CVE-2020-25592

In SaltStack the salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH.

In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH.

This update for salt fixes the following issues:

• Properly validate eauth credentials and tokens on SSH calls made by Salt API (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846)
• Fix disk.blkid to avoid unexpected keyword argument '__pub_user'. (bsc#1177867)
• Ensure virt.update stop_on_reboot is updated with its default value.
• Do not break package building for systemd OSes.
• Drop wrong mock from chroot unit test.
• Support systemd versions with dot. (bsc#1176294)
• Fix for grains.test_core unit test.
• Fix file/directory user and group ownership containing UTF-8 characters. (bsc#1176024)
• Several changes to virtualization:
  • Fix virt update when cpu and memory are changed.
  • Memory Tuning GSoC.
  • Properly fix memory setting regression in virt.update.
  • Expose libvirt on_reboot in virt states.
• Support transactional systems (MicroOS).
• zypperpkg module ignores retcode 104 for search(). (bsc#1159670)
• Xen disk fixes. No longer generates volumes for Xen disks, but the corresponding file or block disk. (bsc#1175987)
• Invalidate file list cache when cache file modified time is in the future. (bsc#1176397)
• Prevent import errors when running test_btrfs unit tests.

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for salt fixes the following issues:

• Avoid regression on 'salt-master': set passphrase for salt-ssh keys to empty string (bsc#1178485)
• Properly validate eauth credentials and tokens on SSH calls made by Salt API (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846)
• Fix disk.blkid to avoid unexpected keyword argument '__pub_user'. (bsc#1177867)
• Ensure virt.update stop_on_reboot is updated with its default value.
• Do not break package building for systemd OSes.
• Drop wrong mock from chroot unit test.
• Support systemd versions with dot. (bsc#1176294)
• Fix for grains.test_core unit test.
• Fix file/directory user and group ownership containing UTF-8 characters. (bsc#1176024)
• Several changes to virtualization:
  • Fix virt update when cpu and memory are changed.
  • Memory Tuning GSoC.
  • Properly fix memory setting regression in virt.update.
  • Expose libvirt on_reboot in virt states.
• Support transactional systems (MicroOS).
• zypperpkg module ignores retcode 104 for search(). (bsc#1159670)
• Xen disk fixes. No longer generates volumes for Xen disks, but the corresponding file or block disk. (bsc#1175987)
• Invalidate file list cache when cache file modified time is in the future. (bsc#1176397)
• Prevent import errors when running test_btrfs unit tests

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for salt fixes the following issues:

Update to Salt release version 3002.2 (jsc#ECO-3212, jsc#SLE-18033, jsc#SLE-18028)

• Check if dpkgnotify is executable (bsc#1186674)
• Drop support for Python2. Obsoletes python2-salt package (jsc#SLE-18028)
• virt module updates
  • network: handle missing ipv4 netmask attribute
  • more network support
  • PCI/USB host devices passthrough support
• Set distro requirement to oldest supported version in requirements/base.txt
• Bring missing part of async batch implementation back (CVE-2021-25315, bsc#1182382)
• Always require python3-distro (bsc#1182293)
• Remove deprecated warning that breaks minion execution when 'server_id_use_crc' opts is missing
• Fix pkg states when DEB package has 'all' arch
• Do not force beacons configuration to be a list.
• Remove msgpack < 1.0.0 from base requirements (bsc#1176293)
• msgpack support for version >= 1.0.0 (bsc#1171257)
• Fix issue parsing errors in ansiblegate state module
• Prevent command injection in the snapper module (bsc#1185281, CVE-2021-31607)
• transactional_update: detect recursion in the executor
• Add subpackage salt-transactional-update (jsc#SLE-18033)
• Improvements on 'ansiblegate' module (bsc#1185092):
  • New methods: ansible.targets / ansible.discover_playbooks
• Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
• Regression fix of salt-ssh on processing targets
• Update target fix for salt-ssh and avoiding race condition on salt-ssh event processing (bsc#1179831, bsc#1182281)
• Add notify beacon for Debian/Ubuntu systems
• Fix zmq bug that causes salt-call to freeze (bsc#1181368)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for salt fixes the following issues:

Update to Salt release version 3002.2 (jsc#ECO-3212, jsc#SLE-18033, jsc#SLE-18028)

• Check if dpkgnotify is executable (bsc#1186674)
• Drop support for Python2. Obsoletes python2-salt package (jsc#SLE-18028)
• virt module updates
  • network: handle missing ipv4 netmask attribute
  • more network support
  • PCI/USB host devices passthrough support
• Set distro requirement to oldest supported version in requirements/base.txt
• Bring missing part of async batch implementation back (CVE-2021-25315, bsc#1182382)
• Always require python3-distro (bsc#1182293)
• Remove deprecated warning that breaks minion execution when 'server_id_use_crc' opts is missing
• Fix pkg states when DEB package has 'all' arch
• Do not force beacons configuration to be a list.
• Remove msgpack < 1.0.0 from base requirements (bsc#1176293)
• msgpack support for version >= 1.0.0 (bsc#1171257)
• Fix issue parsing errors in ansiblegate state module
• Prevent command injection in the snapper module (bsc#1185281, CVE-2021-31607)
• transactional_update: detect recursion in the executor
• Add subpackage salt-transactional-update (jsc#SLE-18033)
• Improvements on 'ansiblegate' module (bsc#1185092):
  • New methods: ansible.targets / ansible.discover_playbooks
• Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
• Regression fix of salt-ssh on processing targets
• Update target fix for salt-ssh and avoiding race condition on salt-ssh event processing (bsc#1179831, bsc#1182281)
• Add notify beacon for Debian/Ubuntu systems
• Fix zmq bug that causes salt-call to freeze (bsc#1181368)

These are all security issues fixed in the python3-salt-3002.2-6.1 package on the GA media of openSUSE Tumbleweed.

In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH.

This update fixes the following issues:

cobbler:

• Fix parsing cobbler dictionary options with values containing '=', e.g. kernel params containing '=' (bsc#1176978)

mgr-daemon:

• Update translation strings

salt:

• Properly validate eauth credentials and tokens on SSH calls made by Salt API (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846)

spacecmd:

• Python3 fixes for errata in spacecmd (bsc#1169664)
• Added support for i18n of user-facing strings
• Python3 fix for sorted usage (bsc#1167907)

spacewalk-client-tools:

• Remove RH references in Python/Ruby localization and use the product name instead

This update for salt fixes the following issues:

• Properly validate eauth credentials and tokens on SSH calls made by Salt API (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846)
• Fix disk.blkid to avoid unexpected keyword argument '__pub_user'. (bsc#1177867)
• Ensure virt.update stop_on_reboot is updated with its default value.
• Do not break package building for systemd OSes.
• Drop wrong mock from chroot unit test.
• Support systemd versions with dot. (bsc#1176294)
• Fix for grains.test_core unit test.
• Fix file/directory user and group ownership containing UTF-8 characters. (bsc#1176024)
• Several changes to virtualization:
  • Fix virt update when cpu and memory are changed.
  • Memory Tuning GSoC.
  • Properly fix memory setting regression in virt.update.
  • Expose libvirt on_reboot in virt states.
• Support transactional systems (MicroOS).
• zypperpkg module ignores retcode 104 for search(). (bsc#1159670)
• Xen disk fixes. No longer generates volumes for Xen disks, but the corresponding file or block disk. (bsc#1175987)
• Invalidate file list cache when cache file modified time is in the future. (bsc#1176397)
• Prevent import errors when running test_btrfs unit tests.

This update for salt fixes the following issues:

• Fix for CVE-2020-25592 (bsc#1178319), CVE-2020-16846, (bsc#1178361), and CVE-2020-17490 (bsc#1178362).

This update fixes the following issues:

bind-formula:

• Temporarily disable dnssec-validation as hotfix for bsc#1177790

grafana-formula:

• Use variable for product name
• Add HA/SAP dashboards
• Add support for system groups in Client Systems dashboard

image-sync-formula:

• Do not use .gz suffix for default initrd symlink
• Keep the old symlink 'initrd.gz' for compatibility

prometheus-exporters-formula:

• Fix empty directory values initialization
• Add systemd collector as default for node_exporters since otherwise some SAP/HA grafana dashboards will be empty
• Disable reverse proxy on default

prometheus-formula:

• Disable Alertmanager clustering (bsc#1178145)
• Use variable for product name

pxe-formula:

• Change default to 'initrd' without .gz suffix

py26-compat-salt:

• Properly validate eauth credentials and tokens on SSH calls made by Salt API (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846)

python-susemanager-retail:

• Use name 'initrd' without .gz suffix

salt-netapi-client:

• Version 0.18.0 See: https://github.com/SUSE/salt-netapi-client/releases/tag/v0.18.0

saltboot-formula:

• Allow setting terminal kernel parameters in saltboot formula

spacecmd:

• Python3 fixes for errata in spacecmd (bsc#1169664)
• Added support for i18n of user-facing strings
• Python3 fix for sorted usage (bsc#1167907)

spacewalk-admin:

• Show info message when applying schema upgrade

spacewalk-backend:

• Prevent IntegrityError during mgr-inter-sync execution (bsc#1177235)

spacewalk-branding:

• Enable to switch to multiple webUI theme

spacewalk-client-tools:

• Remove RH references in Python/Ruby localization and use the product name instead

spacewalk-java:

• Use correct eauth module and credentials for Salt SSH calls (bsc#1178319)
• Remove expiration date from ics files (bsc#1177892)
• Execute Salt SSH actions in parallel (bsc#1173199)
• Enable to switch to multiple webUI theme
• Fix action chain resuming when patches updating salt-minion don't cause service to be restarted (bsc#1144447)
• Renaming autoinstall distro didn't change the name of the Cobbler distro (bsc#1175876)
• Fix the links for downloading the binaries in the package details UI (bsc#1176603)
• Allow nightly ISS sync to also cover custom channels
• Fix: reinspecting a container image (bsc#1177092)
• Add power management xmlrpc api
• Remove hostname from /var/lib/salt/.ssh/known_hosts when deleting system (bsc#1176159)
• Log exception trace on fatal Taskomatic startup error
• Fix max password length check at user creation (bsc#1176765)
• Notify about missing libvirt or hypervisor on virtual host
• Redesign maintenance schedule systems table to use paginated data from server
• Fix SP migration after dry run for cloned channels (bsc#1176307)
• Filter not available optional channels out

spacewalk-search:

• Change default maximum memory to 512 MB, preventing OutOfMemoryError

spacewalk-web:

• Enable to switch to multiple webUI theme
• Only refresh the virtual storage list when pool events are received
• Drop node-fetch to fix CVE-2020-15168
• Notify about missing libvirt or hypervisor on virtual host
• Redesign maintenance schedule systems table to use paginated data from server

susemanager:

• Create bootstrap repo should not flush by default (bsc#1175843)
• Improve detection of base channels for products (bsc#1177478)
• Add LTSS PIDs for SLE12SP1, SLE12SP2, SLE12SP3 and SLE12SP4 to the bootstrap definitions as some packages from LTSS are required (bsc#1177524)
• Fix logrotate config
• Add missing packages to ubuntu20.04 bootstrap data (bsc#1176629)

susemanager-build-keys:

• Replace 'SuSE' user-facing references with 'SUSE'

susemanager-doc-indexes:

• Documented zypper autorefresh feature in Upgrade Guide
• Update SP Migration chapter in Client Configuration Guide
• In Client Configuration and Upgrade Guide, add link to valid autoyast upgrade settings
• Move client upgrade related sections from…

This update for salt fixes the following issues:

• Avoid regression on 'salt-master': set passphrase for salt-ssh keys to empty string (bsc#1178485)
• Properly validate eauth credentials and tokens on SSH calls made by Salt API (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846)
• Fix disk.blkid to avoid unexpected keyword argument '__pub_user'. (bsc#1177867)
• Ensure virt.update stop_on_reboot is updated with its default value.
• Do not break package building for systemd OSes.
• Drop wrong mock from chroot unit test.
• Support systemd versions with dot. (bsc#1176294)
• Fix for grains.test_core unit test.
• Fix file/directory user and group ownership containing UTF-8 characters. (bsc#1176024)
• Several changes to virtualization:
  • Fix virt update when cpu and memory are changed.
  • Memory Tuning GSoC.
  • Properly fix memory setting regression in virt.update.
  • Expose libvirt on_reboot in virt states.
• Support transactional systems (MicroOS).
• zypperpkg module ignores retcode 104 for search(). (bsc#1159670)
• Xen disk fixes. No longer generates volumes for Xen disks, but the corresponding file or block disk. (bsc#1175987)
• Invalidate file list cache when cache file modified time is in the future. (bsc#1176397)
• Prevent import errors when running test_btrfs unit tests

This update fixes the following issues:

salt:

• Avoid regression on 'salt-master': set passphrase for salt-ssh keys to empty string (bsc#1178485)
• Properly validate eauth credentials and tokens on SSH calls made by Salt API (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846)
• Fix disk.blkid to avoid unexpected keyword argument '__pub_user' (bsc#1177867)
• Ensure virt.update stop_on_reboot is updated with its default value
• Do not break package building for systemd OSes
• Drop wrong mock from chroot unit test
• Support systemd versions with dot (bsc#1176294)
• Fix for grains.test_core unit test
• Fix file/directory user and group ownership containing UTF-8 characters (bsc#1176024)
• Several changes to virtualization:
  • Fix virt update when cpu and memory are changed
  • Memory Tuning GSoC
  • Properly fix memory setting regression in virt.update
  • Expose libvirt on_reboot in virt states
• Support transactional systems (MicroOS)
• Zypperpkg module ignores retcode 104 for search() (bsc#1159670)
• Xen disk fixes. No longer generates volumes for Xen disks, but the corresponding file or block disk (bsc#1175987)
• Invalidate file list cache when cache file modified time is in the future (bsc#1176397)
• Prevent import errors when running test_btrfs unit tests

This update fixes the following issues:

salt:

• Fix disk.blkid to avoid unexpected keyword argument '__pub_user' (bsc#1177867)
• Ensure virt.update stop_on_reboot is updated with its default value
• Do not break package building for systemd OSes
• Drop wrong mock from chroot unit test
• Support systemd versions with dot (bsc#1176294)
• Fix for grains.test_core unit test
• Fix file/directory user and group ownership containing UTF-8 characters (bsc#1176024)
• Several changes to virtualization:
  • Fix virt update when cpu and memory are changed
  • Memory Tuning GSoC
  • Properly fix memory setting regression in virt.update
  • Expose libvirt on_reboot in virt states
• Support transactional systems (MicroOS)
• Zypperpkg module ignores retcode 104 for search() (bsc#1159670)
• Xen disk fixes. No longer generates volumes for Xen disks, but the corresponding file or block disk (bsc#1175987)
• Invalidate file list cache when cache file modified time is in the future (bsc#1176397)
• Prevent import errors when running test_btrfs unit tests
• Properly validate eauth credentials and tokens on SSH calls made by Salt API (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846)
• Avoid regression on 'salt-master': set passphrase for salt-ssh keys to empty string (bsc#1178485)

This security update for SUSE Manager 4.0 provides the following fixes:

py26-compat-salt:

• Properly validate eauth credentials and tokens on SSH calls made by Salt API (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846)

spacewalk-java:

• Use correct eauth module and credentials for Salt SSH calls. (bsc#1178319, CVE-2020-25592)

This security update for SUSE Manager 3.2 fixes the following issues:

py26-compat-salt:

• Properly validate eauth credentials and tokens on SSH calls made by Salt API (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846)

spacewalk-java:

• Use correct eauth module and credentials for Salt SSH calls (bsc#1178319, CVE-2020-25592)

This update for salt fixes the following issues:

Update to Salt release version 3002.2 (jsc#ECO-3212, jsc#SLE-18033, jsc#SLE-18028)

• Check if dpkgnotify is executable (bsc#1186674)
• Drop support for Python2. Obsoletes python2-salt package (jsc#SLE-18028)
• virt module updates
  • network: handle missing ipv4 netmask attribute
  • more network support
  • PCI/USB host devices passthrough support
• Set distro requirement to oldest supported version in requirements/base.txt
• Bring missing part of async batch implementation back (bsc#1182382, CVE-2021-25315)
• Always require python3-distro (bsc#1182293)
• Remove deprecated warning that breaks minion execution when 'server_id_use_crc' opts is missing
• Fix pkg states when DEB package has 'all' arch
• Do not force beacons configuration to be a list.
• Remove msgpack < 1.0.0 from base requirements (bsc#1176293)
• msgpack support for version >= 1.0.0 (bsc#1171257)
• Fix issue parsing errors in ansiblegate state module
• Prevent command injection in the snapper module (bsc#1185281, CVE-2021-31607)
• transactional_update: detect recursion in the executor
• Add subpackage salt-transactional-update (jsc#SLE-18033)
• Remove duplicate directories from specfile
• Improvements on 'ansiblegate' module (bsc#1185092):
  • New methods: ansible.targets / ansible.discover_playbooks
• Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
• Regression fix of salt-ssh on processing targets
• Update target fix for salt-ssh and avoiding race condition on salt-ssh event processing (bsc#1179831, bsc#1182281)
• Add notify beacon for Debian/Ubuntu systems
• Fix zmq bug that causes salt-call to freeze (bsc#1181368)

This update for salt fixes the following issues:

Update to Salt release version 3002.2 (jsc#ECO-3212, jsc#SLE-18033, jsc#SLE-18028)

• Check if dpkgnotify is executable (bsc#1186674)
• Drop support for Python2. Obsoletes python2-salt package (jsc#SLE-18028)
• virt module updates
  • network: handle missing ipv4 netmask attribute
  • more network support
  • PCI/USB host devices passthrough support
• Set distro requirement to oldest supported version in requirements/base.txt
• Bring missing part of async batch implementation back (CVE-2021-25315, bsc#1182382)
• Always require python3-distro (bsc#1182293)
• Remove deprecated warning that breaks minion execution when 'server_id_use_crc' opts is missing
• Fix pkg states when DEB package has 'all' arch
• Do not force beacons configuration to be a list.
• Remove msgpack < 1.0.0 from base requirements (bsc#1176293)
• msgpack support for version >= 1.0.0 (bsc#1171257)
• Fix issue parsing errors in ansiblegate state module
• Prevent command injection in the snapper module (bsc#1185281, CVE-2021-31607)
• transactional_update: detect recursion in the executor
• Add subpackage salt-transactional-update (jsc#SLE-18033)
• Improvements on 'ansiblegate' module (bsc#1185092):
  • New methods: ansible.targets / ansible.discover_playbooks
• Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
• Regression fix of salt-ssh on processing targets
• Update target fix for salt-ssh and avoiding race condition on salt-ssh event processing (bsc#1179831, bsc#1182281)
• Add notify beacon for Debian/Ubuntu systems
• Fix zmq bug that causes salt-call to freeze (bsc#1181368)

It was discovered that Salt incorrectly handled crafted web requests. A remote attacker could possibly use this issue to run arbitrary commands. (CVE-2020-16846)

It was discovered that Salt incorrectly created certificates with weak file permissions. (CVE-2020-17490)

It was discovered that Salt incorrectly handled credential validation. A remote attacker could possibly use this issue to bypass authentication. (CVE-2020-25592)

It was discovered that Salt incorrectly handled crafted process names. An attacker could possibly use this issue to run arbitrary commands. This issue only affected Ubuntu 18.04 LTS. (CVE-2020-28243)

It was discovered that Salt incorrectly handled validation of SSL/TLS certificates. A remote attacker could possibly use this issue to spoof a trusted entity. (CVE-2020-28972, CVE-2020-35662)

It was discovered that Salt incorrectly handled credential validation. A remote attacker could possibly use this issue to run arbitrary code. (CVE-2021-25281)

It was discovered that Salt incorrectly handled crafted paths. A remote attacker could possibly use this issue to perform directory traversal. (CVE-2021-25282)

It was discovered that Salt incorrectly handled template rendering. A remote attacker could possibly this issue to run arbitrary code. (CVE-2021-25283)

It was discovered that Salt incorrectly handled logging. An attacker could possibly use this issue to discover credentials. This issue only affected Ubuntu 18.04 LTS. (CVE-2021-25284)

It was discovered that Salt incorrectly handled crafted web requests. A remote attacker could possibly use this issue to run arbitrary commands. This issue only affected Ubuntu 18.04 LTS. (CVE-2021-3148)

It was discovered that Salt incorrectly handled input sanitization. A remote attacker could possibly use this issue to run arbitrary commands. (CVE-2021-3197)