Security update for Salt SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:2676-1 Final 1 1 2017-10-09T13:39:39Z current 2017-10-09T13:39:39Z 2017-10-09T13:39:39Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for Salt This update for salt fixes one security issue and bugs: The following security issue has been fixed: - CVE-2017-12791: Directory traversal vulnerability in minion id validation allowed remote minions with incorrect credentials to authenticate to a master via a crafted minion ID (bsc#1053955). Additionally, the following non-security issues have been fixed: - Added support for SUSE Manager scalability features. (bsc#1052264) - Introduced the kubernetes module. (bsc#1051948) - Notify systemd synchronously via NOTIFY_SOCKET. (bsc#1053376) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2017-1660,SUSE-SLE-Manager-Tools-12-2017-1660,SUSE-SLE-Module-Adv-Systems-Management-12-2017-1660,SUSE-SLE-POS-12-SP2-2017-1660,SUSE-SUSE-Manager-Proxy-3.0-2017-1660,SUSE-SUSE-Manager-Server-3.0-2017-1660,SUSE-Storage-3-2017-1660,SUSE-Storage-4-2017-1660 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20172676-1/ Link for SUSE-SU-2017:2676-1 https://lists.suse.com/pipermail/sle-security-updates/2017-October/003281.html E-Mail link for SUSE-SU-2017:2676-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1051948 SUSE Bug 1051948 https://bugzilla.suse.com/1052264 SUSE Bug 1052264 https://bugzilla.suse.com/1053376 SUSE Bug 1053376 https://bugzilla.suse.com/1053955 SUSE Bug 1053955 https://www.suse.com/security/cve/CVE-2017-12791/ SUSE CVE CVE-2017-12791 page SUSE Enterprise Storage 3 SUSE Enterprise Storage 4 SUSE Linux Enterprise Module for Advanced Systems Management 12 SUSE Linux Enterprise Point of Sale 12 SP2 SUSE Manager Client Tools 12 SUSE Manager Proxy 3.0 SUSE Manager Server 3.0 salt-2016.11.4-46.7.1 salt-doc-2016.11.4-46.7.1 salt-minion-2016.11.4-46.7.1 salt-api-2016.11.4-46.7.1 salt-bash-completion-2016.11.4-46.7.1 salt-cloud-2016.11.4-46.7.1 salt-master-2016.11.4-46.7.1 salt-proxy-2016.11.4-46.7.1 salt-ssh-2016.11.4-46.7.1 salt-syndic-2016.11.4-46.7.1 salt-zsh-completion-2016.11.4-46.7.1 salt-2016.11.4-46.7.1 as a component of SUSE Enterprise Storage 3 salt-master-2016.11.4-46.7.1 as a component of SUSE Enterprise Storage 3 salt-minion-2016.11.4-46.7.1 as a component of SUSE Enterprise Storage 3 salt-2016.11.4-46.7.1 as a component of SUSE Enterprise Storage 4 salt-master-2016.11.4-46.7.1 as a component of SUSE Enterprise Storage 4 salt-minion-2016.11.4-46.7.1 as a component of SUSE Enterprise Storage 4 salt-2016.11.4-46.7.1 as a component of SUSE Linux Enterprise Module for Advanced Systems Management 12 salt-api-2016.11.4-46.7.1 as a component of SUSE Linux Enterprise Module for Advanced Systems Management 12 salt-bash-completion-2016.11.4-46.7.1 as a component of SUSE Linux Enterprise Module for Advanced Systems Management 12 salt-cloud-2016.11.4-46.7.1 as a component of SUSE Linux Enterprise Module for Advanced Systems Management 12 salt-doc-2016.11.4-46.7.1 as a component of SUSE Linux Enterprise Module for Advanced Systems Management 12 salt-master-2016.11.4-46.7.1 as a component of SUSE Linux Enterprise Module for Advanced Systems Management 12 salt-minion-2016.11.4-46.7.1 as a component of SUSE Linux Enterprise Module for Advanced Systems Management 12 salt-proxy-2016.11.4-46.7.1 as a component of SUSE Linux Enterprise Module for Advanced Systems Management 12 salt-ssh-2016.11.4-46.7.1 as a component of SUSE Linux Enterprise Module for Advanced Systems Management 12 salt-syndic-2016.11.4-46.7.1 as a component of SUSE Linux Enterprise Module for Advanced Systems Management 12 salt-zsh-completion-2016.11.4-46.7.1 as a component of SUSE Linux Enterprise Module for Advanced Systems Management 12 salt-2016.11.4-46.7.1 as a component of SUSE Linux Enterprise Point of Sale 12 SP2 salt-minion-2016.11.4-46.7.1 as a component of SUSE Linux Enterprise Point of Sale 12 SP2 salt-2016.11.4-46.7.1 as a component of SUSE Manager Client Tools 12 salt-doc-2016.11.4-46.7.1 as a component of SUSE Manager Client Tools 12 salt-minion-2016.11.4-46.7.1 as a component of SUSE Manager Client Tools 12 salt-2016.11.4-46.7.1 as a component of SUSE Manager Proxy 3.0 salt-api-2016.11.4-46.7.1 as a component of SUSE Manager Proxy 3.0 salt-bash-completion-2016.11.4-46.7.1 as a component of SUSE Manager Proxy 3.0 salt-doc-2016.11.4-46.7.1 as a component of SUSE Manager Proxy 3.0 salt-master-2016.11.4-46.7.1 as a component of SUSE Manager Proxy 3.0 salt-minion-2016.11.4-46.7.1 as a component of SUSE Manager Proxy 3.0 salt-proxy-2016.11.4-46.7.1 as a component of SUSE Manager Proxy 3.0 salt-ssh-2016.11.4-46.7.1 as a component of SUSE Manager Proxy 3.0 salt-syndic-2016.11.4-46.7.1 as a component of SUSE Manager Proxy 3.0 salt-zsh-completion-2016.11.4-46.7.1 as a component of SUSE Manager Proxy 3.0 salt-2016.11.4-46.7.1 as a component of SUSE Manager Server 3.0 salt-api-2016.11.4-46.7.1 as a component of SUSE Manager Server 3.0 salt-bash-completion-2016.11.4-46.7.1 as a component of SUSE Manager Server 3.0 salt-doc-2016.11.4-46.7.1 as a component of SUSE Manager Server 3.0 salt-master-2016.11.4-46.7.1 as a component of SUSE Manager Server 3.0 salt-minion-2016.11.4-46.7.1 as a component of SUSE Manager Server 3.0 salt-proxy-2016.11.4-46.7.1 as a component of SUSE Manager Server 3.0 salt-ssh-2016.11.4-46.7.1 as a component of SUSE Manager Server 3.0 salt-syndic-2016.11.4-46.7.1 as a component of SUSE Manager Server 3.0 salt-zsh-completion-2016.11.4-46.7.1 as a component of SUSE Manager Server 3.0 Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. CVE-2017-12791 SUSE Enterprise Storage 3:salt-2016.11.4-46.7.1 SUSE Enterprise Storage 3:salt-master-2016.11.4-46.7.1 SUSE Enterprise Storage 3:salt-minion-2016.11.4-46.7.1 SUSE Enterprise Storage 4:salt-2016.11.4-46.7.1 SUSE Enterprise Storage 4:salt-master-2016.11.4-46.7.1 SUSE Enterprise Storage 4:salt-minion-2016.11.4-46.7.1 SUSE Linux Enterprise Module for Advanced Systems Management 12:salt-2016.11.4-46.7.1 SUSE Linux Enterprise Module for Advanced Systems Management 12:salt-api-2016.11.4-46.7.1 SUSE Linux Enterprise Module for Advanced Systems Management 12:salt-bash-completion-2016.11.4-46.7.1 SUSE Linux Enterprise Module for Advanced Systems Management 12:salt-cloud-2016.11.4-46.7.1 SUSE Linux Enterprise Module for Advanced Systems Management 12:salt-doc-2016.11.4-46.7.1 SUSE Linux Enterprise Module for Advanced Systems Management 12:salt-master-2016.11.4-46.7.1 SUSE Linux Enterprise Module for Advanced Systems Management 12:salt-minion-2016.11.4-46.7.1 SUSE Linux Enterprise Module for Advanced Systems Management 12:salt-proxy-2016.11.4-46.7.1 SUSE Linux Enterprise Module for Advanced Systems Management 12:salt-ssh-2016.11.4-46.7.1 SUSE Linux Enterprise Module for Advanced Systems Management 12:salt-syndic-2016.11.4-46.7.1 SUSE Linux Enterprise Module for Advanced Systems Management 12:salt-zsh-completion-2016.11.4-46.7.1 SUSE Linux Enterprise Point of Sale 12 SP2:salt-2016.11.4-46.7.1 SUSE Linux Enterprise Point of Sale 12 SP2:salt-minion-2016.11.4-46.7.1 SUSE Manager Client Tools 12:salt-2016.11.4-46.7.1 SUSE Manager Client Tools 12:salt-doc-2016.11.4-46.7.1 SUSE Manager Client Tools 12:salt-minion-2016.11.4-46.7.1 SUSE Manager Proxy 3.0:salt-2016.11.4-46.7.1 SUSE Manager Proxy 3.0:salt-api-2016.11.4-46.7.1 SUSE Manager Proxy 3.0:salt-bash-completion-2016.11.4-46.7.1 SUSE Manager Proxy 3.0:salt-doc-2016.11.4-46.7.1 SUSE Manager Proxy 3.0:salt-master-2016.11.4-46.7.1 SUSE Manager Proxy 3.0:salt-minion-2016.11.4-46.7.1 SUSE Manager Proxy 3.0:salt-proxy-2016.11.4-46.7.1 SUSE Manager Proxy 3.0:salt-ssh-2016.11.4-46.7.1 SUSE Manager Proxy 3.0:salt-syndic-2016.11.4-46.7.1 SUSE Manager Proxy 3.0:salt-zsh-completion-2016.11.4-46.7.1 SUSE Manager Server 3.0:salt-2016.11.4-46.7.1 SUSE Manager Server 3.0:salt-api-2016.11.4-46.7.1 SUSE Manager Server 3.0:salt-bash-completion-2016.11.4-46.7.1 SUSE Manager Server 3.0:salt-doc-2016.11.4-46.7.1 SUSE Manager Server 3.0:salt-master-2016.11.4-46.7.1 SUSE Manager Server 3.0:salt-minion-2016.11.4-46.7.1 SUSE Manager Server 3.0:salt-proxy-2016.11.4-46.7.1 SUSE Manager Server 3.0:salt-ssh-2016.11.4-46.7.1 SUSE Manager Server 3.0:salt-syndic-2016.11.4-46.7.1 SUSE Manager Server 3.0:salt-zsh-completion-2016.11.4-46.7.1 moderate 4 AV:N/AC:L/Au:S/C:P/I:N/A:N 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172676-1/ https://www.suse.com/security/cve/CVE-2017-12791.html CVE-2017-12791 https://bugzilla.suse.com/1053955 SUSE Bug 1053955 https://bugzilla.suse.com/1062462 SUSE Bug 1062462