rpm package
suse/release-notes-susemanager&distro=SUSE Manager Server 4.3
pkg:rpm/suse/release-notes-susemanager&distro=SUSE%20Manager%20Server%204.3
Vulnerabilities (49)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2023-20898 | — | < 4.3.8-150400.3.77.1 | 4.3.8-150400.3.77.1 | Sep 5, 2023 | Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environments can get garbage data or the wrong data, which can lead to wrongful data di | ||
| CVE-2023-20897 | — | < 4.3.8-150400.3.77.1 | 4.3.8-150400.3.77.1 | Sep 5, 2023 | Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted. | ||
| CVE-2023-29409 | — | < 4.3.8-150400.3.77.1 | 4.3.8-150400.3.77.1 | Aug 2, 2023 | Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA keys, there are curr | ||
| CVE-2022-46146 | — | < 4.3.6-150400.3.63.2 | 4.3.6-150400.3.63.2 | Nov 29, 2022 | Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0. | ||
| CVE-2022-31129 | — | < 4.3.2-150400.3.15.1 | 4.3.2-150400.3.15.1 | Jul 6, 2022 | moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried | ||
| CVE-2021-41411 | — | < 4.3.2-150400.3.15.1 | 4.3.2-150400.3.15.1 | Jun 16, 2022 | drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability. | ||
| CVE-2021-43138 | — | < 4.3.2-150400.3.15.1 | 4.3.2-150400.3.15.1 | Apr 6, 2022 | In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution. | ||
| CVE-2022-0860 | — | < 4.3.2-150400.3.15.1 | 4.3.2-150400.3.15.1 | Mar 11, 2022 | Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2. | ||
| CVE-2021-42740 | — | < 4.3.2-150400.3.15.1 | 4.3.2-150400.3.15.1 | Oct 21, 2021 | The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command wi |
- CVE-2023-20898Sep 5, 2023affected < 4.3.8-150400.3.77.1fixed 4.3.8-150400.3.77.1
Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environments can get garbage data or the wrong data, which can lead to wrongful data di
- CVE-2023-20897Sep 5, 2023affected < 4.3.8-150400.3.77.1fixed 4.3.8-150400.3.77.1
Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted.
- CVE-2023-29409Aug 2, 2023affected < 4.3.8-150400.3.77.1fixed 4.3.8-150400.3.77.1
Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA keys, there are curr
- CVE-2022-46146Nov 29, 2022affected < 4.3.6-150400.3.63.2fixed 4.3.6-150400.3.63.2
Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.
- CVE-2022-31129Jul 6, 2022affected < 4.3.2-150400.3.15.1fixed 4.3.2-150400.3.15.1
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried
- CVE-2021-41411Jun 16, 2022affected < 4.3.2-150400.3.15.1fixed 4.3.2-150400.3.15.1
drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.
- CVE-2021-43138Apr 6, 2022affected < 4.3.2-150400.3.15.1fixed 4.3.2-150400.3.15.1
In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.
- CVE-2022-0860Mar 11, 2022affected < 4.3.2-150400.3.15.1fixed 4.3.2-150400.3.15.1
Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2.
- CVE-2021-42740Oct 21, 2021affected < 4.3.2-150400.3.15.1fixed 4.3.2-150400.3.15.1
The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command wi
Page 3 of 3