Security Beta update for SUSE Manager Client Tools

Announcement ID: SUSE-SU-2021:14677-1
Rating: moderate
References:
Cross-References:
CVSS scores:
  • CVE-2020-28243 ( SUSE ): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVE-2020-28243 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2020-28972 ( SUSE ): 7.3 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
  • CVE-2020-28972 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
  • CVE-2020-35662 ( SUSE ): 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
  • CVE-2020-35662 ( NVD ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
  • CVE-2021-25281 ( SUSE ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVE-2021-25281 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVE-2021-25282 ( SUSE ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVE-2021-25282 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
  • CVE-2021-25283 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2021-25283 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVE-2021-25284 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
  • CVE-2021-25284 ( NVD ): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
  • CVE-2021-3144 ( SUSE ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
  • CVE-2021-3144 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
  • CVE-2021-3148 ( SUSE ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVE-2021-3148 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVE-2021-3197 ( SUSE ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVE-2021-3197 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products:
  • SUSE Manager Client Tools Beta for Ubuntu 16.04 1604

An update that solves 10 vulnerabilities and has 10 security fixes can now be installed.

Description:

This update fixes the following issues:

salt:

  • Only require python-certifi for CentOS7
  • Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
  • Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
  • Fix recursion false detection in payload (bsc#1180101)
  • Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
  • Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
  • Always require python-certifi (used by salt.ext.tornado)
  • Exclude SLE 12 from requiring python-certifi
  • Do not crash when unexpected cmd output at listing patches (bsc#1181290)
  • Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
  • Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
  • Allow extra_filerefs as sanitized kwargs for SSH client
  • Fix errors with virt.update
  • Fix for multiple for security issues (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144) (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197) (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560) (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
  • Virt: search for grub.xen path
  • Xen spicevmc, DNS SRV records backports: Fix virtual network generated DNS XML for SRV records Don't add spicevmc channel to xen VMs
  • Virt UEFI fix: virt.update when efi=True
  • Master can read grains (bsc#1179696)

Special Instructions and Notes:

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE Manager Client Tools Beta for Ubuntu 16.04 1604
    zypper in -t patch suse-ubu164ct-client-tools-beta-202103-14677=1

Package List:

  • SUSE Manager Client Tools Beta for Ubuntu 16.04 1604 (all)
    • salt-minion-3000+ds-1+9.26.1
    • salt-common-3000+ds-1+9.26.1

References: