Описание
Security update for salt
This update for salt fixes the following issues:
Update to Salt release version 3002.2 (jsc#ECO-3212, jsc#SLE-18033, jsc#SLE-18028)
- Check if dpkgnotify is executable (bsc#1186674)
- Drop support for Python2. Obsoletes
python2-saltpackage (jsc#SLE-18028) - virt module updates
- network: handle missing ipv4 netmask attribute
- more network support
- PCI/USB host devices passthrough support
- Set distro requirement to oldest supported version in requirements/base.txt
- Bring missing part of async batch implementation back (bsc#1182382, CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Remove deprecated warning that breaks minion execution when 'server_id_use_crc' opts is missing
- Fix pkg states when DEB package has 'all' arch
- Do not force beacons configuration to be a list.
- Remove msgpack < 1.0.0 from base requirements (bsc#1176293)
- msgpack support for version >= 1.0.0 (bsc#1171257)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281, CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18033)
- Remove duplicate directories from specfile
- Improvements on 'ansiblegate' module (bsc#1185092):
- New methods: ansible.targets / ansible.discover_playbooks
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Regression fix of salt-ssh on processing targets
- Update target fix for salt-ssh and avoiding race condition on salt-ssh event processing (bsc#1179831, bsc#1182281)
- Add notify beacon for Debian/Ubuntu systems
- Fix zmq bug that causes salt-call to freeze (bsc#1181368)
Список пакетов
Image SLES15-SP1-Azure-BYOS
python3-salt-3002.2-37.1
salt-3002.2-37.1
salt-minion-3002.2-37.1
Image SLES15-SP1-Azure-HPC-BYOS
python3-salt-3002.2-37.1
salt-3002.2-37.1
salt-minion-3002.2-37.1
Image SLES15-SP1-EC2-HPC-HVM-BYOS
python3-salt-3002.2-37.1
salt-3002.2-37.1
salt-minion-3002.2-37.1
Image SLES15-SP1-EC2-HVM-BYOS
python3-salt-3002.2-37.1
salt-3002.2-37.1
salt-minion-3002.2-37.1
Image SLES15-SP1-GCE-BYOS
python3-salt-3002.2-37.1
salt-3002.2-37.1
salt-minion-3002.2-37.1
Image SLES15-SP1-SAP-Azure-BYOS
python3-salt-3002.2-37.1
salt-3002.2-37.1
salt-minion-3002.2-37.1
Image SLES15-SP1-SAP-EC2-HVM-BYOS
python3-salt-3002.2-37.1
salt-3002.2-37.1
salt-minion-3002.2-37.1
Image SLES15-SP1-SAP-GCE
python3-salt-3002.2-37.1
salt-3002.2-37.1
salt-minion-3002.2-37.1
Image SLES15-SP1-SAP-GCE-BYOS
python3-salt-3002.2-37.1
salt-3002.2-37.1
salt-minion-3002.2-37.1
SUSE Enterprise Storage 6
python3-salt-3002.2-37.1
salt-3002.2-37.1
salt-api-3002.2-37.1
salt-bash-completion-3002.2-37.1
salt-cloud-3002.2-37.1
salt-doc-3002.2-37.1
salt-fish-completion-3002.2-37.1
salt-master-3002.2-37.1
salt-minion-3002.2-37.1
salt-proxy-3002.2-37.1
salt-ssh-3002.2-37.1
salt-standalone-formulas-configuration-3002.2-37.1
salt-syndic-3002.2-37.1
salt-transactional-update-3002.2-37.1
salt-zsh-completion-3002.2-37.1
SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS
python3-salt-3002.2-37.1
salt-3002.2-37.1
salt-api-3002.2-37.1
salt-bash-completion-3002.2-37.1
salt-cloud-3002.2-37.1
salt-doc-3002.2-37.1
salt-fish-completion-3002.2-37.1
salt-master-3002.2-37.1
salt-minion-3002.2-37.1
salt-proxy-3002.2-37.1
salt-ssh-3002.2-37.1
salt-standalone-formulas-configuration-3002.2-37.1
salt-syndic-3002.2-37.1
salt-transactional-update-3002.2-37.1
salt-zsh-completion-3002.2-37.1
SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS
python3-salt-3002.2-37.1
salt-3002.2-37.1
salt-api-3002.2-37.1
salt-bash-completion-3002.2-37.1
salt-cloud-3002.2-37.1
salt-doc-3002.2-37.1
salt-fish-completion-3002.2-37.1
salt-master-3002.2-37.1
salt-minion-3002.2-37.1
salt-proxy-3002.2-37.1
salt-ssh-3002.2-37.1
salt-standalone-formulas-configuration-3002.2-37.1
salt-syndic-3002.2-37.1
salt-transactional-update-3002.2-37.1
salt-zsh-completion-3002.2-37.1
SUSE Linux Enterprise Server 15 SP1-BCL
python3-salt-3002.2-37.1
salt-3002.2-37.1
salt-api-3002.2-37.1
salt-bash-completion-3002.2-37.1
salt-cloud-3002.2-37.1
salt-doc-3002.2-37.1
salt-fish-completion-3002.2-37.1
salt-master-3002.2-37.1
salt-minion-3002.2-37.1
salt-proxy-3002.2-37.1
salt-ssh-3002.2-37.1
salt-standalone-formulas-configuration-3002.2-37.1
salt-syndic-3002.2-37.1
salt-transactional-update-3002.2-37.1
salt-zsh-completion-3002.2-37.1
SUSE Linux Enterprise Server 15 SP1-LTSS
python3-salt-3002.2-37.1
salt-3002.2-37.1
salt-api-3002.2-37.1
salt-bash-completion-3002.2-37.1
salt-cloud-3002.2-37.1
salt-doc-3002.2-37.1
salt-fish-completion-3002.2-37.1
salt-master-3002.2-37.1
salt-minion-3002.2-37.1
salt-proxy-3002.2-37.1
salt-ssh-3002.2-37.1
salt-standalone-formulas-configuration-3002.2-37.1
salt-syndic-3002.2-37.1
salt-transactional-update-3002.2-37.1
salt-zsh-completion-3002.2-37.1
SUSE Linux Enterprise Server for SAP Applications 15 SP1
python3-salt-3002.2-37.1
salt-3002.2-37.1
salt-api-3002.2-37.1
salt-bash-completion-3002.2-37.1
salt-cloud-3002.2-37.1
salt-doc-3002.2-37.1
salt-fish-completion-3002.2-37.1
salt-master-3002.2-37.1
salt-minion-3002.2-37.1
salt-proxy-3002.2-37.1
salt-ssh-3002.2-37.1
salt-standalone-formulas-configuration-3002.2-37.1
salt-syndic-3002.2-37.1
salt-transactional-update-3002.2-37.1
salt-zsh-completion-3002.2-37.1
SUSE Manager Proxy 4.0
python3-salt-3002.2-37.1
salt-3002.2-37.1
salt-api-3002.2-37.1
salt-bash-completion-3002.2-37.1
salt-cloud-3002.2-37.1
salt-doc-3002.2-37.1
salt-fish-completion-3002.2-37.1
salt-master-3002.2-37.1
salt-minion-3002.2-37.1
salt-proxy-3002.2-37.1
salt-ssh-3002.2-37.1
salt-standalone-formulas-configuration-3002.2-37.1
salt-syndic-3002.2-37.1
salt-transactional-update-3002.2-37.1
salt-zsh-completion-3002.2-37.1
SUSE Manager Retail Branch Server 4.0
python3-salt-3002.2-37.1
salt-3002.2-37.1
salt-api-3002.2-37.1
salt-bash-completion-3002.2-37.1
salt-cloud-3002.2-37.1
salt-doc-3002.2-37.1
salt-fish-completion-3002.2-37.1
salt-master-3002.2-37.1
salt-minion-3002.2-37.1
salt-proxy-3002.2-37.1
salt-ssh-3002.2-37.1
salt-standalone-formulas-configuration-3002.2-37.1
salt-syndic-3002.2-37.1
salt-transactional-update-3002.2-37.1
salt-zsh-completion-3002.2-37.1
SUSE Manager Server 4.0
python3-salt-3002.2-37.1
salt-3002.2-37.1
salt-api-3002.2-37.1
salt-bash-completion-3002.2-37.1
salt-cloud-3002.2-37.1
salt-doc-3002.2-37.1
salt-fish-completion-3002.2-37.1
salt-master-3002.2-37.1
salt-minion-3002.2-37.1
salt-proxy-3002.2-37.1
salt-ssh-3002.2-37.1
salt-standalone-formulas-configuration-3002.2-37.1
salt-syndic-3002.2-37.1
salt-transactional-update-3002.2-37.1
salt-zsh-completion-3002.2-37.1
Ссылки
- Link for SUSE-SU-2021:2105-1
- E-Mail link for SUSE-SU-2021:2105-1
- SUSE Security Ratings
- SUSE Bug 1171257
- SUSE Bug 1176293
- SUSE Bug 1179831
- SUSE Bug 1181368
- SUSE Bug 1182281
- SUSE Bug 1182293
- SUSE Bug 1182382
- SUSE Bug 1185092
- SUSE Bug 1185281
- SUSE Bug 1186674
- SUSE CVE CVE-2018-15750 page
- SUSE CVE CVE-2018-15751 page
- SUSE CVE CVE-2020-11651 page
- SUSE CVE CVE-2020-11652 page
- SUSE CVE CVE-2020-25592 page
- SUSE CVE CVE-2021-25315 page
- SUSE CVE CVE-2021-31607 page
Описание
Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to determine which files exist on the server.
Затронутые продукты
Image SLES15-SP1-Azure-BYOS:python3-salt-3002.2-37.1
Image SLES15-SP1-Azure-BYOS:salt-3002.2-37.1
Image SLES15-SP1-Azure-BYOS:salt-minion-3002.2-37.1
Image SLES15-SP1-Azure-HPC-BYOS:python3-salt-3002.2-37.1
Ссылки
- CVE-2018-15750
- SUSE Bug 1113698
Описание
SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands via salt-api(netapi).
Затронутые продукты
Image SLES15-SP1-Azure-BYOS:python3-salt-3002.2-37.1
Image SLES15-SP1-Azure-BYOS:salt-3002.2-37.1
Image SLES15-SP1-Azure-BYOS:salt-minion-3002.2-37.1
Image SLES15-SP1-Azure-HPC-BYOS:python3-salt-3002.2-37.1
Ссылки
- CVE-2018-15751
- SUSE Bug 1113698
- SUSE Bug 1113699
Описание
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.
Затронутые продукты
Image SLES15-SP1-Azure-BYOS:python3-salt-3002.2-37.1
Image SLES15-SP1-Azure-BYOS:salt-3002.2-37.1
Image SLES15-SP1-Azure-BYOS:salt-minion-3002.2-37.1
Image SLES15-SP1-Azure-HPC-BYOS:python3-salt-3002.2-37.1
Ссылки
- CVE-2020-11651
- SUSE Bug 1170595
Описание
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.
Затронутые продукты
Image SLES15-SP1-Azure-BYOS:python3-salt-3002.2-37.1
Image SLES15-SP1-Azure-BYOS:salt-3002.2-37.1
Image SLES15-SP1-Azure-BYOS:salt-minion-3002.2-37.1
Image SLES15-SP1-Azure-HPC-BYOS:python3-salt-3002.2-37.1
Ссылки
- CVE-2020-11652
- SUSE Bug 1170595
Описание
In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH.
Затронутые продукты
Image SLES15-SP1-Azure-BYOS:python3-salt-3002.2-37.1
Image SLES15-SP1-Azure-BYOS:salt-3002.2-37.1
Image SLES15-SP1-Azure-BYOS:salt-minion-3002.2-37.1
Image SLES15-SP1-Azure-HPC-BYOS:python3-salt-3002.2-37.1
Ссылки
- CVE-2020-25592
- SUSE Bug 1178319
Описание
CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions.
Затронутые продукты
Image SLES15-SP1-Azure-BYOS:python3-salt-3002.2-37.1
Image SLES15-SP1-Azure-BYOS:salt-3002.2-37.1
Image SLES15-SP1-Azure-BYOS:salt-minion-3002.2-37.1
Image SLES15-SP1-Azure-HPC-BYOS:python3-salt-3002.2-37.1
Ссылки
- CVE-2021-25315
- SUSE Bug 1182382
Описание
In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely).
Затронутые продукты
Image SLES15-SP1-Azure-BYOS:python3-salt-3002.2-37.1
Image SLES15-SP1-Azure-BYOS:salt-3002.2-37.1
Image SLES15-SP1-Azure-BYOS:salt-minion-3002.2-37.1
Image SLES15-SP1-Azure-HPC-BYOS:python3-salt-3002.2-37.1
Ссылки
- CVE-2021-31607
- SUSE Bug 1185281
- SUSE Bug 1210934