Security Beta update for Salt SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:1690-1 Final 1 1 2021-05-21T14:42:41Z current 2021-05-21T14:42:41Z 2021-05-21T14:42:41Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security Beta update for Salt This update fixes the following issues: salt: - Update to Salt release version 3002.2 (jsc#ECO-3212) - Drop support for Python2. Obsoletes 'python2-salt' package - Virt module updates * network: handle missing ipv4 netmask attribute * more network support * PCI/USB host devices passthrough support - Set distro requirement to oldest supported version in requirements/base.txt - Bring missing part of async batch implementation back - Always require python3-distro (bsc#1182293) - Remove deprecated warning that breaks minion execution when 'server_id_use_crc' opts is missing - Remove msgpack < 1.0.0 from base requirements (bsc#1176293) - Msgpack support for version >= 1.0.0 (bsc#1171257) - Fix issue parsing errors in ansiblegate state module - Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607) - Transactional_update: detect recursion in the executor - Add subpackage salt-transactional-update - Remove duplicate directories from specfile - Improvements on 'ansiblegate' module (bsc#1185092): * New methods: ansible.targets / ansible.discover_playbooks - Add support for Alibaba Cloud Linux 2 (Aliyun Linux) - Regression fix of salt-ssh on processing targets - Update target fix for salt-ssh and avoiding race condition on salt-ssh event processing (bsc#1179831, bsc#1182281) - Add notify beacon for Debian/Ubuntu systems - Fix zmq bug that causes salt-call to freeze (bsc#1181368) - Add core grains support for AlmaLinux - Allow vendor change option with zypper - Virt: virtual network backports to Salt 3000 - Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474) - Only require python-certifi for CentOS7 - Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110) - Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976) - Fix recursion false detection in payload (bsc#1180101) - Add sleep on exception handling on minion connection attempt to the master (bsc#1174855) - Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347) - Always require python-certifi (used by salt.ext.tornado) - Exclude SLE 12 from requiring python-certifi - Do not crash when unexpected cmd output at listing patches (bsc#1181290) - Fix behavior for 'onlyif/unless' when multiple conditions (bsc#1180818) - Fix regression on cmd.run when passing tuples as cmd (bsc#1182740) - Allow extra_filerefs as sanitized kwargs for SSH client - Fix errors with virt.update - Fix for multiple for security issues (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144) (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197) (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560) (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565) - Virt: search for grub.xen path - Xen spicevmc, DNS SRV records backports: Fix virtual network generated DNS XML for SRV records Don't add spicevmc channel to xen VMs - Virt UEFI fix: virt.update when efi=True - Revert wrong zypper patch to support vendorchanges flags on pkg.install The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2021-1690,SUSE-SLE-Manager-Tools-15-2021-1690 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20211690-1/ Link for SUSE-SU-2021:1690-1 https://lists.suse.com/pipermail/sle-updates/2021-May/019028.html E-Mail link for SUSE-SU-2021:1690-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1099976 SUSE Bug 1099976 https://bugzilla.suse.com/1171257 SUSE Bug 1171257 https://bugzilla.suse.com/1172110 SUSE Bug 1172110 https://bugzilla.suse.com/1174855 SUSE Bug 1174855 https://bugzilla.suse.com/1176293 SUSE Bug 1176293 https://bugzilla.suse.com/1177474 SUSE Bug 1177474 https://bugzilla.suse.com/1179831 SUSE Bug 1179831 https://bugzilla.suse.com/1180101 SUSE Bug 1180101 https://bugzilla.suse.com/1180818 SUSE Bug 1180818 https://bugzilla.suse.com/1181290 SUSE Bug 1181290 https://bugzilla.suse.com/1181347 SUSE Bug 1181347 https://bugzilla.suse.com/1181368 SUSE Bug 1181368 https://bugzilla.suse.com/1181550 SUSE Bug 1181550 https://bugzilla.suse.com/1181556 SUSE Bug 1181556 https://bugzilla.suse.com/1181557 SUSE Bug 1181557 https://bugzilla.suse.com/1181558 SUSE Bug 1181558 https://bugzilla.suse.com/1181559 SUSE Bug 1181559 https://bugzilla.suse.com/1181560 SUSE Bug 1181560 https://bugzilla.suse.com/1181561 SUSE Bug 1181561 https://bugzilla.suse.com/1181562 SUSE Bug 1181562 https://bugzilla.suse.com/1181563 SUSE Bug 1181563 https://bugzilla.suse.com/1181564 SUSE Bug 1181564 https://bugzilla.suse.com/1181565 SUSE Bug 1181565 https://bugzilla.suse.com/1182281 SUSE Bug 1182281 https://bugzilla.suse.com/1182293 SUSE Bug 1182293 https://bugzilla.suse.com/1182740 SUSE Bug 1182740 https://bugzilla.suse.com/1185092 SUSE Bug 1185092 https://bugzilla.suse.com/1185281 SUSE Bug 1185281 https://www.suse.com/security/cve/CVE-2020-28243/ SUSE CVE CVE-2020-28243 page https://www.suse.com/security/cve/CVE-2020-28972/ SUSE CVE CVE-2020-28972 page https://www.suse.com/security/cve/CVE-2020-35662/ SUSE CVE CVE-2020-35662 page https://www.suse.com/security/cve/CVE-2021-25281/ SUSE CVE CVE-2021-25281 page https://www.suse.com/security/cve/CVE-2021-25282/ SUSE CVE CVE-2021-25282 page https://www.suse.com/security/cve/CVE-2021-25283/ SUSE CVE CVE-2021-25283 page https://www.suse.com/security/cve/CVE-2021-25284/ SUSE CVE CVE-2021-25284 page https://www.suse.com/security/cve/CVE-2021-3144/ SUSE CVE CVE-2021-3144 page https://www.suse.com/security/cve/CVE-2021-3148/ SUSE CVE CVE-2021-3148 page https://www.suse.com/security/cve/CVE-2021-31607/ SUSE CVE CVE-2021-31607 page https://www.suse.com/security/cve/CVE-2021-3197/ SUSE CVE CVE-2021-3197 page python3-salt-3002.2-8.41.1 salt-3002.2-8.41.1 salt-api-3002.2-8.41.1 salt-bash-completion-3002.2-8.41.1 salt-cloud-3002.2-8.41.1 salt-doc-3002.2-8.41.1 salt-fish-completion-3002.2-8.41.1 salt-master-3002.2-8.41.1 salt-minion-3002.2-8.41.1 salt-proxy-3002.2-8.41.1 salt-ssh-3002.2-8.41.1 salt-standalone-formulas-configuration-3002.2-8.41.1 salt-syndic-3002.2-8.41.1 salt-transactional-update-3002.2-8.41.1 salt-zsh-completion-3002.2-8.41.1 An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blacklisted directory. CVE-2020-28243 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20211690-1/ https://www.suse.com/security/cve/CVE-2020-28243.html CVE-2020-28243 https://bugzilla.suse.com/1181550 SUSE Bug 1181550 https://bugzilla.suse.com/1181556 SUSE Bug 1181556 In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the vmware.py files) does not always validate the SSL/TLS certificate. CVE-2020-28972 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20211690-1/ https://www.suse.com/security/cve/CVE-2020-28972.html CVE-2020-28972 https://bugzilla.suse.com/1181550 SUSE Bug 1181550 https://bugzilla.suse.com/1181557 SUSE Bug 1181557 In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated. CVE-2020-35662 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20211690-1/ https://www.suse.com/security/cve/CVE-2020-35662.html CVE-2020-35662 https://bugzilla.suse.com/1181550 SUSE Bug 1181550 https://bugzilla.suse.com/1181565 SUSE Bug 1181565 An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master. CVE-2021-25281 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20211690-1/ https://www.suse.com/security/cve/CVE-2021-25281.html CVE-2021-25281 https://bugzilla.suse.com/1181550 SUSE Bug 1181550 https://bugzilla.suse.com/1181559 SUSE Bug 1181559 An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal. CVE-2021-25282 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20211690-1/ https://www.suse.com/security/cve/CVE-2021-25282.html CVE-2021-25282 https://bugzilla.suse.com/1181550 SUSE Bug 1181550 https://bugzilla.suse.com/1181560 SUSE Bug 1181560 An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks. CVE-2021-25283 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20211690-1/ https://www.suse.com/security/cve/CVE-2021-25283.html CVE-2021-25283 https://bugzilla.suse.com/1181550 SUSE Bug 1181550 https://bugzilla.suse.com/1181561 SUSE Bug 1181561 An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level. CVE-2021-25284 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20211690-1/ https://www.suse.com/security/cve/CVE-2021-25284.html CVE-2021-25284 https://bugzilla.suse.com/1181550 SUSE Bug 1181550 In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.) CVE-2021-3144 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20211690-1/ https://www.suse.com/security/cve/CVE-2021-3144.html CVE-2021-3144 https://bugzilla.suse.com/1181550 SUSE Bug 1181550 https://bugzilla.suse.com/1181562 SUSE Bug 1181562 An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py. CVE-2021-3148 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20211690-1/ https://www.suse.com/security/cve/CVE-2021-3148.html CVE-2021-3148 https://bugzilla.suse.com/1181550 SUSE Bug 1181550 https://bugzilla.suse.com/1181558 SUSE Bug 1181558 In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely). CVE-2021-31607 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20211690-1/ https://www.suse.com/security/cve/CVE-2021-31607.html CVE-2021-31607 https://bugzilla.suse.com/1185281 SUSE Bug 1185281 https://bugzilla.suse.com/1210934 SUSE Bug 1210934 An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request. CVE-2021-3197 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20211690-1/ https://www.suse.com/security/cve/CVE-2021-3197.html CVE-2021-3197 https://bugzilla.suse.com/1181550 SUSE Bug 1181550 https://bugzilla.suse.com/1181564 SUSE Bug 1181564