Security update for SUSE Manager Client Tools SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:14538-1 Final 1 1 2020-11-06T15:59:37Z current 2020-11-06T15:59:37Z 2020-11-06T15:59:37Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for SUSE Manager Client Tools This update fixes the following issues: cobbler: - Fix parsing cobbler dictionary options with values containing '=', e.g. kernel params containing '=' (bsc#1176978) mgr-daemon: - Update translation strings salt: - Properly validate eauth credentials and tokens on SSH calls made by Salt API (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846) spacecmd: - Python3 fixes for errata in spacecmd (bsc#1169664) - Added support for i18n of user-facing strings - Python3 fix for sorted usage (bsc#1167907) spacewalk-client-tools: - Remove RH references in Python/Ruby localization and use the product name instead The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). slesctsp3-client-tools-202010-14538,slesctsp4-client-tools-202010-14538 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-202014538-1/ Link for SUSE-SU-2020:14538-1 https://lists.suse.com/pipermail/sle-security-updates/2020-November/007715.html E-Mail link for SUSE-SU-2020:14538-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1167907 SUSE Bug 1167907 https://bugzilla.suse.com/1169664 SUSE Bug 1169664 https://bugzilla.suse.com/1176978 SUSE Bug 1176978 https://bugzilla.suse.com/1178319 SUSE Bug 1178319 https://bugzilla.suse.com/1178361 SUSE Bug 1178361 https://bugzilla.suse.com/1178362 SUSE Bug 1178362 https://www.suse.com/security/cve/CVE-2020-16846/ SUSE CVE CVE-2020-16846 page https://www.suse.com/security/cve/CVE-2020-17490/ SUSE CVE CVE-2020-17490 page https://www.suse.com/security/cve/CVE-2020-25592/ SUSE CVE CVE-2020-25592 page SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS koan-2.2.2-0.68.12.1 mgr-daemon-4.1.3-5.20.1 python2-spacewalk-check-4.1.7-27.38.1 python2-spacewalk-client-setup-4.1.7-27.38.1 python2-spacewalk-client-tools-4.1.7-27.38.1 salt-2016.11.10-43.63.1 salt-doc-2016.11.10-43.63.1 salt-minion-2016.11.10-43.63.1 spacecmd-4.1.8-18.72.1 spacewalk-check-4.1.7-27.38.1 spacewalk-client-setup-4.1.7-27.38.1 spacewalk-client-tools-4.1.7-27.38.1 koan-2.2.2-0.68.12.1 as a component of SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS mgr-daemon-4.1.3-5.20.1 as a component of SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS python2-spacewalk-check-4.1.7-27.38.1 as a component of SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS python2-spacewalk-client-setup-4.1.7-27.38.1 as a component of SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS python2-spacewalk-client-tools-4.1.7-27.38.1 as a component of SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS salt-2016.11.10-43.63.1 as a component of SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS salt-doc-2016.11.10-43.63.1 as a component of SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS salt-minion-2016.11.10-43.63.1 as a component of SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS spacecmd-4.1.8-18.72.1 as a component of SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS spacewalk-check-4.1.7-27.38.1 as a component of SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS spacewalk-client-setup-4.1.7-27.38.1 as a component of SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS spacewalk-client-tools-4.1.7-27.38.1 as a component of SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS koan-2.2.2-0.68.12.1 as a component of SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS mgr-daemon-4.1.3-5.20.1 as a component of SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS python2-spacewalk-check-4.1.7-27.38.1 as a component of SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS python2-spacewalk-client-setup-4.1.7-27.38.1 as a component of SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS python2-spacewalk-client-tools-4.1.7-27.38.1 as a component of SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS salt-2016.11.10-43.63.1 as a component of SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS salt-doc-2016.11.10-43.63.1 as a component of SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS salt-minion-2016.11.10-43.63.1 as a component of SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS spacecmd-4.1.8-18.72.1 as a component of SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS spacewalk-check-4.1.7-27.38.1 as a component of SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS spacewalk-client-setup-4.1.7-27.38.1 as a component of SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS spacewalk-client-tools-4.1.7-27.38.1 as a component of SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection. CVE-2020-16846 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:koan-2.2.2-0.68.12.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:mgr-daemon-4.1.3-5.20.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:python2-spacewalk-check-4.1.7-27.38.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:python2-spacewalk-client-setup-4.1.7-27.38.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:python2-spacewalk-client-tools-4.1.7-27.38.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:salt-2016.11.10-43.63.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:salt-doc-2016.11.10-43.63.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:salt-minion-2016.11.10-43.63.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:spacecmd-4.1.8-18.72.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:spacewalk-check-4.1.7-27.38.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:spacewalk-client-setup-4.1.7-27.38.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:spacewalk-client-tools-4.1.7-27.38.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:koan-2.2.2-0.68.12.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:mgr-daemon-4.1.3-5.20.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:python2-spacewalk-check-4.1.7-27.38.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:python2-spacewalk-client-setup-4.1.7-27.38.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:python2-spacewalk-client-tools-4.1.7-27.38.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:salt-2016.11.10-43.63.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:salt-doc-2016.11.10-43.63.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:salt-minion-2016.11.10-43.63.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:spacecmd-4.1.8-18.72.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:spacewalk-check-4.1.7-27.38.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:spacewalk-client-setup-4.1.7-27.38.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:spacewalk-client-tools-4.1.7-27.38.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-202014538-1/ https://www.suse.com/security/cve/CVE-2020-16846.html CVE-2020-16846 https://bugzilla.suse.com/1178361 SUSE Bug 1178361 The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions. CVE-2020-17490 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:koan-2.2.2-0.68.12.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:mgr-daemon-4.1.3-5.20.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:python2-spacewalk-check-4.1.7-27.38.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:python2-spacewalk-client-setup-4.1.7-27.38.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:python2-spacewalk-client-tools-4.1.7-27.38.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:salt-2016.11.10-43.63.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:salt-doc-2016.11.10-43.63.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:salt-minion-2016.11.10-43.63.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:spacecmd-4.1.8-18.72.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:spacewalk-check-4.1.7-27.38.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:spacewalk-client-setup-4.1.7-27.38.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:spacewalk-client-tools-4.1.7-27.38.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:koan-2.2.2-0.68.12.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:mgr-daemon-4.1.3-5.20.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:python2-spacewalk-check-4.1.7-27.38.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:python2-spacewalk-client-setup-4.1.7-27.38.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:python2-spacewalk-client-tools-4.1.7-27.38.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:salt-2016.11.10-43.63.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:salt-doc-2016.11.10-43.63.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:salt-minion-2016.11.10-43.63.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:spacecmd-4.1.8-18.72.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:spacewalk-check-4.1.7-27.38.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:spacewalk-client-setup-4.1.7-27.38.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:spacewalk-client-tools-4.1.7-27.38.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-202014538-1/ https://www.suse.com/security/cve/CVE-2020-17490.html CVE-2020-17490 https://bugzilla.suse.com/1178362 SUSE Bug 1178362 In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH. CVE-2020-25592 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:koan-2.2.2-0.68.12.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:mgr-daemon-4.1.3-5.20.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:python2-spacewalk-check-4.1.7-27.38.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:python2-spacewalk-client-setup-4.1.7-27.38.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:python2-spacewalk-client-tools-4.1.7-27.38.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:salt-2016.11.10-43.63.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:salt-doc-2016.11.10-43.63.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:salt-minion-2016.11.10-43.63.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:spacecmd-4.1.8-18.72.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:spacewalk-check-4.1.7-27.38.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:spacewalk-client-setup-4.1.7-27.38.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:spacewalk-client-tools-4.1.7-27.38.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:koan-2.2.2-0.68.12.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:mgr-daemon-4.1.3-5.20.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:python2-spacewalk-check-4.1.7-27.38.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:python2-spacewalk-client-setup-4.1.7-27.38.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:python2-spacewalk-client-tools-4.1.7-27.38.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:salt-2016.11.10-43.63.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:salt-doc-2016.11.10-43.63.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:salt-minion-2016.11.10-43.63.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:spacecmd-4.1.8-18.72.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:spacewalk-check-4.1.7-27.38.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:spacewalk-client-setup-4.1.7-27.38.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:spacewalk-client-tools-4.1.7-27.38.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-202014538-1/ https://www.suse.com/security/cve/CVE-2020-25592.html CVE-2020-25592 https://bugzilla.suse.com/1178319 SUSE Bug 1178319