CVE-2021-21996

An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and source_hash URLs can gain full file system access as root on a salt minion.

An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and source_hash URLs can gain full file system access as root on a salt minion.

This update for salt fixes the following issues:

• Support querying for JSON data in external sql pillar.
• Exclude the full path of a download URL to prevent injection of malicious code. (bsc#1190265, CVE-2021-21996)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for salt fixes the following issues:

• CVE-2021-21996: Exclude the full path of a download URL to prevent injection of malicious code. (bsc#1190265)

These are all security issues fixed in the python3-salt-3002.2-6.1 package on the GA media of openSUSE Tumbleweed.

An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and source_hash URLs can gain full file system access as root on a salt minion.

This update for SUSE Manager 4.2.3 Release Notes provides the following additions:

Release notes for SUSE Manager:

• Update to 4.2.3
  • aarch64 support for CentOS 7/8, Oracle Linux 7/8, Rocky Linux 8, AlmaLinux 8, Amazon Linux 2 and openSUSE Leap 15.3
  • Package Locking features is now available for Salt Minions
  • New XMLRPC API methods for SaltKey
  • Bugs mentioned: bsc#1171520, bsc#1181223, bsc#1187572, bsc#1187998, bsc#1188315, bsc#1188977, bsc#1189260, bsc#1189422, bsc#1189609, bsc#1189799, bsc#1189818, bsc#1189933, bsc#1190040, bsc#1190123, bsc#1190151, bsc#1190164, bsc#1190166, bsc#1190265, bsc#1190275, bsc#1190276, bsc#1190300, bsc#1190396, bsc#1190405, bsc#1190455, bsc#1190512, bsc#1190602, bsc#1190751, bsc#1190820, bsc#1191123, bsc#1191139, bsc#1191348, bsc#1191551, CVE-2021-40348, CVE-2021-21996

Release notes for SUSE Manager proxy:

• Update to 4.2.3
  • Bugs mentioned: bsc#1171520, bsc#1181223, bsc#1187998, bsc#1188315, bsc#1188977, bsc#1190405, bsc#1190512, bsc#1190602, bsc#1190751, bsc#1190820, bsc#1191348

This update fixes the following issues:

salt:

• Exclude the full path of a download URL to prevent injection of malicious code (bsc#1190265) (CVE-2021-21996)

spacecmd:

• Version 4.2.13-1
  • Update translation strings
  • configchannel_updatefile handles directory properly (bsc#1190512)
  • Add schedule_archivecompleted to mass archive actions (bsc#1181223)
  • Remove whoami from the list of unauthenticated commands (bsc#1188977)

spacewalk-client-tools:

• Version 4.2.14-1
  • Update translation strings

This update fixes the following issues:

salt:

• Fix the regression of docker_container state module
• Support querying for JSON data in external sql pillar
• Exclude the full path of a download URL to prevent injection of malicious code (bsc#1190265) (CVE-2021-21996)
• Fix wrong relative paths resolution with Jinja renderer when importing subdirectories

This update fixes the following issues:

salt:

• Support querying for JSON data in external sql pillar
• Exclude the full path of a download URL to prevent injection of malicious code (bsc#1190265, CVE-2021-21996)
• Fix wrong relative paths resolution with Jinja renderer when importing subdirectories

This update for salt fixes the following issues:

• Support querying for JSON data in external sql pillar.
• Exclude the full path of a download URL to prevent injection of malicious code. (bsc#1190265, CVE-2021-21996)

This update for salt fixes the following issues:

• Support querying for JSON data in external sql pillar.
• Exclude the full path of a download URL to prevent injection of malicious code. (bsc#1190265, CVE-2021-21996)

This update for salt fixes the following issues:

• CVE-2021-21996: Exclude the full path of a download URL to prevent injection of malicious code. (bsc#1190265)

This update fixes the following issues:

cobbler:

• Fixed modify_setting test to complete successfully

hub-xmlrpc-api:

• Use rpm systemd macro to restart service in replace of systemctl

patterns-suse-manager:

• Virtualization-host-formula was renamed to virtualization-formulas

py26-compat-salt:

• Exclude the full path of a download URL to prevent injection of malicious code (bsc#1190265, CVE-2021-21996)

py26-compat-tornado:

• Added compatibility to Enterprise Linux 8

py27-compat-salt:

• Fix the regression of docker_container state module
• Support querying for JSON data in external sql pillar
• Exclude the full path of a download URL to prevent injection of malicious code (bsc#1190265, CVE-2021-21996)
• Fix wrong relative paths resolution with Jinja renderer when importing subdirectories

spacecmd:

• Version 4.2.13-1
  • Update translation strings
  • configchannel_updatefile handles directory properly (bsc#1190512)
  • Add schedule_archivecompleted to mass archive actions (bsc#1181223)
  • Remove whoami from the list of unauthenticated commands (bsc#1188977)

spacewalk-admin:

• Version 4.2.9-1
  • Fix setup with rhn-config-satellite (bsc#1190300)
  • Allow admins to modify only spacewalk config files with rhn-config-satellite.pl (bsc#1190040) (CVE-2021-40348)

spacewalk-backend:

• Version 4.2.17-1
  • Update translations strings
  • handle download of metadata filesnames with checksums (bsc#1188315)
  • Sanitize cached filename for custom SSL certs used by reposync (bsc#1190751)

spacewalk-certs-tools:

• Version 4.2.13-1
  • add GPG keys using apt-key on debian machines (bsc#1187998)

spacewalk-client-tools:

• Version 4.2.14-1
  • Update translation strings

spacewalk-java:

• Version 4.2.30-1
  • Fix datetime format parsing with moment (bsc#1191348)
• Version 4.2.29-1
  • Update translation strings
  • fix logging of the spark framework and map requests to media.1 directory in the download controller (bsc#1189933)
  • Add 'Last build date' column to CLM project list (jsc#PM-2644) (jsc#SUMA-61)
  • Improve exception handling and logging for mgr-libmod calls
  • Add checksums to repository metadata filenames (bsc#1188315)
  • Fix ISE in product migration if base product is missing (bsc#1190151)
  • use TLSv1.3 if it is a supported Protocol
  • Adapt auto errata update to respect maintenance windows
  • Adapt auto errata update to skip during CLM build (bsc#1189609)
  • add CentOS 7/8 aarch64
  • add Oracle Linux 7/8 aarch64
  • add Rocky Linux 8 aarch64
  • add AlmaLinux 8 aarch64
  • add Amazon Linux 2 aarch64
  • Add new endpoints to saltkeys API: acceptedList, pendingList, rejectedList, deniedList, accept and reject
  • fix ISE in SSM when scheduling patches on multiple systems (bsc#1190396, bsc#1190275)
  • Add 'Flush cache' option to Ansible playbook execution (bsc#1190405)
  • Update kernel live patch version on minion startup (bsc#1190276)
  • Allow getting all completed actions via XMLRPC without display limit (bsc#1181223)
  • Support syncing patches with advisory status 'pending' (bsc#1190455)
  • Add XMLRPC API to force refreshing pillar data (bsc#1190123)
  • Add missing string on XCCDF scan results (bsc#1190164)
  • Ignore duplicates in 'pkg.installed' result when applying patches (bsc#1187572)
  • Improved timezone support
  • implement package locking for salt minions

spacewalk-utils:

• Version 4.2.14-1
  • When renaming: don't regenerate CA, allow using third-party certificate and trigger pillar refresh (bsc#1190123)

spacewalk-web:

• Version 4.2.23-1
  • Fix datetime format parsing with moment (bsc#1191348)
• Version 4.2.22-1
  • Add 'Last build date' column to CLM project list (jsc#PM-2644) (jsc#SUMA-61)
  • Fix 'Type' input in CLM source edit form (bsc#1190820)
  • Add 'Flush cache' checkbox to Ansible playbook execution page (bsc#1190405)
  • Fix the VM creation and editing submit button action (bsc#1190602)
  • Improved timezone support
  • Enhance the…

This update fixes the following issues:

grafana-formula:

• Version 0.4.2
  • Add SSH blackbox status check panel to clients dashboard
  • Migrate deprecated panels in clients dashboard

prometheus-formula:

• Version 0.3.4
  • Fix opening Prometheus ports on proxy
• Version 0.3.3
  • Add Prometheus targets configuration for minions SSH probing
  • Add blackbox exporter
  • Open Prometheus ports (bsc#1191144)

py26-compat-salt:

• Exclude the full path of a download URL to prevent injection of alicious code (bsc#1190265, CVE-2021-21996)

py26-compat-tornado:

• No relevant changes for users

py27-compat-salt:

• Fix the regression of docker_container state module
• Support querying for JSON data in external sql pillar
• Exclude the full path of a download URL to prevent injection of malicious code (bsc#1190265, CVE-2021-21996)
• Fix wrong relative paths resolution with Jinja renderer when importing subdirectories

spacecmd:

• Version 4.1.15-1
  • configchannel_updatefile handles directory properly (bsc#1190512)

spacewalk-backend:

• Version 4.1.29-1
  • Avoid GPG errors messages in reposync caused by rpm not understanding signatures (bsc#1191538)
  • handle download of metadata filesnames with checksums (bsc#1188315)
  • Sanitize cached filename for custom SSL certs used by reposync (bsc#1190751)

spacewalk-certs-tools:

• Version 4.1.19-1
  • add GPG keys using apt-key on debian machines (bsc#1187998)
  • set key format to PEM when generating key for traditional clients push ssh (bsc#1189643)

spacewalk-java:

• Version 4.1.41-1
  • Move pickedup actions to history as soon as they are pickedup (bsc#1191444)
  • On salt-ssh minions, enforce package list refresh after state apply
  • Fix internal server error on DuplicateSystemsCompare (bsc#1191643)
  • mgr-sync refresh logs when a vendor channel is expire and shows how to remove it (bsc#1191222)
  • Remove NullPointerException in rhn_web_ui.log when building an image (bsc#1185951)
  • Add checksums to repository metadata filenames (bsc#1188315)
  • Fix ISE in product migration if base product is missing (bsc#1190151)
  • use TLSv1.3 if it is a supported Protocol
  • Adapt auto errata update to respect maintenance windows
  • Adapt auto errata update to skip during CLM build (bsc#1189609)
  • Update kernel live patch version on minion startup (bsc#1190276)

spacewalk-reports:

• Version 4.1.4-1
  • Improve performance of inventory report (bsc#1191495)

spacewalk-web:

• Version 4.1.30-1
  • Update Web UI version to 4.1.12

subscription-matcher:

• Version 0.27
  • update subscription rules for new SKUs (bsc#1189818)

susemanager:

• Version 4.1.31-1
  • Add the gnupg package for ubuntu which is then needed by apt-key (bsc#1187998)
  • Add python-mako, python-gnupg and gnupg1 to the Debian 9 bootstrap repository so bootstrapping without any enabled repositories is possible (bsc#1191898)

susemanager-doc-indexes:

• Add SLS state for keeping clients updated in Client Configuration Guide
• Fixed unpublished patches note in the server update chapter of the Upgrade Guide
• Added DNS resolution for minions to the troubleshooting section in the Client Configuration Guide
• Documented low disc space warnings in the managing disk space chapter of the Administration Guide
• In the ports section of the Installation Guide, mention tftpsync explicitly for port 443 (bsc#1190665)
• In server upgrade procedure of the Upgrade Guide, add zypper ref step to refresh repositories reliably
• Update effective_cache_size section of the Salt Guide (bsc#1191274)
• Documented new filter in the content lifecycle management chapter of the Administration Guide
• Added aarch64 support for clients in the Installation Guide and Client Configuration Guide
• Documented AWS Permissions for Virtual Host Manager in VHM and Amazon Web Services chapter of the Client Configuration Guide
• Removed an outdated patches note in the server update chapter of the
• Fixed mgr-cfg-* issues in appendix of the…

This update fixes the following issues:

salt:

• Remove wrong _parse_cpe_name from grains.core
• Prevent tracebacks if directory for cookie is missing
• Fix file.find tracebacks with non utf8 file names (bsc#1190114)
• Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
• Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
• Fix traceback.*_exc() calls
• Fix the regression of docker_container state module
• Support querying for JSON data in external sql pillar
• Exclude the full path of a download URL to prevent injection of malicious code (bsc#1190265) (CVE-2021-21996)
• Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
• Fix python-MarkupSafe dependency (bsc#1189043)
• Add missing aarch64 to rpm package architectures
• Consolidate some state requisites (bsc#1188641)
• Fix failing unit test for systemd
• Fix error handling in openscap module (bsc#1188647)
• Better handling of bad public keys from minions (bsc#1189040)
• Define license macro as doc in spec file if not existing
• Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
• Do noop for services states when running systemd in offline mode (bsc#1187787)
• Transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
• Handle 'master tops' data when states are applied by 'transactional_update' (bsc#1187787)
• Enhance openscap module: add 'xccdf_eval' call
• Virt: pass emulator when getting domain capabilities from libvirt
• Implementation of held/unheld functions for state pkg (bsc#1187813)
• Fix exception in yumpkg.remove for not installed package
• Fix save for iptables state module (bsc#1185131)
• Virt: use /dev/kvm to detect KVM
• Zypperpkg: improve logic for handling vendorchange flags
• Add bundled provides for tornado to the spec file
• Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
• Add 'python3-pyinotify' as a recommended package for Salt in SUSE/openSUSE distros
• Check if dpkgnotify is executable (bsc#1186674)
• Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
• Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
• Grains.extra: support old non-intel kernels (bsc#1180650)
• Fix missing minion returns in batch mode (bsc#1184659)

This update fixes the following issues:

dracut-saltboot:

• Fix dependencies of python libs (bsc#1188846)
• Update to version 0.1.1628156312.dbd0dec
• Force installation of libexpat.so.1 (bsc#1188846)
• Update to version 0.1.1627546504.96a0b3e
• Use kernel parameters from PXE formula also for local boot

golang-github-prometheus-prometheus:

• Provide and reload firewalld configuration only for:
  • openSUSE Leap 15.0, 15.1, 15.2
  • SUSE SLE15, SLE15 SP1, SLE15 SP2
• Refresh patches
  • Changed:
• Upgrade to upstream version 2.27.1 (jsc#SLE-18254)
  • Bugfix:
  • SECURITY: Fix arbitrary redirects under the /new endpoint (CVE-2021-29622, bsc#1186242)
• Upgrade to upstream version 2.27.0
  • Features:
    • Promtool: Retroactive rule evaluation functionality. #7675
    • Configuration: Environment variable expansion for external labels. Behind --enable-feature=expand-external-labels flag. #8649
    • TSDB: Add a flag(--storage.tsdb.max-block-chunk-segment-size) to control the max chunks file size of the blocks for small Prometheus instances. #8478
    • UI: Add a dark theme. #8604
    • AWS Lightsail Discovery: Add AWS Lightsail Discovery. #8693
    • Docker Discovery: Add Docker Service Discovery. #8629
    • OAuth: Allow OAuth 2.0 to be used anywhere an HTTP client is used. #8761
    • Remote Write: Send exemplars via remote write. Experimental and disabled by default. #8296
  • Enhancements:
    • Digital Ocean Discovery: Add __meta_digitalocean_vpc label. #8642
    • Scaleway Discovery: Read Scaleway secret from a file. #8643
    • Scrape: Add configurable limits for label size and count. #8777
    • UI: Add 16w and 26w time range steps. #8656
    • Templating: Enable parsing strings in humanize functions. #8682
  • Bugfixes:
    • UI: Provide errors instead of blank page on TSDB Status Page. #8654 #8659
    • TSDB: Do not panic when writing very large records to the WAL. #8790
    • TSDB: Avoid panic when mmaped memory is referenced after the file is closed. #8723
    • Scaleway Discovery: Fix nil pointer dereference. #8737
    • Consul Discovery: Restart no longer required after config update with no targets. #8766
• Update package with changes from server:monitoring bsc#1175478 Left out removal of firewalld related configuration files as SLE-15-SP1's firewalld package does not contain prometheus configuration yet.

grafana:

• Add URL to package source code in the login page footer
• Update to version 7.5.7:
  • Updated relref to 'Configuring exemplars' section (#34240) (#34243)
  • Added exemplar topic (#34147) (#34226)
  • Quota: Do not count folders towards dashboard quota (#32519) (#34025)
  • Instructions to separate emails with semicolons (#32499) (#34138)
  • Docs: Remove documentation of v8 generic OAuth feature (#34018)
  • Annotations: Prevent orphaned annotation tags cleanup when no annotations were cleaned (#33957) (#33975)
  • [GH-33898] Add missing --no-cache to Dockerfile. (#33906) (#33935)
  • ReleaseNotes: Updated changelog and release notes for 7.5.6 (#33932) (#33936)
  • Stop hoisting @icons/material (#33922)
  • Chore: fix react-color version in yarn.lock (#33914)
  • 'Release: Updated versions in package to 7.5.6' (#33909)
  • Loki: fix label browser crashing when + typed (#33900) (#33901)
  • Document hide_version flag (#33670) (#33881)
  • Add isolation level db configuration parameter (#33830) (#33878)
  • Sanitize PromLink button (#33874) (#33876)
  • Removed content as per MarcusE's suggestion in https://github.com/grafana/grafana/issues/33822. (#33870) (#33872)
  • Docs feedback: /administration/provisioning.md (#33804) (#33842)
  • Docs: delete from high availability docs references to removed configurations related to session storage (#33827) (#33851)
  • Docs: Update _index.md (#33797) (#33799)
  • Docs: Update installation.md (#33656) (#33703)
  • GraphNG: uPlot 1.6.9 (#33598) (#33612)
  • dont consider invalid email address a failed email (#33671) (#33681)
  • InfluxDB:…