rpm package
suse/release-notes-susemanager-proxy&distro=SUSE Manager Proxy 4.3
pkg:rpm/suse/release-notes-susemanager-proxy&distro=SUSE%20Manager%20Proxy%204.3
Vulnerabilities (33)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2024-22232 | Hig | 7.7 | < 4.3.11-150400.3.79.1 | 4.3.11-150400.3.79.1 | Jun 27, 2024 | A specially crafted url can be created which leads to a directory traversal in the salt file server. A malicious user can read an arbitrary file from a Salt master’s filesystem. | |
| CVE-2024-22231 | Med | 5.0 | < 4.3.11-150400.3.79.1 | 4.3.11-150400.3.79.1 | Jun 27, 2024 | Syndic cache directory creation is vulnerable to a directory traversal attack in salt project which can lead a malicious attacker to create an arbitrary directory on a Salt master. | |
| CVE-2023-51775 | — | < 4.3.12-150400.3.82.3 | 4.3.12-150400.3.82.3 | Dec 25, 2023 | The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value. | ||
| CVE-2023-22644 | — | < 4.3.6-150400.3.55.4 | 4.3.6-150400.3.55.4 | Sep 20, 2023 | A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE. | ||
| CVE-2023-20898 | — | < 4.3.8-150400.3.61.2 | 4.3.8-150400.3.61.2 | Sep 5, 2023 | Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environments can get garbage data or the wrong data, which can lead to wrongful data di | ||
| CVE-2023-20897 | — | < 4.3.8-150400.3.61.2 | 4.3.8-150400.3.61.2 | Sep 5, 2023 | Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted. | ||
| CVE-2023-29409 | — | < 4.3.8-150400.3.61.2 | 4.3.8-150400.3.61.2 | Aug 2, 2023 | Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA keys, there are curr | ||
| CVE-2022-46146 | — | < 4.3.6-150400.3.55.4 | 4.3.6-150400.3.55.4 | Nov 29, 2022 | Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0. | ||
| CVE-2022-31129 | — | < 4.3.2-150400.3.9.3 | 4.3.2-150400.3.9.3 | Jul 6, 2022 | moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried | ||
| CVE-2021-41411 | — | < 4.3.2-150400.3.9.3 | 4.3.2-150400.3.9.3 | Jun 16, 2022 | drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability. | ||
| CVE-2021-43138 | — | < 4.3.2-150400.3.9.3 | 4.3.2-150400.3.9.3 | Apr 6, 2022 | In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution. | ||
| CVE-2022-0860 | — | < 4.3.2-150400.3.9.3 | 4.3.2-150400.3.9.3 | Mar 11, 2022 | Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2. | ||
| CVE-2021-42740 | — | < 4.3.2-150400.3.9.3 | 4.3.2-150400.3.9.3 | Oct 21, 2021 | The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command wi |
- affected < 4.3.11-150400.3.79.1fixed 4.3.11-150400.3.79.1
A specially crafted url can be created which leads to a directory traversal in the salt file server. A malicious user can read an arbitrary file from a Salt master’s filesystem.
- affected < 4.3.11-150400.3.79.1fixed 4.3.11-150400.3.79.1
Syndic cache directory creation is vulnerable to a directory traversal attack in salt project which can lead a malicious attacker to create an arbitrary directory on a Salt master.
- CVE-2023-51775Dec 25, 2023affected < 4.3.12-150400.3.82.3fixed 4.3.12-150400.3.82.3
The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.
- CVE-2023-22644Sep 20, 2023affected < 4.3.6-150400.3.55.4fixed 4.3.6-150400.3.55.4
A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE.
- CVE-2023-20898Sep 5, 2023affected < 4.3.8-150400.3.61.2fixed 4.3.8-150400.3.61.2
Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environments can get garbage data or the wrong data, which can lead to wrongful data di
- CVE-2023-20897Sep 5, 2023affected < 4.3.8-150400.3.61.2fixed 4.3.8-150400.3.61.2
Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted.
- CVE-2023-29409Aug 2, 2023affected < 4.3.8-150400.3.61.2fixed 4.3.8-150400.3.61.2
Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA keys, there are curr
- CVE-2022-46146Nov 29, 2022affected < 4.3.6-150400.3.55.4fixed 4.3.6-150400.3.55.4
Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.
- CVE-2022-31129Jul 6, 2022affected < 4.3.2-150400.3.9.3fixed 4.3.2-150400.3.9.3
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried
- CVE-2021-41411Jun 16, 2022affected < 4.3.2-150400.3.9.3fixed 4.3.2-150400.3.9.3
drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.
- CVE-2021-43138Apr 6, 2022affected < 4.3.2-150400.3.9.3fixed 4.3.2-150400.3.9.3
In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.
- CVE-2022-0860Mar 11, 2022affected < 4.3.2-150400.3.9.3fixed 4.3.2-150400.3.9.3
Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2.
- CVE-2021-42740Oct 21, 2021affected < 4.3.2-150400.3.9.3fixed 4.3.2-150400.3.9.3
The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command wi
Page 2 of 2