<div class="container">
<h1>Security update for SUSE Manager Client Tools</h1>
<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-SU-2024:1508-1</td>
</tr>
<tr>
<th>Rating:</th>
<td>moderate</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1219912">bsc#1219912</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1221465">bsc#1221465</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1222155">bsc#1222155</a>
</li>
<li style="display: inline;">
<a href="https://jira.suse.com/browse/MSQA-760">jsc#MSQA-760</a>
</li>
<li style="display: inline;">
<a href="https://jira.suse.com/browse/PED-7893">jsc#PED-7893</a>
</li>
<li style="display: inline;">
<a href="https://jira.suse.com/browse/PED-7928">jsc#PED-7928</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>
Cross-References:
</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2023-6152.html">CVE-2023-6152</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2024-1313.html">CVE-2024-1313</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>CVSS scores:</th>
<td>
<ul class="list-group">
<li class="list-group-item">
<span class="cvss-reference">CVE-2023-6152</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.4</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2024-1313</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N</span>
</li>
</ul>
</td>
</tr>
<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">
<li class="list-group-item">SUSE Linux Enterprise Desktop 12</li>
<li class="list-group-item">SUSE Linux Enterprise Desktop 12 SP1</li>
<li class="list-group-item">SUSE Linux Enterprise Desktop 12 SP2</li>
<li class="list-group-item">SUSE Linux Enterprise Desktop 12 SP3</li>
<li class="list-group-item">SUSE Linux Enterprise Desktop 12 SP4</li>
<li class="list-group-item">SUSE Linux Enterprise High Performance Computing 12 SP2</li>
<li class="list-group-item">SUSE Linux Enterprise High Performance Computing 12 SP3</li>
<li class="list-group-item">SUSE Linux Enterprise High Performance Computing 12 SP4</li>
<li class="list-group-item">SUSE Linux Enterprise High Performance Computing 12 SP5</li>
<li class="list-group-item">SUSE Linux Enterprise Server 12</li>
<li class="list-group-item">SUSE Linux Enterprise Server 12 SP1</li>
<li class="list-group-item">SUSE Linux Enterprise Server 12 SP2</li>
<li class="list-group-item">SUSE Linux Enterprise Server 12 SP3</li>
<li class="list-group-item">SUSE Linux Enterprise Server 12 SP4</li>
<li class="list-group-item">SUSE Linux Enterprise Server 12 SP5</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 12</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 12 SP1</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 12 SP2</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 12 SP3</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 12 SP4</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 12 SP5</li>
<li class="list-group-item">SUSE Linux Enterprise Server for the Raspberry Pi 12-SP2</li>
<li class="list-group-item">SUSE Manager Client Tools for SLE 12</li>
</ul>
</td>
</tr>
</tbody>
</table>
<p>An update that solves two vulnerabilities, contains three features and has one security fix can now be installed.</p>
<h2>Description:</h2>
<p>This update fixes the following issues:</p>
<p>golang-github-prometheus-node_exporter:</p>
<ul>
<li>Update to 1.7.0 (jsc#PED-7893, jsc#PED-7928):</li>
<li>[FEATURE] Add ZFS freebsd per dataset stats #2753</li>
<li>[FEATURE] Add cpu vulnerabilities reporting from sysfs #2721</li>
<li>[ENHANCEMENT] Parallelize stat calls in Linux filesystem
collector #1772</li>
<li>[ENHANCEMENT] Add missing linkspeeds to ethtool collector #2711</li>
<li>[ENHANCEMENT] Add CPU MHz as the value for node_cpu_info metric
#2778</li>
<li>[ENHANCEMENT] Improve qdisc collector performance #2779</li>
<li>[ENHANCEMENT] Add include and exclude filter for hwmon
collector #2699</li>
<li>[ENHANCEMENT] Optionally fetch ARP stats via rtnetlink instead
of procfs #2777</li>
<li>[BUFFIX] Fix ZFS arcstats on FreeBSD 14.0+ 2754</li>
<li>[BUGFIX] Fallback to 32-bit stats in netdev #2757</li>
<li>[BUGFIX] Close btrfs.FS handle after use #2780</li>
<li>[BUGFIX] Move RO status before error return #2807</li>
<li>[BUFFIX] Fix promhttp_metric_handler_errors_total being always
active #2808</li>
<li>[BUGFIX] Fix nfsd v4 index miss #2824</li>
<li>Update to 1.6.1:
(no source code changes in this release)</li>
<li>BuildRequire go1.20</li>
<li>Update to 1.6.0:</li>
<li>[CHANGE] Fix cpustat when some cpus are offline #2318</li>
<li>[CHANGE] Remove metrics of offline CPUs in CPU collector #2605</li>
<li>[CHANGE] Deprecate ntp collector #2603</li>
<li>[CHANGE] Remove bcache <code>cache_readaheads_totals</code> metrics #2583</li>
<li>[CHANGE] Deprecate supervisord collector #2685</li>
<li>[FEATURE] Enable uname collector on NetBSD #2559</li>
<li>[FEATURE] NetBSD support for the meminfo collector #2570</li>
<li>[FEATURE] NetBSD support for CPU collector #2626</li>
<li>[FEATURE] Add FreeBSD collector for netisr subsystem #2668</li>
<li>[FEATURE] Add softirqs collector #2669</li>
<li>[ENHANCEMENT] Add suspended as a <code>node_zfs_zpool_state</code> #2449</li>
<li>[ENHANCEMENT] Add administrative state of Linux network
interfaces #2515</li>
<li>[ENHANCEMENT] Log current value of GOMAXPROCS #2537</li>
<li>[ENHANCEMENT] Add profiler options for perf collector #2542</li>
<li>[ENHANCEMENT] Allow root path as metrics path #2590</li>
<li>[ENHANCEMENT] Add cpu frequency governor metrics #2569</li>
<li>[ENHANCEMENT] Add new landing page #2622</li>
<li>[ENHANCEMENT] Reduce privileges needed for btrfs device stats
#2634</li>
<li>[ENHANCEMENT] Add ZFS <code>memory_available_bytes</code> #2687</li>
<li>[ENHANCEMENT] Use <code>SCSI_IDENT_SERIAL</code> as serial in diskstats
#2612</li>
<li>[ENHANCEMENT] Read missing from netlink netclass attributes
from sysfs #2669</li>
<li>[BUGFIX] perf: fixes for automatically detecting the correct
tracefs mountpoints #2553</li>
<li>[BUGFIX] Fix <code>thermal_zone</code> collector noise @2554</li>
<li>[BUGFIX] Fix a problem fetching the user wire count on FreeBSD
2584</li>
<li>[BUGFIX] interrupts: Fix fields on linux aarch64 #2631</li>
<li>[BUGFIX] Remove metrics of offline CPUs in CPU collector #2605</li>
<li>[BUGFIX] Fix OpenBSD filesystem collector string parsing #2637</li>
<li>[BUGFIX] Fix bad reporting of <code>node_cpu_seconds_total</code> in
OpenBSD #2663</li>
<li>Change go_modules archive in _service to use obscpio file</li>
</ul>
<p>grafana:</p>
<ul>
<li>Packaging improvements:</li>
<li>Changed deprecated <code>disabled</code> service mode to <code>manual</code></li>
<li>Drop golang-packaging macros</li>
<li>Drop explicit mod=vendor as it is enabled automatically</li>
<li>Update to version 9.5.18:</li>
<li>[SECURITY] CVE-2024-1313: Require same organisation when
deleting snapshots (bsc#1222155)</li>
<li>Update to version 9.5.17:</li>
<li>[FEATURE] Alerting: Backport use Alertmanager API v2</li>
<li>Require Go 1.20</li>
<li>Update to version 9.5.16:</li>
<li>[SECURITY] CVE-2023-6152: Add email verification when updating
user email (bsc#1219912)</li>
<li>[BUGFIX] Annotations: Split cleanup into separate queries and
deletes to avoid deadlocks on MySQL</li>
<li>Update to version 9.5.15:</li>
<li>[FEATURE] Alerting: Attempt to retry retryable errors</li>
<li>Update to version 9.5.14:</li>
<li>[BUGFIX] Alerting: Fix state manager to not keep
datasource_uid and ref_id labels in state after Error</li>
<li>[BUGFIX] Transformations: Config overrides being lost when
config from query transform is applied</li>
<li>[BUGFIX] LDAP: Fix enable users on successfull login</li>
<li>Update to version 9.5.13:</li>
<li>[BUGFIX] BrowseDashboards: Only remember the most recent
expanded folder</li>
<li>[BUGFIX] Licensing: Pass func to update env variables when
starting plugin</li>
<li>Update to version 9.5.12:</li>
<li>[FEATURE] Azure: Add support for Workload Identity
authentication</li>
<li>Update to version 9.5.9:</li>
<li>[FEATURE] SSE: Fix DSNode to not panic when response has empty
response</li>
<li>[FEATURE] Prometheus: Handle the response with different field
key order</li>
<li>[BUGFIX] LDAP: Fix user disabling</li>
</ul>
<p>mgr-daemon:</p>
<ul>
<li>Version 4.3.9-0</li>
<li>Update translation strings</li>
</ul>
<p>spacecmd:</p>
<ul>
<li>Version 4.3.27-0</li>
<li>Update translation strings</li>
</ul>
<p>spacewalk-client-tools:</p>
<ul>
<li>Version 4.3.19-0</li>
<li>Update translation strings</li>
</ul>
<p>spacewalk-koan:</p>
<ul>
<li>Version 4.3.6-0</li>
<li>Change Docker image location for test</li>
</ul>
<p>uyuni-common-libs:</p>
<ul>
<li>Version 4.3.10-0</li>
<li>Add support for package signature type V4 RSA/SHA384</li>
<li>Add support for package signature type V4 RSA/SHA512 (bsc#1221465)</li>
</ul>
<h2>Patch Instructions:</h2>
<p>
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">
<li class="list-group-item">
SUSE Manager Client Tools for SLE 12
<br/>
<code>zypper in -t patch SUSE-SLE-Manager-Tools-12-2024-1508=1</code>
</li>
<li class="list-group-item">
SUSE Linux Enterprise High Performance Computing 12 SP5
<br/>
<code>zypper in -t patch SUSE-SLE-SERVER-12-SP5-2024-1508=1</code>
</li>
<li class="list-group-item">
SUSE Linux Enterprise Server 12 SP5
<br/>
<code>zypper in -t patch SUSE-SLE-SERVER-12-SP5-2024-1508=1</code>
</li>
<li class="list-group-item">
SUSE Linux Enterprise Server for SAP Applications 12 SP5
<br/>
<code>zypper in -t patch SUSE-SLE-SERVER-12-SP5-2024-1508=1</code>
</li>
</ul>
<h2>Package List:</h2>
<ul>
<li>
SUSE Manager Client Tools for SLE 12 (aarch64 ppc64le s390x x86_64)
<ul>
<li>golang-github-prometheus-promu-0.14.0-1.18.1</li>
<li>golang-github-prometheus-alertmanager-0.26.0-1.27.2</li>
<li>golang-github-prometheus-node_exporter-1.7.0-1.30.2</li>
<li>python2-uyuni-common-libs-4.3.10-1.39.1</li>
<li>grafana-9.5.18-1.63.1</li>
</ul>
</li>
<li>
SUSE Manager Client Tools for SLE 12 (noarch)
<ul>
<li>spacewalk-client-setup-4.3.19-52.98.1</li>
<li>spacecmd-4.3.27-38.139.1</li>
<li>python2-spacewalk-client-tools-4.3.19-52.98.1</li>
<li>spacewalk-client-tools-4.3.19-52.98.1</li>
<li>python2-spacewalk-check-4.3.19-52.98.1</li>
<li>spacewalk-koan-4.3.6-24.36.1</li>
<li>spacewalk-check-4.3.19-52.98.1</li>
<li>mgr-daemon-4.3.9-1.47.1</li>
<li>python2-spacewalk-koan-4.3.6-24.36.1</li>
<li>python2-spacewalk-client-setup-4.3.19-52.98.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise High Performance Computing 12 SP5 (aarch64 x86_64)
<ul>
<li>golang-github-prometheus-node_exporter-1.7.0-1.30.2</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server 12 SP5 (aarch64 ppc64le s390x x86_64)
<ul>
<li>golang-github-prometheus-node_exporter-1.7.0-1.30.2</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (ppc64le x86_64)
<ul>
<li>golang-github-prometheus-node_exporter-1.7.0-1.30.2</li>
</ul>
</li>
</ul>
<h2>References:</h2>
<ul>
<li>
<a href="https://www.suse.com/security/cve/CVE-2023-6152.html">https://www.suse.com/security/cve/CVE-2023-6152.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2024-1313.html">https://www.suse.com/security/cve/CVE-2024-1313.html</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1219912">https://bugzilla.suse.com/show_bug.cgi?id=1219912</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1221465">https://bugzilla.suse.com/show_bug.cgi?id=1221465</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1222155">https://bugzilla.suse.com/show_bug.cgi?id=1222155</a>
</li>
<li>
<a href="https://jira.suse.com/browse/MSQA-760">https://jira.suse.com/browse/MSQA-760</a>
</li>
<li>
<a href="https://jira.suse.com/browse/PED-7893">https://jira.suse.com/browse/PED-7893</a>
</li>
<li>
<a href="https://jira.suse.com/browse/PED-7928">https://jira.suse.com/browse/PED-7928</a>
</li>
</ul>
</div>