Security update for Salt SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:3553-1 Final 1 1 2021-10-27T13:28:26Z current 2021-10-27T13:28:26Z 2021-10-27T13:28:26Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for Salt This update fixes the following issues: salt: - Support querying for JSON data in external sql pillar - Exclude the full path of a download URL to prevent injection of malicious code (bsc#1190265, CVE-2021-21996) - Fix wrong relative paths resolution with Jinja renderer when importing subdirectories The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES15-SAP-Azure-BYOS-2021-3553,Image SLES15-SAP-EC2-HVM-BYOS-2021-3553,Image SLES15-SAP-GCE-BYOS-2021-3553,SUSE-2021-3553,SUSE-SLE-Product-HPC-15-2021-3553,SUSE-SLE-Product-SLES-15-2021-3553,SUSE-SLE-Product-SLES_SAP-15-2021-3553 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20213553-1/ Link for SUSE-SU-2021:3553-1 https://lists.suse.com/pipermail/sle-security-updates/2021-October/009665.html E-Mail link for SUSE-SU-2021:3553-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1190265 SUSE Bug 1190265 https://www.suse.com/security/cve/CVE-2021-21996/ SUSE CVE CVE-2021-21996 page Image SLES15-SAP-Azure-BYOS Image SLES15-SAP-EC2-HVM-BYOS Image SLES15-SAP-GCE-BYOS SUSE Linux Enterprise High Performance Computing 15-ESPOS SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server for SAP Applications 15 python3-salt-3002.2-8.41.17.1 salt-3002.2-8.41.17.1 salt-minion-3002.2-8.41.17.1 salt-api-3002.2-8.41.17.1 salt-bash-completion-3002.2-8.41.17.1 salt-cloud-3002.2-8.41.17.1 salt-doc-3002.2-8.41.17.1 salt-fish-completion-3002.2-8.41.17.1 salt-master-3002.2-8.41.17.1 salt-proxy-3002.2-8.41.17.1 salt-ssh-3002.2-8.41.17.1 salt-standalone-formulas-configuration-3002.2-8.41.17.1 salt-syndic-3002.2-8.41.17.1 salt-transactional-update-3002.2-8.41.17.1 salt-zsh-completion-3002.2-8.41.17.1 python3-salt-3002.2-8.41.17.1 as a component of Image SLES15-SAP-Azure-BYOS salt-3002.2-8.41.17.1 as a component of Image SLES15-SAP-Azure-BYOS salt-minion-3002.2-8.41.17.1 as a component of Image SLES15-SAP-Azure-BYOS python3-salt-3002.2-8.41.17.1 as a component of Image SLES15-SAP-EC2-HVM-BYOS salt-3002.2-8.41.17.1 as a component of Image SLES15-SAP-EC2-HVM-BYOS salt-minion-3002.2-8.41.17.1 as a component of Image SLES15-SAP-EC2-HVM-BYOS python3-salt-3002.2-8.41.17.1 as a component of Image SLES15-SAP-GCE-BYOS salt-3002.2-8.41.17.1 as a component of Image SLES15-SAP-GCE-BYOS salt-minion-3002.2-8.41.17.1 as a component of Image SLES15-SAP-GCE-BYOS python3-salt-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS salt-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS salt-api-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS salt-bash-completion-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS salt-cloud-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS salt-doc-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS salt-fish-completion-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS salt-master-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS salt-minion-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS salt-proxy-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS salt-ssh-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS salt-standalone-formulas-configuration-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS salt-syndic-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS salt-transactional-update-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS salt-zsh-completion-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS python3-salt-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS salt-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS salt-api-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS salt-bash-completion-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS salt-cloud-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS salt-doc-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS salt-fish-completion-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS salt-master-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS salt-minion-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS salt-proxy-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS salt-ssh-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS salt-standalone-formulas-configuration-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS salt-syndic-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS salt-transactional-update-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS salt-zsh-completion-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS python3-salt-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise Server 15-LTSS salt-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise Server 15-LTSS salt-api-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise Server 15-LTSS salt-bash-completion-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise Server 15-LTSS salt-cloud-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise Server 15-LTSS salt-doc-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise Server 15-LTSS salt-fish-completion-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise Server 15-LTSS salt-master-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise Server 15-LTSS salt-minion-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise Server 15-LTSS salt-proxy-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise Server 15-LTSS salt-ssh-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise Server 15-LTSS salt-standalone-formulas-configuration-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise Server 15-LTSS salt-syndic-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise Server 15-LTSS salt-transactional-update-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise Server 15-LTSS salt-zsh-completion-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise Server 15-LTSS python3-salt-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 salt-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 salt-api-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 salt-bash-completion-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 salt-cloud-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 salt-doc-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 salt-fish-completion-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 salt-master-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 salt-minion-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 salt-proxy-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 salt-ssh-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 salt-standalone-formulas-configuration-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 salt-syndic-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 salt-transactional-update-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 salt-zsh-completion-3002.2-8.41.17.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and source_hash URLs can gain full file system access as root on a salt minion. CVE-2021-21996 Image SLES15-SAP-Azure-BYOS:python3-salt-3002.2-8.41.17.1 Image SLES15-SAP-Azure-BYOS:salt-3002.2-8.41.17.1 Image SLES15-SAP-Azure-BYOS:salt-minion-3002.2-8.41.17.1 Image SLES15-SAP-EC2-HVM-BYOS:python3-salt-3002.2-8.41.17.1 Image SLES15-SAP-EC2-HVM-BYOS:salt-3002.2-8.41.17.1 Image SLES15-SAP-EC2-HVM-BYOS:salt-minion-3002.2-8.41.17.1 Image SLES15-SAP-GCE-BYOS:python3-salt-3002.2-8.41.17.1 Image SLES15-SAP-GCE-BYOS:salt-3002.2-8.41.17.1 Image SLES15-SAP-GCE-BYOS:salt-minion-3002.2-8.41.17.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:python3-salt-3002.2-8.41.17.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-3002.2-8.41.17.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-api-3002.2-8.41.17.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-bash-completion-3002.2-8.41.17.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-cloud-3002.2-8.41.17.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-doc-3002.2-8.41.17.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-fish-completion-3002.2-8.41.17.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-master-3002.2-8.41.17.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-minion-3002.2-8.41.17.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-proxy-3002.2-8.41.17.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-ssh-3002.2-8.41.17.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-standalone-formulas-configuration-3002.2-8.41.17.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-syndic-3002.2-8.41.17.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-transactional-update-3002.2-8.41.17.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-zsh-completion-3002.2-8.41.17.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:python3-salt-3002.2-8.41.17.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-3002.2-8.41.17.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-api-3002.2-8.41.17.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-bash-completion-3002.2-8.41.17.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-cloud-3002.2-8.41.17.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-doc-3002.2-8.41.17.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-fish-completion-3002.2-8.41.17.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-master-3002.2-8.41.17.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-minion-3002.2-8.41.17.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-proxy-3002.2-8.41.17.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-ssh-3002.2-8.41.17.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-standalone-formulas-configuration-3002.2-8.41.17.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-syndic-3002.2-8.41.17.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-transactional-update-3002.2-8.41.17.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-zsh-completion-3002.2-8.41.17.1 SUSE Linux Enterprise Server 15-LTSS:python3-salt-3002.2-8.41.17.1 SUSE Linux Enterprise Server 15-LTSS:salt-3002.2-8.41.17.1 SUSE Linux Enterprise Server 15-LTSS:salt-api-3002.2-8.41.17.1 SUSE Linux Enterprise Server 15-LTSS:salt-bash-completion-3002.2-8.41.17.1 SUSE Linux Enterprise Server 15-LTSS:salt-cloud-3002.2-8.41.17.1 SUSE Linux Enterprise Server 15-LTSS:salt-doc-3002.2-8.41.17.1 SUSE Linux Enterprise Server 15-LTSS:salt-fish-completion-3002.2-8.41.17.1 SUSE Linux Enterprise Server 15-LTSS:salt-master-3002.2-8.41.17.1 SUSE Linux Enterprise Server 15-LTSS:salt-minion-3002.2-8.41.17.1 SUSE Linux Enterprise Server 15-LTSS:salt-proxy-3002.2-8.41.17.1 SUSE Linux Enterprise Server 15-LTSS:salt-ssh-3002.2-8.41.17.1 SUSE Linux Enterprise Server 15-LTSS:salt-standalone-formulas-configuration-3002.2-8.41.17.1 SUSE Linux Enterprise Server 15-LTSS:salt-syndic-3002.2-8.41.17.1 SUSE Linux Enterprise Server 15-LTSS:salt-transactional-update-3002.2-8.41.17.1 SUSE Linux Enterprise Server 15-LTSS:salt-zsh-completion-3002.2-8.41.17.1 SUSE Linux Enterprise Server for SAP Applications 15:python3-salt-3002.2-8.41.17.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-3002.2-8.41.17.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-api-3002.2-8.41.17.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-bash-completion-3002.2-8.41.17.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-cloud-3002.2-8.41.17.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-doc-3002.2-8.41.17.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-fish-completion-3002.2-8.41.17.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-master-3002.2-8.41.17.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-minion-3002.2-8.41.17.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-proxy-3002.2-8.41.17.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-ssh-3002.2-8.41.17.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-standalone-formulas-configuration-3002.2-8.41.17.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-syndic-3002.2-8.41.17.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-transactional-update-3002.2-8.41.17.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-zsh-completion-3002.2-8.41.17.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20213553-1/ https://www.suse.com/security/cve/CVE-2021-21996.html CVE-2021-21996 https://bugzilla.suse.com/1190265 SUSE Bug 1190265 https://bugzilla.suse.com/1210934 SUSE Bug 1210934