CVE-2022-22935

An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to force a minion process to stop by impersonating a master.

An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to force a minion process to stop by impersonating a master.

This update for salt fixes the following issues:

• CVE-2022-22935: Sign authentication replies to prevent MiTM (bsc#1197417)
• CVE-2022-22934: Sign pillar data to prevent MiTM attacks. (bsc#1197417)
• CVE-2022-22936: Prevent job and fileserver replays (bsc#1197417)
• CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth. (bsc#1197417)

These are all security issues fixed in the python3-salt-3004-5.1 package on the GA media of openSUSE Tumbleweed.

An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to force a minion process to stop by impersonating a master.

This update fixes the following issues:

venv-salt-minion:

• Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
• Fix the regression caused by the patch removing strict requirement for OpenSSL 1.1.1 leading to read/write issues with ssl module for SLE 15, SLE 12, CentOS 7, Debian 9 (bsc#1198556)
• Fix salt-ssh opts poisoning (bsc#1197637)
• Fix multiple security issues (bsc#1197417)
  • CVE-2022-22935: Sign authentication replies to prevent MiTM.
  • CVE-2022-22934: Sign pillar data to prevent MiTM attacks.
  • CVE-2022-22936: Prevent job and fileserver replays.
  • CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth.
• Salt version bump to 3004
• Python version bump to 3.10.2
• Clear network interfaces cache on grains request (bsc#1196050)
• Add salt-ssh with Salt Bundle support (venv-salt-minion) (bsc#1182851, bsc#1196432)
• Restrict 'state.orchestrate_single' to pass a pillar value if it exists (bsc#1194632)

This update fixes the following issues:

venv-salt-minion:

• Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
• Fix the regression caused by the patch removing strict requirement for OpenSSL 1.1.1 leading to read/write issues with ssl module for SLE 15, SLE 12, CentOS 7, Debian 9 (bsc#1198556)
• Fix salt-ssh opts poisoning (bsc#1197637)
• Fix multiple security issues (bsc#1197417)
  • CVE-2022-22935: Sign authentication replies to prevent MiTM.
  • CVE-2022-22934: Sign pillar data to prevent MiTM attacks.
  • CVE-2022-22936: Prevent job and fileserver replays
  • CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth.
• Salt version bump to 3004
• Python version bump to 3.10.2
• Clear network interfaces cache on grains request (bsc#1196050)
• Add salt-ssh with Salt Bundle support (venv-salt-minion) (bsc#1182851, bsc#1196432)
• Restrict 'state.orchestrate_single' to pass a pillar value if it exists (bsc#1194632)

This update fixes the following issues:

salt:

• Fix regression preventing bootstrapping new clients caused by redundant dependency on psutil (bsc#1197533)
• Prevent data pollution between actions processed at the same time (bsc#1197637)
• Fix salt-ssh opts poisoning (bsc#1197637)
• Remove duplicated method definitions in salt.netapi
• Clear network interfaces cache on grains request (bsc#1196050)
• Add salt-ssh with Salt Bundle support (venv-salt-minion) (bsc#1182851, bsc#1196432)
• Restrict 'state.orchestrate_single' to pass a pillar value if it exists (bsc#1194632)

This update for salt fixes the following issues:

• Fix regression preventing bootstrapping new clients caused by redundant dependency on psutil (bsc#1197533)
• Prevent data pollution between actions processed at the same time (bsc#1197637)
• Fix salt-ssh opts poisoning (bsc#1197637)
• Clear network interfaces cache on grains request (bsc#1196050)
• Add salt-ssh with Salt Bundle support (venv-salt-minion)
• Fix Salt-API failure due to an exception from the scheduled SSH-Push Tasks (bsc#1182851, bsc#1196432)
• Restrict 'state.orchestrate_single' to pass a pillar value if it exists (bsc#1194632)

This update for salt fixes the following issues:

• Fix regression preventing bootstrapping new clients caused by redundant dependency on psutil (bsc#1197533)
• Prevent data pollution between actions processed at the same time (bsc#1197637)
• Fix salt-ssh opts poisoning. (bsc#1197637)
• Clear network interfaces cache on grains request. (bsc#1196050)
• Fix Salt-API failure due to an exception from the scheduled SSH-Push Tasks. (bsc#1182851, bsc#1196432)
• Restrict 'state.orchestrate_single' to pass a pillar value if it exists. (bsc#1194632)

This update for salt fixes the following issues:

• Fix regression preventing bootstrapping new clients caused by redundant dependency on psutil (bsc#1197533)
• Prevent data pollution between actions processed at the same time (bsc#1197637)
• Fix salt-ssh opts poisoning (bsc#1197637)
• Clear network interfaces cache on grains request (bsc#1196050)
• Add salt-ssh with Salt Bundle support (venv-salt-minion)
• Fix Salt-API failure due to an exception from the scheduled SSH-Push Tasks (bsc#1182851, bsc#1196432)
• Restrict 'state.orchestrate_single' to pass a pillar value if it exists (bsc#1194632)

This update for SUSE Manager 4.1.14.1 Release Notes provides the following additions:

Release notes for SUSE Manager:

• Update to 4.1.14.1
  • CVEs fixed CVE-2022-22934, CVE-2022-22935, CVE-2022-22936, CVE-2022-22941
  • Bugs mentioned bsc#1197417

This update for SUSE Manager 4.2.5.1 Release Notes provides the following additions:

Release notes for SUSE Manager:

• Update to 4.2.5.1
  • CVEs fixed CVE-2022-22934, CVE-2022-22935, CVE-2022-22936, CVE-2022-22941
  • Bugs mentioned bsc#1197417

This update for salt fixes the following issues:

• CVE-2022-22935: Sign authentication replies to prevent MiTM (bsc#1197417)
• CVE-2022-22934: Sign pillar data to prevent MiTM attacks. (bsc#1197417)
• CVE-2022-22936: Prevent job and fileserver replays (bsc#1197417)
• CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth. (bsc#1197417)

This update for salt fixes the following issues:

• CVE-2022-22935: Sign authentication replies to prevent MiTM (bsc#1197417)
• CVE-2022-22934: Sign pillar data to prevent MiTM attacks. (bsc#1197417)
• CVE-2022-22936: Prevent job and fileserver replays (bsc#1197417)
• CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth. (bsc#1197417)

This update for salt fixes the following issues:

• CVE-2022-22935: Sign authentication replies to prevent MiTM (bsc#1197417)
• CVE-2022-22934: Sign pillar data to prevent MiTM attacks. (bsc#1197417)
• CVE-2022-22936: Prevent job and fileserver replays (bsc#1197417)
• CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth. (bsc#1197417)

This update for salt fixes the following issues:

• CVE-2022-22935: Sign authentication replies to prevent MiTM (bsc#1197417)
• CVE-2022-22934: Sign pillar data to prevent MiTM attacks. (bsc#1197417)
• CVE-2022-22936: Prevent job and fileserver replays (bsc#1197417)
• CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth. (bsc#1197417)

This update for salt fixes the following issues:

• CVE-2022-22935: Sign authentication replies to prevent MiTM (bsc#1197417)
• CVE-2022-22934: Sign pillar data to prevent MiTM attacks. (bsc#1197417)
• CVE-2022-22936: Prevent job and fileserver replays (bsc#1197417)
• CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth. (bsc#1197417)

This update fixes the following issues:

venv-salt-minion:

• Fix the regression caused by the patch removing strict requirement for OpenSSL 1.1.1 leading to read/write issues with ssl module for SLE 15, SLE 12, CentOS 7, Debian 9 (bsc#1198556)
• Fixes for Python 3.10
• Fix salt-ssh opts poisoning (bsc#1197637)
• Fix multiple security issues (bsc#1197417)
  • CVE-2022-22935: Sign authentication replies to prevent MiTM.
  • CVE-2022-22934: Sign pillar data to prevent MiTM attacks.
  • CVE-2022-22936: Prevent job and fileserver replays.
  • CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth.
• Salt version bump to 3004
• Python version bump to 3.10.2

This update fixes the following issues:

venv-salt-minion:

• Fix the regression caused by the patch removing strict requirement for OpenSSL 1.1.1 leading to read/write issues with ssl module for SLE 15, SLE 12, CentOS 7, Debian 9 (bsc#1198556)
• Fixes for Python 3.10
• Fix salt-ssh opts poisoning (bsc#1197637)
• Fix multiple security issues (bsc#1197417)
  • CVE-2022-22935: Sign authentication replies to prevent MiTM
  • CVE-2022-22934: Sign pillar data to prevent MiTM attacks.
  • CVE-2022-22936: Prevent job and fileserver replays.
  • CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth.
• Salt version bump to 3004
• Python version bump to 3.10.2
• CVE-2022-24302: unauthorized information disclosure for python-paramiko.
• CVE-2021-28957: XSS due to missing input sanitization in python-lxml.
• CVE-2018-19787: XSS attacks due to missing URLs sanitization in python-lxml.
• Security Fix: (bsc#1196249, bsc#1196877, CVE-2022-0778)
  • Allow CRYPTO_THREADID_set_callback to be called with NULL parameter
  • Infinite loop in BN_mod_sqrt() reachable when parsing certificates

This update fixes the following issues:

golang-github-prometheus-alertmanager:

• CVE-2022-21698: Denial of service using InstrumentHandlerCounter
  • Update vendor tarball with prometheus/client_golang 1.11.1 (bsc#1196338, jsc#SLE-24077)
• Update to version 0.23.0:
  • amtool: Detect version drift and warn users (#2672)
  • Add ability to skip TLS verification for amtool (#2663)
  • Fix empty isEqual in amtool. (#2668)
  • Fix main tests (#2670)
  • cli: add new template render command (#2538)
  • OpsGenie: refer to alert instead of incident (#2609)
  • Docs: target_match and source_match are DEPRECATED (#2665)
  • Fix test not waiting for cluster member to be ready
• Added hardening to systemd service(s) (bsc#1181400).

golang-github-prometheus-prometheus:

• Build firewalld-prometheus-config only for SUSE Linux Enterprise 15, 15.1 and 15.2, and require firewalld for it
• Firewalld-prometheus-config needs to be a Recommends, not a Requires, as prometheus does not require it to run
• Create firewalld-prometheus-config subpackage (bsc#1197042)
• CVE-2022-21698: Denial of service using InstrumentHandlerCounter.
  • Update vendor tarball with prometheus/client_golang 1.12.1 (bsc#1196338)

mgr-cfg:

• Version 4.3.6-1
  • Fix the condition for preventing building python 2 subpackage for SLE15 (bsc#1197579)

mgr-osad:

• Version 4.3.6-1
  • Fix the condition for preventing building python 2 subpackage for SLE15

mgr-push:

• Version 4.3.4-1
  • Fix the condition for preventing building python 2 subpackage for SLE15

mgr-virtualization:

• Version 4.3.5-1
  • Fix the condition for preventing building python 2 subpackage for SLE15

rhnlib:

• Version 4.3.4-1
  • Fix the condition for preventing building python 2 subpackage for SLE15

salt:

• Prevent data pollution between actions proceesed at the same time (bsc#1197637)
• Fix regression preventing bootstrapping new clients caused by redundant dependency on psutil (bsc#1197533)
• Fixes for Python 3.10
• Fix salt-ssh opts poisoning (bsc#1197637)
• Fix multiple security issues for salt (bsc#1197417):
  • CVE-2022-22935: Sign authentication replies to prevent MiTM.
  • CVE-2022-22934: Sign pillar data to prevent MiTM attacks.
  • CVE-2022-22936: Prevent job and fileserver replays.
  • CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth.

spacecmd:

• Version 4.3.10-1
  • parse boolean parameters correctly (bsc#1197689)
  • Add parameter to set containerized proxy SSH port

spacewalk-client-tools:

• Version 4.3.9-1
  • Fix the condition for preventing building python 2 subpackage for SLE15

spacewalk-koan:

• Version 4.3.5-1
  • Fix the condition for preventing building python 2 subpackage for SLE15

spacewalk-oscap:

• Version 4.3.5-1
  • Fix the condition for preventing building python 2 subpackage for SLE15

suseRegisterInfo:

• Version 4.3.3-1
  • Fix the condition for preventing building python 2 subpackage for SLE15

uyuni-common-libs:

• Version 4.3.4-1
  • implement more decompression algorithms for reposync (bsc#1196704)

uyuni-proxy-systemd-services:

• Version 4.3.2-1
  • Harmonize systemd services names and container names
  • Adapted to work on Enterprise Linux.
  • Add package to SLE and Client tools (jsc#SLE-24145)