Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2017:2383-1

Опубликовано: 07 сент. 2017
Источник: suse-cvrf

Описание

Security update for salt

This update for salt fixes the following issues:

  • Update to 2017.7.1 See https://docs.saltstack.com/en/develop/topics/releases/2017.7.1.html for full changelog

  • CVE-2017-12791: crafted minion ID could lead directory traversal on the Salt-master (boo#1053955)

  • Run fdupes over all of /usr because it still warns about duplicate files. Remove ancient suse_version > 1020 conditional.

  • Replace unnecessary %__ indirections. Use grep -q in favor of

    /dev/null.

  • Avoid bashisms in %pre.

  • Update to 2017.7.0 See https://docs.saltstack.com/en/develop/topics/releases/2017.7.0.html for full changelog

  • fix ownership for whole master cache directory (boo#1035914)

  • fix setting the language on SUSE systems (boo#1038855)

  • wrong os_family grains on SUSE - fix unittests (boo#1038855)

  • speed-up cherrypy by removing sleep call

  • Disable 3rd party runtime packages to be explicitly recommended. (boo#1040886)

  • fix format error (boo#1043111)

  • Add a salt-minion watchdog for RHEL6 and SLES11 systems (sysV) to restart salt-minion in case of crashes during upgrade.

  • Add procps as dependency.

  • Bugfix: jobs scheduled to run at a future time stay pending for Salt minions (boo#1036125)

Список пакетов

openSUSE Leap 42.3
salt-2017.7.1-11.1
salt-api-2017.7.1-11.1
salt-bash-completion-2017.7.1-11.1
salt-cloud-2017.7.1-11.1
salt-doc-2017.7.1-11.1
salt-fish-completion-2017.7.1-11.1
salt-master-2017.7.1-11.1
salt-minion-2017.7.1-11.1
salt-proxy-2017.7.1-11.1
salt-ssh-2017.7.1-11.1
salt-syndic-2017.7.1-11.1
salt-zsh-completion-2017.7.1-11.1

Описание

Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.


Затронутые продукты
openSUSE Leap 42.3:salt-2017.7.1-11.1
openSUSE Leap 42.3:salt-api-2017.7.1-11.1
openSUSE Leap 42.3:salt-bash-completion-2017.7.1-11.1
openSUSE Leap 42.3:salt-cloud-2017.7.1-11.1

Ссылки
Уязвимость openSUSE-SU-2017:2383-1