suse-su-2025:01985-1
Vulnerability from csaf_suse
Published
2025-06-18 02:07
Modified
2025-06-18 02:07
Summary
Security update 4.3.15 for Multi-Linux Manager Server

Notes

Title of the patch
Security update 4.3.15 for Multi-Linux Manager Server
Description of the patch
This update fixes the following issues: release-notes-susemanager: - Update to SUSE Manager 4.3.15.2 * SUSE Manager 4.3 will transition to LTS after June 2025 * CVE Fixed CVE-2023-45288, CVE-2024-11741, CVE-2024-45337, CVE-2024-45339 CVE-2024-51744, CVE-2024-9264, CVE-2024-9476, CVE-2025-22870 CVE-2025-22872, CVE-2025-2703 CVE-2025-27144, CVE-2025-3454 CVE-2025-3580, CVE-2025-4123, CVE-2024-47535
Patchnames
SUSE-2025-1985,SUSE-SLE-Product-SUSE-Manager-Server-4.3-2025-1985
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update 4.3.15 for Multi-Linux Manager Server",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update fixes the following issues:\n\nrelease-notes-susemanager:\n\n- Update to SUSE Manager 4.3.15.2\n  * SUSE Manager 4.3 will transition to LTS after June 2025\n  * CVE Fixed\n    CVE-2023-45288, CVE-2024-11741, CVE-2024-45337, CVE-2024-45339\n    CVE-2024-51744, CVE-2024-9264, CVE-2024-9476, CVE-2025-22870\n    CVE-2025-22872, CVE-2025-2703 CVE-2025-27144, CVE-2025-3454\n    CVE-2025-3580, CVE-2025-4123, CVE-2024-47535\n\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2025-1985,SUSE-SLE-Product-SUSE-Manager-Server-4.3-2025-1985",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_01985-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2025:01985-1",
        "url": "https://www.suse.com/support/update/announcement/2025/suse-su-202501985-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2025:01985-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2025-June/040353.html"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-45288 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-45288/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-11741 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-11741/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-45337 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-45337/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-45339 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-45339/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47535 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47535/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-51744 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-51744/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9264 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9264/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9476 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9476/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-22870 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-22870/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-22872 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-22872/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-2703 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-2703/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-27144 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-27144/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-3454 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-3454/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-3580 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-3580/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-4123 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-4123/"
      }
    ],
    "title": "Security update 4.3.15 for Multi-Linux Manager Server",
    "tracking": {
      "current_release_date": "2025-06-18T02:07:51Z",
      "generator": {
        "date": "2025-06-18T02:07:51Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2025:01985-1",
      "initial_release_date": "2025-06-18T02:07:51Z",
      "revision_history": [
        {
          "date": "2025-06-18T02:07:51Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch",
                "product": {
                  "name": "release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch",
                  "product_id": "release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Manager Server 4.3",
                "product": {
                  "name": "SUSE Manager Server 4.3",
                  "product_id": "SUSE Manager Server 4.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:suse-manager-server:4.3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch as component of SUSE Manager Server 4.3",
          "product_id": "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
        },
        "product_reference": "release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch",
        "relates_to_product_reference": "SUSE Manager Server 4.3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-45288",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-45288"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request\u0027s headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-45288",
          "url": "https://www.suse.com/security/cve/CVE-2023-45288"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1221400 for CVE-2023-45288",
          "url": "https://bugzilla.suse.com/1221400"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-06-18T02:07:51Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-45288"
    },
    {
      "cve": "CVE-2024-11741",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-11741"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Grafana is an open-source platform for monitoring and observability. \nThe Grafana Alerting VictorOps integration was not properly protected and could be exposed to users with Viewer permission. \nFixed in versions 11.5.0, 11.4.1, 11.3.3,   11.2.6, 11.1.11, 11.0.11 and 10.4.15",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-11741",
          "url": "https://www.suse.com/security/cve/CVE-2024-11741"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1236734 for CVE-2024-11741",
          "url": "https://bugzilla.suse.com/1236734"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-06-18T02:07:51Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-11741"
    },
    {
      "cve": "CVE-2024-45337",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-45337"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-45337",
          "url": "https://www.suse.com/security/cve/CVE-2024-45337"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1234482 for CVE-2024-45337",
          "url": "https://bugzilla.suse.com/1234482"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-06-18T02:07:51Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-45337"
    },
    {
      "cve": "CVE-2024-45339",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-45339"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process\u0027s log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-45339",
          "url": "https://www.suse.com/security/cve/CVE-2024-45339"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1236541 for CVE-2024-45339",
          "url": "https://bugzilla.suse.com/1236541"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-06-18T02:07:51Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-45339"
    },
    {
      "cve": "CVE-2024-47535",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47535"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers \u0026 clients. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crashes. This vulnerability is fixed in 4.1.115.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47535",
          "url": "https://www.suse.com/security/cve/CVE-2024-47535"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1233297 for CVE-2024-47535",
          "url": "https://bugzilla.suse.com/1233297"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-06-18T02:07:51Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-47535"
    },
    {
      "cve": "CVE-2024-51744",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-51744"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in `ParseWithClaims` can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by `ParseWithClaims` return both error codes. If users only check for the `jwt.ErrTokenExpired ` using `error.Is`, they will ignore the embedded `jwt.ErrTokenSignatureInvalid` and thus potentially accept invalid tokens. A fix has been back-ported with the error handling logic from the `v5` branch to the `v4` branch. In this logic, the `ParseWithClaims` function will immediately return in \"dangerous\" situations (e.g., an invalid signature), limiting the combined errors only to situations where the signature is valid, but further validation failed (e.g., if the signature is valid, but is expired AND has the wrong audience). This fix is part of the 4.5.1 release. We are aware that this changes the behaviour of an established function and is not 100 % backwards compatible, so updating to 4.5.1 might break your code. In case you cannot update to 4.5.0, please make sure that you are properly checking for all errors (\"dangerous\" ones first), so that you are not running in the case detailed above.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-51744",
          "url": "https://www.suse.com/security/cve/CVE-2024-51744"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1232936 for CVE-2024-51744",
          "url": "https://bugzilla.suse.com/1232936"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-06-18T02:07:51Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-51744"
    },
    {
      "cve": "CVE-2024-9264",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9264"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack.  The `duckdb` binary must be present in Grafana\u0027s $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9264",
          "url": "https://www.suse.com/security/cve/CVE-2024-9264"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1231844 for CVE-2024-9264",
          "url": "https://bugzilla.suse.com/1231844"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-06-18T02:07:51Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2024-9264"
    },
    {
      "cve": "CVE-2024-9476",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9476"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other organizations within the same Grafana instance via the Grafana Cloud Migration Assistant.This vulnerability will only affect users who utilize the Organizations feature to isolate resources on their Grafana instance.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9476",
          "url": "https://www.suse.com/security/cve/CVE-2024-9476"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1233343 for CVE-2024-9476",
          "url": "https://bugzilla.suse.com/1233343"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-06-18T02:07:51Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-9476"
    },
    {
      "cve": "CVE-2025-22870",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-22870"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to \"*.example.com\", a request to \"[::1%25.example.com]:80` will incorrectly match and not be proxied.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-22870",
          "url": "https://www.suse.com/security/cve/CVE-2025-22870"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1238572 for CVE-2025-22870",
          "url": "https://bugzilla.suse.com/1238572"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1238611 for CVE-2025-22870",
          "url": "https://bugzilla.suse.com/1238611"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-06-18T02:07:51Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-22870"
    },
    {
      "cve": "CVE-2025-22872",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-22872"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. \u003cmath\u003e, \u003csvg\u003e, etc contexts).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-22872",
          "url": "https://www.suse.com/security/cve/CVE-2025-22872"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1241710 for CVE-2025-22872",
          "url": "https://bugzilla.suse.com/1241710"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-06-18T02:07:51Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-22872"
    },
    {
      "cve": "CVE-2025-2703",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-2703"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. \n\nA user with Editor permissions is able to modify such a panel in order to make it execute arbitrary JavaScript.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-2703",
          "url": "https://www.suse.com/security/cve/CVE-2025-2703"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1241687 for CVE-2025-2703",
          "url": "https://bugzilla.suse.com/1241687"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-06-18T02:07:51Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-2703"
    },
    {
      "cve": "CVE-2025-27144",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-27144"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, \".\") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-27144",
          "url": "https://www.suse.com/security/cve/CVE-2025-27144"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1237608 for CVE-2025-27144",
          "url": "https://bugzilla.suse.com/1237608"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1237609 for CVE-2025-27144",
          "url": "https://bugzilla.suse.com/1237609"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-06-18T02:07:51Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-27144"
    },
    {
      "cve": "CVE-2025-3454",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-3454"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "This vulnerability in Grafana\u0027s datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path.\n\nUsers with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources.\n\nThe issue primarily affects datasources that implement route-specific permissions, including Alertmanager and certain Prometheus-based datasources.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-3454",
          "url": "https://www.suse.com/security/cve/CVE-2025-3454"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1241683 for CVE-2025-3454",
          "url": "https://bugzilla.suse.com/1241683"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-06-18T02:07:51Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-3454"
    },
    {
      "cve": "CVE-2025-3580",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-3580"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server administrator account. This vulnerability exists in the DELETE /api/org/users/ endpoint.\n\nThe vulnerability can be exploited when:\n\n1. An Organization administrator exists\n\n2. The Server administrator is either:\n\n   - Not part of any organization, or\n   - Part of the same organization as the Organization administrator\nImpact:\n\n- Organization administrators can permanently delete Server administrator accounts\n\n- If the only Server administrator is deleted, the Grafana instance becomes unmanageable\n\n- No super-user permissions remain in the system\n\n- Affects all users, organizations, and teams managed in the instance\n\nThe vulnerability is particularly serious as it can lead to a complete loss of administrative control over the Grafana instance.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-3580",
          "url": "https://www.suse.com/security/cve/CVE-2025-3580"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1243672 for CVE-2025-3580",
          "url": "https://bugzilla.suse.com/1243672"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-06-18T02:07:51Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-3580"
    },
    {
      "cve": "CVE-2025-4123",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-4123"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF.\n\nThe default Content-Security-Policy (CSP) in Grafana will block the XSS though the `connect-src` directive.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-4123",
          "url": "https://www.suse.com/security/cve/CVE-2025-4123"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1243714 for CVE-2025-4123",
          "url": "https://bugzilla.suse.com/1243714"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Manager Server 4.3:release-notes-susemanager-4.3.15.2-150400.3.133.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-06-18T02:07:51Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-4123"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.