SUSE-RU-2024:4008-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2024/suse-ru-20244008-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-RU-2024:4008-1.json
JSON Data
https://api.osv.dev/v1/vulns/SUSE-RU-2024:4008-1
Upstream
  • CVE-2024-22037
Related
  • CVE-2024-22037
Published
2024-11-18T13:20:34Z
Modified
2026-02-04T04:18:37.386320Z
Summary
Security update for SUSE Manager Server 5.0
Details

This update fixes the following issues:

uyuni-storage-setup:

  • Version 5.0.3-0
    • Do not create partition on extra storage disk
  • Version 5.0.2-0
    • Do not build debuginfo package

uyuni-tools:

  • Security issues fixed:
    • Version 0.1.24-0
      • CVE-2024-22037: Use podman secret to store the database credentials (bsc#1231497)
  • Bugs fixed:
    • Version 0.1.26-0
      • Ignore all zypper caches during migration (bsc#1232769)
    • Version 0.1.25-0
      • Don't migrate enabled systemd services, recreate them (bsc#1232575)
    • Version 0.1.24-0
      • Redact JSESSIONID and pxt-session-cookie values from logs and console output (bsc#1231568)
    • Version 0.1.23-0
      • Ensure namespace is defined in all kubernetes commands
      • Use SCC credentials to authenticate against registry.suse.com for kubernetes (bsc#1231157)
      • Fix namespace usage on mgrctl cp command
    • Version 0.1.22-0
      • Set projectId also for test packages/images
      • mgradm migration should not pull Confidential Computing and Hub image is replicas == 0 (bsc#1229432, bsc#1230136)
      • Do not allow SUSE Manager downgrade
      • Prevent completion issue when /var/log/uyuni-tools.log is missing
      • Fix proxy shared volume flag
      • During migration, exclude mgr-sync configuration file (bsc#1228685)
      • Migrate from PostgreSQL 14 to PostgreSQL 16 pg_hba.conf and postgresql.conf files (bsc#1231206)
      • During migration, handle empty autoinstallation path (bsc#1230285)
      • During migration, handle symlinks (bsc#1230288)
      • During migration, trust the remote sender's file list (bsc#1228424)
      • Use SCC flags during podman pull
      • Restore SELinux permission after migration (bsc#1229501)
      • Share volumes between containers (bsc#1223142)
      • Save supportconfig in current directory (bsc#1226759)
      • Fix error code handling on reinstallation (bsc#1230139)
      • Fix creating first user and organization
      • Add missing variable quotes for install vars (bsc#1229108)
      • Add API login and logout calls to allow persistent login

How to apply this update:

  1. Log in as root user to the SUSE Manager Server.
  2. Upgrade mgradm and mgrctl.
  3. If you are in a disconnected environment, upgrade the image packages.
  4. Reboot the system.
  5. Run mgradm upgrade podman which will use the default image tags.
References

Affected packages

SUSE:Manager Proxy 5.0
uyuni-storage-setup

Package

Name
uyuni-storage-setup
Purl
pkg:rpm/suse/uyuni-storage-setup&distro=SUSE%20Manager%20Proxy%205.0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.0.3-150500.12.6.4

Ecosystem specific 

{
    "binaries": [
        {
            "mgrpxy-zsh-completion": "0.1.26-150500.3.12.2",
            "mgrpxy-lang": "0.1.26-150500.3.12.2",
            "mgrpxy-bash-completion": "0.1.26-150500.3.12.2",
            "mgrpxy": "0.1.26-150500.3.12.2",
            "uyuni-storage-setup-proxy": "5.0.3-150500.12.6.4"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-RU-2024:4008-1.json"
uyuni-tools

Package

Name
uyuni-tools
Purl
pkg:rpm/suse/uyuni-tools&distro=SUSE%20Manager%20Proxy%205.0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.1.26-150500.3.12.2

Ecosystem specific 

{
    "binaries": [
        {
            "mgrpxy-zsh-completion": "0.1.26-150500.3.12.2",
            "mgrpxy-lang": "0.1.26-150500.3.12.2",
            "mgrpxy-bash-completion": "0.1.26-150500.3.12.2",
            "mgrpxy": "0.1.26-150500.3.12.2",
            "uyuni-storage-setup-proxy": "5.0.3-150500.12.6.4"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-RU-2024:4008-1.json"
SUSE:Manager Retail Branch Server Extension 5.0
uyuni-storage-setup

Package

Name
uyuni-storage-setup
Purl
pkg:rpm/suse/uyuni-storage-setup&distro=SUSE%20Manager%20Retail%20Branch%20Server%20Extension%205.0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.0.3-150500.12.6.4

Ecosystem specific 

{
    "binaries": [
        {
            "mgrpxy-zsh-completion": "0.1.26-150500.3.12.2",
            "mgrpxy-lang": "0.1.26-150500.3.12.2",
            "mgrpxy-bash-completion": "0.1.26-150500.3.12.2",
            "mgrpxy": "0.1.26-150500.3.12.2",
            "uyuni-storage-setup-proxy": "5.0.3-150500.12.6.4"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-RU-2024:4008-1.json"
uyuni-tools

Package

Name
uyuni-tools
Purl
pkg:rpm/suse/uyuni-tools&distro=SUSE%20Manager%20Retail%20Branch%20Server%20Extension%205.0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.1.26-150500.3.12.2

Ecosystem specific 

{
    "binaries": [
        {
            "mgrpxy-zsh-completion": "0.1.26-150500.3.12.2",
            "mgrpxy-lang": "0.1.26-150500.3.12.2",
            "mgrpxy-bash-completion": "0.1.26-150500.3.12.2",
            "mgrpxy": "0.1.26-150500.3.12.2",
            "uyuni-storage-setup-proxy": "5.0.3-150500.12.6.4"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-RU-2024:4008-1.json"
SUSE:Manager Server 5.0
uyuni-storage-setup

Package

Name
uyuni-storage-setup
Purl
pkg:rpm/suse/uyuni-storage-setup&distro=SUSE%20Manager%20Server%205.0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.0.3-150500.12.6.4

Ecosystem specific 

{
    "binaries": [
        {
            "mgradm": "0.1.26-150500.3.12.2",
            "uyuni-storage-setup-server": "5.0.3-150500.12.6.4",
            "mgrctl": "0.1.26-150500.3.12.2",
            "mgrctl-zsh-completion": "0.1.26-150500.3.12.2",
            "mgrctl-lang": "0.1.26-150500.3.12.2",
            "mgradm-zsh-completion": "0.1.26-150500.3.12.2",
            "mgradm-lang": "0.1.26-150500.3.12.2",
            "mgradm-bash-completion": "0.1.26-150500.3.12.2",
            "mgrctl-bash-completion": "0.1.26-150500.3.12.2"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-RU-2024:4008-1.json"
uyuni-tools

Package

Name
uyuni-tools
Purl
pkg:rpm/suse/uyuni-tools&distro=SUSE%20Manager%20Server%205.0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.1.26-150500.3.12.2

Ecosystem specific 

{
    "binaries": [
        {
            "mgradm": "0.1.26-150500.3.12.2",
            "uyuni-storage-setup-server": "5.0.3-150500.12.6.4",
            "mgrctl": "0.1.26-150500.3.12.2",
            "mgrctl-zsh-completion": "0.1.26-150500.3.12.2",
            "mgrctl-lang": "0.1.26-150500.3.12.2",
            "mgradm-zsh-completion": "0.1.26-150500.3.12.2",
            "mgradm-lang": "0.1.26-150500.3.12.2",
            "mgradm-bash-completion": "0.1.26-150500.3.12.2",
            "mgrctl-bash-completion": "0.1.26-150500.3.12.2"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-RU-2024:4008-1.json"