{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for SUSE Manager Server 4.1",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "\nThis update fixes the following issues:\n\nspacewalk-admin:\n\n- Version 4.1.10-1\n  * Fix setup with rhn-config-satellite (bsc#1190300)\n  * Allow admins to modify only spacewalk config files with\n    rhn-config-satellite.pl (bsc#1190040) (CVE-2021-40348)\n\nHow to apply this update:\n1. Log in as root user to the SUSE Manager server.\n2. Stop the Spacewalk service:\n`spacewalk-service stop`\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Start the Spacewalk service:\n`spacewalk-service start`\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2021-3562,SUSE-SLE-Module-SUSE-Manager-Server-4.1-2021-3562",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2021_3562-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2021:3562-1",
        "url": "https://www.suse.com/support/update/announcement/2021/suse-su-20213562-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2021:3562-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2021-October/009671.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1190040",
        "url": "https://bugzilla.suse.com/1190040"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1190300",
        "url": "https://bugzilla.suse.com/1190300"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-40348 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-40348/"
      }
    ],
    "title": "Security update for SUSE Manager Server 4.1",
    "tracking": {
      "current_release_date": "2021-10-27T13:34:39Z",
      "generator": {
        "date": "2021-10-27T13:34:39Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2021:3562-1",
      "initial_release_date": "2021-10-27T13:34:39Z",
      "revision_history": [
        {
          "date": "2021-10-27T13:34:39Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "spacewalk-admin-4.1.10-3.15.1.noarch",
                "product": {
                  "name": "spacewalk-admin-4.1.10-3.15.1.noarch",
                  "product_id": "spacewalk-admin-4.1.10-3.15.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Manager Server Module 4.1",
                "product": {
                  "name": "SUSE Manager Server Module 4.1",
                  "product_id": "SUSE Manager Server Module 4.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-suse-manager-server:4.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "spacewalk-admin-4.1.10-3.15.1.noarch as component of SUSE Manager Server Module 4.1",
          "product_id": "SUSE Manager Server Module 4.1:spacewalk-admin-4.1.10-3.15.1.noarch"
        },
        "product_reference": "spacewalk-admin-4.1.10-3.15.1.noarch",
        "relates_to_product_reference": "SUSE Manager Server Module 4.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-40348",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-40348"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Spacewalk 2.10, and derivatives such as Uyuni 2021.08, allows code injection. rhn-config-satellite.pl doesn\u0027t sanitize the configuration filename used to append Spacewalk-specific key-value pair. The script is intended to be run by the tomcat user account with Sudo, according to the installation setup. This can lead to the ability of an attacker to use --option to append arbitrary code to a root-owned file that eventually will be executed by the system. This is fixed in Uyuni spacewalk-admin 4.3.2-1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Manager Server Module 4.1:spacewalk-admin-4.1.10-3.15.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-40348",
          "url": "https://www.suse.com/security/cve/CVE-2021-40348"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1190040 for CVE-2021-40348",
          "url": "https://bugzilla.suse.com/1190040"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Manager Server Module 4.1:spacewalk-admin-4.1.10-3.15.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Manager Server Module 4.1:spacewalk-admin-4.1.10-3.15.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-10-27T13:34:39Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-40348"
    }
  ]
}