Security update for salt SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:1151-1 Final 1 1 2020-04-29T20:55:04Z current 2020-04-29T20:55:04Z 2020-04-29T20:55:04Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for salt This update for salt fixes the following issues: - Fix CVE-2020-11651 and CVE-2020-11652 (bsc#1170595) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-1151,SUSE-SLE-Product-HPC-15-2020-1151,SUSE-SLE-Product-SLES-15-2020-1151,SUSE-SLE-Product-SLES_SAP-15-2020-1151 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20201151-1/ Link for SUSE-SU-2020:1151-1 https://lists.suse.com/pipermail/sle-security-updates/2020-April/006762.html E-Mail link for SUSE-SU-2020:1151-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1170595 SUSE Bug 1170595 https://www.suse.com/security/cve/CVE-2020-11651/ SUSE CVE CVE-2020-11651 page https://www.suse.com/security/cve/CVE-2020-11652/ SUSE CVE CVE-2020-11652 page SUSE Linux Enterprise High Performance Computing 15-ESPOS SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server for SAP Applications 15 python2-salt-2019.2.0-5.67.1 python3-salt-2019.2.0-5.67.1 salt-2019.2.0-5.67.1 salt-api-2019.2.0-5.67.1 salt-bash-completion-2019.2.0-5.67.1 salt-cloud-2019.2.0-5.67.1 salt-doc-2019.2.0-5.67.1 salt-fish-completion-2019.2.0-5.67.1 salt-master-2019.2.0-5.67.1 salt-minion-2019.2.0-5.67.1 salt-proxy-2019.2.0-5.67.1 salt-ssh-2019.2.0-5.67.1 salt-standalone-formulas-configuration-2019.2.0-5.67.1 salt-syndic-2019.2.0-5.67.1 salt-zsh-completion-2019.2.0-5.67.1 python2-salt-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS python3-salt-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS salt-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS salt-api-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS salt-bash-completion-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS salt-cloud-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS salt-doc-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS salt-fish-completion-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS salt-master-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS salt-minion-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS salt-proxy-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS salt-ssh-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS salt-standalone-formulas-configuration-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS salt-syndic-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS salt-zsh-completion-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS python2-salt-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS python3-salt-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS salt-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS salt-api-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS salt-bash-completion-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS salt-cloud-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS salt-doc-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS salt-fish-completion-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS salt-master-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS salt-minion-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS salt-proxy-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS salt-ssh-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS salt-standalone-formulas-configuration-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS salt-syndic-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS salt-zsh-completion-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS python2-salt-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise Server 15-LTSS python3-salt-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise Server 15-LTSS salt-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise Server 15-LTSS salt-api-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise Server 15-LTSS salt-bash-completion-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise Server 15-LTSS salt-cloud-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise Server 15-LTSS salt-doc-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise Server 15-LTSS salt-fish-completion-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise Server 15-LTSS salt-master-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise Server 15-LTSS salt-minion-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise Server 15-LTSS salt-proxy-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise Server 15-LTSS salt-ssh-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise Server 15-LTSS salt-standalone-formulas-configuration-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise Server 15-LTSS salt-syndic-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise Server 15-LTSS salt-zsh-completion-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise Server 15-LTSS python2-salt-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 python3-salt-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 salt-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 salt-api-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 salt-bash-completion-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 salt-cloud-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 salt-doc-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 salt-fish-completion-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 salt-master-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 salt-minion-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 salt-proxy-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 salt-ssh-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 salt-standalone-formulas-configuration-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 salt-syndic-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 salt-zsh-completion-2019.2.0-5.67.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions. CVE-2020-11651 SUSE Linux Enterprise High Performance Computing 15-ESPOS:python2-salt-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:python3-salt-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-api-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-bash-completion-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-cloud-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-doc-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-fish-completion-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-master-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-minion-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-proxy-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-ssh-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-standalone-formulas-configuration-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-syndic-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-zsh-completion-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:python2-salt-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:python3-salt-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-api-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-bash-completion-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-cloud-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-doc-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-fish-completion-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-master-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-minion-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-proxy-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-ssh-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-standalone-formulas-configuration-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-syndic-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-zsh-completion-2019.2.0-5.67.1 SUSE Linux Enterprise Server 15-LTSS:python2-salt-2019.2.0-5.67.1 SUSE Linux Enterprise Server 15-LTSS:python3-salt-2019.2.0-5.67.1 SUSE Linux Enterprise Server 15-LTSS:salt-2019.2.0-5.67.1 SUSE Linux Enterprise Server 15-LTSS:salt-api-2019.2.0-5.67.1 SUSE Linux Enterprise Server 15-LTSS:salt-bash-completion-2019.2.0-5.67.1 SUSE Linux Enterprise Server 15-LTSS:salt-cloud-2019.2.0-5.67.1 SUSE Linux Enterprise Server 15-LTSS:salt-doc-2019.2.0-5.67.1 SUSE Linux Enterprise Server 15-LTSS:salt-fish-completion-2019.2.0-5.67.1 SUSE Linux Enterprise Server 15-LTSS:salt-master-2019.2.0-5.67.1 SUSE Linux Enterprise Server 15-LTSS:salt-minion-2019.2.0-5.67.1 SUSE Linux Enterprise Server 15-LTSS:salt-proxy-2019.2.0-5.67.1 SUSE Linux Enterprise Server 15-LTSS:salt-ssh-2019.2.0-5.67.1 SUSE Linux Enterprise Server 15-LTSS:salt-standalone-formulas-configuration-2019.2.0-5.67.1 SUSE Linux Enterprise Server 15-LTSS:salt-syndic-2019.2.0-5.67.1 SUSE Linux Enterprise Server 15-LTSS:salt-zsh-completion-2019.2.0-5.67.1 SUSE Linux Enterprise Server for SAP Applications 15:python2-salt-2019.2.0-5.67.1 SUSE Linux Enterprise Server for SAP Applications 15:python3-salt-2019.2.0-5.67.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-2019.2.0-5.67.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-api-2019.2.0-5.67.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-bash-completion-2019.2.0-5.67.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-cloud-2019.2.0-5.67.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-doc-2019.2.0-5.67.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-fish-completion-2019.2.0-5.67.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-master-2019.2.0-5.67.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-minion-2019.2.0-5.67.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-proxy-2019.2.0-5.67.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-ssh-2019.2.0-5.67.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-standalone-formulas-configuration-2019.2.0-5.67.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-syndic-2019.2.0-5.67.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-zsh-completion-2019.2.0-5.67.1 critical 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201151-1/ https://www.suse.com/security/cve/CVE-2020-11651.html CVE-2020-11651 https://bugzilla.suse.com/1170595 SUSE Bug 1170595 An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users. CVE-2020-11652 SUSE Linux Enterprise High Performance Computing 15-ESPOS:python2-salt-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:python3-salt-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-api-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-bash-completion-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-cloud-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-doc-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-fish-completion-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-master-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-minion-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-proxy-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-ssh-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-standalone-formulas-configuration-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-syndic-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-zsh-completion-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:python2-salt-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:python3-salt-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-api-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-bash-completion-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-cloud-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-doc-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-fish-completion-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-master-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-minion-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-proxy-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-ssh-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-standalone-formulas-configuration-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-syndic-2019.2.0-5.67.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:salt-zsh-completion-2019.2.0-5.67.1 SUSE Linux Enterprise Server 15-LTSS:python2-salt-2019.2.0-5.67.1 SUSE Linux Enterprise Server 15-LTSS:python3-salt-2019.2.0-5.67.1 SUSE Linux Enterprise Server 15-LTSS:salt-2019.2.0-5.67.1 SUSE Linux Enterprise Server 15-LTSS:salt-api-2019.2.0-5.67.1 SUSE Linux Enterprise Server 15-LTSS:salt-bash-completion-2019.2.0-5.67.1 SUSE Linux Enterprise Server 15-LTSS:salt-cloud-2019.2.0-5.67.1 SUSE Linux Enterprise Server 15-LTSS:salt-doc-2019.2.0-5.67.1 SUSE Linux Enterprise Server 15-LTSS:salt-fish-completion-2019.2.0-5.67.1 SUSE Linux Enterprise Server 15-LTSS:salt-master-2019.2.0-5.67.1 SUSE Linux Enterprise Server 15-LTSS:salt-minion-2019.2.0-5.67.1 SUSE Linux Enterprise Server 15-LTSS:salt-proxy-2019.2.0-5.67.1 SUSE Linux Enterprise Server 15-LTSS:salt-ssh-2019.2.0-5.67.1 SUSE Linux Enterprise Server 15-LTSS:salt-standalone-formulas-configuration-2019.2.0-5.67.1 SUSE Linux Enterprise Server 15-LTSS:salt-syndic-2019.2.0-5.67.1 SUSE Linux Enterprise Server 15-LTSS:salt-zsh-completion-2019.2.0-5.67.1 SUSE Linux Enterprise Server for SAP Applications 15:python2-salt-2019.2.0-5.67.1 SUSE Linux Enterprise Server for SAP Applications 15:python3-salt-2019.2.0-5.67.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-2019.2.0-5.67.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-api-2019.2.0-5.67.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-bash-completion-2019.2.0-5.67.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-cloud-2019.2.0-5.67.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-doc-2019.2.0-5.67.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-fish-completion-2019.2.0-5.67.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-master-2019.2.0-5.67.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-minion-2019.2.0-5.67.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-proxy-2019.2.0-5.67.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-ssh-2019.2.0-5.67.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-standalone-formulas-configuration-2019.2.0-5.67.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-syndic-2019.2.0-5.67.1 SUSE Linux Enterprise Server for SAP Applications 15:salt-zsh-completion-2019.2.0-5.67.1 critical 4 AV:N/AC:L/Au:S/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201151-1/ https://www.suse.com/security/cve/CVE-2020-11652.html CVE-2020-11652 https://bugzilla.suse.com/1170595 SUSE Bug 1170595