SUSE-SU-2023:3143-1 | Mondoo Vulnerability Intelligence

SUSE-SU-2023:3143-1

LOW3.4

Security update for salt

Published Aug 2, 2023

Modified 1 months ago

Fix available

Details

Description of the patch:

This update for salt fixes the following issues:

Security fixes:

CVE-2023-28370: Fix an open redirect vulnerability in 'StaticFileHandler' under certain configurations (bsc#1211741)

Bug fixes:

Prevent error loading 'known_hosts' when '$HOME' is not set (bsc#1210994)
Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591)

Affected Packages(15 packages)

python3-salt

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP3-LTSSSUSE Linux Enterprise Micro 5.1

Fixed in:

0:3006.0-150300.53.53.2

salt

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP3-LTSSSUSE Linux Enterprise Micro 5.1

Fixed in:

0:3006.0-150300.53.53.2

salt-api

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP3-LTSSSUSE Linux Enterprise Real Time 15 SP3

Fixed in:

0:3006.0-150300.53.53.2

salt-bash-completion

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP3-LTSSSUSE Linux Enterprise Real Time 15 SP3

Fixed in:

0:3006.0-150300.53.53.2

salt-cloud

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP3-LTSSSUSE Linux Enterprise Real Time 15 SP3

Fixed in:

0:3006.0-150300.53.53.2

salt-doc

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP3-LTSSSUSE Linux Enterprise Real Time 15 SP3

Fixed in:

0:3006.0-150300.53.53.2

salt-fish-completion

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP3-LTSSSUSE Linux Enterprise Real Time 15 SP3

Fixed in:

0:3006.0-150300.53.53.2

salt-master

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP3-LTSSSUSE Linux Enterprise Real Time 15 SP3

Fixed in:

0:3006.0-150300.53.53.2

salt-minion

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP3-LTSSSUSE Linux Enterprise Micro 5.1

Fixed in:

0:3006.0-150300.53.53.2

salt-proxy

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP3-LTSSSUSE Linux Enterprise Real Time 15 SP3

Fixed in:

0:3006.0-150300.53.53.2

References

https://bugzilla.suse.com/1210994

https://bugzilla.suse.com/1211591

https://bugzilla.suse.com/1211741

https://lists.suse.com/pipermail/sle-security-updates/2023-August/015737.html

https://www.suse.com/security/cve/CVE-2023-28370/

https://www.suse.com/support/security/rating/

https://www.suse.com/support/update/announcement/2023/suse-su-20233143-1/

CVSS Analysis

CVSS v3.1

3.4

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

HighAC:H

Privileges Required

NonePR:N

User Interaction

RequiredUI:R

Scope

Scope

ChangedS:C

Impact

Confidentiality

NoneC:N

Integrity

LowI:L

Availability

NoneA:N

3.4/CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N

Upstream

Ecosystems(12)

SUSE Enterprise Storage 7.1 SUSE Linux Enterprise High Performance Computing 15 SP3 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS SUSE Linux Enterprise Micro 5.1

Timeline

PublishedAug 2, 2023

ModifiedSep 20, 2026