Security update for SUSE Manager Salt Bundle SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:4757-1 Final 1 1 2023-12-13T09:33:43Z current 2023-12-13T09:33:43Z 2023-12-13T09:33:43Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for SUSE Manager Salt Bundle This update fixes the following issues: venv-salt-minion: * Security fixes: * CVE-2023-34049: Arbitrary code execution via symlink attack (bsc#1215157) * Non security fixes: * Add python dateutil module to the bundle * Allow all primitive grain types for autosign_grains (bsc#1214477) * Remove non-free RNG schema file (bsc#1213351) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-4757,SUSE-EL-9-CLIENT-TOOLS-2023-4757 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20234757-1/ Link for SUSE-SU-2023:4757-1 https://lists.suse.com/pipermail/sle-security-updates/2023-December/017369.html E-Mail link for SUSE-SU-2023:4757-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1213351 SUSE Bug 1213351 https://bugzilla.suse.com/1214477 SUSE Bug 1214477 https://bugzilla.suse.com/1215157 SUSE Bug 1215157 https://www.suse.com/security/cve/CVE-2023-34049/ SUSE CVE CVE-2023-34049 page SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS SUSE:EL-9:Update:Products:SaltBundle:Update saltbundle-swig-4.1.1-1.9.1 saltbundle-swig-doc-4.1.1-1.9.1 saltbundle-swig-examples-4.1.1-1.9.1 saltbundlepy-appdirs-1.4.4-1.6.1 saltbundlepy-certifi-2018.1.18-1.9.1 saltbundlepy-cffi-1.15.1-1.9.1 saltbundlepy-dateutil-2.8.1-1.3.4 saltbundlepy-editables-0.3-1.3.1 saltbundlepy-exceptiongroup-1.1.0-1.3.1 saltbundlepy-flit-core-3.8.0-1.3.1 saltbundlepy-flit-scm-1.7.0-1.3.1 saltbundlepy-hatch-vcs-0.3.0-1.3.1 saltbundlepy-hatchling-1.13.0-1.3.1 saltbundlepy-iniconfig-2.0.0-1.3.1 saltbundlepy-lxml-4.9.3-1.12.1 saltbundlepy-lxml-devel-4.9.3-1.12.1 saltbundlepy-lxml-doc-4.9.3-1.12.1 saltbundlepy-more-itertools-8.10.0-1.6.1 saltbundlepy-packaging-23.1-1.6.1 saltbundlepy-pathspec-0.11.1-1.3.1 saltbundlepy-pip-20.2.4-1.6.1 saltbundlepy-pluggy-1.0.0-1.6.4 saltbundlepy-py-1.10.0-1.9.4 saltbundlepy-pytest-7.3.2-1.6.1 saltbundlepy-setuptools-scm-7.1.0-1.6.1 saltbundlepy-tomli-1.2.3-1.3.1 saltbundlepy-typing-extensions-4.5.0-1.3.1 saltbundlepy-wheel-0.40.0-1.3.1 venv-salt-minion-3006.0-1.30.3 venv-salt-minion-3006.0-1.30.3 as a component of SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS saltbundle-swig-4.1.1-1.9.1 as a component of SUSE:EL-9:Update:Products:SaltBundle:Update saltbundle-swig-doc-4.1.1-1.9.1 as a component of SUSE:EL-9:Update:Products:SaltBundle:Update saltbundle-swig-examples-4.1.1-1.9.1 as a component of SUSE:EL-9:Update:Products:SaltBundle:Update saltbundlepy-appdirs-1.4.4-1.6.1 as a component of SUSE:EL-9:Update:Products:SaltBundle:Update saltbundlepy-certifi-2018.1.18-1.9.1 as a component of SUSE:EL-9:Update:Products:SaltBundle:Update saltbundlepy-cffi-1.15.1-1.9.1 as a component of SUSE:EL-9:Update:Products:SaltBundle:Update saltbundlepy-dateutil-2.8.1-1.3.4 as a component of SUSE:EL-9:Update:Products:SaltBundle:Update saltbundlepy-editables-0.3-1.3.1 as a component of SUSE:EL-9:Update:Products:SaltBundle:Update saltbundlepy-exceptiongroup-1.1.0-1.3.1 as a component of SUSE:EL-9:Update:Products:SaltBundle:Update saltbundlepy-flit-core-3.8.0-1.3.1 as a component of SUSE:EL-9:Update:Products:SaltBundle:Update saltbundlepy-flit-scm-1.7.0-1.3.1 as a component of SUSE:EL-9:Update:Products:SaltBundle:Update saltbundlepy-hatch-vcs-0.3.0-1.3.1 as a component of SUSE:EL-9:Update:Products:SaltBundle:Update saltbundlepy-hatchling-1.13.0-1.3.1 as a component of SUSE:EL-9:Update:Products:SaltBundle:Update saltbundlepy-iniconfig-2.0.0-1.3.1 as a component of SUSE:EL-9:Update:Products:SaltBundle:Update saltbundlepy-lxml-4.9.3-1.12.1 as a component of SUSE:EL-9:Update:Products:SaltBundle:Update saltbundlepy-lxml-devel-4.9.3-1.12.1 as a component of SUSE:EL-9:Update:Products:SaltBundle:Update saltbundlepy-lxml-doc-4.9.3-1.12.1 as a component of SUSE:EL-9:Update:Products:SaltBundle:Update saltbundlepy-more-itertools-8.10.0-1.6.1 as a component of SUSE:EL-9:Update:Products:SaltBundle:Update saltbundlepy-packaging-23.1-1.6.1 as a component of SUSE:EL-9:Update:Products:SaltBundle:Update saltbundlepy-pathspec-0.11.1-1.3.1 as a component of SUSE:EL-9:Update:Products:SaltBundle:Update saltbundlepy-pip-20.2.4-1.6.1 as a component of SUSE:EL-9:Update:Products:SaltBundle:Update saltbundlepy-pluggy-1.0.0-1.6.4 as a component of SUSE:EL-9:Update:Products:SaltBundle:Update saltbundlepy-py-1.10.0-1.9.4 as a component of SUSE:EL-9:Update:Products:SaltBundle:Update saltbundlepy-pytest-7.3.2-1.6.1 as a component of SUSE:EL-9:Update:Products:SaltBundle:Update saltbundlepy-setuptools-scm-7.1.0-1.6.1 as a component of SUSE:EL-9:Update:Products:SaltBundle:Update saltbundlepy-tomli-1.2.3-1.3.1 as a component of SUSE:EL-9:Update:Products:SaltBundle:Update saltbundlepy-typing-extensions-4.5.0-1.3.1 as a component of SUSE:EL-9:Update:Products:SaltBundle:Update saltbundlepy-wheel-0.40.0-1.3.1 as a component of SUSE:EL-9:Update:Products:SaltBundle:Update venv-salt-minion-3006.0-1.30.3 as a component of SUSE:EL-9:Update:Products:SaltBundle:Update The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH. Do not make the copy path on the target predictable and ensure we check return codes of the scp command if the copy fails. CVE-2023-34049 SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:venv-salt-minion-3006.0-1.30.3 SUSE:EL-9:Update:Products:SaltBundle:Update:saltbundle-swig-4.1.1-1.9.1 SUSE:EL-9:Update:Products:SaltBundle:Update:saltbundle-swig-doc-4.1.1-1.9.1 SUSE:EL-9:Update:Products:SaltBundle:Update:saltbundle-swig-examples-4.1.1-1.9.1 SUSE:EL-9:Update:Products:SaltBundle:Update:saltbundlepy-appdirs-1.4.4-1.6.1 SUSE:EL-9:Update:Products:SaltBundle:Update:saltbundlepy-certifi-2018.1.18-1.9.1 SUSE:EL-9:Update:Products:SaltBundle:Update:saltbundlepy-cffi-1.15.1-1.9.1 SUSE:EL-9:Update:Products:SaltBundle:Update:saltbundlepy-dateutil-2.8.1-1.3.4 SUSE:EL-9:Update:Products:SaltBundle:Update:saltbundlepy-editables-0.3-1.3.1 SUSE:EL-9:Update:Products:SaltBundle:Update:saltbundlepy-exceptiongroup-1.1.0-1.3.1 SUSE:EL-9:Update:Products:SaltBundle:Update:saltbundlepy-flit-core-3.8.0-1.3.1 SUSE:EL-9:Update:Products:SaltBundle:Update:saltbundlepy-flit-scm-1.7.0-1.3.1 SUSE:EL-9:Update:Products:SaltBundle:Update:saltbundlepy-hatch-vcs-0.3.0-1.3.1 SUSE:EL-9:Update:Products:SaltBundle:Update:saltbundlepy-hatchling-1.13.0-1.3.1 SUSE:EL-9:Update:Products:SaltBundle:Update:saltbundlepy-iniconfig-2.0.0-1.3.1 SUSE:EL-9:Update:Products:SaltBundle:Update:saltbundlepy-lxml-4.9.3-1.12.1 SUSE:EL-9:Update:Products:SaltBundle:Update:saltbundlepy-lxml-devel-4.9.3-1.12.1 SUSE:EL-9:Update:Products:SaltBundle:Update:saltbundlepy-lxml-doc-4.9.3-1.12.1 SUSE:EL-9:Update:Products:SaltBundle:Update:saltbundlepy-more-itertools-8.10.0-1.6.1 SUSE:EL-9:Update:Products:SaltBundle:Update:saltbundlepy-packaging-23.1-1.6.1 SUSE:EL-9:Update:Products:SaltBundle:Update:saltbundlepy-pathspec-0.11.1-1.3.1 SUSE:EL-9:Update:Products:SaltBundle:Update:saltbundlepy-pip-20.2.4-1.6.1 SUSE:EL-9:Update:Products:SaltBundle:Update:saltbundlepy-pluggy-1.0.0-1.6.4 SUSE:EL-9:Update:Products:SaltBundle:Update:saltbundlepy-py-1.10.0-1.9.4 SUSE:EL-9:Update:Products:SaltBundle:Update:saltbundlepy-pytest-7.3.2-1.6.1 SUSE:EL-9:Update:Products:SaltBundle:Update:saltbundlepy-setuptools-scm-7.1.0-1.6.1 SUSE:EL-9:Update:Products:SaltBundle:Update:saltbundlepy-tomli-1.2.3-1.3.1 SUSE:EL-9:Update:Products:SaltBundle:Update:saltbundlepy-typing-extensions-4.5.0-1.3.1 SUSE:EL-9:Update:Products:SaltBundle:Update:saltbundlepy-wheel-0.40.0-1.3.1 SUSE:EL-9:Update:Products:SaltBundle:Update:venv-salt-minion-3006.0-1.30.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20234757-1/ https://www.suse.com/security/cve/CVE-2023-34049.html CVE-2023-34049 https://bugzilla.suse.com/1215157 SUSE Bug 1215157