Path traversal in Uyuni - CVE-2022-31255

Vulnerability identifier: #VU69062

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-31255

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote user to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences. A remote user  can send a specially crafted HTTP request and read arbitrary files on the system.

Uyuni
SUSE Linux Enterprise Module for SUSE Manager Server
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
inter-server-sync
inter-server-sync-debuginfo
locale-formula
hub-xmlrpc-api
python3-urlgrabber
release-notes-susemanager-proxy
release-notes-susemanager
spacewalk-utils
spacewalk-utils-extras
spacecmd
spacewalk-client-tools
python3-spacewalk-client-tools
susemanager-schema
spacewalk-backend
spacewalk-backend-xmlrpc
spacewalk-backend-xml-export-libs
spacewalk-backend-tools
spacewalk-backend-sql-postgresql
spacewalk-backend-sql
spacewalk-backend-server
spacewalk-backend-package-push-server
spacewalk-backend-iss-export
spacewalk-backend-iss
spacewalk-backend-config-files-tool
spacewalk-backend-config-files-common
spacewalk-backend-config-files
spacewalk-backend-applet
spacewalk-backend-app
susemanager-sls
uyuni-config-modules
spacewalk-base
spacewalk-base-minimal
spacewalk-base-minimal-config
spacewalk-html
susemanager
susemanager-tools
spacewalk-java-lib
spacewalk-java
spacewalk-taskomatic
spacewalk-java-postgresql
spacewalk-java-config
susemanager-docs_en
susemanager-docs_en-pdf
susemanager-doc-indexes
py27-compat-salt

Install update from vendor's website.

Uyuni - update to 2022.10
inter-server-sync - update to 0.2.4-150300.8.25.2
inter-server-sync-debuginfo - update to 0.2.4-150300.8.25.2
locale-formula - update to 0.3-150300.3.3.2
hub-xmlrpc-api - update to 0.7-150300.3.9.2
python3-urlgrabber - update to 3.10.2.1py2_3-150300.3.3.2
release-notes-susemanager-proxy - update to 4.2.10-150300.3.46.1
release-notes-susemanager - update to 4.2.10-150300.3.57.1
spacewalk-utils - update to 4.2.18-150300.3.21.2
spacewalk-utils-extras - update to 4.2.18-150300.3.21.2
spacecmd - update to 4.2.20-150300.4.30.2
spacewalk-client-tools - update to 4.2.21-150300.4.27.3
python3-spacewalk-client-tools - update to 4.2.21-150300.4.27.3
susemanager-schema - update to 4.2.25-150300.3.30.3
spacewalk-backend - update to 4.2.25-150300.4.32.4
spacewalk-backend-xmlrpc - update to 4.2.25-150300.4.32.4
spacewalk-backend-xml-export-libs - update to 4.2.25-150300.4.32.4
spacewalk-backend-tools - update to 4.2.25-150300.4.32.4
spacewalk-backend-sql-postgresql - update to 4.2.25-150300.4.32.4
spacewalk-backend-sql - update to 4.2.25-150300.4.32.4
spacewalk-backend-server - update to 4.2.25-150300.4.32.4
spacewalk-backend-package-push-server - update to 4.2.25-150300.4.32.4
spacewalk-backend-iss-export - update to 4.2.25-150300.4.32.4
spacewalk-backend-iss - update to 4.2.25-150300.4.32.4
spacewalk-backend-config-files-tool - update to 4.2.25-150300.4.32.4
spacewalk-backend-config-files-common - update to 4.2.25-150300.4.32.4
spacewalk-backend-config-files - update to 4.2.25-150300.4.32.4
spacewalk-backend-applet - update to 4.2.25-150300.4.32.4
spacewalk-backend-app - update to 4.2.25-150300.4.32.4
susemanager-sls - update to 4.2.28-150300.3.36.2
uyuni-config-modules - update to 4.2.28-150300.3.36.2
spacewalk-base - update to 4.2.30-150300.3.30.3
spacewalk-base-minimal - update to 4.2.30-150300.3.30.3
spacewalk-base-minimal-config - update to 4.2.30-150300.3.30.3
spacewalk-html - update to 4.2.30-150300.3.30.3
susemanager - update to 4.2.38-150300.3.44.3
susemanager-tools - update to 4.2.38-150300.3.44.3
spacewalk-java-lib - addressed in versions 4.2.43-150300.3.48.2, 4.3.39-150400.3.11.1
spacewalk-java - addressed in versions 4.2.43-150300.3.48.2, 4.3.39-150400.3.11.1
spacewalk-taskomatic - addressed in versions 4.2.43-150300.3.48.2, 4.3.39-150400.3.11.1
spacewalk-java-postgresql - addressed in versions 4.2.43-150300.3.48.2, 4.3.39-150400.3.11.1
spacewalk-java-config - addressed in versions 4.2.43-150300.3.48.2, 4.3.39-150400.3.11.1
susemanager-docs_en - update to 4.2-150300.12.36.2
susemanager-docs_en-pdf - update to 4.2-150300.12.36.2
susemanager-doc-indexes - update to 4.2-150300.12.36.3
py27-compat-salt - update to 3000.3-150300.7.7.26.2

• Exploit #8585 - CVE-2022-31255 (November 7, 2022)

• https://seclists.org/oss-sec/2022/q4/124

• Multiple vulnerabilities in UYUNI
• SUSE update for SUSE Manager Server 4.2
• SUSE update for release-notes-susemanager, release-notes-susemanager-proxy
• SUSE update for spacewalk-java