A Uncontrolled Resource Consumption vulnerability in rmt of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Public Cloud 15-SP1, SUSE Linux Enterprise Module for Server Applications 15, SUSE Linux Enterprise Module for Server Applications 15-SP1, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1 allows remote attackers to cause DoS against rmt by requesting migrations. This issue affects: SUSE Linux Enterprise High Performance Computing 15-ESPOS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise High Performance Computing 15-LTSS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Module for Public Cloud 15-SP1 rmt-server versions prior to 2.5.2-3.9.1. SUSE Linux Enterprise Module for Server Applications 15 rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Module for Server Applications 15-SP1 rmt-server versions prior to 2.5.2-3.9.1. SUSE Linux Enterprise Server 15-LTSS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Server for SAP 15 rmt-server versions prior to 2.5.2-3.26.1. openSUSE Leap 15.1 rmt-server versions prior to 2.5.2-lp151.2.9.1.

This update for rmt-server to version 2.5.7 fixes the following issues :

Security issues fixed :

CVE-2019-18904: Fixed offline migrations (bsc#1160922).

Fixed a local denial of service (bsc#1165548).

Non-security issues fixed :

Align supported subscription types with SCC (bsc#1168554).

Fix migrations in case adding migration_extra column failed (bsc#1162296).

Fix dependency to removed boot_cli_i18n file (bsc#1136020)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for rmt-server to version 2.5.2 fixes the following issues :

Security issue fixed :

  - CVE-2019-18904: Fixed a denial of service in the offline     migration (bsc#1160922).

Non-security issue fixed :

  - Relaxed systemd units dependencies (bsc#1160673)

  - Added more verbose error reporting for SCC API errors     (bsc#1157119)

  - Fixed system listing when architecture is not well     referenced (bsc#1141122)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for rmt-server to version 2.5.2 fixes the following issues :

Security issue fixed :

CVE-2019-18904: Fixed a denial of service in the offline migration (bsc#1160922).

Non-security issue fixed :

Relaxed systemd units dependencies (bsc#1160673)

Added more verbose error reporting for SCC API errors (bsc#1157119)

Fixed system listing when architecture is not well referenced (bsc#1141122)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
136464	SUSE SLES15 Security Update : rmt-server (SUSE-SU-2020:1179-1)	Nessus	SuSE Local Security Checks	high
133828	openSUSE Security Update : rmt-server (openSUSE-2020-235)	Nessus	SuSE Local Security Checks	high
133438	SUSE SLES15 Security Update : rmt-server (SUSE-SU-2020:0278-1)	Nessus	SuSE Local Security Checks	high
133389	SUSE SLES15 Security Update : rmt-server (SUSE-SU-2020:0260-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2019-18904

high

Tenable Plugins

high

high

high

high