SUSE update for Security Beta update for SUSE Manager Client Tools

1) Incorrect Regular Expression

EUVDB-ID: #VU65355

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-7753

CWE-ID: CWE-185 - Incorrect Regular Expression

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing regular expressions. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) NULL pointer dereference

EUVDB-ID: #VU55287

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-36222

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5). A remote attacker can send a request containing a PA-ENCRYPTED-CHALLENGE padata element without using FAST and perform a denial of service (DoS) attack.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Buffer overflow

EUVDB-ID: #VU56063

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-3711

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in EVP_PKEY_decrypt() function within implementation of the SM2 decryption. A remote attacker can send specially crafted SM2 content for decryption to trigger a buffer overflow by 62 bytes and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Input validation error

EUVDB-ID: #VU57967

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-3807

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when matching crafted invalid ANSI escape codes in ansi-regex. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Code Injection

EUVDB-ID: #VU64034

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-3918

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient sanitization of user-supplied data during the validation of a JSON object. A remote attacker can pass a specially crafted JSON file for validation and execute arbitrary code.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Improper access control

EUVDB-ID: #VU57320

Risk: Medium

CVSSv3.1: 6.2 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:H/RL:O/RC:C]

CVE-ID: CVE-2021-39226

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: Yes

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions to database snapshots. Remote unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey.

Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

7) Cross-site scripting

EUVDB-ID: #VU57926

Risk: Low

CVSSv3.1: 5.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2021-41174

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: Yes

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

8) Incorrect authorization

EUVDB-ID: #VU64430

Risk: Medium

CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-41244

CWE-ID: CWE-863 - Incorrect Authorization

Exploit availability: No

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to improper access control in fine-grained access control feature. A remote user with an admin role in one organization can list, add, remove, and update users’ roles in other organizations in which he is not an admin.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Prototype pollution

EUVDB-ID: #VU62361

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-43138

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to escalate privileges within the application.

The vulnerability exists due to improper input validation when handling data passed via the mapValues() method. A remote attacker can send a specially crafted request and escalate privileges within the application.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Path traversal

EUVDB-ID: #VU58647

Risk: High

CVSSv3.1: 7.2 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C]

CVE-ID: CVE-2021-43798

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: Yes

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences, passed after the "/public/plugins/" URL. A remote non-authenticated attacker can send a specially crafted HTTP request and read arbitrary files on the system.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

11) Path traversal

EUVDB-ID: #VU64273

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-43813

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Path traversal

EUVDB-ID: #VU64404

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-43815

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

The vulnerability allows a remote user to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing .csv files. A remote user can send a specially crafted HTTP request and read arbitrary files on the system.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Information disclosure

EUVDB-ID: #VU61669

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-0155

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote attacker can gain unauthorized access to sensitive information on the system.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Information disclosure

EUVDB-ID: #VU64402

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-21673

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote user can pass a specially crafted query to the data source with an API token and Forward OAuth Identity feature enabled to gain unauthorized access to sensitive information on the system.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Input validation error

EUVDB-ID: #VU61599

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-21698

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input within method label cardinality. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Cross-site scripting

EUVDB-ID: #VU64397

Risk: Low

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-21702

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in Grafana. A remote attacker can trick the victim to visit a specially crafted link, execute arbitrary HTML code, and perform a Cross-site scripting (XSS) attack.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Cross-site request forgery

EUVDB-ID: #VU64399

Risk: Medium

CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-21703

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

Exploit availability: No

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim into inviting the attacker as a new user with high privileges to escalate privileges.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Authorization bypass through user-controlled key

EUVDB-ID: #VU64394

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-21713

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

Exploit availability: No

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to an Insecure Direct Object Reference (IDOR) error in Grafana Teams APIs. A remote authenticated user can view unintended data by querying for the specific team ID or search for teams and see the total number of available teams.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Stored cross-site scripting

EUVDB-ID: #VU71567

Risk: Low

CVSSv3.1: 4.2 [CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-23552

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user with the Editor role can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Use of a broken or risky cryptographic algorithm

EUVDB-ID: #VU62039

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27191

CWE-ID: CWE-327 - Use of a Broken or Risky Cryptographic Algorithm

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an error in golang.org/x/crypto/ssh before 0.0.0-20220314234659-1baeb1ce4c0b, as used in Go programming language. A remote attacker can crash a server in certain circumstances involving AddHostKey.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Input validation error

EUVDB-ID: #VU67396

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27664

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Input validation error

EUVDB-ID: #VU63461

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-29170

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input when processing HTTP Host header during redirection. A remote attacker can perform spoofing attack.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Stored cross-site scripting

EUVDB-ID: #VU65354

Risk: Low

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-31097

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Improper Authentication

EUVDB-ID: #VU65353

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-31107

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in OAuth implementation routine. A remote attacker can bypass authentication process and login under arbitrary account.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Improper Verification of Cryptographic Signature

EUVDB-ID: #VU72128

Risk: Medium

CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-31123

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

Exploit availability: No

The vulnerability allows a remote attacker to compromise the affected instance.

The vulnerability exists due to missing signature verification mechanism. A remote attacker can trick the server admin into installing a malicious plugin even though unsigned plugins are not allowed.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Information disclosure

EUVDB-ID: #VU72130

Risk: Medium

CVSSv3.1: 4.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-31130

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to the GitLab data source plugin leaks the API key to GitLab. A remote privileged user can expose Grafana authentication token to a third-party.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Resource exhaustion

EUVDB-ID: #VU68897

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-32149

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to ParseAcceptLanguage does not properly control consumption of internal resources. A remote attacker can send a specially crafted Accept-Language header that will take a significant time to parse and perform a denial of service (DoS) attack.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Authentication bypass using an alternate path or channel

EUVDB-ID: #VU68557

Risk: Low

CVSSv3.1: 6.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-35957

CWE-ID: CWE-288 - Authentication Bypass Using an Alternate Path or Channel

Exploit availability: No

The vulnerability allows a remote user to escalate privileges within the application.

The vulnerability exists due to the way Grafana handles authorization process when Auth proxy authentication is used. A remote user with admin privileges can authenticate as Server Admin by providing the username (or email) in a X-WEBAUTH-USER HTTP header.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU67646

Risk: Medium

CVSSv3.1: 5.6 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-36062

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions, which leads to security restrictions bypass and privilege escalation.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Information disclosure

EUVDB-ID: #VU72131

Risk: Medium

CVSSv3.1: 4.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-39201

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to Grafana leaks the authentication cookie of users to plugins. A remote user can gain unauthorized access to sensitive information.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Improper Authentication

EUVDB-ID: #VU72132

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-39229

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

The vulnerability allows a remote attacker to deny access to the application.

The vulnerability exists due to a logic error in the authentication process, where application allows usage of the same email address by different accounts. A remote user can set an existing email address that belongs to another user as their username and prevent that user from accessing the application.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Input validation error

EUVDB-ID: #VU69484

Risk: Medium

CVSSv3.1: 5.6 [CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-39306

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to insufficient validation of user-supplied input. A remote user can use the invitation link to sign up with an arbitrary username/email with a malicious intent.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Information disclosure

EUVDB-ID: #VU69485

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-39307

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application when using the forget password on the login page. A remote attacker can gain unauthorized access to sensitive information on the system.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) Spoofing attack

EUVDB-ID: #VU71566

Risk: Low

CVSSv3.1: 2.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-39324

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

Exploit availability: No

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to usage of a hidden originalUrl parameter in the shared dashboard. A remote attacker can trick the victim into opening a shared snapshot and click on the button in the Grafana web UI, which will redirect user to an attacker-controlled URL.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Resource exhaustion

EUVDB-ID: #VU68390

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-41715

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in regexp/syntax when handling regular expressions. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) Resource exhaustion

EUVDB-ID: #VU72686

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-41723

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in the HPACK decoder. A remote attacker can send a specially crafted HTTP/2 stream to the application, cause resource exhaustion and perform a denial of service (DoS) attack.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

37) Use of Password Hash Instead of Password for Authentication

EUVDB-ID: #VU69691

Risk: Low

CVSSv3.1: 4.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-46146

CWE-ID: CWE-836 - Use of Password Hash Instead of Password for Authentication

Exploit availability: No

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to incorrect implementation of basic authentication. A remote attacker with knowledge of the password hash can authenticate against Prometheus without actual knowledge of the password.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

38) Stored cross-site scripting

EUVDB-ID: #VU75358

Risk: Low

CVSSv3.1: 4.2 [CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-0507

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data within the GeoMap plugin. A remote user with the Editor role can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

39) Stored cross-site scripting

EUVDB-ID: #VU75359

Risk: Low

CVSSv3.1: 4.2 [CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-0594

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in the trace view visualization. A remote user the Editor role can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

40) Information disclosure

EUVDB-ID: #VU77620

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-1387

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to application allows users to login with a JWT token passed in the URL query parameter auth_token. A remote attacker can intercept the query and gain unauthorized access to the application.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

41) Stored cross-site scripting

EUVDB-ID: #VU75360

Risk: Low

CVSSv3.1: 4.2 [CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-1410

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in the Graphite FunctionDescription tooltip. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

42) Missing Authorization

EUVDB-ID: #VU78470

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-2183

CWE-ID: CWE-862 - Missing Authorization

Exploit availability: No

The vulnerability allows a remote user to bypass implemented security restrictions.

The vulnerability exists due to missing authorization in the alerts feature within API. A remote user can use the API to send multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

43) Improper synchronization

EUVDB-ID: #VU77623

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-2801

CWE-ID: CWE-662 - Improper Synchronization

Exploit availability: No

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect synchronization when processing multiple requests. A remote user can query multiple distinct data sources using mixed queries via public dashboard or API and crash Grafana instances.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

44) Improper Authentication

EUVDB-ID: #VU77652

Risk: High

CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-3128

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in Azure AD OAuth implementation. Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. A remote attacker can modify their profile and provide the email address of  an existing Grafana user, bypass authentication process and gain unauthorized access to the application.

The vulnerability affects Grafana installations with Azure AD OAuth configured for a multi-tenant app.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

45) Stored cross-site scripting

EUVDB-ID: #VU79967

Risk: Low

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-40577

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data passed to the /api/v1/alerts endpoint in the Alertmanager UI. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Update the affected package Security Beta update for SUSE Manager Client Tools to the latest version.

SUSE Manager Client Tools Beta for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

supportutils-plugin-susemanager-client: before 5.0.1-9.15.2

mgr-push: before 5.0.1-4.21.4

kiwi-desc-saltboot: before 0.1.1687520761.cefb248-4.15.2

system-user-grafana: before 1.0.0-3.7.2

supportutils-plugin-salt: before 1.2.2-9.9.2

python2-hwdata: before 2.3.5-15.12.2

python2-mgr-push: before 5.0.1-4.21.4

system-user-prometheus: before 1.0.0-3.7.2

python2-rhnlib: before 5.0.1-24.30.3

spacecmd: before 5.0.1-41.42.3

golang-github-prometheus-prometheus: before 2.45.0-4.33.3

golang-github-prometheus-promu: before 0.14.0-4.12.2

prometheus-blackbox_exporter-debuginfo: before 0.24.0-3.6.3

golang-github-QubitProducts-exporter_exporter: before 0.4.0-4.6.2

python2-uyuni-common-libs: before 5.0.1-3.33.3

golang-github-boynux-squid_exporter: before 1.6-4.9.2

golang-github-prometheus-node_exporter: before 1.5.0-4.15.4

prometheus-postgres_exporter: before 0.10.1-3.6.4

golang-github-prometheus-alertmanager: before 0.26.0-4.12.4

grafana: before 9.5.8-4.21.2

golang-github-lusitaniae-apache_exporter: before 1.0.0-4.12.4

prometheus-blackbox_exporter: before 0.24.0-3.6.3

http://www.suse.com/support/update/announcement/2024/suse-su-20240191-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.