Security update for Salt
Announcement ID: | SUSE-SU-2021:2104-1 |
---|---|
Rating: | critical |
References: | |
Cross-References: | |
CVSS scores: |
|
Affected Products: |
|
An update that solves two vulnerabilities, contains three features and has eight security fixes can now be installed.
Description:
This update fixes the following issues:
salt:
Update to Salt release version 3002.2 (jsc#ECO-3212, jsc#SLE-18033, jsc#SLE-18028)
- Check if dpkgnotify is executable (bsc#1186674)
- Drop support for Python2. Obsoletes
python2-salt
package (jsc#SLE-18028) - Virt module updates
- network: handle missing ipv4 netmask attribute
- more network support
- PCI/USB host devices passthrough support
- Set distro requirement to oldest supported version in requirements/base.txt
- Bring missing part of async batch implementation back (bsc#1182382, CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Remove deprecated warning that breaks minion execution when "server_id_use_crc" opts is missing
- Fix pkg states when DEB package has "all" arch
- Do not force beacons configuration to be a list.
- Remove msgpack < 1.0.0 from base requirements (bsc#1176293)
- Msgpack support for version >= 1.0.0 (bsc#1171257)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281, CVE-2021-31607)
- Transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18033)
- Remove duplicate directories from specfile
- Improvements on "ansiblegate" module (bsc#1185092):
- New methods: ansible.targets / ansible.discover_playbooks
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Regression fix of salt-ssh on processing targets
- Update target fix for salt-ssh and avoiding race condition on salt-ssh event processing (bsc#1179831, bsc#1182281)
- Add notify beacon for Debian/Ubuntu systems
- Fix zmq bug that causes salt-call to freeze (bsc#1181368)
Special Instructions and Notes:
Patch Instructions:
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
-
SUSE Linux Enterprise Server ESPOS 15
zypper in -t patch SUSE-SLE-Product-HPC-15-2021-2104=1
-
SUSE Linux Enterprise High Performance Computing 15 LTSS 15
zypper in -t patch SUSE-SLE-Product-HPC-15-2021-2104=1
-
SUSE Linux Enterprise Server 15 LTSS 15
zypper in -t patch SUSE-SLE-Product-SLES-15-2021-2104=1
-
SUSE Linux Enterprise Server for SAP Applications 15
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2021-2104=1
Package List:
-
SUSE Linux Enterprise Server ESPOS 15 (aarch64 x86_64)
- salt-ssh-3002.2-8.41.8.1
- salt-transactional-update-3002.2-8.41.8.1
- salt-master-3002.2-8.41.8.1
- salt-minion-3002.2-8.41.8.1
- python3-salt-3002.2-8.41.8.1
- salt-cloud-3002.2-8.41.8.1
- salt-doc-3002.2-8.41.8.1
- salt-proxy-3002.2-8.41.8.1
- salt-syndic-3002.2-8.41.8.1
- salt-3002.2-8.41.8.1
- salt-api-3002.2-8.41.8.1
- salt-standalone-formulas-configuration-3002.2-8.41.8.1
-
SUSE Linux Enterprise Server ESPOS 15 (noarch)
- salt-bash-completion-3002.2-8.41.8.1
- salt-zsh-completion-3002.2-8.41.8.1
- salt-fish-completion-3002.2-8.41.8.1
-
SUSE Linux Enterprise High Performance Computing 15 LTSS 15 (aarch64 x86_64)
- salt-ssh-3002.2-8.41.8.1
- salt-transactional-update-3002.2-8.41.8.1
- salt-master-3002.2-8.41.8.1
- salt-minion-3002.2-8.41.8.1
- python3-salt-3002.2-8.41.8.1
- salt-cloud-3002.2-8.41.8.1
- salt-doc-3002.2-8.41.8.1
- salt-proxy-3002.2-8.41.8.1
- salt-syndic-3002.2-8.41.8.1
- salt-3002.2-8.41.8.1
- salt-api-3002.2-8.41.8.1
- salt-standalone-formulas-configuration-3002.2-8.41.8.1
-
SUSE Linux Enterprise High Performance Computing 15 LTSS 15 (noarch)
- salt-bash-completion-3002.2-8.41.8.1
- salt-zsh-completion-3002.2-8.41.8.1
- salt-fish-completion-3002.2-8.41.8.1
-
SUSE Linux Enterprise Server 15 LTSS 15 (aarch64 ppc64le s390x x86_64)
- salt-ssh-3002.2-8.41.8.1
- salt-transactional-update-3002.2-8.41.8.1
- salt-master-3002.2-8.41.8.1
- salt-minion-3002.2-8.41.8.1
- python3-salt-3002.2-8.41.8.1
- salt-cloud-3002.2-8.41.8.1
- salt-doc-3002.2-8.41.8.1
- salt-proxy-3002.2-8.41.8.1
- salt-syndic-3002.2-8.41.8.1
- salt-3002.2-8.41.8.1
- salt-api-3002.2-8.41.8.1
- salt-standalone-formulas-configuration-3002.2-8.41.8.1
-
SUSE Linux Enterprise Server 15 LTSS 15 (noarch)
- salt-bash-completion-3002.2-8.41.8.1
- salt-zsh-completion-3002.2-8.41.8.1
- salt-fish-completion-3002.2-8.41.8.1
-
SUSE Linux Enterprise Server for SAP Applications 15 (ppc64le x86_64)
- salt-ssh-3002.2-8.41.8.1
- salt-transactional-update-3002.2-8.41.8.1
- salt-master-3002.2-8.41.8.1
- salt-minion-3002.2-8.41.8.1
- python3-salt-3002.2-8.41.8.1
- salt-cloud-3002.2-8.41.8.1
- salt-doc-3002.2-8.41.8.1
- salt-proxy-3002.2-8.41.8.1
- salt-syndic-3002.2-8.41.8.1
- salt-3002.2-8.41.8.1
- salt-api-3002.2-8.41.8.1
- salt-standalone-formulas-configuration-3002.2-8.41.8.1
-
SUSE Linux Enterprise Server for SAP Applications 15 (noarch)
- salt-bash-completion-3002.2-8.41.8.1
- salt-zsh-completion-3002.2-8.41.8.1
- salt-fish-completion-3002.2-8.41.8.1
References:
- https://www.suse.com/security/cve/CVE-2021-25315.html
- https://www.suse.com/security/cve/CVE-2021-31607.html
- https://bugzilla.suse.com/show_bug.cgi?id=1171257
- https://bugzilla.suse.com/show_bug.cgi?id=1176293
- https://bugzilla.suse.com/show_bug.cgi?id=1179831
- https://bugzilla.suse.com/show_bug.cgi?id=1181368
- https://bugzilla.suse.com/show_bug.cgi?id=1182281
- https://bugzilla.suse.com/show_bug.cgi?id=1182293
- https://bugzilla.suse.com/show_bug.cgi?id=1182382
- https://bugzilla.suse.com/show_bug.cgi?id=1185092
- https://bugzilla.suse.com/show_bug.cgi?id=1185281
- https://bugzilla.suse.com/show_bug.cgi?id=1186674
- https://jira.suse.com/browse/ECO-3212
- https://jira.suse.com/browse/SLE-18028
- https://jira.suse.com/browse/SLE-18033