FlawAtlas
Search the atlas
SUSE-SU-2023:2781-1 Not scored

Security update for rmt-server

This update for rmt-server fixes the following issues: Update to version 2.13: - CVE-2023-28120: Fixed a possible XSS Security Vulnerability in bytesliced strings for html_safe (bsc#1209507). - CVE-2023-27530: Fixed a DoS in multipart mime parsing (bsc#1209096). - CVE-2022-31254: Fixed escalation vector bug from user _rmt to root in the packaging file (bsc#1204285). Bug fixes: - Handle X-Original-URI header, partial fix for (bsc#1211398) - Force rmt-client-setup-res script to use https (bsc#1209825) - Mark secrets.yml.key file as part of the rpm to allow seamless downgrades (bsc#1207670) - Adding -f to the file move command when moving the mirrored directory to its final location (bsc#1203171) - Fix %post install of pubcloud subpackage reload of nginx (bsc#1206593) - Skip warnings regarding nokogiri libxml version mismatch (bsc#1202053) - Add option to turn off system token support (bsc#1205089) - Do not retry to import non-existing files in air-gapped mode (bsc#1204769)

Exploit probability Not scored
Published July 4, 2023
Required by Not available
Last source change February 4, 2026

02 / AFFECTED SOFTWARE

Affected packages

SUSE:Linux Enterprise Module for Public Cloud 15 SP5 rmt-server
SUSE:Linux Enterprise Module for Server Applications 15 SP5 rmt-server
openSUSE:Leap 15.5 rmt-server

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities SUSE-SU-2023:2781-1

This update for rmt-server fixes the following issues: Update to version 2.13: - CVE-2023-28120: Fixed a possible XSS Security Vulnerability in bytesliced strings for html_safe (bsc#1209507). - CVE-2023-27530: Fixed a DoS in multipart mime parsing (bsc#1209096). - CVE-2022-31254: Fixed escalation vector bug from user _rmt to root in the packaging file (bsc#1204285). Bug fixes: - Handle X-Original-URI header, partial fix for (bsc#1211398) - Force rmt-client-setup-res script to use https (bsc#1209825) - Mark secrets.yml.key file as part of the rpm to allow seamless downgrades (bsc#1207670) - Adding -f to the file move command when moving the mirrored directory to its final location (bsc#1203171) - Fix %post install of pubcloud subpackage reload of nginx (bsc#1206593) - Skip warnings regarding nokogiri libxml version mismatch (bsc#1202053) - Add option to turn off system token support (bsc#1205089) - Do not retry to import non-existing files in air-gapped mode (bsc#1204769)

View original source

05 / REFERENCES

Further evidence