SUSE update for Maintenance update for SUSE Manager 5.0: Server, Proxy and Retail Branch Server

Published: 2025-02-17

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2024-21528 CVE-2024-45801
CWE-ID	CWE-1321
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	SUSE Manager Retail Branch Server 5.0 Operating systems & Components / Operating system SUSE Manager Proxy 5.0 Operating systems & Components / Operating system SUSE Manager Server 5.0 Operating systems & Components / Operating system SUSE Linux Enterprise Micro Operating systems & Components / Operating system suse-manager-5.0-s390x-server-migration-14-16-image Operating systems & Components / Operating system package or component suse-manager-5.0-s390x-server-image Operating systems & Components / Operating system package or component suse-manager-5.0-s390x-server-attestation-image Operating systems & Components / Operating system package or component suse-manager-5.0-s390x-server-hub-xmlrpc-api-image Operating systems & Components / Operating system package or component suse-manager-5.0-ppc64le-server-migration-14-16-image Operating systems & Components / Operating system package or component suse-manager-5.0-ppc64le-server-hub-xmlrpc-api-image Operating systems & Components / Operating system package or component suse-manager-5.0-ppc64le-server-attestation-image Operating systems & Components / Operating system package or component suse-manager-5.0-ppc64le-server-image Operating systems & Components / Operating system package or component suse-manager-5.0-aarch64-server-hub-xmlrpc-api-image Operating systems & Components / Operating system package or component suse-manager-5.0-aarch64-server-migration-14-16-image Operating systems & Components / Operating system package or component suse-manager-5.0-aarch64-server-image Operating systems & Components / Operating system package or component suse-manager-5.0-aarch64-server-attestation-image Operating systems & Components / Operating system package or component suse-manager-5.0-x86_64-server-attestation-image Operating systems & Components / Operating system package or component suse-manager-5.0-x86_64-server-migration-14-16-image Operating systems & Components / Operating system package or component suse-manager-5.0-x86_64-server-hub-xmlrpc-api-image Operating systems & Components / Operating system package or component suse-manager-5.0-x86_64-server-image Operating systems & Components / Operating system package or component suse-manager-5.0-x86_64-proxy-httpd-image Operating systems & Components / Operating system package or component suse-manager-5.0-x86_64-proxy-ssh-image Operating systems & Components / Operating system package or component suse-manager-5.0-x86_64-proxy-salt-broker-image Operating systems & Components / Operating system package or component suse-manager-5.0-x86_64-proxy-tftpd-image Operating systems & Components / Operating system package or component suse-manager-5.0-x86_64-proxy-squid-image Operating systems & Components / Operating system package or component suse-manager-5.0-s390x-proxy-ssh-image Operating systems & Components / Operating system package or component suse-manager-5.0-s390x-proxy-tftpd-image Operating systems & Components / Operating system package or component suse-manager-5.0-s390x-proxy-salt-broker-image Operating systems & Components / Operating system package or component suse-manager-5.0-s390x-proxy-squid-image Operating systems & Components / Operating system package or component suse-manager-5.0-s390x-proxy-httpd-image Operating systems & Components / Operating system package or component suse-manager-5.0-ppc64le-proxy-salt-broker-image Operating systems & Components / Operating system package or component suse-manager-5.0-ppc64le-proxy-ssh-image Operating systems & Components / Operating system package or component suse-manager-5.0-ppc64le-proxy-httpd-image Operating systems & Components / Operating system package or component suse-manager-5.0-ppc64le-proxy-tftpd-image Operating systems & Components / Operating system package or component suse-manager-5.0-ppc64le-proxy-squid-image Operating systems & Components / Operating system package or component suse-manager-5.0-aarch64-proxy-salt-broker-image Operating systems & Components / Operating system package or component suse-manager-5.0-aarch64-proxy-httpd-image Operating systems & Components / Operating system package or component suse-manager-5.0-aarch64-proxy-squid-image Operating systems & Components / Operating system package or component suse-manager-5.0-aarch64-proxy-tftpd-image Operating systems & Components / Operating system package or component suse-manager-5.0-aarch64-proxy-ssh-image Operating systems & Components / Operating system package or component
Vendor	SUSE

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Prototype pollution

EUVDB-ID: #VU104017

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-21528

CWE-ID: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists due to improper input validation within the addTranslations() function in gettext.js. A remote attacker can pass specially crafted input to the application and perform prototype pollution, which can result in information disclosure or data manipulation.

Mitigation

Update the affected package Maintenance update for SUSE Manager 5.0: Server, Proxy and Retail Branch Server to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server 5.0: Extension

SUSE Manager Proxy 5.0: Extension

SUSE Manager Server 5.0: Extension

SUSE Linux Enterprise Micro: 5.5

suse-manager-5.0-s390x-server-migration-14-16-image: before 5.0.3-7.9.7

suse-manager-5.0-s390x-server-image: before 5.0.3-7.11.12

suse-manager-5.0-s390x-server-attestation-image: before 5.0.3-6.9.10

suse-manager-5.0-s390x-server-hub-xmlrpc-api-image: before 5.0.3-6.9.5

suse-manager-5.0-ppc64le-server-migration-14-16-image: before 5.0.3-7.9.7

suse-manager-5.0-ppc64le-server-hub-xmlrpc-api-image: before 5.0.3-6.9.5

suse-manager-5.0-ppc64le-server-attestation-image: before 5.0.3-6.9.10

suse-manager-5.0-ppc64le-server-image: before 5.0.3-7.11.12

suse-manager-5.0-aarch64-server-hub-xmlrpc-api-image: before 5.0.3-6.9.5

suse-manager-5.0-aarch64-server-migration-14-16-image: before 5.0.3-7.9.7

suse-manager-5.0-aarch64-server-image: before 5.0.3-7.11.12

suse-manager-5.0-aarch64-server-attestation-image: before 5.0.3-6.9.10

suse-manager-5.0-x86_64-server-attestation-image: before 5.0.3-6.9.10

suse-manager-5.0-x86_64-server-migration-14-16-image: before 5.0.3-7.9.7

suse-manager-5.0-x86_64-server-hub-xmlrpc-api-image: before 5.0.3-6.9.5

suse-manager-5.0-x86_64-server-image: before 5.0.3-7.11.12

suse-manager-5.0-x86_64-proxy-httpd-image: before 5.0.3-7.9.12

suse-manager-5.0-x86_64-proxy-ssh-image: before 5.0.3-7.9.6

suse-manager-5.0-x86_64-proxy-salt-broker-image: before 5.0.3-7.9.14

suse-manager-5.0-x86_64-proxy-tftpd-image: before 5.0.3-7.9.6

suse-manager-5.0-x86_64-proxy-squid-image: before 5.0.3-7.9.6

suse-manager-5.0-s390x-proxy-ssh-image: before 5.0.3-7.9.6

suse-manager-5.0-s390x-proxy-tftpd-image: before 5.0.3-7.9.6

suse-manager-5.0-s390x-proxy-salt-broker-image: before 5.0.3-7.9.14

suse-manager-5.0-s390x-proxy-squid-image: before 5.0.3-7.9.6

suse-manager-5.0-s390x-proxy-httpd-image: before 5.0.3-7.9.12

suse-manager-5.0-ppc64le-proxy-salt-broker-image: before 5.0.3-7.9.14

suse-manager-5.0-ppc64le-proxy-ssh-image: before 5.0.3-7.9.6

suse-manager-5.0-ppc64le-proxy-httpd-image: before 5.0.3-7.9.12

suse-manager-5.0-ppc64le-proxy-tftpd-image: before 5.0.3-7.9.6

suse-manager-5.0-ppc64le-proxy-squid-image: before 5.0.3-7.9.6

suse-manager-5.0-aarch64-proxy-salt-broker-image: before 5.0.3-7.9.14

suse-manager-5.0-aarch64-proxy-httpd-image: before 5.0.3-7.9.12

suse-manager-5.0-aarch64-proxy-squid-image: before 5.0.3-7.9.6

suse-manager-5.0-aarch64-proxy-tftpd-image: before 5.0.3-7.9.6

suse-manager-5.0-aarch64-proxy-ssh-image: before 5.0.3-7.9.6

CPE2.3

External links

https://www.suse.com/support/update/announcement/2025/suse-ru-20250523-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Prototype pollution

EUVDB-ID: #VU97758