rpm package
suse/susemanager-sync-data&distro=SUSE Manager Server Module 4.2
pkg:rpm/suse/susemanager-sync-data&distro=SUSE%20Manager%20Server%20Module%204.2
Vulnerabilities (8)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2022-31248 | — | < 4.2.12-150300.3.18.3 | 4.2.12-150300.3.18.3 | Jun 22, 2022 | A Observable Response Discrepancy vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to discover valid usernames. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46-1. SUSE Manager Server 4. | ||
| CVE-2022-21952 | — | < 4.2.12-150300.3.18.3 | 4.2.12-150300.3.18.3 | Jun 22, 2022 | A Missing Authentication for Critical Function vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to easily exhaust available disk resources leading to DoS. This issue affects: SUSE Manager Server 4.1 spacewalk-java version | ||
| CVE-2021-44906 | — | < 4.2.12-150300.3.18.3 | 4.2.12-150300.3.18.3 | Mar 17, 2022 | Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95). | ||
| CVE-2021-40348 | — | < 4.2.9-3.9.1 | 4.2.9-3.9.1 | Nov 1, 2021 | Spacewalk 2.10, and derivatives such as Uyuni 2021.08, allows code injection. rhn-config-satellite.pl doesn't sanitize the configuration filename used to append Spacewalk-specific key-value pair. The script is intended to be run by the tomcat user account with Sudo, according to | ||
| CVE-2021-40325 | — | < 4.2.8-3.6.1 | 4.2.8-3.6.1 | Oct 4, 2021 | Cobbler before 3.3.0 allows authorization bypass for modification of settings. | ||
| CVE-2021-40324 | — | < 4.2.8-3.6.1 | 4.2.8-3.6.1 | Oct 4, 2021 | Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data. | ||
| CVE-2021-40323 | — | < 4.2.8-3.6.1 | 4.2.8-3.6.1 | Oct 4, 2021 | Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection. | ||
| CVE-2021-21996 | — | < 4.2.9-3.9.1 | 4.2.9-3.9.1 | Sep 8, 2021 | An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and source_hash URLs can gain full file system access as root on a salt minion. |
- CVE-2022-31248Jun 22, 2022affected < 4.2.12-150300.3.18.3fixed 4.2.12-150300.3.18.3
A Observable Response Discrepancy vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to discover valid usernames. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46-1. SUSE Manager Server 4.
- CVE-2022-21952Jun 22, 2022affected < 4.2.12-150300.3.18.3fixed 4.2.12-150300.3.18.3
A Missing Authentication for Critical Function vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to easily exhaust available disk resources leading to DoS. This issue affects: SUSE Manager Server 4.1 spacewalk-java version
- CVE-2021-44906Mar 17, 2022affected < 4.2.12-150300.3.18.3fixed 4.2.12-150300.3.18.3
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
- CVE-2021-40348Nov 1, 2021affected < 4.2.9-3.9.1fixed 4.2.9-3.9.1
Spacewalk 2.10, and derivatives such as Uyuni 2021.08, allows code injection. rhn-config-satellite.pl doesn't sanitize the configuration filename used to append Spacewalk-specific key-value pair. The script is intended to be run by the tomcat user account with Sudo, according to
- CVE-2021-40325Oct 4, 2021affected < 4.2.8-3.6.1fixed 4.2.8-3.6.1
Cobbler before 3.3.0 allows authorization bypass for modification of settings.
- CVE-2021-40324Oct 4, 2021affected < 4.2.8-3.6.1fixed 4.2.8-3.6.1
Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.
- CVE-2021-40323Oct 4, 2021affected < 4.2.8-3.6.1fixed 4.2.8-3.6.1
Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.
- CVE-2021-21996Sep 8, 2021affected < 4.2.9-3.9.1fixed 4.2.9-3.9.1
An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and source_hash URLs can gain full file system access as root on a salt minion.