SUSE-SU-2022:1059-1

Details

This update for salt fixes the following issues:

CVE-2022-22935: Sign authentication replies to prevent MiTM (bsc#1197417)
CVE-2022-22934: Sign pillar data to prevent MiTM attacks. (bsc#1197417)
CVE-2022-22936: Prevent job and fileserver replays (bsc#1197417)
CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth. (bsc#1197417)

Affected Packages(15 packages)

python3-salt

SUSE Linux Enterprise Micro 5.1SUSE Linux Enterprise Module for Basesystem 15 SP3

Fixed in:

3002.2-150300.53.10.1

salt

SUSE Linux Enterprise Micro 5.1SUSE Linux Enterprise Module for Basesystem 15 SP3SUSE Linux Enterprise Module for Server Applications 15 SP3SUSE Linux Enterprise Module for Transactional Server 15 SP3

Fixed in:

3002.2-150300.53.10.1

salt-minion

SUSE Linux Enterprise Micro 5.1SUSE Linux Enterprise Module for Basesystem 15 SP3

Fixed in:

3002.2-150300.53.10.1

salt-transactional-update

SUSE Linux Enterprise Micro 5.1SUSE Linux Enterprise Module for Transactional Server 15 SP3

Fixed in:

3002.2-150300.53.10.1

salt-bash-completion

SUSE Linux Enterprise Module for Basesystem 15 SP3