SUSE-SU-2019:0863-1: moderate: Security update for SUSE Manager Server 3.1

Wed Apr 3 16:13:45 MDT 2019

   SUSE Security Update: Security update for SUSE Manager Server 3.1
______________________________________________________________________________

Announcement ID:    SUSE-SU-2019:0863-1
Rating:             moderate
References:         #1109316 #1111191 #1111910 #1114029 #1114059 
                    #1114157 #1114169 #1117759 #1119081 #1119964 
                    #1121038 #1121195 #1121856 #1122836 #1123991 
                    #1124639 #1126862 #1128781 #1129765 #1130658 

Cross-References:   CVE-2018-10851 CVE-2018-14626 CVE-2018-17197

Affected Products:
                    SUSE Manager Server 3.1
                    SUSE Manager Proxy 3.1
______________________________________________________________________________

   An update that solves three vulnerabilities and has 17
   fixes is now available.

Description:

   This update fixes the following issues:

   cobbler:

   - Fixes case where distribution detection returns None (bsc#1130658)
   - SUSE texmode fix (bsc#1109316)
   - Fix for SUSE distribution detection in ISO building (bsc#1123991)

   py26-compat-salt:

   - Remove arch from name when pkg.list_pkgs is called with 'attr'
     (bsc#1114029)

   spacecmd:

   - Fix importing state channels using configchannel_import
   - Fix getting file info for latest revision (via configchannel_filedetails)

   spacewalk-branding:

   - Update jquery.timepicker dependency to 1.11.14 to allow parsing the time
     format without depending on the language. (bsc#1119081)

   spacewalk-java:

   - Fix a problem when cloning public child channels with a private base
     channel (bsc#1124639)
   - Keep assigned channels on traditional to minion migration (bsc#1122836)
   - Fix "Add Selected to SSM" on System Groups -> systems page (bsc#1121856)
   - Disable notification types with 'java.notifications_type_disabled' in
     rhn.conf (bsc#1111910)
   - XMLRPC API: Include init.sls in channel file list (bsc#1111191)
   - Fix the config channels assignment via SSM (bsc#1117759)

   spacewalk-utils:

   - Create /etc/rhn with correct ownership to prevent file conflicts

   spacewalk-web:

   - Fix action scheduler time picker prefill when the server is on
     "UTC/GMT" timezone (bsc#1121195)
   - Fix initializing of the datetime picker (bsc#1126862)
   - Show feedback messages after using the retry option on the notification
     messages page

   subscription-matcher:

   - Old style hard bundle merging fix (bsc#1114059)

   susemanager:

   - Fix creation of bootstrap repositories for SLE12 (no SP) by requiring
     python-setuptools
     only for SLE12 >= SP1 (bsc#1129765)
   - Add `python-setuptools` package dependency to SLES12 bootstrap repo
     (bsc#1119964)
   - Rhnlib was renamed to python2-rhnlib. Change bootstrap data accordingly.

   susemanager-schema:

   - Fix performance regression in inter-server-sync (bsc#1128781)

   susemanager-docs_en:

   - Update text and image files
   - 2.1 comparison: clarify profile syncing support
   - Adjust documentation about notification settings
   - Fix internal link (SMT documentation).
   - Remove documentation about the "mgr-sync enable-scc" subcommand.  This
     subcommand is no longer available.

   susemanager-frontend-libs:

   - Update jquery.timepicker to 1.11.14 (bsc#1119081)

   tika-core:

   - New upstream version (1.20). Fixes infinite loop in SQLite3Parser
     (CVE-2018-17197) (bsc#1121038)

Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Manager Server 3.1:

      zypper in -t patch SUSE-SUSE-Manager-Server-3.1-2019-863=1

   - SUSE Manager Proxy 3.1:

      zypper in -t patch SUSE-SUSE-Manager-Proxy-3.1-2019-863=1

Package List:

   - SUSE Manager Server 3.1 (ppc64le s390x x86_64):

      spacewalk-branding-2.7.2.17-2.31.3
      susemanager-3.1.19-2.34.2
      susemanager-tools-3.1.19-2.34.2

   - SUSE Manager Server 3.1 (noarch):

      cobbler-2.6.6-5.25.1
      py26-compat-salt-2016.11.10-1.19.3
      spacecmd-2.7.8.15-2.32.1
      spacewalk-base-2.7.1.21-2.35.1
      spacewalk-base-minimal-2.7.1.21-2.35.1
      spacewalk-base-minimal-config-2.7.1.21-2.35.1
      spacewalk-html-2.7.1.21-2.35.1
      spacewalk-java-2.7.46.19-2.41.3
      spacewalk-java-config-2.7.46.19-2.41.3
      spacewalk-java-lib-2.7.46.19-2.41.3
      spacewalk-java-oracle-2.7.46.19-2.41.3
      spacewalk-java-postgresql-2.7.46.19-2.41.3
      spacewalk-taskomatic-2.7.46.19-2.41.3
      spacewalk-utils-2.7.10.11-2.23.3
      subscription-matcher-0.22-4.9.2
      susemanager-advanced-topics_en-pdf-3.1-10.29.4
      susemanager-best-practices_en-pdf-3.1-10.29.4
      susemanager-docs_en-3.1-10.29.4
      susemanager-frontend-libs-3.1.2-3.10.1
      susemanager-getting-started_en-pdf-3.1-10.29.4
      susemanager-jsp_en-3.1-10.29.4
      susemanager-reference_en-pdf-3.1-10.29.4
      susemanager-schema-3.1.21-2.36.1
      tika-core-1.20-1.6.2

   - SUSE Manager Proxy 3.1 (noarch):

      spacewalk-base-minimal-2.7.1.21-2.35.1
      spacewalk-base-minimal-config-2.7.1.21-2.35.1

References:

   https://www.suse.com/security/cve/CVE-2018-10851.html
   https://www.suse.com/security/cve/CVE-2018-14626.html
   https://www.suse.com/security/cve/CVE-2018-17197.html
   https://bugzilla.suse.com/1109316
   https://bugzilla.suse.com/1111191
   https://bugzilla.suse.com/1111910
   https://bugzilla.suse.com/1114029
   https://bugzilla.suse.com/1114059
   https://bugzilla.suse.com/1114157
   https://bugzilla.suse.com/1114169
   https://bugzilla.suse.com/1117759
   https://bugzilla.suse.com/1119081
   https://bugzilla.suse.com/1119964
   https://bugzilla.suse.com/1121038
   https://bugzilla.suse.com/1121195
   https://bugzilla.suse.com/1121856
   https://bugzilla.suse.com/1122836
   https://bugzilla.suse.com/1123991
   https://bugzilla.suse.com/1124639
   https://bugzilla.suse.com/1126862
   https://bugzilla.suse.com/1128781
   https://bugzilla.suse.com/1129765
   https://bugzilla.suse.com/1130658