openSUSE Security Update: Security update for salt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4197-1 Rating: moderate References: #1104491 #1107333 #1108557 #1108834 #1108995 #1109893 #1110938 #1112874 #1113698 #1113699 #1113784 #1114197 #1114824 Cross-References: CVE-2018-15750 CVE-2018-15751 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has 11 fixes is now available. Description: This update for salt fixes the following issues: - Crontab module fix: file attributes option missing (boo#1114824) - Fix git_pillar merging across multiple __env__ repositories (boo#1112874) - Bugfix: unable to detect os arch when RPM is not installed (boo#1114197) - Fix LDAP authentication issue when a valid token is generated by the salt-api even when invalid user credentials are passed. (U#48901) - Improved handling of LDAP group id. gid is no longer treated as a string, which could have lead to faulty group creations. (boo#1113784) - Fix remote command execution and incorrect access control when using salt-api. (boo#1113699) (CVE-2018-15751) - Fix Directory traversal vulnerability when using salt-api. Allows an attacker to determine what files exist on a server when querying /run or /events. (boo#1113698) (CVE-2018-15750) - Add multi-file support and globbing to the filetree (U#50018) - Bugfix: supportconfig non-root permission issues (U#50095) - Open profiles permissions to everyone for read-only - Preserving signature in "module.run" state (U#50049) - Install default salt-support profiles - Remove unit test, came from a wrong branch. Fix merging failure. - Add CPE_NAME for osversion* grain parsing - Get os_family for RPM distros from the RPM macros - Install support profiles - Fix async call to process manager (boo#1110938) - Salt-based supportconfig implementation (technology preview) - Bugfix: any unicode string of length 16 will raise TypeError - Fix IPv6 scope (boo#1108557) - Handle zypper ZYPPER_EXIT_NO_REPOS exit code (boo#1108834, boo#1109893) - Bugfix for pkg_resources crash (boo#1104491) - Fix loosen azure sdk dependencies in azurearm cloud driver (boo#1107333) - Fix broken "resolve_capabilities" on Python 3 (boo#1108995) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1574=1 Package List: - openSUSE Leap 42.3 (noarch): salt-bash-completion-2018.3.0-23.1 salt-fish-completion-2018.3.0-23.1 salt-zsh-completion-2018.3.0-23.1 - openSUSE Leap 42.3 (x86_64): python2-salt-2018.3.0-23.1 python3-salt-2018.3.0-23.1 salt-2018.3.0-23.1 salt-api-2018.3.0-23.1 salt-cloud-2018.3.0-23.1 salt-doc-2018.3.0-23.1 salt-master-2018.3.0-23.1 salt-minion-2018.3.0-23.1 salt-proxy-2018.3.0-23.1 salt-ssh-2018.3.0-23.1 salt-syndic-2018.3.0-23.1 References: https://www.suse.com/security/cve/CVE-2018-15750.html https://www.suse.com/security/cve/CVE-2018-15751.html https://bugzilla.suse.com/1104491 https://bugzilla.suse.com/1107333 https://bugzilla.suse.com/1108557 https://bugzilla.suse.com/1108834 https://bugzilla.suse.com/1108995 https://bugzilla.suse.com/1109893 https://bugzilla.suse.com/1110938 https://bugzilla.suse.com/1112874 https://bugzilla.suse.com/1113698 https://bugzilla.suse.com/1113699 https://bugzilla.suse.com/1113784 https://bugzilla.suse.com/1114197 https://bugzilla.suse.com/1114824