Security update for salt SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2018:4197-1 Final 1 1 2018-12-19T15:22:19Z current 2018-12-19T15:22:19Z 2018-12-19T15:22:19Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for salt This update for salt fixes the following issues: - Crontab module fix: file attributes option missing (boo#1114824) - Fix git_pillar merging across multiple __env__ repositories (boo#1112874) - Bugfix: unable to detect os arch when RPM is not installed (boo#1114197) - Fix LDAP authentication issue when a valid token is generated by the salt-api even when invalid user credentials are passed. (U#48901) - Improved handling of LDAP group id. gid is no longer treated as a string, which could have lead to faulty group creations. (boo#1113784) - Fix remote command execution and incorrect access control when using salt-api. (boo#1113699) (CVE-2018-15751) - Fix Directory traversal vulnerability when using salt-api. Allows an attacker to determine what files exist on a server when querying /run or /events. (boo#1113698) (CVE-2018-15750) - Add multi-file support and globbing to the filetree (U#50018) - Bugfix: supportconfig non-root permission issues (U#50095) - Open profiles permissions to everyone for read-only - Preserving signature in 'module.run' state (U#50049) - Install default salt-support profiles - Remove unit test, came from a wrong branch. Fix merging failure. - Add CPE_NAME for osversion* grain parsing - Get os_family for RPM distros from the RPM macros - Install support profiles - Fix async call to process manager (boo#1110938) - Salt-based supportconfig implementation (technology preview) - Bugfix: any unicode string of length 16 will raise TypeError - Fix IPv6 scope (boo#1108557) - Handle zypper ZYPPER_EXIT_NO_REPOS exit code (boo#1108834, boo#1109893) - Bugfix for pkg_resources crash (boo#1104491) - Fix loosen azure sdk dependencies in azurearm cloud driver (boo#1107333) - Fix broken 'resolve_capabilities' on Python 3 (boo#1108995) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-security-announce/2018-12/msg00052.html E-Mail link for openSUSE-SU-2018:4197-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.3 python2-salt-2018.3.0-23.1 python3-salt-2018.3.0-23.1 salt-2018.3.0-23.1 salt-api-2018.3.0-23.1 salt-bash-completion-2018.3.0-23.1 salt-cloud-2018.3.0-23.1 salt-doc-2018.3.0-23.1 salt-fish-completion-2018.3.0-23.1 salt-master-2018.3.0-23.1 salt-minion-2018.3.0-23.1 salt-proxy-2018.3.0-23.1 salt-ssh-2018.3.0-23.1 salt-syndic-2018.3.0-23.1 salt-zsh-completion-2018.3.0-23.1 python2-salt-2018.3.0-23.1 as a component of openSUSE Leap 42.3 python3-salt-2018.3.0-23.1 as a component of openSUSE Leap 42.3 salt-2018.3.0-23.1 as a component of openSUSE Leap 42.3 salt-api-2018.3.0-23.1 as a component of openSUSE Leap 42.3 salt-bash-completion-2018.3.0-23.1 as a component of openSUSE Leap 42.3 salt-cloud-2018.3.0-23.1 as a component of openSUSE Leap 42.3 salt-doc-2018.3.0-23.1 as a component of openSUSE Leap 42.3 salt-fish-completion-2018.3.0-23.1 as a component of openSUSE Leap 42.3 salt-master-2018.3.0-23.1 as a component of openSUSE Leap 42.3 salt-minion-2018.3.0-23.1 as a component of openSUSE Leap 42.3 salt-proxy-2018.3.0-23.1 as a component of openSUSE Leap 42.3 salt-ssh-2018.3.0-23.1 as a component of openSUSE Leap 42.3 salt-syndic-2018.3.0-23.1 as a component of openSUSE Leap 42.3 salt-zsh-completion-2018.3.0-23.1 as a component of openSUSE Leap 42.3 Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to determine which files exist on the server. CVE-2018-15750 openSUSE Leap 42.3:python2-salt-2018.3.0-23.1 openSUSE Leap 42.3:python3-salt-2018.3.0-23.1 openSUSE Leap 42.3:salt-2018.3.0-23.1 openSUSE Leap 42.3:salt-api-2018.3.0-23.1 openSUSE Leap 42.3:salt-bash-completion-2018.3.0-23.1 openSUSE Leap 42.3:salt-cloud-2018.3.0-23.1 openSUSE Leap 42.3:salt-doc-2018.3.0-23.1 openSUSE Leap 42.3:salt-fish-completion-2018.3.0-23.1 openSUSE Leap 42.3:salt-master-2018.3.0-23.1 openSUSE Leap 42.3:salt-minion-2018.3.0-23.1 openSUSE Leap 42.3:salt-proxy-2018.3.0-23.1 openSUSE Leap 42.3:salt-ssh-2018.3.0-23.1 openSUSE Leap 42.3:salt-syndic-2018.3.0-23.1 openSUSE Leap 42.3:salt-zsh-completion-2018.3.0-23.1 important Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2018-12/msg00052.html https://www.suse.com/security/cve/CVE-2018-15750.html CVE-2018-15750 https://bugzilla.suse.com/1113698 SUSE Bug 1113698 SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands via salt-api(netapi). CVE-2018-15751 openSUSE Leap 42.3:python2-salt-2018.3.0-23.1 openSUSE Leap 42.3:python3-salt-2018.3.0-23.1 openSUSE Leap 42.3:salt-2018.3.0-23.1 openSUSE Leap 42.3:salt-api-2018.3.0-23.1 openSUSE Leap 42.3:salt-bash-completion-2018.3.0-23.1 openSUSE Leap 42.3:salt-cloud-2018.3.0-23.1 openSUSE Leap 42.3:salt-doc-2018.3.0-23.1 openSUSE Leap 42.3:salt-fish-completion-2018.3.0-23.1 openSUSE Leap 42.3:salt-master-2018.3.0-23.1 openSUSE Leap 42.3:salt-minion-2018.3.0-23.1 openSUSE Leap 42.3:salt-proxy-2018.3.0-23.1 openSUSE Leap 42.3:salt-ssh-2018.3.0-23.1 openSUSE Leap 42.3:salt-syndic-2018.3.0-23.1 openSUSE Leap 42.3:salt-zsh-completion-2018.3.0-23.1 critical Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2018-12/msg00052.html https://www.suse.com/security/cve/CVE-2018-15751.html CVE-2018-15751 https://bugzilla.suse.com/1113698 SUSE Bug 1113698 https://bugzilla.suse.com/1113699 SUSE Bug 1113699