
<li>Create mgrpxy upgrade command</li>
<li>Add domain for internal container network</li>
<li>Stop the Server if first user creation failed</li>
<li>Add localization support</li>
<li>Require Podman 4.5.0 for its --shm-size-systemd parameter</li>
<li>Add --podman-mount-www flag for install and migration</li>
<li>Only colorize output if outputting to a terminal</li>
<li>Fix output missing newlines due to the spinner</li>
<li>Add product version and commit id to the version output</li>
<li>Add missing whitespace between podman common arguments and
additional ones</li>
<li>Bump the push tag to 5.0.0-RC</li>
<li>Add gpg command to mgradm</li>
<li>Hide message in stdout if SCCcredentials is missing
(bsc#1222277)</li>
<li>Redact password in stdout and uyuni-tools.log</li>
<li>Rework distribution mapping to work with distros without
.treeinfo data</li>
<li>Add initial installation support for Confidental Computing
attestation container</li>
<li>Allow PAM and LDAP authentication using SSSD</li>
<li>Change pull policy default to Always during upgrade</li>
<li>Allow migration with non-root user on source server</li>
</ul>
<h2>Patch Instructions:</h2>
<p>
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">
<li class="list-group-item">
SUSE Manager Client Tools Beta for SLE 12
<br/>
<code>zypper in -t patch SUSE-SLE-Manager-Tools-12-BETA-2024-1815=1</code>
</li>
</ul>
<h2>Package List:</h2>
<ul>
<li>
SUSE Manager Client Tools Beta for SLE 12 (aarch64 ppc64le s390x x86_64)
<ul>
<li>grafana-9.5.18-4.30.4</li>
<li>python2-uyuni-common-libs-5.0.3-3.39.3</li>
<li>mgrctl-0.1.9-3.11.4</li>
</ul>
</li>
<li>
SUSE Manager Client Tools Beta for SLE 12 (noarch)
<ul>
<li>mgr-push-5.0.2-4.24.5</li>
<li>spacecmd-5.0.6-41.51.3</li>
<li>mgrctl-bash-completion-0.1.9-3.11.4</li>
<li>mgrctl-lang-0.1.9-3.11.4</li>
<li>python2-mgr-push-5.0.2-4.24.5</li>
<li>mgrctl-zsh-completion-0.1.9-3.11.4</li>
</ul>
</li>
</ul>
<h2>References:</h2>
<ul>
<li>
<a href="https://www.suse.com/security/cve/CVE-2024-1313.html">https://www.suse.com/security/cve/CVE-2024-1313.html</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1221465">https://bugzilla.suse.com/show_bug.cgi?id=1221465</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1222155">https://bugzilla.suse.com/show_bug.cgi?id=1222155</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1222277">https://bugzilla.suse.com/show_bug.cgi?id=1222277</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1222731">https://bugzilla.suse.com/show_bug.cgi?id=1222731</a>
</li>
<li>
<a href="https://jira.suse.com/browse/MSQA-775">https://jira.suse.com/browse/MSQA-775</a>
</li>
</ul>
</div>