Security update 5.1.1.1 for Multi-Linux Manager Client Tools SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2025:4446-1 Final 1 1 2025-12-18T08:49:58Z current 2025-12-18T08:49:58Z 2025-12-18T08:49:58Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update 5.1.1.1 for Multi-Linux Manager Client Tools This update fixes the following issues: grafana was updated from version 11.5.7 to 11.5.10: - Security issues fixed: * CVE-2025-64751: Drop experimental implementation of authorization Zanzana server/client (version 11.5.10) (bsc#1254113) * CVE-2025-47911: Fix parsing HTML documents (version 11.5.10) (bsc#1251454) * CVE-2025-58190: Fix excessive memory consumption (version 11.5.10) (bsc#1251657) * CVE-2025-11065: Fixed sensitive information leak in logs (version 11.5.9) (bsc#1250616) - Other changes, new features and bugs fixed: * Version 11.5.10: + Use forked wire from Grafana repository instead of external package (jsc#PED-14178) + Auth: Fix render user OAuth passthrough. + LDAP Authentication: Fix URL to propagate username context as parameter. + Plugins: Dependencies do not inherit parent URL for preinstall. * Version 11.5.9: + Auditing: Document new options for recording datasource query request/response body. + Login: Fixed redirection after login when Grafana is served from subpath. * Update to version 11.5.8: + No relevant changes uyuni-tools: - version 5.1.23-0 * Update the default tag to 5.1.1.1 - version 5.1.22-0 * Fix cobbler config migration to standalone files * Fix generated DB certificate subject alternate names - version 5.1.21-0 * Remove extraneous quotes when getting the running image (bsc#1249434) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2025-4446,SUSE-MultiLinuxManagerTools-SLE-15-2025-4446,SUSE-MultiLinuxManagerTools-SLE-Micro-5-2025-4446 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2025/suse-su-20254446-1/ Link for SUSE-SU-2025:4446-1 https://lists.suse.com/pipermail/sle-security-updates/2025-December/023607.html E-Mail link for SUSE-SU-2025:4446-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1249434 SUSE Bug 1249434 https://bugzilla.suse.com/1250616 SUSE Bug 1250616 https://bugzilla.suse.com/1251454 SUSE Bug 1251454 https://bugzilla.suse.com/1251657 SUSE Bug 1251657 https://bugzilla.suse.com/1254113 SUSE Bug 1254113 https://www.suse.com/security/cve/CVE-2025-11065/ SUSE CVE CVE-2025-11065 page https://www.suse.com/security/cve/CVE-2025-47911/ SUSE CVE CVE-2025-47911 page https://www.suse.com/security/cve/CVE-2025-58190/ SUSE CVE CVE-2025-58190 page https://www.suse.com/security/cve/CVE-2025-64751/ SUSE CVE CVE-2025-64751 page SUSE Multi Linux Manager Tools SLE-15 SUSE Multi Linux Manager Tools SLE-Micro-5 grafana-11.5.10-150002.4.6.1 mgrctl-5.1.23-150002.3.6.1 mgrctl-bash-completion-5.1.23-150002.3.6.1 mgrctl-lang-5.1.23-150002.3.6.1 mgrctl-zsh-completion-5.1.23-150002.3.6.1 grafana-11.5.10-150002.4.6.1 as a component of SUSE Multi Linux Manager Tools SLE-15 mgrctl-5.1.23-150002.3.6.1 as a component of SUSE Multi Linux Manager Tools SLE-15 mgrctl-bash-completion-5.1.23-150002.3.6.1 as a component of SUSE Multi Linux Manager Tools SLE-15 mgrctl-lang-5.1.23-150002.3.6.1 as a component of SUSE Multi Linux Manager Tools SLE-15 mgrctl-zsh-completion-5.1.23-150002.3.6.1 as a component of SUSE Multi Linux Manager Tools SLE-15 mgrctl-5.1.23-150002.3.6.1 as a component of SUSE Multi Linux Manager Tools SLE-Micro-5 mgrctl-bash-completion-5.1.23-150002.3.6.1 as a component of SUSE Multi Linux Manager Tools SLE-Micro-5 mgrctl-lang-5.1.23-150002.3.6.1 as a component of SUSE Multi Linux Manager Tools SLE-Micro-5 mgrctl-zsh-completion-5.1.23-150002.3.6.1 as a component of SUSE Multi Linux Manager Tools SLE-Micro-5 unknown CVE-2025-11065 SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1 SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1 SUSE Multi Linux Manager Tools SLE-15:mgrctl-bash-completion-5.1.23-150002.3.6.1 SUSE Multi Linux Manager Tools SLE-15:mgrctl-lang-5.1.23-150002.3.6.1 SUSE Multi Linux Manager Tools SLE-15:mgrctl-zsh-completion-5.1.23-150002.3.6.1 SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1 SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-bash-completion-5.1.23-150002.3.6.1 SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-lang-5.1.23-150002.3.6.1 SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-zsh-completion-5.1.23-150002.3.6.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20254446-1/ https://www.suse.com/security/cve/CVE-2025-11065.html CVE-2025-11065 https://bugzilla.suse.com/1250608 SUSE Bug 1250608 unknown CVE-2025-47911 SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1 SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1 SUSE Multi Linux Manager Tools SLE-15:mgrctl-bash-completion-5.1.23-150002.3.6.1 SUSE Multi Linux Manager Tools SLE-15:mgrctl-lang-5.1.23-150002.3.6.1 SUSE Multi Linux Manager Tools SLE-15:mgrctl-zsh-completion-5.1.23-150002.3.6.1 SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1 SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-bash-completion-5.1.23-150002.3.6.1 SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-lang-5.1.23-150002.3.6.1 SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-zsh-completion-5.1.23-150002.3.6.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20254446-1/ https://www.suse.com/security/cve/CVE-2025-47911.html CVE-2025-47911 https://bugzilla.suse.com/1251308 SUSE Bug 1251308 unknown CVE-2025-58190 SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1 SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1 SUSE Multi Linux Manager Tools SLE-15:mgrctl-bash-completion-5.1.23-150002.3.6.1 SUSE Multi Linux Manager Tools SLE-15:mgrctl-lang-5.1.23-150002.3.6.1 SUSE Multi Linux Manager Tools SLE-15:mgrctl-zsh-completion-5.1.23-150002.3.6.1 SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1 SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-bash-completion-5.1.23-150002.3.6.1 SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-lang-5.1.23-150002.3.6.1 SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-zsh-completion-5.1.23-150002.3.6.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20254446-1/ https://www.suse.com/security/cve/CVE-2025-58190.html CVE-2025-58190 https://bugzilla.suse.com/1251309 SUSE Bug 1251309 OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.4.0 to v1.11.0 ( openfga-0.1.34 <= Helm chart <= openfga-0.2.48, v.1.4.0 <= docker <= v.1.11.0) are vulnerable to improper policy enforcement when certain Check and ListObject calls are executed. This issue has been patched in version 1.11.1. CVE-2025-64751 SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1 SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1 SUSE Multi Linux Manager Tools SLE-15:mgrctl-bash-completion-5.1.23-150002.3.6.1 SUSE Multi Linux Manager Tools SLE-15:mgrctl-lang-5.1.23-150002.3.6.1 SUSE Multi Linux Manager Tools SLE-15:mgrctl-zsh-completion-5.1.23-150002.3.6.1 SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1 SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-bash-completion-5.1.23-150002.3.6.1 SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-lang-5.1.23-150002.3.6.1 SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-zsh-completion-5.1.23-150002.3.6.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20254446-1/ https://www.suse.com/security/cve/CVE-2025-64751.html CVE-2025-64751 https://bugzilla.suse.com/1254112 SUSE Bug 1254112