Recommended update for SUSE Manager Server 4.0
This update fixes the following issues: branch-network-formula: - Handle application/efi mime type - Allow http access to saltboot directory cobbler: - Signatures file now uses 'default_autoinstall' which fixes import problem happening with some distributions (bsc#1159010) - Fix for kernel and initrd detection (bsc#1159010) dhcpd-formula: - UEFI HTTPBoot support - Changed default of filename_efi to shim.efi for secure boot grafana-formula: - Add CaaSP datasource and dashboards image-sync-formula: - Install dosfstools package for sync_image_usb module to work patterns-suse-manager: - Require yast2-migration to allow online OS migrations (bsc#1167777) prometheus-formula: - Add meta-monitoring configuration - Add federation configuration pxe-formula: - Add non-EFI grub menu variant - Use /usr/lib64/efi/shim.efi path (workaround for bsc#1166523) - Use grub2 variable 'prefix' instead of hardcoded /boot - Prepare configuration for UEFI with Secure Boot - Add support fot new terminal naming for UEFI network boot py26-compat-salt: - Do not make py26-compat-salt to require python-tornado on SLE15 (all SPs) - Backport saltutil state module to 2016.11 codebase (bsc#1167556) - Add new custom SUSE capability for saltutil state module python-susemanager-retail: - Fix retail_branch_init python error due to change in branch id handling saltboot-formula: - Add grain to force image redeployment and repartition - Allow pillar customizable download urls Saltboot now recognizes following pillars: - saltboot_download_server: specifies from where download the images, kernel, etc. - saltboot_download_protocol: specifies what protocol to use for download - Use more reliable progress output - Python3 compatibility fix - Use file.read instead of cp.get_file_str - Improve image cache debug messages spacewalk: - Explicitly require postgresql10 package (bsc#1165926) spacewalk-backend: - Validate cached package entries on ISS slave (bsc#1159184) - Do not break when syncing Oracle 7 yum channel (bsc#1158463) - Always use the same RPM database when running 'spacewalk-repo-sync' from the command line or via taskomatic (bsc#1163468) spacewalk-certs-tools: - Add minion option in config file to disable salt mine when generated by bootstrap script (bsc#1163001) - Disable modularity failsafe mechanism for RHEL 8 bootstrap repos (bsc#1164875) spacewalk-client-tools: - Use 'int' instead of 'long' on rhn_check for both Python 2 and 3 - Do not crash 'mgr-update-status' because 'long' type is not defined in Python 3 - Add workaround for uptime overflow to spacewalk-update-status as well (bsc#1165921) spacewalk-java: - Hide message about changed Update Tag change (bsc#1169109) - Refresh pillar after channel change - Use 'changes' field if 'pchanges' field doesn't exist (bsc#1159202) - Fix the original-clone channel relationship for CLM channels (bsc#1163121) - Fix serializer and documentation for system.listSystems (bsc#1168083) - Skip and show migration targets which do not have a successor for all installed extension products (bsc#1168227) - Fix resource leak in taskomatic (bsc#1168696) - Add XMLRPC API method: proxy.listProxyClients (bsc#1166408) - Hide Virtualization > Provisioning tab for Salt systems (bsc#1167329) - Remove no longer necessary check for retail TERMINALS group membership - Fix error when adding systems to ssm with 'add to ssm' button (bsc#1160246) - Prevent build/promote on content projects which have build/promote in progress - Clean stale Content Lifecycle targets on Tomcat startup (bsc#1164121) - Show warning on products page when no SUSE Manager Server Subscription is available - Improve performance for States view in SystemGroups detail view (bsc#1158752) - Validate the suseproductchannel table and update missing date when running mgr-sync refresh (bsc#1163538) - Add 'init.repo' kernel option to RHEL 8 kickstart tree (bsc#1163884) spacewalk-utils: - Check for delimiter as well when detecting current phase (bsc#1164771) - Common-channels: Fix repo type assignment for type YUM (bsc#1151683) spacewalk-web: - Show warning on products page when no SUSE Manager Server Subscription is available - Scheme is not allowed for URI of image store's API endpoint (bsc#1165571) susemanager: - Require python3-tornado only for SLE15/SLE15SP1/openSUSE Leap 15.1 (bsc#1169865) - Use python3-M2Crypto for all SLE15 versions and openSUSE Leap 15.1 bootstrap repositories - Add missing packages to OES2018-SP1-x86_64 target for bootstrap data (bsc#1169144) - Add dbus-1-glib to SLE12SP5 x86_64 to allow onboarding of AWS Cloud SLE12SP5 clients (they do not have it by defaul anymore) - Add package redhat-rpm-config to bootstrap repo for RH and CentOS systems (bsc#1168069) - Add 'python-singledispatch' to SLE12 (all SPs) and RES7 bootstrap repos. - Fix salt bootstrapping on SLE15 (require python3-pycrypto or python3-M2Crypto to support all variants) (bsc#1164563) susemanager-doc-indexes: - Removed incorrect version number attribute - On IBM Z by default use the Unified Installer - Improve nav link descriptions CLI section layout fixes - Update example in SUSE Manager salt configuration - Update salt file locations - Removed incorrect version number attribute - On IBM Z by default use the Unified Installer - Improve nav link descriptions CLI section layout fixes - Update example in SUSE Manager salt configuration - Update salt file locations susemanager-docs_en: - Removed incorrect version number attribute - On IBM Z by default use the Unified Installer - Improve nav link descriptions CLI section layout fixes - Update example in SUSE Manager salt configuration - Update salt file locations - Removed incorrect version number attribute - On IBM Z by default use the Unified Installer - Improve nav link descriptions CLI section layout fixes - Update example in SUSE Manager salt configuration - Update salt file locations susemanager-nodejs-sdk-devel: - upgrade node_module dependencies - CVE-2020-7598 and SNYK-JS-ACORN-559469 susemanager-schema: - Enable monitoring for ppc64le and aarch64 (bsc#1166613) susemanager-sls: - Fix virt.deleted state dependency - Remove key grains only when file and grain exists (bsc#1167237) - Cleanup key grains after usage - Use saltutil states if available on the minion (bsc#1167556) - Make 'product' state module only available for minions with zypper >= 1.8.13 (bsc#1166699) - Adapt 'mgractionchains' module to work with Salt 3000 - Disable modularity failsafe mechanism for RHEL 8 repos (bsc#1164875) susemanager-tftpsync: - Fix few compat issues with Python3 at MultipartPostHandler - Use alternative method for deprecated 'Request.get_data' (bsc#1164111) virtual-host-gatherer: - Cast to NodeState to str to allow serialization on libcloud 2.8.1 (bsc#1167052) virtualization-host-formula: - Fix required fields - Fix bridge network creation How to apply this update: 1. Log in as root user to the SUSE Manager server. 2. Stop the Spacewalk service: spacewalk-service stop 3. Apply the patch using either zypper patch or YaST Online Update. 4. Upgrade the database schema: spacewalk-schema-upgrade 5. Start the Spacewalk service: spacewalk-service start
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update fixes the following issues: branch-network-formula: - Handle application/efi mime type - Allow http access to saltboot directory cobbler: - Signatures file now uses 'default_autoinstall' which fixes import problem happening with some distributions (bsc#1159010) - Fix for kernel and initrd detection (bsc#1159010) dhcpd-formula: - UEFI HTTPBoot support - Changed default of filename_efi to shim.efi for secure boot grafana-formula: - Add CaaSP datasource and dashboards image-sync-formula: - Install dosfstools package for sync_image_usb module to work patterns-suse-manager: - Require yast2-migration to allow online OS migrations (bsc#1167777) prometheus-formula: - Add meta-monitoring configuration - Add federation configuration pxe-formula: - Add non-EFI grub menu variant - Use /usr/lib64/efi/shim.efi path (workaround for bsc#1166523) - Use grub2 variable 'prefix' instead of hardcoded /boot - Prepare configuration for UEFI with Secure Boot - Add support fot new terminal naming for UEFI network boot py26-compat-salt: - Do not make py26-compat-salt to require python-tornado on SLE15 (all SPs) - Backport saltutil state module to 2016.11 codebase (bsc#1167556) - Add new custom SUSE capability for saltutil state module python-susemanager-retail: - Fix retail_branch_init python error due to change in branch id handling saltboot-formula: - Add grain to force image redeployment and repartition - Allow pillar customizable download urls Saltboot now recognizes following pillars: - saltboot_download_server: specifies from where download the images, kernel, etc. - saltboot_download_protocol: specifies what protocol to use for download - Use more reliable progress output - Python3 compatibility fix - Use file.read instead of cp.get_file_str - Improve image cache debug messages spacewalk: - Explicitly require postgresql10 package (bsc#1165926) spacewalk-backend: - Validate cached package entries on ISS slave (bsc#1159184) - Do not break when syncing Oracle 7 yum channel (bsc#1158463) - Always use the same RPM database when running 'spacewalk-repo-sync' from the command line or via taskomatic (bsc#1163468) spacewalk-certs-tools: - Add minion option in config file to disable salt mine when generated by bootstrap script (bsc#1163001) - Disable modularity failsafe mechanism for RHEL 8 bootstrap repos (bsc#1164875) spacewalk-client-tools: - Use 'int' instead of 'long' on rhn_check for both Python 2 and 3 - Do not crash 'mgr-update-status' because 'long' type is not defined in Python 3 - Add workaround for uptime overflow to spacewalk-update-status as well (bsc#1165921) spacewalk-java: - Hide message about changed Update Tag change (bsc#1169109) - Refresh pillar after channel change - Use 'changes' field if 'pchanges' field doesn't exist (bsc#1159202) - Fix the original-clone channel relationship for CLM channels (bsc#1163121) - Fix serializer and documentation for system.listSystems (bsc#1168083) - Skip and show migration targets which do not have a successor for all installed extension products (bsc#1168227) - Fix resource leak in taskomatic (bsc#1168696) - Add XMLRPC API method: proxy.listProxyClients (bsc#1166408) - Hide Virtualization > Provisioning tab for Salt systems (bsc#1167329) - Remove no longer necessary check for retail TERMINALS group membership - Fix error when adding systems to ssm with 'add to ssm' button (bsc#1160246) - Prevent build/promote on content projects which have build/promote in progress - Clean stale Content Lifecycle targets on Tomcat startup (bsc#1164121) - Show warning on products page when no SUSE Manager Server Subscription is available - Improve performance for States view in SystemGroups detail view (bsc#1158752) - Validate the suseproductchannel table and update missing date when running mgr-sync refresh (bsc#1163538) - Add 'init.repo' kernel option to RHEL 8 kickstart tree (bsc#1163884) spacewalk-utils: - Check for delimiter as well when detecting current phase (bsc#1164771) - Common-channels: Fix repo type assignment for type YUM (bsc#1151683) spacewalk-web: - Show warning on products page when no SUSE Manager Server Subscription is available - Scheme is not allowed for URI of image store's API endpoint (bsc#1165571) susemanager: - Require python3-tornado only for SLE15/SLE15SP1/openSUSE Leap 15.1 (bsc#1169865) - Use python3-M2Crypto for all SLE15 versions and openSUSE Leap 15.1 bootstrap repositories - Add missing packages to OES2018-SP1-x86_64 target for bootstrap data (bsc#1169144) - Add dbus-1-glib to SLE12SP5 x86_64 to allow onboarding of AWS Cloud SLE12SP5 clients (they do not have it by defaul anymore) - Add package redhat-rpm-config to bootstrap repo for RH and CentOS systems (bsc#1168069) - Add 'python-singledispatch' to SLE12 (all SPs) and RES7 bootstrap repos. - Fix salt bootstrapping on SLE15 (require python3-pycrypto or python3-M2Crypto to support all variants) (bsc#1164563) susemanager-doc-indexes: - Removed incorrect version number attribute - On IBM Z by default use the Unified Installer - Improve nav link descriptions CLI section layout fixes - Update example in SUSE Manager salt configuration - Update salt file locations - Removed incorrect version number attribute - On IBM Z by default use the Unified Installer - Improve nav link descriptions CLI section layout fixes - Update example in SUSE Manager salt configuration - Update salt file locations susemanager-docs_en: - Removed incorrect version number attribute - On IBM Z by default use the Unified Installer - Improve nav link descriptions CLI section layout fixes - Update example in SUSE Manager salt configuration - Update salt file locations - Removed incorrect version number attribute - On IBM Z by default use the Unified Installer - Improve nav link descriptions CLI section layout fixes - Update example in SUSE Manager salt configuration - Update salt file locations susemanager-nodejs-sdk-devel: - upgrade node_module dependencies - CVE-2020-7598 and SNYK-JS-ACORN-559469 susemanager-schema: - Enable monitoring for ppc64le and aarch64 (bsc#1166613) susemanager-sls: - Fix virt.deleted state dependency - Remove key grains only when file and grain exists (bsc#1167237) - Cleanup key grains after usage - Use saltutil states if available on the minion (bsc#1167556) - Make 'product' state module only available for minions with zypper >= 1.8.13 (bsc#1166699) - Adapt 'mgractionchains' module to work with Salt 3000 - Disable modularity failsafe mechanism for RHEL 8 repos (bsc#1164875) susemanager-tftpsync: - Fix few compat issues with Python3 at MultipartPostHandler - Use alternative method for deprecated 'Request.get_data' (bsc#1164111) virtual-host-gatherer: - Cast to NodeState to str to allow serialization on libcloud 2.8.1 (bsc#1167052) virtualization-host-formula: - Fix required fields - Fix bridge network creation How to apply this update: 1. Log in as root user to the SUSE Manager server. 2. Stop the Spacewalk service: spacewalk-service stop 3. Apply the patch using either zypper patch or YaST Online Update. 4. Upgrade the database schema: spacewalk-schema-upgrade 5. Start the Spacewalk service: spacewalk-service start
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1151683
- https://bugzilla.suse.com/1158463
- https://bugzilla.suse.com/1158752
- https://bugzilla.suse.com/1159010
- https://bugzilla.suse.com/1159184
- https://bugzilla.suse.com/1159202
- https://bugzilla.suse.com/1160246
- https://bugzilla.suse.com/1163001
- https://bugzilla.suse.com/1163121
- https://bugzilla.suse.com/1163468
- https://bugzilla.suse.com/1163538
- https://bugzilla.suse.com/1163884
- https://bugzilla.suse.com/1164111
- https://bugzilla.suse.com/1164121
- https://bugzilla.suse.com/1164563
- https://bugzilla.suse.com/1164771
- https://bugzilla.suse.com/1164875
- https://bugzilla.suse.com/1165571
- https://bugzilla.suse.com/1165921
- https://bugzilla.suse.com/1165926
- https://bugzilla.suse.com/1166408
- https://bugzilla.suse.com/1166523
- https://bugzilla.suse.com/1166613
- https://bugzilla.suse.com/1166699
- https://bugzilla.suse.com/1167052
- https://bugzilla.suse.com/1167237
- https://bugzilla.suse.com/1167329
- https://bugzilla.suse.com/1167556
- https://bugzilla.suse.com/1167777
- https://bugzilla.suse.com/1168069
- https://bugzilla.suse.com/1168083
- https://bugzilla.suse.com/1168227
- https://bugzilla.suse.com/1168696
- https://bugzilla.suse.com/1169109
- https://bugzilla.suse.com/1169144
- https://bugzilla.suse.com/1169865
- https://www.suse.com/security/cve/CVE-2020-7598
- https://www.suse.com/support/update/announcement/-2020-1238/suse-ru-20201238-1/