SUSE-SU-2017:2266-1

Vulnerability from csaf_suse - Published: 2017-08-25 11:42 - Updated: 2017-08-25 11:42
Summary
Security update for SUSE Manager Proxy 3.1
Severity
Moderate
Notes
Title of the patch: Security update for SUSE Manager Proxy 3.1
Description of the patch: This update for SUSE Manager Proxy 3.1 provides several fixes and improvements: The following security issues have been fixed: jabberd: - Fix offered SASL mechanism check. (bsc#1047282, CVE-2017-10807) Additionally, the following non-security issues have been fixed: jabberd: - Fix memory leak in pgsql storage driver. - Fix two double-frees caused by dangling pointers. - wss:// (WebSocket over SSL) support in c2s. - Allow BareJID S10N packets. - SQLite postconnect SQL support. - Support WebSocket fragmented packets. - Module to verify users using e-mail. - Use OpenSSL functions for base64 en/decoding when available. - Option to dump packet-filter matched packets to file. - bcrypt support for PostgreSQL and MySQL storage. - Option to set authreg module per realm. - WebSocket C2S SX plugin. - Support for RSA/DH/ECDH key agreement. - For a detailed description of all fixes, please refer to the changelog. osad: - Reduce maximal size of osad log before rotating. - Perform osad restart in posttrans. (bsc#1039913) spacewalk-backend: - Make master_label static to keep its value when retrying. (bsc#1038321) - Adapt for the new gpgcheck flag for the channels. spacewalk-certs-tools: - Improve text for bootstrap. (bsc#1032324) spacewalk-proxy: - Use query string in upstream HEAD requests. (bsc#1036260) spacewalk-web: - Fix overlapping of elements. (bsc#1031143) - Fix formulas action buttons position. (bsc#1047513) - Do not show old messages. (bsc#1043831) - Add a dynamic counter of the remaining textarea length. - Confirm if navigating away while bootstrapping. spacewalksd: - Fix permissions of PID files in spacewalksd. (bsc#1049936) zypp-plugin-spacewalk: - Fix setting pkg_gpgcheck. - Make pkg_gpgcheck configurable. How to apply this update: 1. Log in as root user to the SUSE Manager proxy. 2. Stop the proxy service: spacewalk-proxy stop 3. Apply the patch using either zypper patch or YaST Online Update. 4. Start the Spacewalk service: spacewalk-proxy start
Patchnames: SUSE-SUSE-Manager-Proxy-3.1-2017-1387
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2017-10807
7.5 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for SUSE Manager Proxy 3.1",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for SUSE Manager Proxy 3.1 provides several fixes and improvements:\n\nThe following security issues have been fixed:\n\njabberd:\n\n- Fix offered SASL mechanism check. (bsc#1047282, CVE-2017-10807)\n\nAdditionally, the following non-security issues have been fixed:\n\njabberd:\n\n- Fix memory leak in pgsql storage driver.\n- Fix two double-frees caused by dangling pointers.\n- wss:// (WebSocket over SSL) support in c2s.\n- Allow BareJID S10N packets.\n- SQLite postconnect SQL support.\n- Support WebSocket fragmented packets.\n- Module to verify users using e-mail.\n- Use OpenSSL functions for base64 en/decoding when available.\n- Option to dump packet-filter matched packets to file.\n- bcrypt support for PostgreSQL and MySQL storage.\n- Option to set authreg module per realm.\n- WebSocket C2S SX plugin.\n- Support for RSA/DH/ECDH key agreement.\n- For a detailed description of all fixes, please refer to the changelog.\n\nosad:\n\n- Reduce maximal size of osad log before rotating.\n- Perform osad restart in posttrans. (bsc#1039913)\n\nspacewalk-backend:\n\n- Make master_label static to keep its value when retrying. (bsc#1038321)\n- Adapt for the new gpgcheck flag for the channels.\n\nspacewalk-certs-tools:\n\n- Improve text for bootstrap. (bsc#1032324)\n\nspacewalk-proxy:\n\n- Use query string in upstream HEAD requests. (bsc#1036260)\n\nspacewalk-web:\n\n- Fix overlapping of elements. (bsc#1031143)\n- Fix formulas action buttons position. (bsc#1047513)\n- Do not show old messages. (bsc#1043831)\n- Add a dynamic counter of the remaining textarea length.\n- Confirm if navigating away while bootstrapping.\n\nspacewalksd:\n\n- Fix permissions of PID files in spacewalksd. (bsc#1049936)\n\nzypp-plugin-spacewalk:\n\n- Fix setting pkg_gpgcheck.\n- Make pkg_gpgcheck configurable.\n\nHow to apply this update:\n1. Log in as root user to the SUSE Manager proxy.\n2. Stop the proxy service:\nspacewalk-proxy stop\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Start the Spacewalk service:\nspacewalk-proxy start\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SUSE-Manager-Proxy-3.1-2017-1387",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2017_2266-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2017:2266-1",
        "url": "https://www.suse.com/support/update/announcement/2017/suse-su-20172266-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2017:2266-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2017-August/003161.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1031143",
        "url": "https://bugzilla.suse.com/1031143"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1032324",
        "url": "https://bugzilla.suse.com/1032324"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1036260",
        "url": "https://bugzilla.suse.com/1036260"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1038321",
        "url": "https://bugzilla.suse.com/1038321"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1039913",
        "url": "https://bugzilla.suse.com/1039913"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1043831",
        "url": "https://bugzilla.suse.com/1043831"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1047282",
        "url": "https://bugzilla.suse.com/1047282"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1047513",
        "url": "https://bugzilla.suse.com/1047513"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1049936",
        "url": "https://bugzilla.suse.com/1049936"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1052039",
        "url": "https://bugzilla.suse.com/1052039"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-10807 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-10807/"
      }
    ],
    "title": "Security update for SUSE Manager Proxy 3.1",
    "tracking": {
      "current_release_date": "2017-08-25T11:42:12Z",
      "generator": {
        "date": "2017-08-25T11:42:12Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2017:2266-1",
      "initial_release_date": "2017-08-25T11:42:12Z",
      "revision_history": [
        {
          "date": "2017-08-25T11:42:12Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "osa-common-5.11.80.3-2.3.1.noarch",
                "product": {
                  "name": "osa-common-5.11.80.3-2.3.1.noarch",
                  "product_id": "osa-common-5.11.80.3-2.3.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "osad-5.11.80.3-2.3.1.noarch",
                "product": {
                  "name": "osad-5.11.80.3-2.3.1.noarch",
                  "product_id": "osad-5.11.80.3-2.3.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "rhnpush-5.5.104.3-2.3.2.noarch",
                "product": {
                  "name": "rhnpush-5.5.104.3-2.3.2.noarch",
                  "product_id": "rhnpush-5.5.104.3-2.3.2.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "spacewalk-backend-2.7.73.7-2.3.1.noarch",
                "product": {
                  "name": "spacewalk-backend-2.7.73.7-2.3.1.noarch",
                  "product_id": "spacewalk-backend-2.7.73.7-2.3.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "spacewalk-backend-libs-2.7.73.7-2.3.1.noarch",
                "product": {
                  "name": "spacewalk-backend-libs-2.7.73.7-2.3.1.noarch",
                  "product_id": "spacewalk-backend-libs-2.7.73.7-2.3.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "spacewalk-base-minimal-2.7.1.10-2.3.1.noarch",
                "product": {
                  "name": "spacewalk-base-minimal-2.7.1.10-2.3.1.noarch",
                  "product_id": "spacewalk-base-minimal-2.7.1.10-2.3.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "spacewalk-base-minimal-config-2.7.1.10-2.3.1.noarch",
                "product": {
                  "name": "spacewalk-base-minimal-config-2.7.1.10-2.3.1.noarch",
                  "product_id": "spacewalk-base-minimal-config-2.7.1.10-2.3.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "spacewalk-certs-tools-2.7.0.7-2.3.1.noarch",
                "product": {
                  "name": "spacewalk-certs-tools-2.7.0.7-2.3.1.noarch",
                  "product_id": "spacewalk-certs-tools-2.7.0.7-2.3.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "spacewalk-proxy-broker-2.7.1.4-2.3.1.noarch",
                "product": {
                  "name": "spacewalk-proxy-broker-2.7.1.4-2.3.1.noarch",
                  "product_id": "spacewalk-proxy-broker-2.7.1.4-2.3.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "spacewalk-proxy-common-2.7.1.4-2.3.1.noarch",
                "product": {
                  "name": "spacewalk-proxy-common-2.7.1.4-2.3.1.noarch",
                  "product_id": "spacewalk-proxy-common-2.7.1.4-2.3.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "spacewalk-proxy-management-2.7.1.4-2.3.1.noarch",
                "product": {
                  "name": "spacewalk-proxy-management-2.7.1.4-2.3.1.noarch",
                  "product_id": "spacewalk-proxy-management-2.7.1.4-2.3.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "spacewalk-proxy-package-manager-2.7.1.4-2.3.1.noarch",
                "product": {
                  "name": "spacewalk-proxy-package-manager-2.7.1.4-2.3.1.noarch",
                  "product_id": "spacewalk-proxy-package-manager-2.7.1.4-2.3.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "spacewalk-proxy-redirect-2.7.1.4-2.3.1.noarch",
                "product": {
                  "name": "spacewalk-proxy-redirect-2.7.1.4-2.3.1.noarch",
                  "product_id": "spacewalk-proxy-redirect-2.7.1.4-2.3.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "spacewalk-proxy-salt-2.7.1.4-2.3.1.noarch",
                "product": {
                  "name": "spacewalk-proxy-salt-2.7.1.4-2.3.1.noarch",
                  "product_id": "spacewalk-proxy-salt-2.7.1.4-2.3.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "supportutils-plugin-susemanager-client-3.1.2-2.3.1.noarch",
                "product": {
                  "name": "supportutils-plugin-susemanager-client-3.1.2-2.3.1.noarch",
                  "product_id": "supportutils-plugin-susemanager-client-3.1.2-2.3.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jabberd-2.6.1-3.3.1.ppc64le",
                "product": {
                  "name": "jabberd-2.6.1-3.3.1.ppc64le",
                  "product_id": "jabberd-2.6.1-3.3.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "jabberd-db-2.6.1-3.3.1.ppc64le",
                "product": {
                  "name": "jabberd-db-2.6.1-3.3.1.ppc64le",
                  "product_id": "jabberd-db-2.6.1-3.3.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "jabberd-sqlite-2.6.1-3.3.1.ppc64le",
                "product": {
                  "name": "jabberd-sqlite-2.6.1-3.3.1.ppc64le",
                  "product_id": "jabberd-sqlite-2.6.1-3.3.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "spacewalksd-5.0.26.3-2.3.1.ppc64le",
                "product": {
                  "name": "spacewalksd-5.0.26.3-2.3.1.ppc64le",
                  "product_id": "spacewalksd-5.0.26.3-2.3.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "zypp-plugin-spacewalk-0.9.16-2.3.1.ppc64le",
                "product": {
                  "name": "zypp-plugin-spacewalk-0.9.16-2.3.1.ppc64le",
                  "product_id": "zypp-plugin-spacewalk-0.9.16-2.3.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jabberd-2.6.1-3.3.1.x86_64",
                "product": {
                  "name": "jabberd-2.6.1-3.3.1.x86_64",
                  "product_id": "jabberd-2.6.1-3.3.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "jabberd-db-2.6.1-3.3.1.x86_64",
                "product": {
                  "name": "jabberd-db-2.6.1-3.3.1.x86_64",
                  "product_id": "jabberd-db-2.6.1-3.3.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "jabberd-sqlite-2.6.1-3.3.1.x86_64",
                "product": {
                  "name": "jabberd-sqlite-2.6.1-3.3.1.x86_64",
                  "product_id": "jabberd-sqlite-2.6.1-3.3.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "spacewalksd-5.0.26.3-2.3.1.x86_64",
                "product": {
                  "name": "spacewalksd-5.0.26.3-2.3.1.x86_64",
                  "product_id": "spacewalksd-5.0.26.3-2.3.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "zypp-plugin-spacewalk-0.9.16-2.3.1.x86_64",
                "product": {
                  "name": "zypp-plugin-spacewalk-0.9.16-2.3.1.x86_64",
                  "product_id": "zypp-plugin-spacewalk-0.9.16-2.3.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Manager Proxy 3.1",
                "product": {
                  "name": "SUSE Manager Proxy 3.1",
                  "product_id": "SUSE Manager Proxy 3.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:suse-manager-proxy:3.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jabberd-2.6.1-3.3.1.ppc64le as component of SUSE Manager Proxy 3.1",
          "product_id": "SUSE Manager Proxy 3.1:jabberd-2.6.1-3.3.1.ppc64le"
        },
        "product_reference": "jabberd-2.6.1-3.3.1.ppc64le",
        "relates_to_product_reference": "SUSE Manager Proxy 3.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jabberd-2.6.1-3.3.1.x86_64 as component of SUSE Manager Proxy 3.1",
          "product_id": "SUSE Manager Proxy 3.1:jabberd-2.6.1-3.3.1.x86_64"
        },
        "product_reference": "jabberd-2.6.1-3.3.1.x86_64",
        "relates_to_product_reference": "SUSE Manager Proxy 3.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jabberd-db-2.6.1-3.3.1.ppc64le as component of SUSE Manager Proxy 3.1",
          "product_id": "SUSE Manager Proxy 3.1:jabberd-db-2.6.1-3.3.1.ppc64le"
        },
        "product_reference": "jabberd-db-2.6.1-3.3.1.ppc64le",
        "relates_to_product_reference": "SUSE Manager Proxy 3.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jabberd-db-2.6.1-3.3.1.x86_64 as component of SUSE Manager Proxy 3.1",
          "product_id": "SUSE Manager Proxy 3.1:jabberd-db-2.6.1-3.3.1.x86_64"
        },
        "product_reference": "jabberd-db-2.6.1-3.3.1.x86_64",
        "relates_to_product_reference": "SUSE Manager Proxy 3.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jabberd-sqlite-2.6.1-3.3.1.ppc64le as component of SUSE Manager Proxy 3.1",
          "product_id": "SUSE Manager Proxy 3.1:jabberd-sqlite-2.6.1-3.3.1.ppc64le"
        },
        "product_reference": "jabberd-sqlite-2.6.1-3.3.1.ppc64le",
        "relates_to_product_reference": "SUSE Manager Proxy 3.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jabberd-sqlite-2.6.1-3.3.1.x86_64 as component of SUSE Manager Proxy 3.1",
          "product_id": "SUSE Manager Proxy 3.1:jabberd-sqlite-2.6.1-3.3.1.x86_64"
        },
        "product_reference": "jabberd-sqlite-2.6.1-3.3.1.x86_64",
        "relates_to_product_reference": "SUSE Manager Proxy 3.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osa-common-5.11.80.3-2.3.1.noarch as component of SUSE Manager Proxy 3.1",
          "product_id": "SUSE Manager Proxy 3.1:osa-common-5.11.80.3-2.3.1.noarch"
        },
        "product_reference": "osa-common-5.11.80.3-2.3.1.noarch",
        "relates_to_product_reference": "SUSE Manager Proxy 3.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osad-5.11.80.3-2.3.1.noarch as component of SUSE Manager Proxy 3.1",
          "product_id": "SUSE Manager Proxy 3.1:osad-5.11.80.3-2.3.1.noarch"
        },
        "product_reference": "osad-5.11.80.3-2.3.1.noarch",
        "relates_to_product_reference": "SUSE Manager Proxy 3.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhnpush-5.5.104.3-2.3.2.noarch as component of SUSE Manager Proxy 3.1",
          "product_id": "SUSE Manager Proxy 3.1:rhnpush-5.5.104.3-2.3.2.noarch"
        },
        "product_reference": "rhnpush-5.5.104.3-2.3.2.noarch",
        "relates_to_product_reference": "SUSE Manager Proxy 3.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "spacewalk-backend-2.7.73.7-2.3.1.noarch as component of SUSE Manager Proxy 3.1",
          "product_id": "SUSE Manager Proxy 3.1:spacewalk-backend-2.7.73.7-2.3.1.noarch"
        },
        "product_reference": "spacewalk-backend-2.7.73.7-2.3.1.noarch",
        "relates_to_product_reference": "SUSE Manager Proxy 3.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "spacewalk-backend-libs-2.7.73.7-2.3.1.noarch as component of SUSE Manager Proxy 3.1",
          "product_id": "SUSE Manager Proxy 3.1:spacewalk-backend-libs-2.7.73.7-2.3.1.noarch"
        },
        "product_reference": "spacewalk-backend-libs-2.7.73.7-2.3.1.noarch",
        "relates_to_product_reference": "SUSE Manager Proxy 3.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "spacewalk-base-minimal-2.7.1.10-2.3.1.noarch as component of SUSE Manager Proxy 3.1",
          "product_id": "SUSE Manager Proxy 3.1:spacewalk-base-minimal-2.7.1.10-2.3.1.noarch"
        },
        "product_reference": "spacewalk-base-minimal-2.7.1.10-2.3.1.noarch",
        "relates_to_product_reference": "SUSE Manager Proxy 3.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "spacewalk-base-minimal-config-2.7.1.10-2.3.1.noarch as component of SUSE Manager Proxy 3.1",
          "product_id": "SUSE Manager Proxy 3.1:spacewalk-base-minimal-config-2.7.1.10-2.3.1.noarch"
        },
        "product_reference": "spacewalk-base-minimal-config-2.7.1.10-2.3.1.noarch",
        "relates_to_product_reference": "SUSE Manager Proxy 3.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "spacewalk-certs-tools-2.7.0.7-2.3.1.noarch as component of SUSE Manager Proxy 3.1",
          "product_id": "SUSE Manager Proxy 3.1:spacewalk-certs-tools-2.7.0.7-2.3.1.noarch"
        },
        "product_reference": "spacewalk-certs-tools-2.7.0.7-2.3.1.noarch",
        "relates_to_product_reference": "SUSE Manager Proxy 3.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "spacewalk-proxy-broker-2.7.1.4-2.3.1.noarch as component of SUSE Manager Proxy 3.1",
          "product_id": "SUSE Manager Proxy 3.1:spacewalk-proxy-broker-2.7.1.4-2.3.1.noarch"
        },
        "product_reference": "spacewalk-proxy-broker-2.7.1.4-2.3.1.noarch",
        "relates_to_product_reference": "SUSE Manager Proxy 3.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "spacewalk-proxy-common-2.7.1.4-2.3.1.noarch as component of SUSE Manager Proxy 3.1",
          "product_id": "SUSE Manager Proxy 3.1:spacewalk-proxy-common-2.7.1.4-2.3.1.noarch"
        },
        "product_reference": "spacewalk-proxy-common-2.7.1.4-2.3.1.noarch",
        "relates_to_product_reference": "SUSE Manager Proxy 3.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "spacewalk-proxy-management-2.7.1.4-2.3.1.noarch as component of SUSE Manager Proxy 3.1",
          "product_id": "SUSE Manager Proxy 3.1:spacewalk-proxy-management-2.7.1.4-2.3.1.noarch"
        },
        "product_reference": "spacewalk-proxy-management-2.7.1.4-2.3.1.noarch",
        "relates_to_product_reference": "SUSE Manager Proxy 3.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "spacewalk-proxy-package-manager-2.7.1.4-2.3.1.noarch as component of SUSE Manager Proxy 3.1",
          "product_id": "SUSE Manager Proxy 3.1:spacewalk-proxy-package-manager-2.7.1.4-2.3.1.noarch"
        },
        "product_reference": "spacewalk-proxy-package-manager-2.7.1.4-2.3.1.noarch",
        "relates_to_product_reference": "SUSE Manager Proxy 3.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "spacewalk-proxy-redirect-2.7.1.4-2.3.1.noarch as component of SUSE Manager Proxy 3.1",
          "product_id": "SUSE Manager Proxy 3.1:spacewalk-proxy-redirect-2.7.1.4-2.3.1.noarch"
        },
        "product_reference": "spacewalk-proxy-redirect-2.7.1.4-2.3.1.noarch",
        "relates_to_product_reference": "SUSE Manager Proxy 3.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "spacewalk-proxy-salt-2.7.1.4-2.3.1.noarch as component of SUSE Manager Proxy 3.1",
          "product_id": "SUSE Manager Proxy 3.1:spacewalk-proxy-salt-2.7.1.4-2.3.1.noarch"
        },
        "product_reference": "spacewalk-proxy-salt-2.7.1.4-2.3.1.noarch",
        "relates_to_product_reference": "SUSE Manager Proxy 3.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "spacewalksd-5.0.26.3-2.3.1.ppc64le as component of SUSE Manager Proxy 3.1",
          "product_id": "SUSE Manager Proxy 3.1:spacewalksd-5.0.26.3-2.3.1.ppc64le"
        },
        "product_reference": "spacewalksd-5.0.26.3-2.3.1.ppc64le",
        "relates_to_product_reference": "SUSE Manager Proxy 3.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "spacewalksd-5.0.26.3-2.3.1.x86_64 as component of SUSE Manager Proxy 3.1",
          "product_id": "SUSE Manager Proxy 3.1:spacewalksd-5.0.26.3-2.3.1.x86_64"
        },
        "product_reference": "spacewalksd-5.0.26.3-2.3.1.x86_64",
        "relates_to_product_reference": "SUSE Manager Proxy 3.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "supportutils-plugin-susemanager-client-3.1.2-2.3.1.noarch as component of SUSE Manager Proxy 3.1",
          "product_id": "SUSE Manager Proxy 3.1:supportutils-plugin-susemanager-client-3.1.2-2.3.1.noarch"
        },
        "product_reference": "supportutils-plugin-susemanager-client-3.1.2-2.3.1.noarch",
        "relates_to_product_reference": "SUSE Manager Proxy 3.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "zypp-plugin-spacewalk-0.9.16-2.3.1.ppc64le as component of SUSE Manager Proxy 3.1",
          "product_id": "SUSE Manager Proxy 3.1:zypp-plugin-spacewalk-0.9.16-2.3.1.ppc64le"
        },
        "product_reference": "zypp-plugin-spacewalk-0.9.16-2.3.1.ppc64le",
        "relates_to_product_reference": "SUSE Manager Proxy 3.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "zypp-plugin-spacewalk-0.9.16-2.3.1.x86_64 as component of SUSE Manager Proxy 3.1",
          "product_id": "SUSE Manager Proxy 3.1:zypp-plugin-spacewalk-0.9.16-2.3.1.x86_64"
        },
        "product_reference": "zypp-plugin-spacewalk-0.9.16-2.3.1.x86_64",
        "relates_to_product_reference": "SUSE Manager Proxy 3.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2017-10807",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-10807"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "JabberD 2.x (aka jabberd2) before 2.6.1 allows anyone to authenticate using SASL ANONYMOUS, even when the sasl.anonymous c2s.xml option is not enabled.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Manager Proxy 3.1:jabberd-2.6.1-3.3.1.ppc64le",
          "SUSE Manager Proxy 3.1:jabberd-2.6.1-3.3.1.x86_64",
          "SUSE Manager Proxy 3.1:jabberd-db-2.6.1-3.3.1.ppc64le",
          "SUSE Manager Proxy 3.1:jabberd-db-2.6.1-3.3.1.x86_64",
          "SUSE Manager Proxy 3.1:jabberd-sqlite-2.6.1-3.3.1.ppc64le",
          "SUSE Manager Proxy 3.1:jabberd-sqlite-2.6.1-3.3.1.x86_64",
          "SUSE Manager Proxy 3.1:osa-common-5.11.80.3-2.3.1.noarch",
          "SUSE Manager Proxy 3.1:osad-5.11.80.3-2.3.1.noarch",
          "SUSE Manager Proxy 3.1:rhnpush-5.5.104.3-2.3.2.noarch",
          "SUSE Manager Proxy 3.1:spacewalk-backend-2.7.73.7-2.3.1.noarch",
          "SUSE Manager Proxy 3.1:spacewalk-backend-libs-2.7.73.7-2.3.1.noarch",
          "SUSE Manager Proxy 3.1:spacewalk-base-minimal-2.7.1.10-2.3.1.noarch",
          "SUSE Manager Proxy 3.1:spacewalk-base-minimal-config-2.7.1.10-2.3.1.noarch",
          "SUSE Manager Proxy 3.1:spacewalk-certs-tools-2.7.0.7-2.3.1.noarch",
          "SUSE Manager Proxy 3.1:spacewalk-proxy-broker-2.7.1.4-2.3.1.noarch",
          "SUSE Manager Proxy 3.1:spacewalk-proxy-common-2.7.1.4-2.3.1.noarch",
          "SUSE Manager Proxy 3.1:spacewalk-proxy-management-2.7.1.4-2.3.1.noarch",
          "SUSE Manager Proxy 3.1:spacewalk-proxy-package-manager-2.7.1.4-2.3.1.noarch",
          "SUSE Manager Proxy 3.1:spacewalk-proxy-redirect-2.7.1.4-2.3.1.noarch",
          "SUSE Manager Proxy 3.1:spacewalk-proxy-salt-2.7.1.4-2.3.1.noarch",
          "SUSE Manager Proxy 3.1:spacewalksd-5.0.26.3-2.3.1.ppc64le",
          "SUSE Manager Proxy 3.1:spacewalksd-5.0.26.3-2.3.1.x86_64",
          "SUSE Manager Proxy 3.1:supportutils-plugin-susemanager-client-3.1.2-2.3.1.noarch",
          "SUSE Manager Proxy 3.1:zypp-plugin-spacewalk-0.9.16-2.3.1.ppc64le",
          "SUSE Manager Proxy 3.1:zypp-plugin-spacewalk-0.9.16-2.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-10807",
          "url": "https://www.suse.com/security/cve/CVE-2017-10807"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1047282 for CVE-2017-10807",
          "url": "https://bugzilla.suse.com/1047282"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Manager Proxy 3.1:jabberd-2.6.1-3.3.1.ppc64le",
            "SUSE Manager Proxy 3.1:jabberd-2.6.1-3.3.1.x86_64",
            "SUSE Manager Proxy 3.1:jabberd-db-2.6.1-3.3.1.ppc64le",
            "SUSE Manager Proxy 3.1:jabberd-db-2.6.1-3.3.1.x86_64",
            "SUSE Manager Proxy 3.1:jabberd-sqlite-2.6.1-3.3.1.ppc64le",
            "SUSE Manager Proxy 3.1:jabberd-sqlite-2.6.1-3.3.1.x86_64",
            "SUSE Manager Proxy 3.1:osa-common-5.11.80.3-2.3.1.noarch",
            "SUSE Manager Proxy 3.1:osad-5.11.80.3-2.3.1.noarch",
            "SUSE Manager Proxy 3.1:rhnpush-5.5.104.3-2.3.2.noarch",
            "SUSE Manager Proxy 3.1:spacewalk-backend-2.7.73.7-2.3.1.noarch",
            "SUSE Manager Proxy 3.1:spacewalk-backend-libs-2.7.73.7-2.3.1.noarch",
            "SUSE Manager Proxy 3.1:spacewalk-base-minimal-2.7.1.10-2.3.1.noarch",
            "SUSE Manager Proxy 3.1:spacewalk-base-minimal-config-2.7.1.10-2.3.1.noarch",
            "SUSE Manager Proxy 3.1:spacewalk-certs-tools-2.7.0.7-2.3.1.noarch",
            "SUSE Manager Proxy 3.1:spacewalk-proxy-broker-2.7.1.4-2.3.1.noarch",
            "SUSE Manager Proxy 3.1:spacewalk-proxy-common-2.7.1.4-2.3.1.noarch",
            "SUSE Manager Proxy 3.1:spacewalk-proxy-management-2.7.1.4-2.3.1.noarch",
            "SUSE Manager Proxy 3.1:spacewalk-proxy-package-manager-2.7.1.4-2.3.1.noarch",
            "SUSE Manager Proxy 3.1:spacewalk-proxy-redirect-2.7.1.4-2.3.1.noarch",
            "SUSE Manager Proxy 3.1:spacewalk-proxy-salt-2.7.1.4-2.3.1.noarch",
            "SUSE Manager Proxy 3.1:spacewalksd-5.0.26.3-2.3.1.ppc64le",
            "SUSE Manager Proxy 3.1:spacewalksd-5.0.26.3-2.3.1.x86_64",
            "SUSE Manager Proxy 3.1:supportutils-plugin-susemanager-client-3.1.2-2.3.1.noarch",
            "SUSE Manager Proxy 3.1:zypp-plugin-spacewalk-0.9.16-2.3.1.ppc64le",
            "SUSE Manager Proxy 3.1:zypp-plugin-spacewalk-0.9.16-2.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Manager Proxy 3.1:jabberd-2.6.1-3.3.1.ppc64le",
            "SUSE Manager Proxy 3.1:jabberd-2.6.1-3.3.1.x86_64",
            "SUSE Manager Proxy 3.1:jabberd-db-2.6.1-3.3.1.ppc64le",
            "SUSE Manager Proxy 3.1:jabberd-db-2.6.1-3.3.1.x86_64",
            "SUSE Manager Proxy 3.1:jabberd-sqlite-2.6.1-3.3.1.ppc64le",
            "SUSE Manager Proxy 3.1:jabberd-sqlite-2.6.1-3.3.1.x86_64",
            "SUSE Manager Proxy 3.1:osa-common-5.11.80.3-2.3.1.noarch",
            "SUSE Manager Proxy 3.1:osad-5.11.80.3-2.3.1.noarch",
            "SUSE Manager Proxy 3.1:rhnpush-5.5.104.3-2.3.2.noarch",
            "SUSE Manager Proxy 3.1:spacewalk-backend-2.7.73.7-2.3.1.noarch",
            "SUSE Manager Proxy 3.1:spacewalk-backend-libs-2.7.73.7-2.3.1.noarch",
            "SUSE Manager Proxy 3.1:spacewalk-base-minimal-2.7.1.10-2.3.1.noarch",
            "SUSE Manager Proxy 3.1:spacewalk-base-minimal-config-2.7.1.10-2.3.1.noarch",
            "SUSE Manager Proxy 3.1:spacewalk-certs-tools-2.7.0.7-2.3.1.noarch",
            "SUSE Manager Proxy 3.1:spacewalk-proxy-broker-2.7.1.4-2.3.1.noarch",
            "SUSE Manager Proxy 3.1:spacewalk-proxy-common-2.7.1.4-2.3.1.noarch",
            "SUSE Manager Proxy 3.1:spacewalk-proxy-management-2.7.1.4-2.3.1.noarch",
            "SUSE Manager Proxy 3.1:spacewalk-proxy-package-manager-2.7.1.4-2.3.1.noarch",
            "SUSE Manager Proxy 3.1:spacewalk-proxy-redirect-2.7.1.4-2.3.1.noarch",
            "SUSE Manager Proxy 3.1:spacewalk-proxy-salt-2.7.1.4-2.3.1.noarch",
            "SUSE Manager Proxy 3.1:spacewalksd-5.0.26.3-2.3.1.ppc64le",
            "SUSE Manager Proxy 3.1:spacewalksd-5.0.26.3-2.3.1.x86_64",
            "SUSE Manager Proxy 3.1:supportutils-plugin-susemanager-client-3.1.2-2.3.1.noarch",
            "SUSE Manager Proxy 3.1:zypp-plugin-spacewalk-0.9.16-2.3.1.ppc64le",
            "SUSE Manager Proxy 3.1:zypp-plugin-spacewalk-0.9.16-2.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-08-25T11:42:12Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-10807"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.