Security update for salt SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2020:0564-1 Final 1 1 2020-04-30T14:39:54Z current 2020-04-30T14:39:54Z 2020-04-30T14:39:54Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for salt This update for salt fixes the following issues: - Fix CVE-2020-11651 and CVE-2020-11652 (bsc#1170595) This update was imported from the SUSE:SLE-15-SP1:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2020-564 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SSOLZPKWSWDPR4VMI5Q3QMPA72BQNRCM/ E-Mail link for openSUSE-SU-2020:0564-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1170595 SUSE Bug 1170595 https://www.suse.com/security/cve/CVE-2020-11651/ SUSE CVE CVE-2020-11651 page https://www.suse.com/security/cve/CVE-2020-11652/ SUSE CVE CVE-2020-11652 page openSUSE Leap 15.1 python2-salt-2019.2.0-lp151.5.15.1 python3-salt-2019.2.0-lp151.5.15.1 salt-2019.2.0-lp151.5.15.1 salt-api-2019.2.0-lp151.5.15.1 salt-bash-completion-2019.2.0-lp151.5.15.1 salt-cloud-2019.2.0-lp151.5.15.1 salt-doc-2019.2.0-lp151.5.15.1 salt-fish-completion-2019.2.0-lp151.5.15.1 salt-master-2019.2.0-lp151.5.15.1 salt-minion-2019.2.0-lp151.5.15.1 salt-proxy-2019.2.0-lp151.5.15.1 salt-ssh-2019.2.0-lp151.5.15.1 salt-standalone-formulas-configuration-2019.2.0-lp151.5.15.1 salt-syndic-2019.2.0-lp151.5.15.1 salt-zsh-completion-2019.2.0-lp151.5.15.1 python2-salt-2019.2.0-lp151.5.15.1 as a component of openSUSE Leap 15.1 python3-salt-2019.2.0-lp151.5.15.1 as a component of openSUSE Leap 15.1 salt-2019.2.0-lp151.5.15.1 as a component of openSUSE Leap 15.1 salt-api-2019.2.0-lp151.5.15.1 as a component of openSUSE Leap 15.1 salt-bash-completion-2019.2.0-lp151.5.15.1 as a component of openSUSE Leap 15.1 salt-cloud-2019.2.0-lp151.5.15.1 as a component of openSUSE Leap 15.1 salt-doc-2019.2.0-lp151.5.15.1 as a component of openSUSE Leap 15.1 salt-fish-completion-2019.2.0-lp151.5.15.1 as a component of openSUSE Leap 15.1 salt-master-2019.2.0-lp151.5.15.1 as a component of openSUSE Leap 15.1 salt-minion-2019.2.0-lp151.5.15.1 as a component of openSUSE Leap 15.1 salt-proxy-2019.2.0-lp151.5.15.1 as a component of openSUSE Leap 15.1 salt-ssh-2019.2.0-lp151.5.15.1 as a component of openSUSE Leap 15.1 salt-standalone-formulas-configuration-2019.2.0-lp151.5.15.1 as a component of openSUSE Leap 15.1 salt-syndic-2019.2.0-lp151.5.15.1 as a component of openSUSE Leap 15.1 salt-zsh-completion-2019.2.0-lp151.5.15.1 as a component of openSUSE Leap 15.1 An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions. CVE-2020-11651 openSUSE Leap 15.1:python2-salt-2019.2.0-lp151.5.15.1 openSUSE Leap 15.1:python3-salt-2019.2.0-lp151.5.15.1 openSUSE Leap 15.1:salt-2019.2.0-lp151.5.15.1 openSUSE Leap 15.1:salt-api-2019.2.0-lp151.5.15.1 openSUSE Leap 15.1:salt-bash-completion-2019.2.0-lp151.5.15.1 openSUSE Leap 15.1:salt-cloud-2019.2.0-lp151.5.15.1 openSUSE Leap 15.1:salt-doc-2019.2.0-lp151.5.15.1 openSUSE Leap 15.1:salt-fish-completion-2019.2.0-lp151.5.15.1 openSUSE Leap 15.1:salt-master-2019.2.0-lp151.5.15.1 openSUSE Leap 15.1:salt-minion-2019.2.0-lp151.5.15.1 openSUSE Leap 15.1:salt-proxy-2019.2.0-lp151.5.15.1 openSUSE Leap 15.1:salt-ssh-2019.2.0-lp151.5.15.1 openSUSE Leap 15.1:salt-standalone-formulas-configuration-2019.2.0-lp151.5.15.1 openSUSE Leap 15.1:salt-syndic-2019.2.0-lp151.5.15.1 openSUSE Leap 15.1:salt-zsh-completion-2019.2.0-lp151.5.15.1 critical 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SSOLZPKWSWDPR4VMI5Q3QMPA72BQNRCM/ https://www.suse.com/security/cve/CVE-2020-11651.html CVE-2020-11651 https://bugzilla.suse.com/1170595 SUSE Bug 1170595 An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users. CVE-2020-11652 openSUSE Leap 15.1:python2-salt-2019.2.0-lp151.5.15.1 openSUSE Leap 15.1:python3-salt-2019.2.0-lp151.5.15.1 openSUSE Leap 15.1:salt-2019.2.0-lp151.5.15.1 openSUSE Leap 15.1:salt-api-2019.2.0-lp151.5.15.1 openSUSE Leap 15.1:salt-bash-completion-2019.2.0-lp151.5.15.1 openSUSE Leap 15.1:salt-cloud-2019.2.0-lp151.5.15.1 openSUSE Leap 15.1:salt-doc-2019.2.0-lp151.5.15.1 openSUSE Leap 15.1:salt-fish-completion-2019.2.0-lp151.5.15.1 openSUSE Leap 15.1:salt-master-2019.2.0-lp151.5.15.1 openSUSE Leap 15.1:salt-minion-2019.2.0-lp151.5.15.1 openSUSE Leap 15.1:salt-proxy-2019.2.0-lp151.5.15.1 openSUSE Leap 15.1:salt-ssh-2019.2.0-lp151.5.15.1 openSUSE Leap 15.1:salt-standalone-formulas-configuration-2019.2.0-lp151.5.15.1 openSUSE Leap 15.1:salt-syndic-2019.2.0-lp151.5.15.1 openSUSE Leap 15.1:salt-zsh-completion-2019.2.0-lp151.5.15.1 critical 4 AV:N/AC:L/Au:S/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SSOLZPKWSWDPR4VMI5Q3QMPA72BQNRCM/ https://www.suse.com/security/cve/CVE-2020-11652.html CVE-2020-11652 https://bugzilla.suse.com/1170595 SUSE Bug 1170595