The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3878-1 advisory.

    hub-xmlrpc-api:

    - Use golang(API) = 1.18 for building on SUSE (bsc#1203599)       This source fails to build with the current go1.19 on SUSE and we       need to use go1.18 instead.

    inter-server-sync:

    - Version 0.2.4
      * Improve memory usage and log information #17193
      * Conditional insert check for FK reference exists (bsc#1202785)
      * Correct navigation path for table rhnerratafilechannel (bsc#1202785)

    locale-formula:

    - Update to version 0.3
      * Remove .map.gz from kb_map dictionary (bsc#1203406)

    py27-compat-salt:

    - Fix state.apply in test mode with file state module       on user/group checking (bsc#1202167)
    - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)

    python-urlgrabber:

    - Fix wrong logic on find_proxy method causing proxy not being used       (bsc#1201788)

    spacecmd:

    - Version 4.2.20-1
      * Remove 'Undefined return code' from debug messages (bsc#1203283)

    spacewalk-backend:

    - Version 4.2.25-1
      * Enhance passwords cleanup and add extra files in spacewalk-debug (bsc#1201059)
      * Prevent mixing credentials for proxy and repository server         while using basic authentication and avoid hiding errors         i.e. timeouts while having proxy settings issues         with extra logging in verbose mode (bsc#1201788)

    spacewalk-client-tools:

    - Version 4.2.21-1
      * Update translation strings

    spacewalk-java:

    - Version 4.2.43-1
      * CVE-2022-31255: Fix directory path traversal vulnerability (bsc#1204543)
      * CVE-2022-43754: Fix reflected cross site scripting vulnerability (bsc#1204741)
      * CVE-2022-43753: Fix arbitrary file disclosure vulnerability (bsc#1204716)
    - Version 4.2.42-1
      * Properly pass allow vendor change to salt state (bsc#1204203)
      * add ongres requirements to spec file (bsc#1203898)
      * Refresh pillar data (bsc#1197724)
      * Fix hardware update where there is no DNS FQDN changes (bsc#1203611)
      * Use mgrnet.dns_fqdns module to improve FQDN detection (bsc#1199726)
      * Support Pay-as-you-go new CA location for SLES15SP4         and higher (bsc#1202729)
      * Detect the clients running on Amazon EC2 (bsc#1195624)

    spacewalk-utils:

    - Version 4.2.18-1
      * Make spacewalk-hostname-rename working with settings.yaml         cobbler config file (bsc#1203564)

    spacewalk-web:

    - Version 4.2.30-1
      * Upgrade moment-timezone

    susemanager:

    - Version 4.2.38-1
      * add venv-salt-minion to bootstrap repo (bsc#1204146)

    susemanager-doc-indexes:

    - Documented that only SUSE clients are supported as monitoring servers       in the Administration Guide
    - Fixed description of default notification settings (bsc#1203422)
    - Added missing Debian 11 references
    - Removed references to Debian 9, as it is EoL, and therefore       unsupported by SUSE Manager
    - Document Helm deployment of the proxy on k3s and MetalLB in Installation       and Upgrade Guide
    - Added secure mail communication settings in Administration Guide
    - Fixed the incorrect path to state and pillar files in Salt Guide
    - Documented how pxeboot works with Secure Boot enabled in Client       Configuration Guide
    - Added SLE Micro 5.2 and 5.3 as available as a technology preview in       the Client Configuration Guide, and the IBM Z architecture for 5.1,       5.2, and 5.3

    susemanager-docs_en:

    - Documented that only SUSE clients are supported as monitoring servers       in the Administration Guide
    - Fixed description of default notification settings (bsc#1203422)
    - Added missing Debian 11 references
    - Removed references to Debian 9, as it is EoL, and therefore       unsupported by SUSE Manager
    - Document Helm deployment of the proxy on k3s and MetalLB in Installation       and Upgrade Guide
    - Added secure mail communication settings in Administration Guide
    - Fixed the incorrect path to state and pillar files in Salt Guide
    - Documented how pxeboot works with Secure Boot enabled in Client       Configuration Guide
    - Added SLE Micro 5.2 and 5.3 as available as a technology preview in       the Client Configuration Guide, and the IBM Z architecture for 5.1,       5.2, and 5.3

    susemanager-schema:

    - Version 4.2.25-1
      * Add subtypes for Amazon EC2 virtual instances (bsc#1195624)

    susemanager-sls:

    - Version 4.2.28-1
      * Fix mgrnet availability check
      * Remove dependence on Kiwi libraries
      * Use mgrnet.dns_fqdns module to improve FQDN detection (bsc#1199726)
      * Add mgrnet salt module with mgrnet.dns_fqnd function implementation         allowing to get all possible FQDNs from DNS (bsc#1199726)

    How to apply this update:

    1. Log in as root user to the SUSE Manager server.
    2. Stop the Spacewalk service:
    `spacewalk-service stop`     3. Apply the patch using either zypper patch or YaST Online Update.
    4. Start the Spacewalk service:
    `spacewalk-service start`

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

SUSE SLES15: hub-xmlrpc-api / inter-server-sync / locale-formula / etc (SUSE-SU-2022:3878-1)

medium Nessus Plugin ID 177784

Version 1.3

Version 1.2

Version 1.1

Version 1.0

Version 1.3 Jun 26, 2026, 4:08 PM Plugin metadata Plugin Feed: 202606261608
Version 1.2 Jul 14, 2023, 8:58 AM Plugin metadata Plugin Feed: 202307140858
Version 1.1 Jul 12, 2023, 5:37 PM Detection Plugin Feed: 202307121737
Version 1.0 Jun 30, 2023, 2:06 AM New Plugin Feed: 202306300206