Security update for smt
Announcement ID: | SUSE-SU-2018:2899-1 |
---|---|
Rating: | important |
References: | |
Cross-References: | |
CVSS scores: |
|
Affected Products: |
|
An update that solves three vulnerabilities and has two security fixes can now be installed.
Description:
This update for smt to 2.0.34 fixes the following issues:
These security issues were fixed:
- CVE-2018-12471: Xml External Entity processing in the RegistrationSharing modules allowed to read arbitrary file read (bsc#1103809)
- CVE-2018-12470: SQL injection in RegistrationSharing module allows remote attackers to run arbitary SQL statements (bsc#1103810)
- CVE-2018-12472: Authentication bypass in sibling check facilitated further attacks on SMT (bsc#1104076)
SUSE would like to thank Jake Miller for reporting these issues to us.
This non-security issue was fixed:
- More verbose incomplete registration logging (bsc#1072921, bsc#1074608)
Patch Instructions:
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
-
Subscription Management Tool for SUSE Linux Enterprise 11 SP3
zypper in -t patch slesmtsp3-smt-13798=1
Package List:
-
Subscription Management Tool for SUSE Linux Enterprise 11 SP3 (s390x x86_64 i586)
- res-signingkeys-2.0.34-50.8.1
- smt-2.0.34-50.8.1
- smt-support-2.0.34-50.8.1
References:
- https://www.suse.com/security/cve/CVE-2018-12470.html
- https://www.suse.com/security/cve/CVE-2018-12471.html
- https://www.suse.com/security/cve/CVE-2018-12472.html
- https://bugzilla.suse.com/show_bug.cgi?id=1072921
- https://bugzilla.suse.com/show_bug.cgi?id=1074608
- https://bugzilla.suse.com/show_bug.cgi?id=1103809
- https://bugzilla.suse.com/show_bug.cgi?id=1103810
- https://bugzilla.suse.com/show_bug.cgi?id=1104076