SUSE-SU-2018:2898-2: important: Security update for smt, yast2-smt

sle-updates at sle-updates at
Thu Oct 18 11:44:17 MDT 2018

   SUSE Security Update: Security update for smt, yast2-smt

Announcement ID:    SUSE-SU-2018:2898-2
Rating:             important
References:         #1006984 #1006989 #1037811 #1097560 #1097824 
                    #1103809 #1103810 #1104076 #977043 
Cross-References:   CVE-2018-12470 CVE-2018-12471 CVE-2018-12472
Affected Products:
                    SUSE Linux Enterprise Server 12-SP2-BCL

   An update that solves three vulnerabilities and has 6 fixes
   is now available.


   This update for yast2-smt to 3.0.14 and smt to 3.0.37 fixes the following

   These security issues were fixed in SMT:

   - CVE-2018-12471: Xml External Entity processing in the
     RegistrationSharing modules allowed to read arbitrary file read
   - CVE-2018-12470: SQL injection in RegistrationSharing module allows
     remote attackers to run arbitrary SQL statements (bsc#1103810).
   - CVE-2018-12472: Authentication bypass in sibling check facilitated
     further attacks on SMT (bsc#1104076).

   SUSE would like to thank Jake Miller for reporting these issues to us.

   These non-security issues were fixed in SMT:

   - Fix cron jobs randomization (bsc#1097560)
   - Fix duplicate migration paths (bsc#1097824)

   This non-security issue was fixed in yast2-smt:

   - Remove cron job rescheduling (bsc#1097560)
   - Added missing translation marks (bsc#1037811)
   - Explicitly mention "Organization Credentials" (fate#321759)
   - Rearrange the SMT set-up dialog (bsc#977043)
   - Make the Filter button default (bsc#1006984)
   - Prevent exiting the repo selection dialog via hitting Enter in the
     repository filter (bsc#1006984)
   - report when error occurs during repo mirroring (bsc#1006989)
   - Use TextEntry-based filter for repos (fate#319777)

Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Server 12-SP2-BCL:

      zypper in -t patch SUSE-SLE-SERVER-12-SP2-BCL-2018-2056=1

Package List:

   - SUSE Linux Enterprise Server 12-SP2-BCL (x86_64):



More information about the sle-updates mailing list