CVE-2021-44215

Northern.tech CFEngine Enterprise 3.15.4 before 3.15.5 has Insecure Permissions that may allow unauthorized local users to have an unspecified impact.

Northern.tech CFEngine Enterprise 3.15.4 before 3.15.5 has Insecure Permissions that may allow unauthorized local users to have an unspecified impact.

Northern.tech CFEngine Enterprise 3.15.4 before 3.15.5 has Insecure Permissions that may allow unauthorized local users to have an unspecified impact.

Northern.tech CFEngine Enterprise 3.15.4 before 3.15.5 has Insecure Permissions that may allow unauthorized local users to have an unspecified impact.

Northern.tech CFEngine Enterprise 3.15.4 before 3.15.5 has Insecure Permissions that may allow unauthorized local users to have an unspecified impact.

This update for cfengine, cfengine-masterfiles fixes the following issues:

Changes in cfengine:

• cfengine3.target: removed, replaced by upstream cfengine3.service
• In version 3.15.0, cfengine core split off libutils and libcompat directories as libntech. We include both together as we do not use or plan on using it outside of cfengine.

Changes since 3.7.3 are below, in reverse chronological order:

• Update to version 3.21.0: (jsc#SLE-24222, bsc#1197029, CVE-2021-44215)

  • Added cf-support utility for generating support information (ENT-9037)
  • Adjusted cf-check and package module code for empty updates list (ENT-9050)
  • '$(this.promiser)' can now be used in 'files' promise attributes 'if', 'ifvarclass' and 'unless' (CFE-2262, ENT-7008)
  • Fixed storage promise for nfs on MacOS (CFE-4093)
  • Fixed definition of _low_ldt class from cf-monitord (CFE-4022)
  • Insertion of contents of a file with blank lines into another file with blank lines no longer results in mixed content (ENT-8788)
  • Added suggestion to use a negative lookahead when non-convergent edits are attempted (CFE-192)
  • Unresolved function calls that return scalar values are now considered OK for constraints expecting strings during syntax check (CFE-4094)
  • cf-monitord now honors monitorfacility in body monitor control (ENT-4492)
  • cf-serverd now periodically reloads its policy if it contains unresolved variables (e.g. $(sys.policy_hub) in 'allowconnect'). (ENT-8456)
  • cf-serverd now starts in the network-online.target on systemd-based systems (ENT-8456)
  • edit_line bundles can now use the new $(edit.empty_before_use) variable mirroring the value of edit_defaults=>empty_before_use of the related files promise (ENT-5866)
  • Package modules with unresolved variables in their names are now skipped in package queries (ENT-9377)
  • Removed unsupported name_connect capability for udp_socket class (ENT-8824)
  • 'meta' attribute can now be used in custom promises (CFE-3440)
  • Custom promise modules can now support the 'action_policy' feature allowing promises of their custom types to be used in dry-run and simulation modes and in combination with 'action_policy => 'warn''. (CFE-3433)
  • Use of custom promise modules that don't fully specify protocol now results in warning (CFE-3433)
  • Warnings are logged if levels of log messages from custom promise modules don't match results of their related promises (CFE-3433)
  • Adjusted SELinux policy for RHEL 9 (ENT-8824)
  • Fixed SELinux policy to allow hub to send emails (ENT-9557, ENT-9473)
  • SELinux no longer breaks SQL queries with large result sets on RHEL 8 hubs (ENT-9496)
  • Added SELinux LDAP port access for Mission Portal (ENT-9694)
  • Allowed ciphers are now properly split into TLS 1.3 cipher suites and ciphers used for TLS 1.2 and older (ENT-9018)
  • Fixed git_cfbs_deploy_refspec in masterfiles_stage leaving temp dir

• Update to version 3.20.0:

  • 'rxdirs' now defaults to 'false'. This means that the read permission bit no longer implies execute bit for directories, by default. Permission bits will be exactly as specified. To restore the old behavior you can still enable 'rxdirs' explicitly. (CFE-951)
  • 'N' or 'Ns' signal specs can now be used to sleep between signals sent by 'processes' promises (CFE-2207, ENT-5899)
  • Directories named .no-distrib are no longer copied from policy server (in bootstrap/failsafe) (ENT-8079)
  • Files promises using content attribute or template method now create files by default unless create => 'false' is specified. (CFE-3955, CFE-3916)
  • template_method mustache and inline_mustache now create file in promiser, if template rendering was successfull and file does not exist. (ENT-4792)
  • Added support for use of custom bodies in custom promise types (CFE-3574)
  • Custom promise modules now never get promise…