Описание
Security update for salt
This update for salt fixes the following issues:
-
Update to 2017.7.1 See https://docs.saltstack.com/en/develop/topics/releases/2017.7.1.html for full changelog
-
CVE-2017-12791: crafted minion ID could lead directory traversal on the Salt-master (boo#1053955)
-
Run fdupes over all of /usr because it still warns about duplicate files. Remove ancient suse_version > 1020 conditional.
-
Replace unnecessary %__ indirections. Use grep -q in favor of
/dev/null.
-
Avoid bashisms in %pre.
-
Update to 2017.7.0 See https://docs.saltstack.com/en/develop/topics/releases/2017.7.0.html for full changelog
-
fix ownership for whole master cache directory (boo#1035914)
-
fix setting the language on SUSE systems (boo#1038855)
-
wrong os_family grains on SUSE - fix unittests (boo#1038855)
-
speed-up cherrypy by removing sleep call
-
Disable 3rd party runtime packages to be explicitly recommended. (boo#1040886)
-
fix format error (boo#1043111)
-
Add a salt-minion watchdog for RHEL6 and SLES11 systems (sysV) to restart salt-minion in case of crashes during upgrade.
-
Add procps as dependency.
-
Bugfix: jobs scheduled to run at a future time stay pending for Salt minions (boo#1036125)
Список пакетов
openSUSE Leap 42.3
Ссылки
- E-Mail link for openSUSE-SU-2017:2383-1
- SUSE Security Ratings
Описание
Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.
Затронутые продукты
Ссылки
- CVE-2017-12791
- SUSE Bug 1053955
- SUSE Bug 1062462