SUSE-SU-2018:2899-1: important: Security update for smt

sle-updates at sle-updates at
Thu Sep 27 10:12:05 MDT 2018

   SUSE Security Update: Security update for smt

Announcement ID:    SUSE-SU-2018:2899-1
Rating:             important
References:         #1072921 #1074608 #1103809 #1103810 #1104076 
Cross-References:   CVE-2018-12470 CVE-2018-12471 CVE-2018-12472
Affected Products:
                    Subscription Management Tool for SUSE Linux Enterprise 11-SP3

   An update that solves three vulnerabilities and has two
   fixes is now available.


   This update for smt to 2.0.34 fixes the following issues:

   These security issues were fixed:

   - CVE-2018-12471: Xml External Entity processing in the
     RegistrationSharing modules allowed to read arbitrary file read
   - CVE-2018-12470: SQL injection in RegistrationSharing module allows
     remote attackers to run arbitary SQL statements (bsc#1103810)
   - CVE-2018-12472: Authentication bypass in sibling check facilitated
     further attacks on SMT (bsc#1104076)

   SUSE would like to thank Jake Miller for reporting these issues to us.

   This non-security issue was fixed:

   - More verbose incomplete registration logging (bsc#1072921, bsc#1074608)

Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - Subscription Management Tool for SUSE Linux Enterprise 11-SP3:

      zypper in -t patch slesmtsp3-smt-13798=1

Package List:

   - Subscription Management Tool for SUSE Linux Enterprise 11-SP3 (i586 s390x x86_64):



More information about the sle-updates mailing list