{"id":"SUSE-SU-2019:1790-1","summary":"Security update for SUSE Manager Server 3.2","details":"\nThis update fixes the following issues:\n\nrelease-notes-susemanager:\n\n- Fix invalid characters in ncurses mode (bsc#1102770)\n\nspacewalk-backend:\n\n- Fix for CVE-2019-10136. An attacker with a valid, but expired,\n  authenticated set of headers could move some digits around,\n  artificially extending the session validity without modifying\n  the checksum. (bsc#1136480)\n\nspacewalk-web:\n\n- Change WebUI string version to 3.2.9\n\n","modified":"2026-02-04T04:10:59.604867Z","published":"2019-07-09T13:22:02Z","related":["CVE-2019-10136","CVE-2019-10137"],"upstream":["CVE-2019-10136","CVE-2019-10137"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191790-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1102770"},{"type":"REPORT","url":"https://bugzilla.suse.com/1136476"},{"type":"REPORT","url":"https://bugzilla.suse.com/1136480"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2019-10136"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2019-10137"}],"affected":[{"package":{"name":"release-notes-susemanager-proxy","ecosystem":"SUSE:Manager Proxy 3.2","purl":"pkg:rpm/suse/release-notes-susemanager-proxy&distro=SUSE%20Manager%20Proxy%203.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.9-0.16.27.1"}]}],"ecosystem_specific":{"binaries":[{"release-notes-susemanager-proxy":"3.2.9-0.16.27.1","spacewalk-backend":"2.8.57.17-3.33.1","spacewalk-proxy-broker":"2.8.5.6-3.11.1","spacewalk-proxy-management":"2.8.5.6-3.11.1","spacewalk-proxy-package-manager":"2.8.5.6-3.11.1","spacewalk-proxy-salt":"2.8.5.6-3.11.1","susemanager-web-libs":"2.8.7.17-3.30.1","spacewalk-backend-libs":"2.8.57.17-3.33.1","spacewalk-base-minimal-config":"2.8.7.17-3.30.1","spacewalk-base-minimal":"2.8.7.17-3.30.1","spacewalk-proxy-common":"2.8.5.6-3.11.1","spacewalk-proxy-redirect":"2.8.5.6-3.11.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2019:1790-1.json"}},{"package":{"name":"spacewalk-backend","ecosystem":"SUSE:Manager Proxy 3.2","purl":"pkg:rpm/suse/spacewalk-backend&distro=SUSE%20Manager%20Proxy%203.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.57.17-3.33.1"}]}],"ecosystem_specific":{"binaries":[{"release-notes-susemanager-proxy":"3.2.9-0.16.27.1","spacewalk-backend":"2.8.57.17-3.33.1","spacewalk-base-minimal":"2.8.7.17-3.30.1","spacewalk-proxy-common":"2.8.5.6-3.11.1","spacewalk-proxy-management":"2.8.5.6-3.11.1","spacewalk-proxy-package-manager":"2.8.5.6-3.11.1","susemanager-web-libs":"2.8.7.17-3.30.1","spacewalk-backend-libs":"2.8.57.17-3.33.1","spacewalk-base-minimal-config":"2.8.7.17-3.30.1","spacewalk-proxy-broker":"2.8.5.6-3.11.1","spacewalk-proxy-redirect":"2.8.5.6-3.11.1","spacewalk-proxy-salt":"2.8.5.6-3.11.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2019:1790-1.json"}},{"package":{"name":"spacewalk-proxy","ecosystem":"SUSE:Manager Proxy 3.2","purl":"pkg:rpm/suse/spacewalk-proxy&distro=SUSE%20Manager%20Proxy%203.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5.6-3.11.1"}]}],"ecosystem_specific":{"binaries":[{"release-notes-susemanager-proxy":"3.2.9-0.16.27.1","spacewalk-backend-libs":"2.8.57.17-3.33.1","spacewalk-backend":"2.8.57.17-3.33.1","spacewalk-base-minimal":"2.8.7.17-3.30.1","spacewalk-proxy-broker":"2.8.5.6-3.11.1","spacewalk-proxy-management":"2.8.5.6-3.11.1","spacewalk-proxy-salt":"2.8.5.6-3.11.1","spacewalk-base-minimal-config":"2.8.7.17-3.30.1","spacewalk-proxy-common":"2.8.5.6-3.11.1","spacewalk-proxy-package-manager":"2.8.5.6-3.11.1","spacewalk-proxy-redirect":"2.8.5.6-3.11.1","susemanager-web-libs":"2.8.7.17-3.30.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2019:1790-1.json"}},{"package":{"name":"spacewalk-web","ecosystem":"SUSE:Manager Proxy 3.2","purl":"pkg:rpm/suse/spacewalk-web&distro=SUSE%20Manager%20Proxy%203.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.7.17-3.30.1"}]}],"ecosystem_specific":{"binaries":[{"spacewalk-backend-libs":"2.8.57.17-3.33.1","spacewalk-base-minimal":"2.8.7.17-3.30.1","spacewalk-proxy-broker":"2.8.5.6-3.11.1","spacewalk-proxy-common":"2.8.5.6-3.11.1","spacewalk-proxy-management":"2.8.5.6-3.11.1","spacewalk-proxy-redirect":"2.8.5.6-3.11.1","release-notes-susemanager-proxy":"3.2.9-0.16.27.1","spacewalk-backend":"2.8.57.17-3.33.1","spacewalk-base-minimal-config":"2.8.7.17-3.30.1","spacewalk-proxy-package-manager":"2.8.5.6-3.11.1","spacewalk-proxy-salt":"2.8.5.6-3.11.1","susemanager-web-libs":"2.8.7.17-3.30.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2019:1790-1.json"}},{"package":{"name":"release-notes-susemanager","ecosystem":"SUSE:Manager Server 3.2","purl":"pkg:rpm/suse/release-notes-susemanager&distro=SUSE%20Manager%20Server%203.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.9-6.35.1"}]}],"ecosystem_specific":{"binaries":[{"release-notes-susemanager":"3.2.9-6.35.1","spacewalk-backend-server":"2.8.57.17-3.33.1","spacewalk-backend-sql":"2.8.57.17-3.33.1","spacewalk-backend-tools":"2.8.57.17-3.33.1","spacewalk-backend":"2.8.57.17-3.33.1","spacewalk-base-minimal":"2.8.7.17-3.30.1","susemanager-web-libs":"2.8.7.17-3.30.1","spacewalk-backend-applet":"2.8.57.17-3.33.1","spacewalk-backend-config-files-tool":"2.8.57.17-3.33.1","spacewalk-backend-iss":"2.8.57.17-3.33.1","spacewalk-backend-package-push-server":"2.8.57.17-3.33.1","spacewalk-backend-sql-oracle":"2.8.57.17-3.33.1","spacewalk-base-minimal-config":"2.8.7.17-3.30.1","spacewalk-base":"2.8.7.17-3.30.1","spacewalk-backend-config-files":"2.8.57.17-3.33.1","spacewalk-backend-iss-export":"2.8.57.17-3.33.1","spacewalk-backend-libs":"2.8.57.17-3.33.1","spacewalk-backend-sql-postgresql":"2.8.57.17-3.33.1","spacewalk-backend-xmlrpc":"2.8.57.17-3.33.1","spacewalk-backend-app":"2.8.57.17-3.33.1","spacewalk-backend-config-files-common":"2.8.57.17-3.33.1","spacewalk-backend-xml-export-libs":"2.8.57.17-3.33.1","spacewalk-html":"2.8.7.17-3.30.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2019:1790-1.json"}},{"package":{"name":"spacewalk-backend","ecosystem":"SUSE:Manager Server 3.2","purl":"pkg:rpm/suse/spacewalk-backend&distro=SUSE%20Manager%20Server%203.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.57.17-3.33.1"}]}],"ecosystem_specific":{"binaries":[{"spacewalk-backend-applet":"2.8.57.17-3.33.1","spacewalk-backend-sql-postgresql":"2.8.57.17-3.33.1","spacewalk-base-minimal-config":"2.8.7.17-3.30.1","spacewalk-base":"2.8.7.17-3.30.1","spacewalk-backend-package-push-server":"2.8.57.17-3.33.1","spacewalk-backend-server":"2.8.57.17-3.33.1","spacewalk-backend-sql":"2.8.57.17-3.33.1","spacewalk-backend-app":"2.8.57.17-3.33.1","spacewalk-backend-config-files-tool":"2.8.57.17-3.33.1","spacewalk-backend-config-files":"2.8.57.17-3.33.1","spacewalk-backend-iss-export":"2.8.57.17-3.33.1","spacewalk-backend-iss":"2.8.57.17-3.33.1","spacewalk-backend-xml-export-libs":"2.8.57.17-3.33.1","spacewalk-backend":"2.8.57.17-3.33.1","spacewalk-base-minimal":"2.8.7.17-3.30.1","spacewalk-html":"2.8.7.17-3.30.1","spacewalk-backend-sql-oracle":"2.8.57.17-3.33.1","release-notes-susemanager":"3.2.9-6.35.1","spacewalk-backend-config-files-common":"2.8.57.17-3.33.1","spacewalk-backend-libs":"2.8.57.17-3.33.1","spacewalk-backend-tools":"2.8.57.17-3.33.1","spacewalk-backend-xmlrpc":"2.8.57.17-3.33.1","susemanager-web-libs":"2.8.7.17-3.30.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2019:1790-1.json"}},{"package":{"name":"spacewalk-web","ecosystem":"SUSE:Manager Server 3.2","purl":"pkg:rpm/suse/spacewalk-web&distro=SUSE%20Manager%20Server%203.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.7.17-3.30.1"}]}],"ecosystem_specific":{"binaries":[{"spacewalk-backend-config-files-common":"2.8.57.17-3.33.1","spacewalk-backend-config-files-tool":"2.8.57.17-3.33.1","spacewalk-backend-iss-export":"2.8.57.17-3.33.1","spacewalk-backend-libs":"2.8.57.17-3.33.1","spacewalk-backend-sql-oracle":"2.8.57.17-3.33.1","spacewalk-backend-xmlrpc":"2.8.57.17-3.33.1","spacewalk-backend":"2.8.57.17-3.33.1","spacewalk-base":"2.8.7.17-3.30.1","spacewalk-backend-applet":"2.8.57.17-3.33.1","spacewalk-backend-app":"2.8.57.17-3.33.1","spacewalk-backend-iss":"2.8.57.17-3.33.1","spacewalk-backend-package-push-server":"2.8.57.17-3.33.1","spacewalk-backend-sql":"2.8.57.17-3.33.1","susemanager-web-libs":"2.8.7.17-3.30.1","release-notes-susemanager":"3.2.9-6.35.1","spacewalk-backend-sql-postgresql":"2.8.57.17-3.33.1","spacewalk-backend-xml-export-libs":"2.8.57.17-3.33.1","spacewalk-base-minimal-config":"2.8.7.17-3.30.1","spacewalk-base-minimal":"2.8.7.17-3.30.1","spacewalk-backend-config-files":"2.8.57.17-3.33.1","spacewalk-backend-server":"2.8.57.17-3.33.1","spacewalk-backend-tools":"2.8.57.17-3.33.1","spacewalk-html":"2.8.7.17-3.30.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2019:1790-1.json"}}],"schema_version":"1.7.3"}