Security update for salt SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2018:1053-1 Final 1 1 2018-04-23T21:36:16Z current 2018-04-23T21:36:16Z 2018-04-23T21:36:16Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for salt This update for salt fixes the following issues: - [Regression] Permission problem: salt-ssh minion boostrap doesn't work anymore. (bsc#1027722) - wrong use of os_family string for Suse in the locale module and others (bsc#1038855) - Cannot bootstrap a host using 'Manage system completely via SSH (will not install an agent)' (bsc#1002529) - add user to or replace members of group not working with SLES11 SPx (bsc#978150) - SLES-12-GA client fail to start salt minion (SUSE MANAGER 3.0) (bsc#991048) - salt pkg.latest raises exception if package is not availible (bsc#1012999) - pkg.list_products on 'registerrelease' and 'productline' returns boolean.False if empty (bsc#989193) - SLES-12-SP1 salt-minion clients has no Base Channel added by default (bsc#986019) - 'The system requires a reboot' does not disappear from web-UI despite the reboot (bsc#1017078) - Remove option -f from startproc (bsc#975733) - [PYTHON2] package salt-minion requires /usr/bin/python (bsc#1081592) - Upgrading packages on RHEL6/7 client fails (bsc#1068566) - /var/log/salt has insecure permissions (bsc#1071322) - [Minion-bootstrapping] Invalid char cause server (salt-master ERROR) (bsc#1011304) - CVE-2016-9639: Possible information leak due to revoked keys still being used (bsc#1012398) - Bootstrapping SLES12 minion invalid (bsc#1053376) - Minions not correctly onboarded if Proxy has multiple FQDNs (bsc#1063419) - salt --summary '*' <function> reporting '# of minions that did not return' wrongly (bsc#972311) - RH-L3 SALT - Stacktrace if nscd package is not present when using nscd state (bsc#1027044) - Inspector broken: no module 'query' or 'inspector' while querying or inspecting (bsc#989798) - [ Regression ]Centos7 Minion remote command execution from gui or cli , minion not responding (bsc#1027240) - SALT, minion_id generation doesn't match the newhostname (bsc#967803) - Salt API server shuts down when SSH call with no matches is issued (bsc#1004723) - /var/log/salt/minion fails logrotate (bsc#1030009) - Salt proxy test.ping crashes (bsc#975303) - salt master flood log with useless messages (bsc#985661) - After bootstrap salt client has deprecation warnings (bsc#1041993) - Head: salt 2017.7.2 starts salt-master as user root (bsc#1064520) - CVE-2017-12791: Maliciously crafted minion IDs can cause unwanted directory traversals on the Salt-master (bsc#1053955) - salt-2017.7.2 - broken %post script for salt-master (bsc#1079048) - Tearing down deployment with SaltStack Kubernetes module always shows error (bsc#1059291) - lvm.vg_present does not recognize PV with certain LVM filter settings. (bsc#988506) - High state fails: No service execution module loaded: check support for service (bsc#1065792) - When multiple versions of a package are installed on a minion, patch status may vary (bsc#972490) - Salt cp.push does not work on SUMA 3.2 Builds because of python3.4 (bsc#1075950) - timezone modue does not update /etc/sysconfig/clock (bsc#1008933) - Add patches to salt to support SUSE Manager scalability features (bsc#1052264) - salt-minion failed to start on minimal RHEL6 because of DBus exception during load of snapper module (bsc#993039) - Permission denied: '/var/run/salt-master.pid' (bsc#1050003) - Jobs scheduled to run at a future time stay pending for Salt minions (bsc#1036125) - Backport kubernetes-modules to salt (bsc#1051948) - After highstate: The minion function caused an exception (bsc#1068446) - VUL-0: CVE-2017-14695: salt: directory traversal vulnerability in minion id validation (bsc#1062462) - unable to update salt-minion on RHEL (bsc#1022841) - Nodes run out of memory due to salt-minion process (bsc#983512) - [Proxy] 'Broken pipe' during bootstrap of salt minion (bsc#1039370) - incorrect return code from /etc/rc.d/salt-minion (bsc#999852) - CVE-2017-5200: Salt-ssh via api let's run arbitrary commands as user salt (bsc#1011800) - beacons.conf on salt-minion not processed (bsc#1060230) - SLES11 SP3 salt-minion Client Cannot Select Base Channel (bsc#975093) - salt-ssh sys.doc gives authentication failure without arguments (bsc#1019386) - minion bootstrapping: error when bootstrap SLE11 clients (bsc#990439) - Certificate Deployment Fails for SLES11 SP3 Clients (bsc#975757) - state.module run() does not translate varargs (bsc#1025896) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-updates/2018-04/msg00061.html E-Mail link for openSUSE-SU-2018:1053-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.3 python2-salt-2018.3.0-17.1 python3-salt-2018.3.0-17.1 salt-2018.3.0-17.1 salt-api-2018.3.0-17.1 salt-bash-completion-2018.3.0-17.1 salt-cloud-2018.3.0-17.1 salt-doc-2018.3.0-17.1 salt-fish-completion-2018.3.0-17.1 salt-master-2018.3.0-17.1 salt-minion-2018.3.0-17.1 salt-proxy-2018.3.0-17.1 salt-ssh-2018.3.0-17.1 salt-syndic-2018.3.0-17.1 salt-zsh-completion-2018.3.0-17.1 python2-salt-2018.3.0-17.1 as a component of openSUSE Leap 42.3 python3-salt-2018.3.0-17.1 as a component of openSUSE Leap 42.3 salt-2018.3.0-17.1 as a component of openSUSE Leap 42.3 salt-api-2018.3.0-17.1 as a component of openSUSE Leap 42.3 salt-bash-completion-2018.3.0-17.1 as a component of openSUSE Leap 42.3 salt-cloud-2018.3.0-17.1 as a component of openSUSE Leap 42.3 salt-doc-2018.3.0-17.1 as a component of openSUSE Leap 42.3 salt-fish-completion-2018.3.0-17.1 as a component of openSUSE Leap 42.3 salt-master-2018.3.0-17.1 as a component of openSUSE Leap 42.3 salt-minion-2018.3.0-17.1 as a component of openSUSE Leap 42.3 salt-proxy-2018.3.0-17.1 as a component of openSUSE Leap 42.3 salt-ssh-2018.3.0-17.1 as a component of openSUSE Leap 42.3 salt-syndic-2018.3.0-17.1 as a component of openSUSE Leap 42.3 salt-zsh-completion-2018.3.0-17.1 as a component of openSUSE Leap 42.3 Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching. CVE-2016-9639 openSUSE Leap 42.3:python2-salt-2018.3.0-17.1 openSUSE Leap 42.3:python3-salt-2018.3.0-17.1 openSUSE Leap 42.3:salt-2018.3.0-17.1 openSUSE Leap 42.3:salt-api-2018.3.0-17.1 openSUSE Leap 42.3:salt-bash-completion-2018.3.0-17.1 openSUSE Leap 42.3:salt-cloud-2018.3.0-17.1 openSUSE Leap 42.3:salt-doc-2018.3.0-17.1 openSUSE Leap 42.3:salt-fish-completion-2018.3.0-17.1 openSUSE Leap 42.3:salt-master-2018.3.0-17.1 openSUSE Leap 42.3:salt-minion-2018.3.0-17.1 openSUSE Leap 42.3:salt-proxy-2018.3.0-17.1 openSUSE Leap 42.3:salt-ssh-2018.3.0-17.1 openSUSE Leap 42.3:salt-syndic-2018.3.0-17.1 openSUSE Leap 42.3:salt-zsh-completion-2018.3.0-17.1 moderate 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N Please Install the update. https://lists.opensuse.org/opensuse-updates/2018-04/msg00061.html https://www.suse.com/security/cve/CVE-2016-9639.html CVE-2016-9639 https://bugzilla.suse.com/1012398 SUSE Bug 1012398 Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. CVE-2017-12791 openSUSE Leap 42.3:python2-salt-2018.3.0-17.1 openSUSE Leap 42.3:python3-salt-2018.3.0-17.1 openSUSE Leap 42.3:salt-2018.3.0-17.1 openSUSE Leap 42.3:salt-api-2018.3.0-17.1 openSUSE Leap 42.3:salt-bash-completion-2018.3.0-17.1 openSUSE Leap 42.3:salt-cloud-2018.3.0-17.1 openSUSE Leap 42.3:salt-doc-2018.3.0-17.1 openSUSE Leap 42.3:salt-fish-completion-2018.3.0-17.1 openSUSE Leap 42.3:salt-master-2018.3.0-17.1 openSUSE Leap 42.3:salt-minion-2018.3.0-17.1 openSUSE Leap 42.3:salt-proxy-2018.3.0-17.1 openSUSE Leap 42.3:salt-ssh-2018.3.0-17.1 openSUSE Leap 42.3:salt-syndic-2018.3.0-17.1 openSUSE Leap 42.3:salt-zsh-completion-2018.3.0-17.1 moderate 4 AV:N/AC:L/Au:S/C:P/I:N/A:N Please Install the update. https://lists.opensuse.org/opensuse-updates/2018-04/msg00061.html https://www.suse.com/security/cve/CVE-2017-12791.html CVE-2017-12791 https://bugzilla.suse.com/1053955 SUSE Bug 1053955 https://bugzilla.suse.com/1062462 SUSE Bug 1062462 Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12791. CVE-2017-14695 openSUSE Leap 42.3:python2-salt-2018.3.0-17.1 openSUSE Leap 42.3:python3-salt-2018.3.0-17.1 openSUSE Leap 42.3:salt-2018.3.0-17.1 openSUSE Leap 42.3:salt-api-2018.3.0-17.1 openSUSE Leap 42.3:salt-bash-completion-2018.3.0-17.1 openSUSE Leap 42.3:salt-cloud-2018.3.0-17.1 openSUSE Leap 42.3:salt-doc-2018.3.0-17.1 openSUSE Leap 42.3:salt-fish-completion-2018.3.0-17.1 openSUSE Leap 42.3:salt-master-2018.3.0-17.1 openSUSE Leap 42.3:salt-minion-2018.3.0-17.1 openSUSE Leap 42.3:salt-proxy-2018.3.0-17.1 openSUSE Leap 42.3:salt-ssh-2018.3.0-17.1 openSUSE Leap 42.3:salt-syndic-2018.3.0-17.1 openSUSE Leap 42.3:salt-zsh-completion-2018.3.0-17.1 moderate 5 AV:N/AC:L/Au:N/C:P/I:N/A:N Please Install the update. https://lists.opensuse.org/opensuse-updates/2018-04/msg00061.html https://www.suse.com/security/cve/CVE-2017-14695.html CVE-2017-14695 https://bugzilla.suse.com/1053955 SUSE Bug 1053955 https://bugzilla.suse.com/1062462 SUSE Bug 1062462 SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of service via a crafted authentication request. CVE-2017-14696 openSUSE Leap 42.3:python2-salt-2018.3.0-17.1 openSUSE Leap 42.3:python3-salt-2018.3.0-17.1 openSUSE Leap 42.3:salt-2018.3.0-17.1 openSUSE Leap 42.3:salt-api-2018.3.0-17.1 openSUSE Leap 42.3:salt-bash-completion-2018.3.0-17.1 openSUSE Leap 42.3:salt-cloud-2018.3.0-17.1 openSUSE Leap 42.3:salt-doc-2018.3.0-17.1 openSUSE Leap 42.3:salt-fish-completion-2018.3.0-17.1 openSUSE Leap 42.3:salt-master-2018.3.0-17.1 openSUSE Leap 42.3:salt-minion-2018.3.0-17.1 openSUSE Leap 42.3:salt-proxy-2018.3.0-17.1 openSUSE Leap 42.3:salt-ssh-2018.3.0-17.1 openSUSE Leap 42.3:salt-syndic-2018.3.0-17.1 openSUSE Leap 42.3:salt-zsh-completion-2018.3.0-17.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P Please Install the update. https://lists.opensuse.org/opensuse-updates/2018-04/msg00061.html https://www.suse.com/security/cve/CVE-2017-14696.html CVE-2017-14696 https://bugzilla.suse.com/1053955 SUSE Bug 1053955 https://bugzilla.suse.com/1062464 SUSE Bug 1062464 Salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 allows arbitrary command execution on a salt-master via Salt's ssh_client. CVE-2017-5200 openSUSE Leap 42.3:python2-salt-2018.3.0-17.1 openSUSE Leap 42.3:python3-salt-2018.3.0-17.1 openSUSE Leap 42.3:salt-2018.3.0-17.1 openSUSE Leap 42.3:salt-api-2018.3.0-17.1 openSUSE Leap 42.3:salt-bash-completion-2018.3.0-17.1 openSUSE Leap 42.3:salt-cloud-2018.3.0-17.1 openSUSE Leap 42.3:salt-doc-2018.3.0-17.1 openSUSE Leap 42.3:salt-fish-completion-2018.3.0-17.1 openSUSE Leap 42.3:salt-master-2018.3.0-17.1 openSUSE Leap 42.3:salt-minion-2018.3.0-17.1 openSUSE Leap 42.3:salt-proxy-2018.3.0-17.1 openSUSE Leap 42.3:salt-ssh-2018.3.0-17.1 openSUSE Leap 42.3:salt-syndic-2018.3.0-17.1 openSUSE Leap 42.3:salt-zsh-completion-2018.3.0-17.1 moderate 6 AV:N/AC:M/Au:S/C:P/I:P/A:P Please Install the update. https://lists.opensuse.org/opensuse-updates/2018-04/msg00061.html https://www.suse.com/security/cve/CVE-2017-5200.html CVE-2017-5200 https://bugzilla.suse.com/1011800 SUSE Bug 1011800