openSUSE-SU-2018:4197-1
Security update for salt
Severity by source
No source gives a CVSS score.
Trivy's own label is CRITICAL. Rated critical by SUSE.
Description
This update for salt fixes the following issues: - Crontab module fix: file attributes option missing (boo#1114824) - Fix git_pillar merging across multiple __env__ repositories (boo#1112874) - Bugfix: unable to detect os arch when RPM is not installed (boo#1114197) - Fix LDAP authentication issue when a valid token is generated by the salt-api even when invalid user credentials are passed. (U#48901) - Improved handling of LDAP group id. gid is no longer treated as a string, which could have lead to faulty group creations. (boo#1113784) - Fix remote command execution and incorrect access control when using salt-api. (boo#1113699) (CVE-2018-15751) - Fix Directory traversal vulnerability when using salt-api. Allows an attacker to determine what files exist on a server when querying /run or /events. (boo#1113698) (CVE-2018-15750) - Add multi-file support and globbing to the filetree (U#50018) - Bugfix: supportconfig non-root permission issues (U#50095) - Open profiles permissions to everyone for read-only - Preserving signature in 'module.run' state (U#50049) - Install default salt-support profiles - Remove unit test, came from a wrong branch. Fix merging failure. - Add CPE_NAME for osversion* grain parsing - Get os_family for RPM distros from the RPM macros - Install support profiles - Fix async call to process manager (boo#1110938) - Salt-based supportconfig implementation (technology preview) - Bugfix: any unicode string of length 16 will raise TypeError - Fix IPv6 scope (boo#1108557) - Handle zypper ZYPPER_EXIT_NO_REPOS exit code (boo#1108834, boo#1109893) - Bugfix for pkg_resources crash (boo#1104491) - Fix loosen azure sdk dependencies in azurearm cloud driver (boo#1107333) - Fix broken 'resolve_capabilities' on Python 3 (boo#1108995)
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| openSUSE Leap 42.3 | python2-salt, python3-salt, salt and 11 more | 2018.3.0-23.1 |
Show all 14 entries from 1 source
| Source | Package | Fixed in |
|---|---|---|
| openSUSE Leap 42.3 | python2-salt | 2018.3.0-23.1 |
| openSUSE Leap 42.3 | python3-salt | 2018.3.0-23.1 |
| openSUSE Leap 42.3 | salt | 2018.3.0-23.1 |
| openSUSE Leap 42.3 | salt-api | 2018.3.0-23.1 |
| openSUSE Leap 42.3 | salt-bash-completion | 2018.3.0-23.1 |
| openSUSE Leap 42.3 | salt-cloud | 2018.3.0-23.1 |
| openSUSE Leap 42.3 | salt-doc | 2018.3.0-23.1 |
| openSUSE Leap 42.3 | salt-fish-completion | 2018.3.0-23.1 |
| openSUSE Leap 42.3 | salt-master | 2018.3.0-23.1 |
| openSUSE Leap 42.3 | salt-minion | 2018.3.0-23.1 |
| openSUSE Leap 42.3 | salt-proxy | 2018.3.0-23.1 |
| openSUSE Leap 42.3 | salt-ssh | 2018.3.0-23.1 |
| openSUSE Leap 42.3 | salt-syndic | 2018.3.0-23.1 |
| openSUSE Leap 42.3 | salt-zsh-completion | 2018.3.0-23.1 |