🛡️ SUSE-SU-2024:1427-1 — ansible (CVE-2023-5764 +7 more)

Security Beta update for SUSE Manager Client Tools and Salt

This update fixes the following issues:

POS_Image-Graphical7:

• Update to version 0.1.1710765237.46af599
• Move image services to dracut-saltboot package
• Use salt bundle
• Update to version 0.1.1645440615.7f1328c
• Remove deprecated kiwi functions

POS_Image-JeOS7:

• Update to version 0.1.1710765237.46af599
• Move image services to dracut-saltboot package
• Use salt bundle
• Update to version 0.1.1645440615.7f1328c
• Remove deprecated kiwi functions

ansible:

• CVE-2023-5764: Address issues where internal templating can cause unsafe

variables to lose their unsafe designation (bsc#1216854)

• breaking_changes:

assert - Nested templating may result in an inability for the conditional

to be evaluated. See the porting guide for more information.

• CVE-2024-0690: Address issue where ANSIBLE_NO_LOG was ignored (bsc#1219002)
• CVE-2020-14365: Do a GPG validation if the disable_gpg_check option is not set. (bsc#1175993)
• Don't Require python-coverage, it is needed only for testing (bsc#1177948)
• CVE-2018-10874: Inventory variables are loaded from current working directory when running ad-hoc command that can

lead to code execution (included upstream in 2.6.1) (bsc#1099805)

dracut-saltboot:

• Update to version 0.1.1710765237.46af599
• Load only first available leaseinfo (bsc#1221092)
• Update to version 0.1.1681904360.84ef141

grafana:

• Require Go 1.20
• Update to version 9.5.16:
• [SECURITY] CVE-2023-6152: Add email verification when updating

user email (bsc#1219912)

• [BUGFIX] Annotations: Split cleanup into separate queries and

deletes to avoid deadlocks on MySQL

• Update to version 9.5.15:
• [FEATURE] Alerting: Attempt to retry retryable errors
• Update to version 9.5.14:
• [BUGFIX] Alerting: Fix state manager to not keep

datasource_uid and ref_id labels in state after Error

• [BUGFIX] Transformations: Config overrides being lost when

config from query transform is applied

• [BUGFIX] LDAP: Fix enable users on successfull login
• Update to version 9.5.13:
• [BUGFIX] BrowseDashboards: Only remember the most recent

expanded folder

• [BUGFIX] Licensing: Pass func to update env variables when

starting plugin

• Update to version 9.5.12:
• [FEATURE] Azure: Add support for Workload Identity

authentication

• Update to version 9.5.9:
• [FEATURE] SSE: Fix DSNode to not panic when response has empty

response

• [FEATURE] Prometheus: Handle the response with different field

key order

• [BUGFIX] LDAP: Fix user disabling

golang-github-prometheus-node_exporter:

• Add device_error label for filesystem metrics.
• Update rtnetlink library to fix errors during ARP metrics collection.
• Update to 1.7.0 (jsc#PED-7893, jsc#PED-7928):
• [FEATURE] Add ZFS freebsd per dataset stats #2753
• [FEATURE] Add cpu vulnerabilities reporting from sysfs #2721
• [ENHANCEMENT] Parallelize stat calls in Linux filesystem

collector #1772

• [ENHANCEMENT] Add missing linkspeeds to ethtool collector #2711
• [ENHANCEMENT] Add CPU MHz as the value for node_cpu_info metric

#2778

• [ENHANCEMENT] Improve qdisc collector performance #2779
• [ENHANCEMENT] Add include and exclude filter for hwmon

collector #2699

• [ENHANCEMENT] Optionally fetch ARP stats via rtnetlink instead

of procfs #2777

• [BUFFIX] Fix ZFS arcstats on FreeBSD 14.0+ 2754
• [BUGFIX] Fallback to 32-bit stats in netdev #2757
• [BUGFIX] Close btrfs.FS handle after use #2780
• [BUGFIX] Move RO status before error return #2807
• [BUFFIX] Fix promhttp_metric_handler_errors_total being always

active #2808

• [BUGFIX] Fix nfsd v4 index miss #2824
• Update to 1.6.1:

(no source code changes in this release)

• BuildRequire go1.20
• Update to 1.6.0:
• [CHANGE] Fix cpustat when some cpus are offline #2318
• [CHANGE] Remove metrics of offline CPUs in CPU collector #2605
• [CHANGE] Deprecate ntp collector #2603
• [CHANGE] Remove bcache cache_readaheads_totals metrics #2583
• [CHANGE] Deprecate supervisord collector #2685
• [FEATURE] Enable uname collector on NetBSD #2559
• [FEATURE] NetBSD support for the meminfo collector #2570
• [FEATURE] NetBSD support for CPU collector #2626
• [FEATURE] Add FreeBSD collector for netisr subsystem #2668
• [FEATURE] Add softirqs collector #2669
• [ENHANCEMENT] Add suspended as a node_zfs_zpool_state #2449
• [ENHANCEMENT] Add administrative state of Linux network

interfaces #2515

• [ENHANCEMENT] Log current value of GOMAXPROCS #2537
• [ENHANCEMENT] Add profiler options for perf collector #2542
• [ENHANCEMENT] Allow root path as metrics path #2590
• [ENHANCEMENT] Add cpu frequency governor metrics #2569
• [ENHANCEMENT] Add new landing page #2622
• [ENHANCEMENT] Reduce privileges needed for btrfs device stats #2634
• [ENHANCEMENT] Add ZFS memory_available_bytes #2687
• [ENHANCEMENT] Use SCSI_IDENT_SERIAL as serial in