You are here
Home > Preporuke > Sigurnosni nedostaci programskog paketa salt

Sigurnosni nedostaci programskog paketa salt

  • Detalji os-a: WN7
  • Važnost: URG
  • Operativni sustavi: L
  • Kategorije: LSU

openSUSE Security Update: Security update for salt
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:4174-1
Rating: important
References: #1110938 #1112874 #1113698 #1113699 #1113784
#1114197 #1114824
Cross-References: CVE-2018-15750 CVE-2018-15751
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that solves two vulnerabilities and has 5 fixes
is now available.

Description:

This update for salt fixes the following issues:

Security issues fixed:

– CVE-2018-15750: Fixed directory traversal vulnerability in salt-api
(bsc#1113698).
– CVE-2018-15751: Fixed remote authentication bypass in salt-api(netapi)
that allows to execute arbitrary commands (bsc#1113699).

Non-security issues fixed:

– Improved handling of LDAP group id. gid is no longer treated as a
string, which could have lead to faulty group creations (bsc#1113784).
– Fixed async call to process manager (bsc#1110938)
– Fixed OS arch detection when RPM is not installed (bsc#1114197)
– Crontab module fix: file attributes option missing (bsc#1114824)
– Fix git_pillar merging across multiple __env__ repositories (bsc#1112874)

This update was imported from the SUSE:SLE-15:Update update project.

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or “zypper patch”.

Alternatively you can run the command listed for your product:

– openSUSE Leap 15.0:

zypper in -t patch openSUSE-2018-1569=1

Package List:

– openSUSE Leap 15.0 (x86_64):

python2-salt-2018.3.0-lp150.3.17.1
python3-salt-2018.3.0-lp150.3.17.1
salt-2018.3.0-lp150.3.17.1
salt-api-2018.3.0-lp150.3.17.1
salt-cloud-2018.3.0-lp150.3.17.1
salt-doc-2018.3.0-lp150.3.17.1
salt-master-2018.3.0-lp150.3.17.1
salt-minion-2018.3.0-lp150.3.17.1
salt-proxy-2018.3.0-lp150.3.17.1
salt-ssh-2018.3.0-lp150.3.17.1
salt-syndic-2018.3.0-lp150.3.17.1

– openSUSE Leap 15.0 (noarch):

salt-bash-completion-2018.3.0-lp150.3.17.1
salt-fish-completion-2018.3.0-lp150.3.17.1
salt-zsh-completion-2018.3.0-lp150.3.17.1

References:

https://www.suse.com/security/cve/CVE-2018-15750.html
https://www.suse.com/security/cve/CVE-2018-15751.html
https://bugzilla.suse.com/1110938
https://bugzilla.suse.com/1112874
https://bugzilla.suse.com/1113698
https://bugzilla.suse.com/1113699
https://bugzilla.suse.com/1113784
https://bugzilla.suse.com/1114197
https://bugzilla.suse.com/1114824


To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org

AutorToni Vugdelija
Cert idNCERT-REF-2018-12-0001-ADV
CveCERT-CVE-DUMMY
ID izvornikaCERT-ORIGID-DUMMY
ProizvodCERT-DUMMY-PRODUCT
IzvorAdobe
Top
More in Preporuke
Sigurnosni nedostatak jezgre operacijskog sustava

Otkriven je sigurnosni nedostatak jezgre operacijskog sustava RHEL. Otkriveni nedostatak potencijalnim napadačima omogućuje izazivanje DoS stanja ili izvršavanje proizvoljnog programskog...

Close