CVE-2020-11652

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.

This update for salt fixes the following issues:

• Fix CVE-2020-11651 and CVE-2020-11652 (bsc#1170595)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for salt contains the following fixes:

• Fix for TypeError in Tornado importer (bsc#1174165)

• Require python3-distro only for TW (bsc#1173072)

• Update to Salt version 3000: See release notes: https://docs.saltstack.com/en/latest/topics/releases/3000.html

• Add docker.logout to docker execution module. (bsc#1165572)

• Add option to enable/disable force refresh for zypper.

• Add publish_batch to ClearFuncs exposed methods.

• Adds test for zypper abbreviation fix.

• Avoid segfault from 'salt-api' under certain conditions of heavy load managing SSH minions. (bsc#1169604)

• Avoid traceback on debug logging for swarm module. (bsc#1172075)

• Batch mode now also correctly provides return value. (bsc#1168340)

• Better import cache handline.

• Do not make file.recurse state to fail when msgpack 0.5.4. (bsc#1167437)

• Do not require vendored backports-abc. (bsc#1170288)

• Fix errors from unit tests due NO_MOCK and NO_MOCK_REASON deprecation.

• Fix for low rpm_lowpkg unit test.

• Fix for temp folder definition in loader unit test.

• Fix for unless requisite when pip is not installed.

• Fix integration test failure for test_mod_del_repo_multiline_values.

• Fix regression in service states with reload argument.

• Fix tornado imports and missing _utils after rebasing patches.

• Fix status attribute issue in aptpkg test.

• Improved storage pool or network handling.

• loop: fix variable names for until_no_eval.

• Make 'salt.ext.tornado.gen' to use 'salt.ext.backports_abc' on Python 2.

• Make setup.py script not to require setuptools greater than 9.1.

• More robust remote port detection.

• Prevent sporious 'salt-api' stuck processes when managing SSH minions. because of logging deadlock. (bsc#1159284)

• Python3.8 compatibility changes.

• Removes unresolved merge conflict in yumpkg module.

• Returns a the list of IPs filtered by the optional network list.

• Revert broken changes to slspath made on Salt 3000 (saltstack/salt#56341). (bsc#1170104)

• Sanitize grains loaded from roster_grains.json cache during 'state.pkg'.

• Various virt backports from 3000.2.

• zypperpkg: filter patterns that start with dot. (bsc#1171906)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for salt fixes the following issues:

Update to Salt release version 3002.2 (jsc#ECO-3212, jsc#SLE-18033, jsc#SLE-18028)

• Check if dpkgnotify is executable (bsc#1186674)
• Drop support for Python2. Obsoletes python2-salt package (jsc#SLE-18028)
• virt module updates
  • network: handle missing ipv4 netmask attribute
  • more network support
  • PCI/USB host devices passthrough support
• Set distro requirement to oldest supported version in requirements/base.txt
• Bring missing part of async batch implementation back (CVE-2021-25315, bsc#1182382)
• Always require python3-distro (bsc#1182293)
• Remove deprecated warning that breaks minion execution when 'server_id_use_crc' opts is missing
• Fix pkg states when DEB package has 'all' arch
• Do not force beacons configuration to be a list.
• Remove msgpack < 1.0.0 from base requirements (bsc#1176293)
• msgpack support for version >= 1.0.0 (bsc#1171257)
• Fix issue parsing errors in ansiblegate state module
• Prevent command injection in the snapper module (bsc#1185281, CVE-2021-31607)
• transactional_update: detect recursion in the executor
• Add subpackage salt-transactional-update (jsc#SLE-18033)
• Improvements on 'ansiblegate' module (bsc#1185092):
  • New methods: ansible.targets / ansible.discover_playbooks
• Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
• Regression fix of salt-ssh on processing targets
• Update target fix for salt-ssh and avoiding race condition on salt-ssh event processing (bsc#1179831, bsc#1182281)
• Add notify beacon for Debian/Ubuntu systems
• Fix zmq bug that causes salt-call to freeze (bsc#1181368)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for salt fixes the following issues:

Update to Salt release version 3002.2 (jsc#ECO-3212, jsc#SLE-18033, jsc#SLE-18028)

• Check if dpkgnotify is executable (bsc#1186674)
• Drop support for Python2. Obsoletes python2-salt package (jsc#SLE-18028)
• virt module updates
  • network: handle missing ipv4 netmask attribute
  • more network support
  • PCI/USB host devices passthrough support
• Set distro requirement to oldest supported version in requirements/base.txt
• Bring missing part of async batch implementation back (CVE-2021-25315, bsc#1182382)
• Always require python3-distro (bsc#1182293)
• Remove deprecated warning that breaks minion execution when 'server_id_use_crc' opts is missing
• Fix pkg states when DEB package has 'all' arch
• Do not force beacons configuration to be a list.
• Remove msgpack < 1.0.0 from base requirements (bsc#1176293)
• msgpack support for version >= 1.0.0 (bsc#1171257)
• Fix issue parsing errors in ansiblegate state module
• Prevent command injection in the snapper module (bsc#1185281, CVE-2021-31607)
• transactional_update: detect recursion in the executor
• Add subpackage salt-transactional-update (jsc#SLE-18033)
• Improvements on 'ansiblegate' module (bsc#1185092):
  • New methods: ansible.targets / ansible.discover_playbooks
• Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
• Regression fix of salt-ssh on processing targets
• Update target fix for salt-ssh and avoiding race condition on salt-ssh event processing (bsc#1179831, bsc#1182281)
• Add notify beacon for Debian/Ubuntu systems
• Fix zmq bug that causes salt-call to freeze (bsc#1181368)

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.

This update for salt fixes the following issues:

• Fix CVE-2020-11651 and CVE-2020-11652 (bsc#1170595)

This update for salt fixes the following issues:

• Fix CVE-2020-11651 and CVE-2020-11652 (bsc#1170595)

This update for salt fixes the following issues:

• Fix CVE-2020-11651 and CVE-2020-11652 (bsc#1170595)

This update for salt fixes the following issues:

Security issues fixed:

• CVE-2020-11651: Fixed the improper validation of method calls in salt-master, that could have allowed unauthenticated remote users to run arbitrary commands on salt minions (bsc#1170595).
• CVE-2020-11652: Fixed an improper path sanitation in salt-master, that could have allowed authenticated users to access arbitrary directories (bsc#1170595).

This update fixes the following issues:

dracut-saltboot:

• Print a list of available disk devices (bsc#1170824)
• Install wipefs to initrd
• Force install crypt modules
• Add missing terminal naming modifiers as exported veriables

golang-github-prometheus-prometheus:

• Update change log and spec file
  • Modified spec file: default to golang 1.14 to avoid 'have choice' build issues in OBS.
  • Rebase and update patches for version 2.18.0
  • Changed:
    • 0002-Default-settings.patch Changed
• Update to 2.18.0
  • Features
    • Tracing: Added experimental Jaeger support #7148
  • Changes
    • Federation: Only use local TSDB for federation (ignore remote read). #7096
    • Rules: rule_evaluations_total and rule_evaluation_failures_total have a rule_group label now. #7094
  • Enhancements
    • TSDB: Significantly reduce WAL size kept around after a block cut. #7098
    • Discovery: Add architecture meta label for EC2. #7000
  • Bug fixes
    • UI: Fixed wrong MinTime reported by /status. #7182
    • React UI: Fixed multiselect legend on OSX. #6880
    • Remote Write: Fixed blocked resharding edge case. #7122
    • Remote Write: Fixed remote write not updating on relabel configs change. #7073
• Changes from 2.17.2
  • Bug fixes
    • Federation: Register federation metrics #7081
    • PromQL: Fix panic in parser error handling #7132
    • Rules: Fix reloads hanging when deleting a rule group that is being evaluated #7138
    • TSDB: Fix a memory leak when prometheus starts with an empty TSDB WAL #7135
    • TSDB: Make isolation more robust to panics in web handlers #7129 #7136
• Changes from 2.17.1
  • Bug fixes
    • TSDB: Fix query performance regression that increased memory and CPU usage #7051
• Changes from 2.17.0
  • Features
    • TSDB: Support isolation #6841
    • This release implements isolation in TSDB. API queries and recording rules are guaranteed to only see full scrapes and full recording rules. This comes with a certain overhead in resource usage. Depending on the situation, there might be some increase in memory usage, CPU usage, or query latency.
  • Enhancements
    • PromQL: Allow more keywords as metric names #6933
    • React UI: Add normalization of localhost URLs in targets page #6794
    • Remote read: Read from remote storage concurrently #6770
    • Rules: Mark deleted rule series as stale after a reload #6745
    • Scrape: Log scrape append failures as debug rather than warn #6852
    • TSDB: Improve query performance for queries that partially hit the head #6676
    • Consul SD: Expose service health as meta label #5313
    • EC2 SD: Expose EC2 instance lifecycle as meta label #6914
    • Kubernetes SD: Expose service type as meta label for K8s service role #6684
    • Kubernetes SD: Expose label_selector and field_selector #6807
    • Openstack SD: Expose hypervisor id as meta label #6962
  • Bug fixes
    • PromQL: Do not escape HTML-like chars in query log #6834 #6795
    • React UI: Fix data table matrix values #6896
    • React UI: Fix new targets page not loading when using non-ASCII characters #6892
    • Remote read: Fix duplication of metrics read from remote storage with external labels #6967 #7018
    • Remote write: Register WAL watcher and live reader metrics for all remotes, not just the first one #6998
    • Scrape: Prevent removal of metric names upon relabeling #6891
    • Scrape: Fix 'superfluous response.WriteHeader call' errors when scrape fails under some circonstances #6986
    • Scrape: Fix crash when reloads are separated by two scrape intervals #7011
• Changes from 2.16.0
  • Features
    • React UI: Support local timezone on /graph #6692
    • PromQL: add absent_over_time query function #6490
    • Adding optional logging of queries to their own file #6520
  • Enhancements
    • React UI: Add support for rules page and 'Xs ago' duration displays #6503
    • React UI: alerts page, replace filtering togglers tabs with checkboxes #6543 …

This update fixes the following issues:

cobbler:

• Calculate relative path for kernel and inited when generating grub entry (bsc#1170231) Added: fix-grub2-entry-paths.diff
• Fix os-release version detection for SUSE Modified: sles15.patch
• Jinja2 template library fix (bsc#1141661)
• Removes string replace for textmode fix (bsc#1134195)

golang-github-prometheus-prometheus:

• Update change log and spec file
  • Modified spec file: default to golang 1.14 to avoid 'have choice' build issues in OBS.
  • Rebase and update patches for version 2.18.0
  • Changed:
    • 0002-Default-settings.patch Changed
• Update to 2.18.0
  • Features
    • Tracing: Added experimental Jaeger support #7148
  • Changes
    • Federation: Only use local TSDB for federation (ignore remote read). #7096
    • Rules: rule_evaluations_total and rule_evaluation_failures_total have a rule_group label now. #7094
  • Enhancements
    • TSDB: Significantly reduce WAL size kept around after a block cut. #7098
    • Discovery: Add architecture meta label for EC2. #7000
  • Bug fixes
    • UI: Fixed wrong MinTime reported by /status. #7182
    • React UI: Fixed multiselect legend on OSX. #6880
    • Remote Write: Fixed blocked resharding edge case. #7122
    • Remote Write: Fixed remote write not updating on relabel configs change. #7073
• Changes from 2.17.2
  • Bug fixes
    • Federation: Register federation metrics #7081
    • PromQL: Fix panic in parser error handling #7132
    • Rules: Fix reloads hanging when deleting a rule group that is being evaluated #7138
    • TSDB: Fix a memory leak when prometheus starts with an empty TSDB WAL #7135
    • TSDB: Make isolation more robust to panics in web handlers #7129 #7136
• Changes from 2.17.1
  • Bug fixes
    • TSDB: Fix query performance regression that increased memory and CPU usage #7051
• Changes from 2.17.0
  • Features
    • TSDB: Support isolation #6841
    • This release implements isolation in TSDB. API queries and recording rules are guaranteed to only see full scrapes and full recording rules. This comes with a certain overhead in resource usage. Depending on the situation, there might be some increase in memory usage, CPU usage, or query latency.
  • Enhancements
    • PromQL: Allow more keywords as metric names #6933
    • React UI: Add normalization of localhost URLs in targets page #6794
    • Remote read: Read from remote storage concurrently #6770
    • Rules: Mark deleted rule series as stale after a reload #6745
    • Scrape: Log scrape append failures as debug rather than warn #6852
    • TSDB: Improve query performance for queries that partially hit the head #6676
    • Consul SD: Expose service health as meta label #5313
    • EC2 SD: Expose EC2 instance lifecycle as meta label #6914
    • Kubernetes SD: Expose service type as meta label for K8s service role #6684
    • Kubernetes SD: Expose label_selector and field_selector #6807
    • Openstack SD: Expose hypervisor id as meta label #6962
  • Bug fixes
    • PromQL: Do not escape HTML-like chars in query log #6834 #6795
    • React UI: Fix data table matrix values #6896
    • React UI: Fix new targets page not loading when using non-ASCII characters #6892
    • Remote read: Fix duplication of metrics read from remote storage with external labels #6967 #7018
    • Remote write: Register WAL watcher and live reader metrics for all remotes, not just the first one #6998
    • Scrape: Prevent removal of metric names upon relabeling #6891
    • Scrape: Fix 'superfluous response.WriteHeader call' errors when scrape fails under some circonstances #6986
    • Scrape: Fix crash when reloads are separated by two scrape intervals #7011
• Changes from 2.16.0
  • Features
    • React UI: Support local timezone on /graph #6692
    • PromQL: add absent_over_time query function #6490
    • Adding optional logging of queries to their own file #6520
  • Enhancements
    • React UI: Add support for rules page and…

This update fixes the following issues:

salt:

• Fix for TypeError in Tornado importer (bsc#1174165)
• Require python3-distro only for TW (bsc#1173072)
• Various virt backports from 3000.2
• Avoid traceback on debug logging for swarm module (bsc#1172075)
• Add publish_batch to ClearFuncs exposed methods
• Update to salt version 3000 See release notes: https://docs.saltstack.com/en/latest/topics/releases/3000.html
• Zypperpkg: filter patterns that start with dot (bsc#1171906)
• Batch mode now also correctly provides return value (bsc#1168340)
• Add docker.logout to docker execution module (bsc#1165572)
• Testsuite fix
• Add option to enable/disable force refresh for zypper
• Python3.8 compatibility changes
• Prevent sporious 'salt-api' stuck processes when managing SSH minions because of logging deadlock (bsc#1159284)
• Avoid segfault from 'salt-api' under certain conditions of heavy load managing SSH minions (bsc#1169604)
• Revert broken changes to slspath made on Salt 3000 (saltstack/salt#56341) (bsc#1170104)
• Returns a the list of IPs filtered by the optional network list
• Fix CVE-2020-11651 and CVE-2020-11652 (bsc#1170595)
• Do not require vendored backports-abc (bsc#1170288)
• Fix partition.mkpart to work without fstype (bsc#1169800)
• Enable building and installation for Fedora
• Disable python2 build on Tumbleweed We are removing the python2 interpreter from openSUSE (SLE16). As such disable salt building for python2 there.
• More robust remote port detection
• Sanitize grains loaded from roster_grains.json cache during 'state.pkg'
• Do not make file.recurse state to fail when msgpack 0.5.4 (bsc#1167437)
• Build: Buildequire pkgconfig(systemd) instead of systemd pkgconfig(systemd) is provided by systemd, so this is de-facto no change. But inside the Open Build Service (OBS), the same symbol is also provided by systemd-mini, which exists to shorten build-chains by only enabling what other packages need to successfully build
• Add new custom SUSE capability for saltutil state module
• Fixes status attribute issue in aptpkg test
• Make setup.py script not to require setuptools greater than 9.1
• Loop: fix variable names for until_no_eval
• Drop conflictive module.run state patch (bsc#1167437)
• Update patches after rebase with upstream v3000 tag (bsc#1167437)
• Fix some requirements issues depending on Python3 versions
• Removes obsolete patch
• Fix for low rpm_lowpkg unit test
• Add python-singledispatch as dependency for python2-salt
• Virt._get_domain: don't raise an exception if there is no VM
• Fix for temp folder definition in loader unit test
• Adds test for zypper abbreviation fix
• Improved storage pool or network handling
• Better import cache handline
• Make 'salt.ext.tornado.gen' to use 'salt.ext.backports_abc' on Python 2
• Fix regression in service states with reload argument
• Fix integration test failure for test_mod_del_repo_multiline_values
• Fix for unless requisite when pip is not installed
• Fix errors from unit tests due NO_MOCK and NO_MOCK_REASON deprecation
• Fix tornado imports and missing _utils after rebasing patches
• Removes unresolved merge conflict in yumpkg module
• Use full option name instead of undocumented abbreviation for zypper
• Requiring python3-distro only for openSUSE/SLE >= 15 and not for Python 2 builds
• Avoid possible user escalation upgrading salt-master (bsc#1157465) (CVE-2019-18897)
• Fix unit tests failures in test_batch_async tests
• Batch Async: Handle exceptions, properly unregister and close instances after running async batching to avoid CPU starvation of the MWorkers (bsc#1162327)
• RHEL/CentOS 8 uses platform-python instead of python3
• Loader: invalidate the import cachefor extra modules
• Zypperpkg: filter patterns that start with dot (bsc#1171906)
• Batch mode now also correctly provides return value (bsc#1168340)
• Add docker.logout to docker execution module (bsc#1165572)
• Improvements for chroot module
• Add option to enable/disable force…

This update fixes the following issues:

salt:

• Fix for TypeError in Tornado importer (bsc#1174165)
• Require python3-distro only for TW (bsc#1173072)
• Various virt backports from 3000.2
• Avoid traceback on debug logging for swarm module (bsc#1172075)
• Add publish_batch to ClearFuncs exposed methods
• Update to salt version 3000 See release notes: https://docs.saltstack.com/en/latest/topics/releases/3000.html
• Zypperpkg: filter patterns that start with dot (bsc#1171906)
• Batch mode now also correctly provides return value (bsc#1168340)
• Add docker.logout to docker execution module (bsc#1165572)
• Testsuite fix
• Add option to enable/disable force refresh for zypper
• Python3.8 compatibility changes
• Prevent sporious 'salt-api' stuck processes when managing SSH minions because of logging deadlock (bsc#1159284)
• Avoid segfault from 'salt-api' under certain conditions of heavy load managing SSH minions (bsc#1169604)
• Revert broken changes to slspath made on Salt 3000 (saltstack/salt#56341) (bsc#1170104)
• Returns a the list of IPs filtered by the optional network list
• Fix CVE-2020-11651 and CVE-2020-11652 (bsc#1170595)
• Do not require vendored backports-abc (bsc#1170288)
• Fix partition.mkpart to work without fstype (bsc#1169800)
• Enable building and installation for Fedora
• Disable python2 build on Tumbleweed We are removing the python2 interpreter from openSUSE (SLE16). As such disable salt building for python2 there.
• More robust remote port detection
• Sanitize grains loaded from roster_grains.json cache during 'state.pkg'
• Do not make file.recurse state to fail when msgpack 0.5.4 (bsc#1167437)
• Build: Buildequire pkgconfig(systemd) instead of systemd pkgconfig(systemd) is provided by systemd, so this is de-facto no change. But inside the Open Build Service (OBS), the same symbol is also provided by systemd-mini, which exists to shorten build-chains by only enabling what other packages need to successfully build
• Add new custom SUSE capability for saltutil state module
• Fixes status attribute issue in aptpkg test
• Make setup.py script not to require setuptools greater than 9.1
• Loop: fix variable names for until_no_eval
• Drop conflictive module.run state patch (bsc#1167437)
• Update patches after rebase with upstream v3000 tag (bsc#1167437)
• Fix some requirements issues depending on Python3 versions
• Removes obsolete patch
• Fix for low rpm_lowpkg unit test
• Add python-singledispatch as dependency for python2-salt
• Virt._get_domain: don't raise an exception if there is no VM
• Fix for temp folder definition in loader unit test
• Adds test for zypper abbreviation fix
• Improved storage pool or network handling
• Better import cache handline
• Make 'salt.ext.tornado.gen' to use 'salt.ext.backports_abc' on Python 2
• Fix regression in service states with reload argument
• Fix integration test failure for test_mod_del_repo_multiline_values
• Fix for unless requisite when pip is not installed
• Fix errors from unit tests due NO_MOCK and NO_MOCK_REASON deprecation
• Fix tornado imports and missing _utils after rebasing patches
• Removes unresolved merge conflict in yumpkg module
• Use full option name instead of undocumented abbreviation for zypper
• Requiring python3-distro only for openSUSE/SLE >= 15 and not for Python 2 builds
• Avoid possible user escalation upgrading salt-master (bsc#1157465) (CVE-2019-18897)
• Fix unit tests failures in test_batch_async tests
• Batch Async: Handle exceptions, properly unregister and close instances after running async batching to avoid CPU starvation of the MWorkers (bsc#1162327)
• RHEL/CentOS 8 uses platform-python instead of python3
• Loader: invalidate the import cachefor extra modules
• Zypperpkg: filter patterns that start with dot (bsc#1171906)
• Batch mode now also correctly provides return value (bsc#1168340)
• Add docker.logout to docker execution module (bsc#1165572)
• Improvements for chroot module
• Add option to enable/disable force…

This update for salt contains the following fixes:

• Fix for TypeError in Tornado importer (bsc#1174165)

• Require python3-distro only for TW (bsc#1173072)

• Update to Salt version 3000: See release notes: https://docs.saltstack.com/en/latest/topics/releases/3000.html

• Add docker.logout to docker execution module. (bsc#1165572)

• Add option to enable/disable force refresh for zypper.

• Add publish_batch to ClearFuncs exposed methods.

• Adds test for zypper abbreviation fix.

• Avoid segfault from 'salt-api' under certain conditions of heavy load managing SSH minions. (bsc#1169604)

• Avoid traceback on debug logging for swarm module. (bsc#1172075)

• Batch mode now also correctly provides return value. (bsc#1168340)

• Better import cache handline.

• Do not make file.recurse state to fail when msgpack 0.5.4. (bsc#1167437)

• Do not require vendored backports-abc. (bsc#1170288)

• Fix errors from unit tests due NO_MOCK and NO_MOCK_REASON deprecation.

• Fix for low rpm_lowpkg unit test.

• Fix for temp folder definition in loader unit test.

• Fix for unless requisite when pip is not installed.

• Fix integration test failure for test_mod_del_repo_multiline_values.

• Fix regression in service states with reload argument.

• Fix tornado imports and missing _utils after rebasing patches.

• Fix status attribute issue in aptpkg test.

• Improved storage pool or network handling.

• loop: fix variable names for until_no_eval.

• Make 'salt.ext.tornado.gen' to use 'salt.ext.backports_abc' on Python 2.

• Make setup.py script not to require setuptools greater than 9.1.

• More robust remote port detection.

• Prevent sporious 'salt-api' stuck processes when managing SSH minions. because of logging deadlock. (bsc#1159284)

• Python3.8 compatibility changes.

• Removes unresolved merge conflict in yumpkg module.

• Returns a the list of IPs filtered by the optional network list.

• Revert broken changes to slspath made on Salt 3000 (saltstack/salt#56341). (bsc#1170104)

• Sanitize grains loaded from roster_grains.json cache during 'state.pkg'.

• Various virt backports from 3000.2.

• zypperpkg: filter patterns that start with dot. (bsc#1171906)

This update for salt fixes the following issues:

Update to Salt release version 3002.2 (jsc#ECO-3212, jsc#SLE-18033, jsc#SLE-18028)

• Check if dpkgnotify is executable (bsc#1186674)
• Drop support for Python2. Obsoletes python2-salt package (jsc#SLE-18028)
• virt module updates
  • network: handle missing ipv4 netmask attribute
  • more network support
  • PCI/USB host devices passthrough support
• Set distro requirement to oldest supported version in requirements/base.txt
• Bring missing part of async batch implementation back (bsc#1182382, CVE-2021-25315)
• Always require python3-distro (bsc#1182293)
• Remove deprecated warning that breaks minion execution when 'server_id_use_crc' opts is missing
• Fix pkg states when DEB package has 'all' arch
• Do not force beacons configuration to be a list.
• Remove msgpack < 1.0.0 from base requirements (bsc#1176293)
• msgpack support for version >= 1.0.0 (bsc#1171257)
• Fix issue parsing errors in ansiblegate state module
• Prevent command injection in the snapper module (bsc#1185281, CVE-2021-31607)
• transactional_update: detect recursion in the executor
• Add subpackage salt-transactional-update (jsc#SLE-18033)
• Remove duplicate directories from specfile
• Improvements on 'ansiblegate' module (bsc#1185092):
  • New methods: ansible.targets / ansible.discover_playbooks
• Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
• Regression fix of salt-ssh on processing targets
• Update target fix for salt-ssh and avoiding race condition on salt-ssh event processing (bsc#1179831, bsc#1182281)
• Add notify beacon for Debian/Ubuntu systems
• Fix zmq bug that causes salt-call to freeze (bsc#1181368)

This update for salt fixes the following issues:

Update to Salt release version 3002.2 (jsc#ECO-3212, jsc#SLE-18033, jsc#SLE-18028)

• Check if dpkgnotify is executable (bsc#1186674)
• Drop support for Python2. Obsoletes python2-salt package (jsc#SLE-18028)
• virt module updates
  • network: handle missing ipv4 netmask attribute
  • more network support
  • PCI/USB host devices passthrough support
• Set distro requirement to oldest supported version in requirements/base.txt
• Bring missing part of async batch implementation back (CVE-2021-25315, bsc#1182382)
• Always require python3-distro (bsc#1182293)
• Remove deprecated warning that breaks minion execution when 'server_id_use_crc' opts is missing
• Fix pkg states when DEB package has 'all' arch
• Do not force beacons configuration to be a list.
• Remove msgpack < 1.0.0 from base requirements (bsc#1176293)
• msgpack support for version >= 1.0.0 (bsc#1171257)
• Fix issue parsing errors in ansiblegate state module
• Prevent command injection in the snapper module (bsc#1185281, CVE-2021-31607)
• transactional_update: detect recursion in the executor
• Add subpackage salt-transactional-update (jsc#SLE-18033)
• Improvements on 'ansiblegate' module (bsc#1185092):
  • New methods: ansible.targets / ansible.discover_playbooks
• Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
• Regression fix of salt-ssh on processing targets
• Update target fix for salt-ssh and avoiding race condition on salt-ssh event processing (bsc#1179831, bsc#1182281)
• Add notify beacon for Debian/Ubuntu systems
• Fix zmq bug that causes salt-call to freeze (bsc#1181368)

It was discovered that Salt allows remote attackers to determine which files exist on the server. An attacker could use that to extract sensitive information. (CVE-2018-15750)

It was discovered that Salt has a vulnerability that allows an user to bypass authentication. An attacker could use that to extract sensitive information, execute abritrary code or crash the server. (CVE-2018-15751)

It was discovered that Salt is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host. (CVE-2019-17361)

It was discovered that Salt incorrectly validated method calls and sanitized paths. A remote attacker could possibly use this issue to access some methods without authentication. (CVE-2020-11651, CVE-2020-11652)

It was discovered that Salt incorrectly validated method calls and sanitized paths. A remote attacker could possibly use this issue to access some methods without authentication. (CVE-2020-11651, CVE-2020-11652)