{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for SUSE Manager Server 4.3",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update fixes the following issues:\n\nrelease-notes-susemanager:\n\n- Update to SUSE Manager 4.3.8\n  * Important Salt minion update\n  * SUSE Manager Pay-as-you-go (PAYG)\n  * Automated RHUI credential update\n  * Monitoring: Prometheus upgraded to 2.45.0\n  * Monitoring: Apache exporter updated to version 1.0.0\n  * Expose lastBuildDate property (last build/promote date of an\n    environment) through contentlifecycle API (jsc#SUMA-280)\n  * Add saltboot redeploy and repartition based on pillars (jsc#SUMA-158)  \n  * Security CVE issues fixed:\n    CVE-2023-29409, CVE-2023-20897, CVE-2023-20898\n  * Bugs mentioned\n    bsc#1207330, bsc#1208692, bsc#1210935, bsc#1211525, bsc#1211874\n    bsc#1211884, bsc#1212246, bsc#1212730, bsc#1212814, bsc#1212827\n    bsc#1212856, bsc#1212943, bsc#1213009, bsc#1213077, bsc#1213288\n    bsc#1213445, bsc#1213675, bsc#1213716, bsc#1213880, bsc#1214002\n    bsc#1214121, bsc#1214124, bsc#1214187, bsc#1214266, bsc#1214280\n    bsc#1214889, bsc#1214982, bsc#1215352, bsc#1215362, bsc#1215497\n    bsc#1193948, bsc#1214797, bsc#1213441, bsc#1214796, bsc#1213469\n    bsc#1215413, bsc#1215756\n\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2023-3885,SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2023-3885,SUSE-SLE-Product-SUSE-Manager-Server-4.3-2023-3885",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2023_3885-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2023:3885-1",
        "url": "https://www.suse.com/support/update/announcement/2023/suse-su-20233885-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2023:3885-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-September/016389.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1193948",
        "url": "https://bugzilla.suse.com/1193948"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1207330",
        "url": "https://bugzilla.suse.com/1207330"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1208692",
        "url": "https://bugzilla.suse.com/1208692"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1210935",
        "url": "https://bugzilla.suse.com/1210935"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1211525",
        "url": "https://bugzilla.suse.com/1211525"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1211874",
        "url": "https://bugzilla.suse.com/1211874"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1211884",
        "url": "https://bugzilla.suse.com/1211884"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1212246",
        "url": "https://bugzilla.suse.com/1212246"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1212730",
        "url": "https://bugzilla.suse.com/1212730"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1212814",
        "url": "https://bugzilla.suse.com/1212814"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1212827",
        "url": "https://bugzilla.suse.com/1212827"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1212856",
        "url": "https://bugzilla.suse.com/1212856"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1212943",
        "url": "https://bugzilla.suse.com/1212943"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1213009",
        "url": "https://bugzilla.suse.com/1213009"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1213077",
        "url": "https://bugzilla.suse.com/1213077"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1213288",
        "url": "https://bugzilla.suse.com/1213288"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1213441",
        "url": "https://bugzilla.suse.com/1213441"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1213445",
        "url": "https://bugzilla.suse.com/1213445"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1213469",
        "url": "https://bugzilla.suse.com/1213469"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1213675",
        "url": "https://bugzilla.suse.com/1213675"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1213716",
        "url": "https://bugzilla.suse.com/1213716"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1213880",
        "url": "https://bugzilla.suse.com/1213880"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1214002",
        "url": "https://bugzilla.suse.com/1214002"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1214121",
        "url": "https://bugzilla.suse.com/1214121"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1214124",
        "url": "https://bugzilla.suse.com/1214124"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1214187",
        "url": "https://bugzilla.suse.com/1214187"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1214266",
        "url": "https://bugzilla.suse.com/1214266"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1214280",
        "url": "https://bugzilla.suse.com/1214280"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1214796",
        "url": "https://bugzilla.suse.com/1214796"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1214797",
        "url": "https://bugzilla.suse.com/1214797"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1214889",
        "url": "https://bugzilla.suse.com/1214889"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1214982",
        "url": "https://bugzilla.suse.com/1214982"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1215352",
        "url": "https://bugzilla.suse.com/1215352"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1215362",
        "url": "https://bugzilla.suse.com/1215362"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1215413",
        "url": "https://bugzilla.suse.com/1215413"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1215497",
        "url": "https://bugzilla.suse.com/1215497"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1215756",
        "url": "https://bugzilla.suse.com/1215756"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-20897 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-20897/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-20898 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-20898/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-29409 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-29409/"
      }
    ],
    "title": "Security update for SUSE Manager Server 4.3",
    "tracking": {
      "current_release_date": "2023-09-28T11:52:11Z",
      "generator": {
        "date": "2023-09-28T11:52:11Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2023:3885-1",
      "initial_release_date": "2023-09-28T11:52:11Z",
      "revision_history": [
        {
          "date": "2023-09-28T11:52:11Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "release-notes-susemanager-4.3.8-150400.3.77.1.noarch",
                "product": {
                  "name": "release-notes-susemanager-4.3.8-150400.3.77.1.noarch",
                  "product_id": "release-notes-susemanager-4.3.8-150400.3.77.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "release-notes-susemanager-proxy-4.3.8-150400.3.61.2.noarch",
                "product": {
                  "name": "release-notes-susemanager-proxy-4.3.8-150400.3.61.2.noarch",
                  "product_id": "release-notes-susemanager-proxy-4.3.8-150400.3.61.2.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Manager Proxy 4.3",
                "product": {
                  "name": "SUSE Manager Proxy 4.3",
                  "product_id": "SUSE Manager Proxy 4.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:suse-manager-proxy:4.3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Manager Server 4.3",
                "product": {
                  "name": "SUSE Manager Server 4.3",
                  "product_id": "SUSE Manager Server 4.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:suse-manager-server:4.3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "release-notes-susemanager-proxy-4.3.8-150400.3.61.2.noarch as component of SUSE Manager Proxy 4.3",
          "product_id": "SUSE Manager Proxy 4.3:release-notes-susemanager-proxy-4.3.8-150400.3.61.2.noarch"
        },
        "product_reference": "release-notes-susemanager-proxy-4.3.8-150400.3.61.2.noarch",
        "relates_to_product_reference": "SUSE Manager Proxy 4.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "release-notes-susemanager-4.3.8-150400.3.77.1.noarch as component of SUSE Manager Server 4.3",
          "product_id": "SUSE Manager Server 4.3:release-notes-susemanager-4.3.8-150400.3.77.1.noarch"
        },
        "product_reference": "release-notes-susemanager-4.3.8-150400.3.77.1.noarch",
        "relates_to_product_reference": "SUSE Manager Server 4.3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-20897",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-20897"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Manager Proxy 4.3:release-notes-susemanager-proxy-4.3.8-150400.3.61.2.noarch",
          "SUSE Manager Server 4.3:release-notes-susemanager-4.3.8-150400.3.77.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-20897",
          "url": "https://www.suse.com/security/cve/CVE-2023-20897"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1214796 for CVE-2023-20897",
          "url": "https://bugzilla.suse.com/1214796"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Manager Proxy 4.3:release-notes-susemanager-proxy-4.3.8-150400.3.61.2.noarch",
            "SUSE Manager Server 4.3:release-notes-susemanager-4.3.8-150400.3.77.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Manager Proxy 4.3:release-notes-susemanager-proxy-4.3.8-150400.3.61.2.noarch",
            "SUSE Manager Server 4.3:release-notes-susemanager-4.3.8-150400.3.77.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-09-28T11:52:11Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-20897"
    },
    {
      "cve": "CVE-2023-20898",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-20898"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environments can get garbage data or the wrong data, which can lead to wrongful data disclosure, wrongful executions, data corruption and/or crash.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Manager Proxy 4.3:release-notes-susemanager-proxy-4.3.8-150400.3.61.2.noarch",
          "SUSE Manager Server 4.3:release-notes-susemanager-4.3.8-150400.3.77.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-20898",
          "url": "https://www.suse.com/security/cve/CVE-2023-20898"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1214797 for CVE-2023-20898",
          "url": "https://bugzilla.suse.com/1214797"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Manager Proxy 4.3:release-notes-susemanager-proxy-4.3.8-150400.3.61.2.noarch",
            "SUSE Manager Server 4.3:release-notes-susemanager-4.3.8-150400.3.77.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Manager Proxy 4.3:release-notes-susemanager-proxy-4.3.8-150400.3.61.2.noarch",
            "SUSE Manager Server 4.3:release-notes-susemanager-4.3.8-150400.3.77.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-09-28T11:52:11Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-20898"
    },
    {
      "cve": "CVE-2023-29409",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-29409"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to \u003c= 8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in circulation with keys larger than this, and all three appear to be test certificates that are not actively deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so causing breakage here in the interests of increasing the default safety of users of crypto/tls seems reasonable.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Manager Proxy 4.3:release-notes-susemanager-proxy-4.3.8-150400.3.61.2.noarch",
          "SUSE Manager Server 4.3:release-notes-susemanager-4.3.8-150400.3.77.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-29409",
          "url": "https://www.suse.com/security/cve/CVE-2023-29409"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1213880 for CVE-2023-29409",
          "url": "https://bugzilla.suse.com/1213880"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Manager Proxy 4.3:release-notes-susemanager-proxy-4.3.8-150400.3.61.2.noarch",
            "SUSE Manager Server 4.3:release-notes-susemanager-4.3.8-150400.3.77.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Manager Proxy 4.3:release-notes-susemanager-proxy-4.3.8-150400.3.61.2.noarch",
            "SUSE Manager Server 4.3:release-notes-susemanager-4.3.8-150400.3.77.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-09-28T11:52:11Z",
          "details": "important"
        }
      ],
      "title": "CVE-2023-29409"
    }
  ]
}