Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2021:3557-1

Опубликовано: 27 окт. 2021
Источник: suse-cvrf

Описание

Security update for salt

This update for salt fixes the following issues:

  • CVE-2021-21996: Exclude the full path of a download URL to prevent injection of malicious code. (bsc#1190265)

Список пакетов

Image SLES15-SP3-BYOS-Azure
python3-salt-3002.2-50.1.15.1
salt-3002.2-50.1.15.1
salt-minion-3002.2-50.1.15.1
Image SLES15-SP3-BYOS-EC2-HVM
python3-salt-3002.2-50.1.15.1
salt-3002.2-50.1.15.1
salt-minion-3002.2-50.1.15.1
Image SLES15-SP3-BYOS-GCE
python3-salt-3002.2-50.1.15.1
salt-3002.2-50.1.15.1
salt-minion-3002.2-50.1.15.1
Image SLES15-SP3-HPC-BYOS-Azure
python3-salt-3002.2-50.1.15.1
salt-3002.2-50.1.15.1
salt-minion-3002.2-50.1.15.1
Image SLES15-SP3-HPC-BYOS-EC2-HVM
python3-salt-3002.2-50.1.15.1
salt-3002.2-50.1.15.1
salt-minion-3002.2-50.1.15.1
Image SLES15-SP3-HPC-BYOS-GCE
python3-salt-3002.2-50.1.15.1
salt-3002.2-50.1.15.1
salt-minion-3002.2-50.1.15.1
Image SLES15-SP3-Manager-4-2-Proxy-BYOS-Azure
python3-salt-3002.2-50.1.15.1
salt-3002.2-50.1.15.1
salt-minion-3002.2-50.1.15.1
Image SLES15-SP3-Manager-4-2-Proxy-BYOS-EC2-HVM
python3-salt-3002.2-50.1.15.1
salt-3002.2-50.1.15.1
salt-minion-3002.2-50.1.15.1
Image SLES15-SP3-Manager-4-2-Proxy-BYOS-GCE
python3-salt-3002.2-50.1.15.1
salt-3002.2-50.1.15.1
salt-minion-3002.2-50.1.15.1
Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure
python3-salt-3002.2-50.1.15.1
salt-3002.2-50.1.15.1
salt-api-3002.2-50.1.15.1
salt-master-3002.2-50.1.15.1
salt-minion-3002.2-50.1.15.1
Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM
python3-salt-3002.2-50.1.15.1
salt-3002.2-50.1.15.1
salt-api-3002.2-50.1.15.1
salt-master-3002.2-50.1.15.1
salt-minion-3002.2-50.1.15.1
Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE
python3-salt-3002.2-50.1.15.1
salt-3002.2-50.1.15.1
salt-api-3002.2-50.1.15.1
salt-master-3002.2-50.1.15.1
salt-minion-3002.2-50.1.15.1
Image SLES15-SP3-Micro-5-1-BYOS-Azure
python3-salt-3002.2-50.1.15.1
salt-3002.2-50.1.15.1
salt-minion-3002.2-50.1.15.1
salt-transactional-update-3002.2-50.1.15.1
Image SLES15-SP3-Micro-5-1-BYOS-EC2-HVM
python3-salt-3002.2-50.1.15.1
salt-3002.2-50.1.15.1
salt-minion-3002.2-50.1.15.1
salt-transactional-update-3002.2-50.1.15.1
Image SLES15-SP3-Micro-5-1-BYOS-GCE
python3-salt-3002.2-50.1.15.1
salt-3002.2-50.1.15.1
salt-minion-3002.2-50.1.15.1
salt-transactional-update-3002.2-50.1.15.1
Image SLES15-SP3-Micro-5-2-BYOS-Azure
python3-salt-3002.2-50.1.15.1
salt-3002.2-50.1.15.1
salt-minion-3002.2-50.1.15.1
salt-transactional-update-3002.2-50.1.15.1
Image SLES15-SP3-Micro-5-2-BYOS-EC2-HVM
python3-salt-3002.2-50.1.15.1
salt-3002.2-50.1.15.1
salt-minion-3002.2-50.1.15.1
salt-transactional-update-3002.2-50.1.15.1
Image SLES15-SP3-Micro-5-2-BYOS-GCE
python3-salt-3002.2-50.1.15.1
salt-3002.2-50.1.15.1
salt-minion-3002.2-50.1.15.1
salt-transactional-update-3002.2-50.1.15.1
Image SLES15-SP3-Micro-BYOS-GCE
python3-salt-3002.2-50.1.15.1
salt-3002.2-50.1.15.1
salt-minion-3002.2-50.1.15.1
salt-transactional-update-3002.2-50.1.15.1
Image SLES15-SP3-SAP-Azure-LI-BYOS-Production
python3-salt-3002.2-50.1.15.1
salt-3002.2-50.1.15.1
salt-standalone-formulas-configuration-3002.2-50.1.15.1
Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production
python3-salt-3002.2-50.1.15.1
salt-3002.2-50.1.15.1
salt-standalone-formulas-configuration-3002.2-50.1.15.1
Image SLES15-SP3-SAP-BYOS-Azure
python3-salt-3002.2-50.1.15.1
salt-3002.2-50.1.15.1
salt-minion-3002.2-50.1.15.1
salt-standalone-formulas-configuration-3002.2-50.1.15.1
Image SLES15-SP3-SAP-BYOS-EC2-HVM
python3-salt-3002.2-50.1.15.1
salt-3002.2-50.1.15.1
salt-minion-3002.2-50.1.15.1
salt-standalone-formulas-configuration-3002.2-50.1.15.1
Image SLES15-SP3-SAP-BYOS-GCE
python3-salt-3002.2-50.1.15.1
salt-3002.2-50.1.15.1
salt-minion-3002.2-50.1.15.1
salt-standalone-formulas-configuration-3002.2-50.1.15.1
SUSE Linux Enterprise Micro 5.1
python3-salt-3002.2-50.1.15.1
salt-3002.2-50.1.15.1
salt-minion-3002.2-50.1.15.1
salt-transactional-update-3002.2-50.1.15.1
SUSE Linux Enterprise Module for Basesystem 15 SP3
python3-salt-3002.2-50.1.15.1
salt-3002.2-50.1.15.1
salt-bash-completion-3002.2-50.1.15.1
salt-doc-3002.2-50.1.15.1
salt-minion-3002.2-50.1.15.1
salt-zsh-completion-3002.2-50.1.15.1
SUSE Linux Enterprise Module for Server Applications 15 SP3
salt-api-3002.2-50.1.15.1
salt-cloud-3002.2-50.1.15.1
salt-fish-completion-3002.2-50.1.15.1
salt-master-3002.2-50.1.15.1
salt-proxy-3002.2-50.1.15.1
salt-ssh-3002.2-50.1.15.1
salt-standalone-formulas-configuration-3002.2-50.1.15.1
salt-syndic-3002.2-50.1.15.1
SUSE Linux Enterprise Module for Transactional Server 15 SP3
salt-transactional-update-3002.2-50.1.15.1

Ссылки

Описание

An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and source_hash URLs can gain full file system access as root on a salt minion.

Затронутые продукты
Image SLES15-SP3-BYOS-Azure:python3-salt-3002.2-50.1.15.1
Image SLES15-SP3-BYOS-Azure:salt-3002.2-50.1.15.1
Image SLES15-SP3-BYOS-Azure:salt-minion-3002.2-50.1.15.1
Image SLES15-SP3-BYOS-EC2-HVM:python3-salt-3002.2-50.1.15.1
Ссылки
Уязвимость SUSE-SU-2021:3557-1