Описание
Security update for salt
This update for salt contains the following fixes:
-
Fix for TypeError in Tornado importer (bsc#1174165)
-
Require python3-distro only for TW (bsc#1173072)
-
Update to Salt version 3000: See release notes: https://docs.saltstack.com/en/latest/topics/releases/3000.html
-
Add docker.logout to docker execution module. (bsc#1165572)
-
Add option to enable/disable force refresh for zypper.
-
Add publish_batch to ClearFuncs exposed methods.
-
Adds test for zypper abbreviation fix.
-
Avoid segfault from 'salt-api' under certain conditions of heavy load managing SSH minions. (bsc#1169604)
-
Avoid traceback on debug logging for swarm module. (bsc#1172075)
-
Batch mode now also correctly provides return value. (bsc#1168340)
-
Better import cache handline.
-
Do not make file.recurse state to fail when msgpack 0.5.4. (bsc#1167437)
-
Do not require vendored backports-abc. (bsc#1170288)
-
Fix errors from unit tests due NO_MOCK and NO_MOCK_REASON deprecation.
-
Fix for low rpm_lowpkg unit test.
-
Fix for temp folder definition in loader unit test.
-
Fix for unless requisite when pip is not installed.
-
Fix integration test failure for test_mod_del_repo_multiline_values.
-
Fix regression in service states with reload argument.
-
Fix tornado imports and missing _utils after rebasing patches.
-
Fix status attribute issue in aptpkg test.
-
Improved storage pool or network handling.
-
loop: fix variable names for until_no_eval.
-
Make 'salt.ext.tornado.gen' to use 'salt.ext.backports_abc' on Python 2.
-
Make setup.py script not to require setuptools greater than 9.1.
-
More robust remote port detection.
-
Prevent sporious 'salt-api' stuck processes when managing SSH minions. because of logging deadlock. (bsc#1159284)
-
Python3.8 compatibility changes.
-
Removes unresolved merge conflict in yumpkg module.
-
Returns a the list of IPs filtered by the optional network list.
-
Revert broken changes to slspath made on Salt 3000 (saltstack/salt#56341). (bsc#1170104)
-
Sanitize grains loaded from roster_grains.json cache during 'state.pkg'.
-
Various virt backports from 3000.2.
-
zypperpkg: filter patterns that start with dot. (bsc#1171906)
Список пакетов
Image SLES15-SP1-Azure-BYOS
Image SLES15-SP1-Azure-HPC-BYOS
Image SLES15-SP1-EC2-HPC-HVM-BYOS
Image SLES15-SP1-EC2-HVM-BYOS
Image SLES15-SP1-GCE-BYOS
Image SLES15-SP1-Manager-4-0-Azure-BYOS-Proxy
Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server
Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Proxy
Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server
Image SLES15-SP1-Manager-4-0-GCE-BYOS-Proxy
Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server
Image SLES15-SP1-SAP-Azure-BYOS
Image SLES15-SP1-SAP-EC2-HVM-BYOS
Image SLES15-SP1-SAP-GCE
Image SLES15-SP1-SAP-GCE-BYOS
SUSE Linux Enterprise Module for Basesystem 15 SP1
SUSE Linux Enterprise Module for Python 2 15 SP1
SUSE Linux Enterprise Module for Server Applications 15 SP1
Ссылки
- Link for SUSE-SU-2020:1974-1
- E-Mail link for SUSE-SU-2020:1974-1
- SUSE Security Ratings
- SUSE Bug 1159284
- SUSE Bug 1165572
- SUSE Bug 1167437
- SUSE Bug 1168340
- SUSE Bug 1169604
- SUSE Bug 1170104
- SUSE Bug 1170288
- SUSE Bug 1171906
- SUSE Bug 1172075
- SUSE Bug 1173072
- SUSE Bug 1174165
- SUSE CVE CVE-2018-15750 page
- SUSE CVE CVE-2018-15751 page
- SUSE CVE CVE-2020-11651 page
- SUSE CVE CVE-2020-11652 page
Описание
Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to determine which files exist on the server.
Затронутые продукты
Ссылки
- CVE-2018-15750
- SUSE Bug 1113698
Описание
SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands via salt-api(netapi).
Затронутые продукты
Ссылки
- CVE-2018-15751
- SUSE Bug 1113698
- SUSE Bug 1113699
Описание
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.
Затронутые продукты
Ссылки
- CVE-2020-11651
- SUSE Bug 1170595
Описание
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.
Затронутые продукты
Ссылки
- CVE-2020-11652
- SUSE Bug 1170595