SUSE-SU-2017:2676-1 | Mondoo Vulnerability Intelligence

SUSE-SU-2017:2676-1

MEDIUM6.5

Security update for Salt

Published Oct 9, 2017

Modified 8 years ago

Fix available

Details

Description of the patch:

This update for salt fixes one security issue and bugs:

The following security issue has been fixed:

CVE-2017-12791: Directory traversal vulnerability in minion id validation allowed remote minions with incorrect credentials to authenticate to a master via a crafted minion ID (bsc#1053955).

Additionally, the following non-security issues have been fixed:

Added support for SUSE Manager scalability features. (bsc#1052264)
Introduced the kubernetes module. (bsc#1051948)
Notify systemd synchronously via NOTIFY_SOCKET. (bsc#1053376)

Affected Packages(11 packages)

salt

SUSE Enterprise Storage 3SUSE Enterprise Storage 4SUSE Linux Enterprise Module for Advanced Systems Management 12SUSE Linux Enterprise Point of Sale 12 SP2SUSE Manager Client Tools 12

Fixed in:

2016.11.4-46.7.1

salt-master

SUSE Enterprise Storage 3SUSE Enterprise Storage 4SUSE Linux Enterprise Module for Advanced Systems Management 12SUSE Manager Proxy 3.0SUSE Manager Server 3.0

Fixed in:

2016.11.4-46.7.1

salt-minion

SUSE Enterprise Storage 3SUSE Enterprise Storage 4SUSE Linux Enterprise Module for Advanced Systems Management 12SUSE Linux Enterprise Point of Sale 12 SP2SUSE Manager Client Tools 12

Fixed in:

2016.11.4-46.7.1

salt-api

SUSE Linux Enterprise Module for Advanced Systems Management 12SUSE Manager Proxy 3.0SUSE Manager Server 3.0

Fixed in:

2016.11.4-46.7.1

salt-bash-completion

SUSE Linux Enterprise Module for Advanced Systems Management 12SUSE Manager Proxy 3.0SUSE Manager Server 3.0

Fixed in:

2016.11.4-46.7.1

salt-cloud

SUSE Linux Enterprise Module for Advanced Systems Management 12