Security update for Salt

Announcement ID:	SUSE-SU-2017:1582-1
Rating:	moderate
References:	bsc#1011800 bsc#1012999 bsc#1017078 bsc#1020831 bsc#1022562 bsc#1025896 bsc#1027240 bsc#1027722 bsc#1030009 bsc#1030073 bsc#1032931 bsc#1035912 bsc#1035914 bsc#1036125 bsc#1038855 bsc#1039370 bsc#1040584 bsc#1040886 bsc#1043111
Cross-References:	CVE-2017-5200 CVE-2017-8109
CVSS scores:	CVE-2017-5200 ( NVD ): 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2017-8109 ( NVD ): 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products:	Advanced Systems Management Module 12 Magnum Orchestration 7 SUSE Enterprise Storage 3 SUSE Enterprise Storage 4 SUSE Linux Enterprise Desktop 12 SUSE Linux Enterprise Desktop 12 SP1 SUSE Linux Enterprise Desktop 12 SP2 SUSE Linux Enterprise Desktop 12 SP3 SUSE Linux Enterprise Desktop 12 SP4 SUSE Linux Enterprise High Performance Computing 12 SP2 SUSE Linux Enterprise High Performance Computing 12 SP3 SUSE Linux Enterprise High Performance Computing 12 SP4 SUSE Linux Enterprise High Performance Computing 12 SP5 SUSE Linux Enterprise Point of Service Image Server 12 12-SP2 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Server for the Raspberry Pi 12-SP2 SUSE Manager Client Tools for SLE 12 SUSE Manager Proxy 3.0 SUSE Manager Server 3.0

An update that solves two vulnerabilities and has 17 security fixes can now be installed.

Description:

This update for salt provides version 2016.11.4 and brings various fixes and improvements:

• Adding a salt-minion watchdog for RHEL6 and SLES11 systems (sysV) to restart salt-minion in case of crashes during upgrade.
• Fix format error. (bsc#1043111)
• Fix ownership for whole master cache directory. (bsc#1035914)
• Disable 3rd party runtime packages to be explicitly recommended. (bsc#1040886)
• Fix insecure permissions in salt-ssh temporary files. (bsc#1035912, CVE-2017-8109)
• Disable custom rosters for Salt SSH via Salt API. (bsc#1011800, CVE-2017-5200)
• Orchestrate and batches don't return false failed information anymore.
• Speed-up cherrypy by removing sleep call.
• Fix os_family grains on SUSE. (bsc#1038855)
• Fix setting the language on SUSE systems. (bsc#1038855)
• Use SUSE specific salt-api.service. (bsc#1039370)
• Fix using hostname for minion ID as '127'.
• Fix core grains constants for timezone. (bsc#1032931)
• Minor fixes on new pkg.list_downloaded.
• Listing all type of advisory patches for Yum module.
• Prevents zero length error on Python 2.6.
• Fixes zypper test error after backporting.
• Raet protocol is no longer supported. (bsc#1020831)
• Fix moving SSH data to the new home. (bsc#1027722)
• Fix logrotating /var/log/salt/minion. (bsc#1030009)
• Fix result of master_tops extension is mutually overwritten. (bsc#1030073)
• Allows to set 'timeout' and 'gather_job_timeout' via kwargs.
• Allows to set custom timeouts for 'manage.up' and 'manage.status'.
• Use salt's ordereddict for comparison.
• Fix scripts for salt-proxy.
• Add openscap module.
• File.get_managed regression fix.
• Fix translate variable arguments if they contain hidden keywords. (bsc#1025896)
• Added unit test for dockerng.sls_build dryrun.
• Added dryrun to dockerng.sls_build.
• Update dockerng minimal version requirements.
• Fix format error in error parsing.
• Keep fix for migrating salt home directory. (bsc#1022562)
• Fix salt pkg.latest raises exception if package is not available. (bsc#1012999)
• Timezone should always be in UTC. (bsc#1017078)
• Fix timezone handling for rpm installtime. (bsc#1017078)
• Increasing timeouts for running integrations tests.
• Add buildargs option to dockerng.build module.
• Fix error when missing ssh-option parameter.
• Re-add yum notify plugin.
• All kwargs to dockerng.create to provide all features to sls_build as well.
• Datetime should be returned always in UTC.
• Fix possible crash while deserialising data on infinite recursion in scheduled state. (bsc#1036125)
• Documentation refresh to 2016.11.4
• For a detailed description, please refer to:
• https://docs.saltstack.com/en/develop/topics/releases/2016.11.4.html
• https://docs.saltstack.com/en/develop/topics/releases/2016.11.3.html
• https://docs.saltstack.com/en/develop/topics/releases/2016.11.2.html
• https://docs.saltstack.com/en/develop/topics/releases/2016.11.1.html

Special Instructions and Notes:

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• Magnum Orchestration 7
  zypper in -t patch SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2017-974=1
• SUSE Manager Client Tools for SLE 12
  zypper in -t patch SUSE-SLE-Manager-Tools-12-2017-974=1
• Advanced Systems Management Module 12
  zypper in -t patch SUSE-SLE-Module-Adv-Systems-Management-12-2017-974=1
• SUSE Linux Enterprise Point of Service Image Server 12 12-SP2
  zypper in -t patch SUSE-SLE-POS-12-SP2-2017-974=1
• SUSE Enterprise Storage 3
  zypper in -t patch SUSE-Storage-3-2017-974=1
• SUSE Enterprise Storage 4
  zypper in -t patch SUSE-Storage-4-2017-974=1
• SUSE Manager Proxy 3.0
  zypper in -t patch SUSE-SUSE-Manager-Proxy-3.0-2017-974=1
• SUSE Manager Server 3.0
  zypper in -t patch SUSE-SUSE-Manager-Server-3.0-2017-974=1

Package List:

• Magnum Orchestration 7 (x86_64)
  • salt-minion-2016.11.4-45.2
  • salt-2016.11.4-45.2
• SUSE Manager Client Tools for SLE 12 (aarch64 ppc64le s390x x86_64)
  • salt-minion-2016.11.4-45.2
  • salt-doc-2016.11.4-45.2
  • salt-2016.11.4-45.2
• Advanced Systems Management Module 12 (ppc64le s390x x86_64)
  • salt-cloud-2016.11.4-45.2
  • salt-ssh-2016.11.4-45.2
  • salt-2016.11.4-45.2
  • salt-proxy-2016.11.4-45.2
  • salt-master-2016.11.4-45.2
  • salt-doc-2016.11.4-45.2
  • salt-api-2016.11.4-45.2
  • salt-syndic-2016.11.4-45.2
  • salt-minion-2016.11.4-45.2
• Advanced Systems Management Module 12 (noarch)
  • salt-zsh-completion-2016.11.4-45.2
  • salt-bash-completion-2016.11.4-45.2
• SUSE Linux Enterprise Point of Service Image Server 12 12-SP2 (x86_64)
  • salt-minion-2016.11.4-45.2
  • salt-2016.11.4-45.2
• SUSE Enterprise Storage 3 (x86_64)
  • salt-minion-2016.11.4-45.2
  • salt-master-2016.11.4-45.2
  • salt-2016.11.4-45.2
• SUSE Enterprise Storage 4 (aarch64 x86_64)
  • salt-minion-2016.11.4-45.2
  • salt-master-2016.11.4-45.2
  • salt-2016.11.4-45.2
• SUSE Manager Proxy 3.0 (x86_64)
  • salt-ssh-2016.11.4-45.2
  • salt-2016.11.4-45.2
  • salt-proxy-2016.11.4-45.2
  • salt-master-2016.11.4-45.2
  • salt-doc-2016.11.4-45.2
  • salt-api-2016.11.4-45.2
  • salt-syndic-2016.11.4-45.2
  • salt-minion-2016.11.4-45.2
• SUSE Manager Proxy 3.0 (noarch)
  • salt-zsh-completion-2016.11.4-45.2
  • salt-bash-completion-2016.11.4-45.2
• SUSE Manager Server 3.0 (s390x x86_64)
  • salt-ssh-2016.11.4-45.2
  • salt-2016.11.4-45.2
  • salt-proxy-2016.11.4-45.2
  • salt-master-2016.11.4-45.2
  • salt-doc-2016.11.4-45.2
  • salt-api-2016.11.4-45.2
  • salt-syndic-2016.11.4-45.2
  • salt-minion-2016.11.4-45.2
• SUSE Manager Server 3.0 (noarch)
  • salt-zsh-completion-2016.11.4-45.2
  • salt-bash-completion-2016.11.4-45.2

References:

• https://www.suse.com/security/cve/CVE-2017-5200.html
• https://www.suse.com/security/cve/CVE-2017-8109.html
• https://bugzilla.suse.com/show_bug.cgi?id=1011800
• https://bugzilla.suse.com/show_bug.cgi?id=1012999
• https://bugzilla.suse.com/show_bug.cgi?id=1017078
• https://bugzilla.suse.com/show_bug.cgi?id=1020831
• https://bugzilla.suse.com/show_bug.cgi?id=1022562
• https://bugzilla.suse.com/show_bug.cgi?id=1025896
• https://bugzilla.suse.com/show_bug.cgi?id=1027240
• https://bugzilla.suse.com/show_bug.cgi?id=1027722
• https://bugzilla.suse.com/show_bug.cgi?id=1030009
• https://bugzilla.suse.com/show_bug.cgi?id=1030073
• https://bugzilla.suse.com/show_bug.cgi?id=1032931
• https://bugzilla.suse.com/show_bug.cgi?id=1035912
• https://bugzilla.suse.com/show_bug.cgi?id=1035914
• https://bugzilla.suse.com/show_bug.cgi?id=1036125
• https://bugzilla.suse.com/show_bug.cgi?id=1038855
• https://bugzilla.suse.com/show_bug.cgi?id=1039370
• https://bugzilla.suse.com/show_bug.cgi?id=1040584
• https://bugzilla.suse.com/show_bug.cgi?id=1040886
• https://bugzilla.suse.com/show_bug.cgi?id=1043111