CVE-2019-18897

This update fixes the following issues:

salt:

• RHEL/CentOS 8 uses platform-python instead of python3
• New configuration option for selection of grains in the minion start event.
• Fix 'os_family' grain for Astra Linux Common Edition
• Fix for salt-api NET API where unauthenticated attacker could run arbitrary code (CVE-2019-17361) (bsc#1162504)
• Adds disabled parameter to mod_repo in aptpkg module
• Move token with atomic operation
• Bad API token files get deleted (bsc#1160931)
• Support for Btrfs and XFS in parted and mkfs added
• Adds list_downloaded for apt Module to enable pre-downloading support
• Adds virt.(pool|network)_get_xml functions
• Virt: adding kernel boot parameters to libvirt xml
• Fix to scheduler when data['run'] does not exist (bsc#1159118)
• Fix virt states to not fail on VMs already stopped
• Fix applying of attributes for returner rawfile_json (bsc#1158940)
• Xfs: do not fail if type is not present (bsc#1153611)
• Don't use __python indirection macros on spec file %__python is no longer defined in RPM 4.15 (python2 is going EOL in Jan 2020); additionally, python/python3 are just binaries in the path.
• Fix errors when running virt.get_hypervisor function
• Align virt.full_info fixes with upstream Salt
• Fix for log checking in x509 test
• Prevent test_mod_del_repo_multiline_values to fail
• Read repo info without using interpolation (bsc#1135656)
• Replacing pycrypto with M2Crypto as dependency for >= SLE15 (bsc#1165425)
• Batch Async: Handle exceptions, properly unregister and close instances after running async batching to avoid CPU starvation of the MWorkers (bsc#1162327)
• Avoid possible user escalation upgrading salt-master (bsc#1157465) (CVE-2019-18897)

This update fixes the following issues:

salt:

• RHEL/CentOS 8 uses platform-python instead of python3
• New configuration option for selection of grains in the minion start event.
• Fix 'os_family' grain for Astra Linux Common Edition
• Fix for salt-api NET API where unauthenticated attacker could run arbitrary code (CVE-2019-17361) (bsc#1162504)
• Adds disabled parameter to mod_repo in aptpkg module
• Move token with atomic operation
• Bad API token files get deleted (bsc#1160931)
• Support for Btrfs and XFS in parted and mkfs added
• Adds list_downloaded for apt Module to enable pre-downloading support
• Adds virt.(pool|network)_get_xml functions
• Virt: adding kernel boot parameters to libvirt xml
• Fix to scheduler when data['run'] does not exist (bsc#1159118)
• Fix virt states to not fail on VMs already stopped
• Fix applying of attributes for returner rawfile_json (bsc#1158940)
• Xfs: do not fail if type is not present (bsc#1153611)
• Don't use __python indirection macros on spec file %__python is no longer defined in RPM 4.15 (python2 is going EOL in Jan 2020); additionally, python/python3 are just binaries in the path.
• Fix errors when running virt.get_hypervisor function
• Align virt.full_info fixes with upstream Salt
• Fix for log checking in x509 test
• Prevent test_mod_del_repo_multiline_values to fail
• Read repo info without using interpolation (bsc#1135656)
• Replacing pycrypto with M2Crypto as dependency for >= SLE15 (bsc#1165425)
• Batch Async: Handle exceptions, properly unregister and close instances after running async batching to avoid CPU starvation of the MWorkers (bsc#1162327)
• Avoid possible user escalation upgrading salt-master (bsc#1157465) (CVE-2019-18897)

This update for salt fixes the following issues:

• Avoid possible user escalation upgrading salt-master (bsc#1157465) (CVE-2019-18897)
• Fix unit tests failures in test_batch_async tests
• Batch Async: Handle exceptions, properly unregister and close instances after running async batching to avoid CPU starvation of the MWorkers (bsc#1162327)
• RHEL/CentOS 8 uses platform-python instead of python3
• New configuration option for selection of grains in the minion start event.
• Fix 'os_family' grain for Astra Linux Common Edition
• Fix for salt-api NET API where unauthenticated attacker could run arbitrary code (CVE-2019-17361) (bsc#1162504)
• Adds disabled parameter to mod_repo in aptpkg module Move token with atomic operation Bad API token files get deleted (bsc#1160931)
• Support for Btrfs and XFS in parted and mkfs added
• Adds list_downloaded for apt Module to enable pre-downloading support Adds virt.(pool|network)_get_xml functions
• Various libvirt updates:
  • Add virt.pool_capabilities function
  • virt.pool_running improvements
  • Add virt.pool_deleted state
  • virt.network_define allow adding IP configuration
• virt: adding kernel boot parameters to libvirt xml
• Fix to scheduler when data['run'] does not exist (bsc#1159118)
• Fix virt states to not fail on VMs already stopped
• Fix applying of attributes for returner rawfile_json (bsc#1158940)
• xfs: do not fail if type is not present (bsc#1153611)
• Fix errors when running virt.get_hypervisor function
• Align virt.full_info fixes with upstream Salt
• Fix for log checking in x509 test
• Read repo info without using interpolation (bsc#1135656)
• Limiting M2Crypto to >= SLE15
• Replacing pycrypto with M2Crypto (bsc#1165425)

This update fixes the following issues:

salt:

• Requiring python3-distro only for openSUSE/SLE >= 15
• Use full option name instead of undocumented abbreviation for zypper
• Python-distro is only needed for > Python 3.7. Removing it for Python 2
• Fixed a local privilege escalation to root (bsc#1157465) (CVE-2019-18897)
• Fix unit tests failures in test_batch_async tests
• Batch Async: Handle exceptions, properly unregister and close instances after running async batching to avoid CPU starvation of the MWorkers (bsc#1162327)
• RHEL/CentOS 8 uses platform-python instead of python3
• Enable build for Python 3.8
• Update to Salt version 2019.2.3 (bsc#1163981) (bsc#1162504)
• Replacing pycrypto with M2Crypto (bsc#1165425)

This update fixes the following issues:

salt:

• Requiring python3-distro only for openSUSE/SLE >= 15
• Use full option name instead of undocumented abbreviation for zypper
• Python-distro is only needed for > Python 3.7. Removing it for Python 2
• Fixed a local privilege escalation to root (bsc#1157465) (CVE-2019-18897)
• Fix unit tests failures in test_batch_async tests
• Batch Async: Handle exceptions, properly unregister and close instances after running async batching to avoid CPU starvation of the MWorkers (bsc#1162327)
• RHEL/CentOS 8 uses platform-python instead of python3
• Enable build for Python 3.8
• Update to Salt version 2019.2.3 (bsc#1163981) (bsc#1162504)
• Replacing pycrypto with M2Crypto (bsc#1165425)

This update fixes the following issues:

salt:

• Fix for TypeError in Tornado importer (bsc#1174165)
• Require python3-distro only for TW (bsc#1173072)
• Various virt backports from 3000.2
• Avoid traceback on debug logging for swarm module (bsc#1172075)
• Add publish_batch to ClearFuncs exposed methods
• Update to salt version 3000 See release notes: https://docs.saltstack.com/en/latest/topics/releases/3000.html
• Zypperpkg: filter patterns that start with dot (bsc#1171906)
• Batch mode now also correctly provides return value (bsc#1168340)
• Add docker.logout to docker execution module (bsc#1165572)
• Testsuite fix
• Add option to enable/disable force refresh for zypper
• Python3.8 compatibility changes
• Prevent sporious 'salt-api' stuck processes when managing SSH minions because of logging deadlock (bsc#1159284)
• Avoid segfault from 'salt-api' under certain conditions of heavy load managing SSH minions (bsc#1169604)
• Revert broken changes to slspath made on Salt 3000 (saltstack/salt#56341) (bsc#1170104)
• Returns a the list of IPs filtered by the optional network list
• Fix CVE-2020-11651 and CVE-2020-11652 (bsc#1170595)
• Do not require vendored backports-abc (bsc#1170288)
• Fix partition.mkpart to work without fstype (bsc#1169800)
• Enable building and installation for Fedora
• Disable python2 build on Tumbleweed We are removing the python2 interpreter from openSUSE (SLE16). As such disable salt building for python2 there.
• More robust remote port detection
• Sanitize grains loaded from roster_grains.json cache during 'state.pkg'
• Do not make file.recurse state to fail when msgpack 0.5.4 (bsc#1167437)
• Build: Buildequire pkgconfig(systemd) instead of systemd pkgconfig(systemd) is provided by systemd, so this is de-facto no change. But inside the Open Build Service (OBS), the same symbol is also provided by systemd-mini, which exists to shorten build-chains by only enabling what other packages need to successfully build
• Add new custom SUSE capability for saltutil state module
• Fixes status attribute issue in aptpkg test
• Make setup.py script not to require setuptools greater than 9.1
• Loop: fix variable names for until_no_eval
• Drop conflictive module.run state patch (bsc#1167437)
• Update patches after rebase with upstream v3000 tag (bsc#1167437)
• Fix some requirements issues depending on Python3 versions
• Removes obsolete patch
• Fix for low rpm_lowpkg unit test
• Add python-singledispatch as dependency for python2-salt
• Virt._get_domain: don't raise an exception if there is no VM
• Fix for temp folder definition in loader unit test
• Adds test for zypper abbreviation fix
• Improved storage pool or network handling
• Better import cache handline
• Make 'salt.ext.tornado.gen' to use 'salt.ext.backports_abc' on Python 2
• Fix regression in service states with reload argument
• Fix integration test failure for test_mod_del_repo_multiline_values
• Fix for unless requisite when pip is not installed
• Fix errors from unit tests due NO_MOCK and NO_MOCK_REASON deprecation
• Fix tornado imports and missing _utils after rebasing patches
• Removes unresolved merge conflict in yumpkg module
• Use full option name instead of undocumented abbreviation for zypper
• Requiring python3-distro only for openSUSE/SLE >= 15 and not for Python 2 builds
• Avoid possible user escalation upgrading salt-master (bsc#1157465) (CVE-2019-18897)
• Fix unit tests failures in test_batch_async tests
• Batch Async: Handle exceptions, properly unregister and close instances after running async batching to avoid CPU starvation of the MWorkers (bsc#1162327)
• RHEL/CentOS 8 uses platform-python instead of python3
• Loader: invalidate the import cachefor extra modules
• Zypperpkg: filter patterns that start with dot (bsc#1171906)
• Batch mode now also correctly provides return value (bsc#1168340)
• Add docker.logout to docker execution module (bsc#1165572)
• Improvements for chroot module
• Add option to enable/disable force…

This update fixes the following issues:

salt:

• Fix for TypeError in Tornado importer (bsc#1174165)
• Require python3-distro only for TW (bsc#1173072)
• Various virt backports from 3000.2
• Avoid traceback on debug logging for swarm module (bsc#1172075)
• Add publish_batch to ClearFuncs exposed methods
• Update to salt version 3000 See release notes: https://docs.saltstack.com/en/latest/topics/releases/3000.html
• Zypperpkg: filter patterns that start with dot (bsc#1171906)
• Batch mode now also correctly provides return value (bsc#1168340)
• Add docker.logout to docker execution module (bsc#1165572)
• Testsuite fix
• Add option to enable/disable force refresh for zypper
• Python3.8 compatibility changes
• Prevent sporious 'salt-api' stuck processes when managing SSH minions because of logging deadlock (bsc#1159284)
• Avoid segfault from 'salt-api' under certain conditions of heavy load managing SSH minions (bsc#1169604)
• Revert broken changes to slspath made on Salt 3000 (saltstack/salt#56341) (bsc#1170104)
• Returns a the list of IPs filtered by the optional network list
• Fix CVE-2020-11651 and CVE-2020-11652 (bsc#1170595)
• Do not require vendored backports-abc (bsc#1170288)
• Fix partition.mkpart to work without fstype (bsc#1169800)
• Enable building and installation for Fedora
• Disable python2 build on Tumbleweed We are removing the python2 interpreter from openSUSE (SLE16). As such disable salt building for python2 there.
• More robust remote port detection
• Sanitize grains loaded from roster_grains.json cache during 'state.pkg'
• Do not make file.recurse state to fail when msgpack 0.5.4 (bsc#1167437)
• Build: Buildequire pkgconfig(systemd) instead of systemd pkgconfig(systemd) is provided by systemd, so this is de-facto no change. But inside the Open Build Service (OBS), the same symbol is also provided by systemd-mini, which exists to shorten build-chains by only enabling what other packages need to successfully build
• Add new custom SUSE capability for saltutil state module
• Fixes status attribute issue in aptpkg test
• Make setup.py script not to require setuptools greater than 9.1
• Loop: fix variable names for until_no_eval
• Drop conflictive module.run state patch (bsc#1167437)
• Update patches after rebase with upstream v3000 tag (bsc#1167437)
• Fix some requirements issues depending on Python3 versions
• Removes obsolete patch
• Fix for low rpm_lowpkg unit test
• Add python-singledispatch as dependency for python2-salt
• Virt._get_domain: don't raise an exception if there is no VM
• Fix for temp folder definition in loader unit test
• Adds test for zypper abbreviation fix
• Improved storage pool or network handling
• Better import cache handline
• Make 'salt.ext.tornado.gen' to use 'salt.ext.backports_abc' on Python 2
• Fix regression in service states with reload argument
• Fix integration test failure for test_mod_del_repo_multiline_values
• Fix for unless requisite when pip is not installed
• Fix errors from unit tests due NO_MOCK and NO_MOCK_REASON deprecation
• Fix tornado imports and missing _utils after rebasing patches
• Removes unresolved merge conflict in yumpkg module
• Use full option name instead of undocumented abbreviation for zypper
• Requiring python3-distro only for openSUSE/SLE >= 15 and not for Python 2 builds
• Avoid possible user escalation upgrading salt-master (bsc#1157465) (CVE-2019-18897)
• Fix unit tests failures in test_batch_async tests
• Batch Async: Handle exceptions, properly unregister and close instances after running async batching to avoid CPU starvation of the MWorkers (bsc#1162327)
• RHEL/CentOS 8 uses platform-python instead of python3
• Loader: invalidate the import cachefor extra modules
• Zypperpkg: filter patterns that start with dot (bsc#1171906)
• Batch mode now also correctly provides return value (bsc#1168340)
• Add docker.logout to docker execution module (bsc#1165572)
• Improvements for chroot module
• Add option to enable/disable force…