SUSE SLED15 / SLES15 : Recommended update for suse-migration-sle16-activation, SLES16-Migration, SLES16-SAP_Migration, suse-migration-services, suse-migration-rpm, wicked2nm, image-janitor (SUSE-SU-SUSE-RU-2025:4131-1)

medium Nessus Plugin ID 275759

Language:

Synopsis

The remote SUSE host is missing a security update.

Description

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-SUSE-RU-2025:4131-1 advisory.

Changes for suse-migration-sle16-activation:

- Simplify interface naming by disabling predictable names at boot
- shellcheck heavily complained
- check migration target before testing for architecture version
- Create systemd.link files for virtual VMware/Hyper-V NICs
- Add changes for newest wicked2nm
- Activation packages can no longer be noarch
- Architecture check before allowing migration to be activated
- Add missing pre snapshot setup to run_migration
- Add wicked2nm network migration
- Setup ExclusiveArch for activation packages
- Make activation package require by provides tag
- Fix product related requirement settings

Changes for SLES16-Migration:

- Added .ssh directory for migration user
- Add etc/motd overlay file Print message how to show migration progress information
- Fix build on more architectures
- Initial changelog

Changes for SLES16-SAP_Migration:

- Support wicked2nm migration
- Migration live image for SLES4SAP 15 to 16

Changes for suse-migration-services:

- Set systemd offline for Zypper in chroot mode
- Fix apparmor install procedure
- Fixed azuremetadata device lookup
- Use of f-strings not allowed in the DMS
- Simplify interface naming by disabling predictable names at boot
- Fixed test_check_lsm_migration unit test
- Fix setup_host_network_test by mocking os.makedirs
- wicked2nm: log network state on nm-online failure
- Fixed LSM pre checks to be more robust
- shellcheck heavily complained
- Do not evaluate wicked2nm output in precheck
- Fix unit test for lsm check
- prechecks/lsm.py: remove _apparmor_analyze_profiles()
- LSM migration check for AppArmor -> SELinux
- Improve pre-check message
- Fix MinSLEVersion value depending on target
- reduce package set on migration image
- Fixed behavior of wicked2m pre check
- implementation of sshd root login pre-check
- Fixed selinux to apparmor migration
- Fixed reading of migration config for target class
- Add recursion guard to MigrationConfig::_merge_config_dicts
- shrink migration image
- container/sle16/config.sh
- sle16/config.sh - use dropin for s390 migration-config
- doc: fix indentation
- check for migration target by matching ISO file name
- config: introduce dropin dir migration-config.d/
- Apply SLE16 live image setup to container setup
- bind mount only required subdirectories under /run into chroot
- Add missing package requirement
- check migration target before testing for architecture version
- setup_host_network: simplify code - use os.makedirs()
- Create systemd.link files for virtual VMware/Hyper-V NIC
- Preserve systemd.link files from /etc/systemd/network/
- Add changes for the newest wicked2nm
- Ensure wicked2nm is a dependency of pre-checks for SLE 16 migration
- Activation packages can no longer be noarch
- Fix update of image .changes files
- Architecture check before allowing migration to be activated
- Improve error logs when wicked2nm fails
- Include image changelog to version bump
- Ensure wicked2nm migration is always running, despite warnings
- Fix: add --no-recommends on patterns-base-selinux installation
- Update suse-migration-services for container use
- Update SLE16 migration container
- Update SAP live migration image
- Add missing pre snapshot setup to run_migration
- Follow up fix for the wicked to nm migration
- Add wicked2nm network migration
- Add glob support to preserve_files
- Setup ExclusiveArch for activation packages
- Build sles4sap migration for cloud on x86_64 only
- Do not build sles4sap migration on s390x
- Use systemctl kexec
- Fix: return the correct kernel path based on machine type
- Fixed glob pattern match for package name
- Remove menitoning of SLES 12-SP4
- Make activation package require by provides tag
- Added SLES16-SAP_Migration live image
- Do not use list[str] type hint
- Fix error evaluation from offline_migrations API
- Fix logging from non unit files
- Fix product related requirement settings
- Repos for migration image must be in kiwi
- Added .ssh to migration user for SAP 15 live image
- Added SLES15-SAP_Migration Makefile target
- Add proper release package for SLE16 migration
- Fix typo in service name
- Drop obsolete check for resolv.conf
- Fix migration user home dir setup for SLE16
- Update README_QA.rst
- test: split unit test for setup_name_resolver
- Install patterns-base-selinux for Apparmor migration
- Ensure the rebuild counter is not stripped from the rpm
- Exit silently if no migration iso is found
- Ensure rpmlintrc file is part of suse-migration-services SRPM
- Ignore fixup! entries when generating changelog
- Increase python test matrix
- Remove redundanct requires on itself
- Fix ordering of pre-checks and actual migration
- Add SLES15-Migration target to Makefile
- Fix suse-migration-console-log service
- Fix typo in REA- Activate only connections if present in the current system
- Improve error output, exit codes and add flag to disable user hints
- Add support for autoip-fallback
- Issue only a info when dhcp.update is non default
- Add ipv4_static broadcast
- Apply dhcp settings to mirror wicked client id
- Fix test.sh, fail if migration succeed but expect fail
- Fix sysctl handling
- Avoid cloning in parsing of route
- Fix continue migration to show all warnings beforehand
- Improve warning messages - show interface, element names
- Remove unwrap in route parsing
- bump slab from 0.4.10 to 0.4.11 to address CVE-2025-55159 (bsc#1248010)
- Fix netconfig handling with proper priority setting
- Add ovs support
- Use agama-network instead of agama-(lib|server)
- Only activate connections marked with autostart
- Give hint in error message how to ignore warnings
- Update README.md with updated installation and usage infos
- Add support for Leap 15
- Remove BuildRequires that are no longer necessary due to the agama-network switch.
- The agama-network switch also removes the vulnerable and unmaintained 'users' crate from the dependencies. (bsc#1244188)DME_QA
- Fix: split name resolver setup into its own service
- Fix: set path according to current arch in grub.d/99_migration
- Add support to enable single rpm transaction for upgrade
- enable suse-migration-ha.service in the migration image
- Migration for high availability extension
- RPM wrapper fixes
- Cleanup secfile to follow python singlespec policy
- Support product specifier in ISO name
- Ensure sle16 images can build on all supported platforms
- Use name pattern compatible to suse-migration-rpm
- Fix SLE15 migration images
- SAP product should migrate to 15 SP4
- Add SLES15-SAP-Migration
- Bump target to SLE15 SP7
- Update bumpversion config Include sle16 container build to version bump
- Handle selinux boot option when using kexec
- Ensure migration to SLES16 uses selinux, not apparmor
- improve os-release parsing
- Ensure SLES16 is also detected in SCC precheck
- Add high availablity extension check
- Fix package names for python packages on SLE16
- Relax on the shim-install call
- Fixup package name for SLE16 and SLE16 container
- Fix changelog references for activation packages
- Add product migration check

Changes for suse-migration-rpm:

- Fix MinSLEVersion value depending on target
- Add product requirement according to image name.
- Exit silently if no migration iso is found.
- Add build and perl(Date::Parse) to ensure we can append changelog entries to generated package.

Changes for wicked2nm:

- Activate only connections if present in the current system
- Improve error output, exit codes and add flag to disable user hints
- Add support for autoip-fallback
- Issue only a info when dhcp.update is non default
- Add ipv4_static broadcast
- Apply dhcp settings to mirror wicked client id
- Fix test.sh, fail if migration succeed but expect fail
- Fix sysctl handling
- Avoid cloning in parsing of route
- Fix continue migration to show all warnings beforehand
- Improve warning messages - show interface, element names
- Remove unwrap in route parsing
- bump slab from 0.4.10 to 0.4.11 to address CVE-2025-55159 (bsc#1248010)
- Fix netconfig handling with proper priority setting
- Add ovs support
- Use agama-network instead of agama-(lib|server)
- Only activate connections marked with autostart
- Give hint in error message how to ignore warnings
- Update README.md with updated installation and usage infos
- Add support for Leap 15
- Remove BuildRequires that are no longer necessary due to the agama-network switch.
- The agama-network switch also removes the vulnerable and unmaintained 'users' crate from the dependencies. (bsc#1244188)

Chages for image-janitor:
- Fix packaging (add doc, license)
- Release 0.2.0 with configuration files packaged
- Initial packag

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: Medium

ID: 275759

File Name: suse_SU-RU-2025-4131-1.nasl

Version: 1.1

Type: local

Agent: unix

Family: SuSE Local Security Checks

Published: 11/19/2025

Updated: 11/19/2025

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.7

CVSS v2

Risk Factor: Medium

Base Score: 5.2

Temporal Score: 3.8

Vector: CVSS2#AV:L/AC:H/Au:N/C:P/I:P/A:C

CVSS Score Source: CVE-2025-55159

CVSS v3

Risk Factor: Medium

Base Score: 5.8

Temporal Score: 5.1

Vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 5.1

Threat Score: 1.2

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:suse-migration-pre-checks, p-cpe:/a:novell:suse_linux:wicked2nm, p-cpe:/a:novell:suse_linux:sles16-migration, p-cpe:/a:novell:suse_linux:python3-cerberus, p-cpe:/a:novell:suse_linux:sles16-sap_migration, p-cpe:/a:novell:suse_linux:python3-migration, p-cpe:/a:novell:suse_linux:suse-migration-sle16-activation, cpe:/o:novell:suse_linux:15

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 11/18/2025

Vulnerability Publication Date: 8/11/2025

Reference Information

CVE: CVE-2025-55159

SuSE: SUSE-RU-2025:4131-1

Detections

Analytics

SUSE SLED15 / SLES15 : Recommended update for suse-migration-sle16-activation, SLES16-Migration, SLES16-SAP_Migration, suse-migration-services, suse-migration-rpm, wicked2nm, image-janitor (SUSE-SU-SUSE-RU-2025:4131-1)

medium Nessus Plugin ID 275759

Synopsis

Description

Solution

See Also

Plugin Details

Risk Information

VPR

CVSS v2

CVSS v3

CVSS v4

Vulnerability Information

Reference Information