Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2020:14538-1

Опубликовано: 06 нояб. 2020
Источник: suse-cvrf

Описание

Security update for SUSE Manager Client Tools

This update fixes the following issues:

cobbler:

  • Fix parsing cobbler dictionary options with values containing '=', e.g. kernel params containing '=' (bsc#1176978)

mgr-daemon:

  • Update translation strings

salt:

  • Properly validate eauth credentials and tokens on SSH calls made by Salt API (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846)

spacecmd:

  • Python3 fixes for errata in spacecmd (bsc#1169664)
  • Added support for i18n of user-facing strings
  • Python3 fix for sorted usage (bsc#1167907)

spacewalk-client-tools:

  • Remove RH references in Python/Ruby localization and use the product name instead

Список пакетов

SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS
koan-2.2.2-0.68.12.1
mgr-daemon-4.1.3-5.20.1
python2-spacewalk-check-4.1.7-27.38.1
python2-spacewalk-client-setup-4.1.7-27.38.1
python2-spacewalk-client-tools-4.1.7-27.38.1
salt-2016.11.10-43.63.1
salt-doc-2016.11.10-43.63.1
salt-minion-2016.11.10-43.63.1
spacecmd-4.1.8-18.72.1
spacewalk-check-4.1.7-27.38.1
spacewalk-client-setup-4.1.7-27.38.1
spacewalk-client-tools-4.1.7-27.38.1
SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS
koan-2.2.2-0.68.12.1
mgr-daemon-4.1.3-5.20.1
python2-spacewalk-check-4.1.7-27.38.1
python2-spacewalk-client-setup-4.1.7-27.38.1
python2-spacewalk-client-tools-4.1.7-27.38.1
salt-2016.11.10-43.63.1
salt-doc-2016.11.10-43.63.1
salt-minion-2016.11.10-43.63.1
spacecmd-4.1.8-18.72.1
spacewalk-check-4.1.7-27.38.1
spacewalk-client-setup-4.1.7-27.38.1
spacewalk-client-tools-4.1.7-27.38.1

Ссылки

Описание

An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.

Затронутые продукты
SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:koan-2.2.2-0.68.12.1
SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:mgr-daemon-4.1.3-5.20.1
SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:python2-spacewalk-check-4.1.7-27.38.1
SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:python2-spacewalk-client-setup-4.1.7-27.38.1
Ссылки

Описание

The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.

Затронутые продукты
SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:koan-2.2.2-0.68.12.1
SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:mgr-daemon-4.1.3-5.20.1
SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:python2-spacewalk-check-4.1.7-27.38.1
SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:python2-spacewalk-client-setup-4.1.7-27.38.1
Ссылки

Описание

In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH.

Затронутые продукты
SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:koan-2.2.2-0.68.12.1
SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:mgr-daemon-4.1.3-5.20.1
SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:python2-spacewalk-check-4.1.7-27.38.1
SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:python2-spacewalk-client-setup-4.1.7-27.38.1
Ссылки
Уязвимость SUSE-SU-2020:14538-1