Security update for salt SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:3866-1 Final 1 1 2023-09-28T11:41:34Z current 2023-09-28T11:41:34Z 2023-09-28T11:41:34Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for salt This update for salt fixes the following issues: Security issues fixed: - CVE-2023-20897: Fixed DOS in minion return. (bsc#1214796, bsc#1213441) - CVE-2023-20898: Fixed Git Providers can read from the wrong environment because they get the same cache directory base name. (bsc#1214797, bsc#1193948) Bugs fixed: - Create minion_id with reproducible mtime - Fix broken tests to make them running in the testsuite - Fix detection of Salt codename by 'salt_version' execution module - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix utf8 handling in 'pass' renderer and make it more robust - Fix zypper repositories always being reconfigured - Make sure configured user is properly set by Salt (bsc#1210994) - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Revert usage of long running REQ channel to prevent possible missing responses on requests and duplicated responses (bsc#1213960, bsc#1213630, bsc#1213257) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-3866,SUSE-SLE-Product-HPC-15-SP1-LTSS-2023-3866,SUSE-SLE-Product-SLES-15-SP1-LTSS-2023-3866,SUSE-SLE-Product-SLES_SAP-15-SP1-2023-3866 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20233866-1/ Link for SUSE-SU-2023:3866-1 https://lists.suse.com/pipermail/sle-updates/2023-September/031791.html E-Mail link for SUSE-SU-2023:3866-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1193948 SUSE Bug 1193948 https://bugzilla.suse.com/1210994 SUSE Bug 1210994 https://bugzilla.suse.com/1212794 SUSE Bug 1212794 https://bugzilla.suse.com/1212844 SUSE Bug 1212844 https://bugzilla.suse.com/1212855 SUSE Bug 1212855 https://bugzilla.suse.com/1213257 SUSE Bug 1213257 https://bugzilla.suse.com/1213441 SUSE Bug 1213441 https://bugzilla.suse.com/1213630 SUSE Bug 1213630 https://bugzilla.suse.com/1213960 SUSE Bug 1213960 https://bugzilla.suse.com/1214796 SUSE Bug 1214796 https://bugzilla.suse.com/1214797 SUSE Bug 1214797 https://bugzilla.suse.com/1215489 SUSE Bug 1215489 https://www.suse.com/security/cve/CVE-2023-20897/ SUSE CVE CVE-2023-20897 page https://www.suse.com/security/cve/CVE-2023-20898/ SUSE CVE CVE-2023-20898 page SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Server for SAP Applications 15 SP1 python3-salt-3006.0-150100.107.1 salt-3006.0-150100.107.1 salt-api-3006.0-150100.107.1 salt-bash-completion-3006.0-150100.107.1 salt-cloud-3006.0-150100.107.1 salt-doc-3006.0-150100.107.1 salt-fish-completion-3006.0-150100.107.1 salt-master-3006.0-150100.107.1 salt-minion-3006.0-150100.107.1 salt-proxy-3006.0-150100.107.1 salt-ssh-3006.0-150100.107.1 salt-standalone-formulas-configuration-3006.0-150100.107.1 salt-syndic-3006.0-150100.107.1 salt-tests-3006.0-150100.107.1 salt-transactional-update-3006.0-150100.107.1 salt-zsh-completion-3006.0-150100.107.1 python3-salt-3006.0-150100.107.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS salt-3006.0-150100.107.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS salt-api-3006.0-150100.107.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS salt-bash-completion-3006.0-150100.107.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS salt-cloud-3006.0-150100.107.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS salt-doc-3006.0-150100.107.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS salt-fish-completion-3006.0-150100.107.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS salt-master-3006.0-150100.107.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS salt-minion-3006.0-150100.107.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS salt-proxy-3006.0-150100.107.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS salt-ssh-3006.0-150100.107.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS salt-standalone-formulas-configuration-3006.0-150100.107.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS salt-syndic-3006.0-150100.107.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS salt-transactional-update-3006.0-150100.107.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS salt-zsh-completion-3006.0-150100.107.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS python3-salt-3006.0-150100.107.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS salt-3006.0-150100.107.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS salt-api-3006.0-150100.107.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS salt-bash-completion-3006.0-150100.107.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS salt-cloud-3006.0-150100.107.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS salt-doc-3006.0-150100.107.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS salt-fish-completion-3006.0-150100.107.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS salt-master-3006.0-150100.107.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS salt-minion-3006.0-150100.107.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS salt-proxy-3006.0-150100.107.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS salt-ssh-3006.0-150100.107.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS salt-standalone-formulas-configuration-3006.0-150100.107.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS salt-syndic-3006.0-150100.107.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS salt-transactional-update-3006.0-150100.107.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS salt-zsh-completion-3006.0-150100.107.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS python3-salt-3006.0-150100.107.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 salt-3006.0-150100.107.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 salt-api-3006.0-150100.107.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 salt-bash-completion-3006.0-150100.107.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 salt-cloud-3006.0-150100.107.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 salt-doc-3006.0-150100.107.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 salt-fish-completion-3006.0-150100.107.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 salt-master-3006.0-150100.107.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 salt-minion-3006.0-150100.107.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 salt-proxy-3006.0-150100.107.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 salt-ssh-3006.0-150100.107.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 salt-standalone-formulas-configuration-3006.0-150100.107.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 salt-syndic-3006.0-150100.107.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 salt-transactional-update-3006.0-150100.107.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 salt-zsh-completion-3006.0-150100.107.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted. CVE-2023-20897 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:python3-salt-3006.0-150100.107.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:salt-3006.0-150100.107.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:salt-api-3006.0-150100.107.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:salt-bash-completion-3006.0-150100.107.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:salt-cloud-3006.0-150100.107.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:salt-doc-3006.0-150100.107.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:salt-fish-completion-3006.0-150100.107.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:salt-master-3006.0-150100.107.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:salt-minion-3006.0-150100.107.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:salt-proxy-3006.0-150100.107.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:salt-ssh-3006.0-150100.107.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:salt-standalone-formulas-configuration-3006.0-150100.107.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:salt-syndic-3006.0-150100.107.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:salt-transactional-update-3006.0-150100.107.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:salt-zsh-completion-3006.0-150100.107.1 SUSE Linux Enterprise Server 15 SP1-LTSS:python3-salt-3006.0-150100.107.1 SUSE Linux Enterprise Server 15 SP1-LTSS:salt-3006.0-150100.107.1 SUSE Linux Enterprise Server 15 SP1-LTSS:salt-api-3006.0-150100.107.1 SUSE Linux Enterprise Server 15 SP1-LTSS:salt-bash-completion-3006.0-150100.107.1 SUSE Linux Enterprise Server 15 SP1-LTSS:salt-cloud-3006.0-150100.107.1 SUSE Linux Enterprise Server 15 SP1-LTSS:salt-doc-3006.0-150100.107.1 SUSE Linux Enterprise Server 15 SP1-LTSS:salt-fish-completion-3006.0-150100.107.1 SUSE Linux Enterprise Server 15 SP1-LTSS:salt-master-3006.0-150100.107.1 SUSE Linux Enterprise Server 15 SP1-LTSS:salt-minion-3006.0-150100.107.1 SUSE Linux Enterprise Server 15 SP1-LTSS:salt-proxy-3006.0-150100.107.1 SUSE Linux Enterprise Server 15 SP1-LTSS:salt-ssh-3006.0-150100.107.1 SUSE Linux Enterprise Server 15 SP1-LTSS:salt-standalone-formulas-configuration-3006.0-150100.107.1 SUSE Linux Enterprise Server 15 SP1-LTSS:salt-syndic-3006.0-150100.107.1 SUSE Linux Enterprise Server 15 SP1-LTSS:salt-transactional-update-3006.0-150100.107.1 SUSE Linux Enterprise Server 15 SP1-LTSS:salt-zsh-completion-3006.0-150100.107.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:python3-salt-3006.0-150100.107.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:salt-3006.0-150100.107.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:salt-api-3006.0-150100.107.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:salt-bash-completion-3006.0-150100.107.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:salt-cloud-3006.0-150100.107.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:salt-doc-3006.0-150100.107.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:salt-fish-completion-3006.0-150100.107.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:salt-master-3006.0-150100.107.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:salt-minion-3006.0-150100.107.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:salt-proxy-3006.0-150100.107.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:salt-ssh-3006.0-150100.107.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:salt-standalone-formulas-configuration-3006.0-150100.107.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:salt-syndic-3006.0-150100.107.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:salt-transactional-update-3006.0-150100.107.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:salt-zsh-completion-3006.0-150100.107.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233866-1/ https://www.suse.com/security/cve/CVE-2023-20897.html CVE-2023-20897 https://bugzilla.suse.com/1214796 SUSE Bug 1214796 Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environments can get garbage data or the wrong data, which can lead to wrongful data disclosure, wrongful executions, data corruption and/or crash. CVE-2023-20898 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:python3-salt-3006.0-150100.107.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:salt-3006.0-150100.107.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:salt-api-3006.0-150100.107.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:salt-bash-completion-3006.0-150100.107.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:salt-cloud-3006.0-150100.107.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:salt-doc-3006.0-150100.107.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:salt-fish-completion-3006.0-150100.107.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:salt-master-3006.0-150100.107.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:salt-minion-3006.0-150100.107.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:salt-proxy-3006.0-150100.107.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:salt-ssh-3006.0-150100.107.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:salt-standalone-formulas-configuration-3006.0-150100.107.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:salt-syndic-3006.0-150100.107.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:salt-transactional-update-3006.0-150100.107.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:salt-zsh-completion-3006.0-150100.107.1 SUSE Linux Enterprise Server 15 SP1-LTSS:python3-salt-3006.0-150100.107.1 SUSE Linux Enterprise Server 15 SP1-LTSS:salt-3006.0-150100.107.1 SUSE Linux Enterprise Server 15 SP1-LTSS:salt-api-3006.0-150100.107.1 SUSE Linux Enterprise Server 15 SP1-LTSS:salt-bash-completion-3006.0-150100.107.1 SUSE Linux Enterprise Server 15 SP1-LTSS:salt-cloud-3006.0-150100.107.1 SUSE Linux Enterprise Server 15 SP1-LTSS:salt-doc-3006.0-150100.107.1 SUSE Linux Enterprise Server 15 SP1-LTSS:salt-fish-completion-3006.0-150100.107.1 SUSE Linux Enterprise Server 15 SP1-LTSS:salt-master-3006.0-150100.107.1 SUSE Linux Enterprise Server 15 SP1-LTSS:salt-minion-3006.0-150100.107.1 SUSE Linux Enterprise Server 15 SP1-LTSS:salt-proxy-3006.0-150100.107.1 SUSE Linux Enterprise Server 15 SP1-LTSS:salt-ssh-3006.0-150100.107.1 SUSE Linux Enterprise Server 15 SP1-LTSS:salt-standalone-formulas-configuration-3006.0-150100.107.1 SUSE Linux Enterprise Server 15 SP1-LTSS:salt-syndic-3006.0-150100.107.1 SUSE Linux Enterprise Server 15 SP1-LTSS:salt-transactional-update-3006.0-150100.107.1 SUSE Linux Enterprise Server 15 SP1-LTSS:salt-zsh-completion-3006.0-150100.107.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:python3-salt-3006.0-150100.107.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:salt-3006.0-150100.107.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:salt-api-3006.0-150100.107.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:salt-bash-completion-3006.0-150100.107.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:salt-cloud-3006.0-150100.107.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:salt-doc-3006.0-150100.107.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:salt-fish-completion-3006.0-150100.107.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:salt-master-3006.0-150100.107.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:salt-minion-3006.0-150100.107.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:salt-proxy-3006.0-150100.107.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:salt-ssh-3006.0-150100.107.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:salt-standalone-formulas-configuration-3006.0-150100.107.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:salt-syndic-3006.0-150100.107.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:salt-transactional-update-3006.0-150100.107.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:salt-zsh-completion-3006.0-150100.107.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233866-1/ https://www.suse.com/security/cve/CVE-2023-20898.html CVE-2023-20898 https://bugzilla.suse.com/1214797 SUSE Bug 1214797