Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2021:2102-1

Опубликовано: 21 июн. 2021
Источник: suse-cvrf

Описание

Security update for Salt

This update fixes the following issues:

salt:

  • Parsing Epoch out of version provided during pkg remove (bsc#1173692)
  • Fix issue parsing errors in ansiblegate state module
  • Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
  • Transactional_update: detect recursion in the executor
  • Add subpackage salt-transactional-update
  • Remove duplicate directories from specfile
  • Improvements on 'ansiblegate' module (bsc#1185092):
    • New methods: ansible.targets / ansible.discover_playbooks
    • General bugfixes
  • Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
  • Regression fix of salt-ssh on processing targets
  • Update target fix for salt-ssh and avoiding race condition on salt-ssh event processing (bsc#1179831, bsc#1182281)
  • Add notify beacon for Debian/Ubuntu systems
  • Fix zmq bug that causes salt-call to freeze (bsc#1181368)

Список пакетов

Image SLES12-SP4-Azure-BYOS
python2-salt-3000-46.142.2
salt-3000-46.142.2
salt-minion-3000-46.142.2
Image SLES12-SP4-EC2-HVM-BYOS
python2-salt-3000-46.142.2
salt-3000-46.142.2
salt-minion-3000-46.142.2
Image SLES12-SP4-GCE-BYOS
python2-salt-3000-46.142.2
salt-3000-46.142.2
salt-minion-3000-46.142.2
Image SLES12-SP4-SAP-Azure-BYOS
python2-salt-3000-46.142.2
salt-3000-46.142.2
salt-minion-3000-46.142.2
Image SLES12-SP4-SAP-EC2-HVM-BYOS
python2-salt-3000-46.142.2
salt-3000-46.142.2
salt-minion-3000-46.142.2
Image SLES12-SP4-SAP-GCE-BYOS
python2-salt-3000-46.142.2
salt-3000-46.142.2
salt-minion-3000-46.142.2
Image SLES12-SP5-Azure-BYOS
python2-salt-3000-46.142.2
salt-3000-46.142.2
salt-minion-3000-46.142.2
Image SLES12-SP5-Azure-HPC-BYOS
python2-salt-3000-46.142.2
salt-3000-46.142.2
salt-minion-3000-46.142.2
Image SLES12-SP5-Azure-SAP-BYOS
python2-salt-3000-46.142.2
salt-3000-46.142.2
salt-minion-3000-46.142.2
Image SLES12-SP5-EC2-BYOS
python2-salt-3000-46.142.2
salt-3000-46.142.2
salt-minion-3000-46.142.2
Image SLES12-SP5-EC2-SAP-BYOS
python2-salt-3000-46.142.2
salt-3000-46.142.2
salt-minion-3000-46.142.2
Image SLES12-SP5-GCE-BYOS
python2-salt-3000-46.142.2
salt-3000-46.142.2
salt-minion-3000-46.142.2
Image SLES12-SP5-GCE-SAP-BYOS
python2-salt-3000-46.142.2
salt-3000-46.142.2
salt-minion-3000-46.142.2
SUSE Linux Enterprise Module for Advanced Systems Management 12
python2-salt-3000-46.142.2
salt-3000-46.142.2
salt-api-3000-46.142.2
salt-bash-completion-3000-46.142.2
salt-cloud-3000-46.142.2
salt-doc-3000-46.142.2
salt-master-3000-46.142.2
salt-minion-3000-46.142.2
salt-proxy-3000-46.142.2
salt-ssh-3000-46.142.2
salt-standalone-formulas-configuration-3000-46.142.2
salt-syndic-3000-46.142.2
salt-zsh-completion-3000-46.142.2
SUSE Manager Client Tools 12
python2-salt-3000-46.142.2
python3-salt-3000-46.142.2
salt-3000-46.142.2
salt-doc-3000-46.142.2
salt-minion-3000-46.142.2

Ссылки

Описание

In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely).

Затронутые продукты
Image SLES12-SP4-Azure-BYOS:python2-salt-3000-46.142.2
Image SLES12-SP4-Azure-BYOS:salt-3000-46.142.2
Image SLES12-SP4-Azure-BYOS:salt-minion-3000-46.142.2
Image SLES12-SP4-EC2-HVM-BYOS:python2-salt-3000-46.142.2
Ссылки
Уязвимость SUSE-SU-2021:2102-1