CVE-2022-22941

An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisher_acl, if a user configured in the publisher_acl targets any minion connected to the Syndic, the Salt Master incorrectly interpreted no valid targets as valid, allowing configured users to target any of the minions connected to the syndic with their configured commands. This requires a syndic master combined with publisher_acl configured on the Master-of-Masters, allowing users specified in the publisher_acl to bypass permissions, publishing authorized commands to any configured minion.

An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisher_acl, if a user configured in the publisher_acl targets any minion connected to the Syndic, the Salt Master incorrectly interpreted no valid targets as valid, allowing configured users to target any of the minions connected to the syndic with their configured commands. This requires a syndic master combined with publisher_acl configured on the Master-of-Masters, allowing users specified in the publisher_acl to bypass permissions, publishing authorized commands to any configured minion.

This update for salt fixes the following issues:

• CVE-2022-22935: Sign authentication replies to prevent MiTM (bsc#1197417)
• CVE-2022-22934: Sign pillar data to prevent MiTM attacks. (bsc#1197417)
• CVE-2022-22936: Prevent job and fileserver replays (bsc#1197417)
• CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth. (bsc#1197417)

These are all security issues fixed in the python3-salt-3004-5.1 package on the GA media of openSUSE Tumbleweed.

An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisher_acl, if a user configured in the publisher_acl targets any minion connected to the Syndic, the Salt Master incorrectly interpreted no valid targets as valid, allowing configured users to target any of the minions connected to the syndic with their configured commands. This requires a syndic master combined with publisher_acl configured on the Master-of-Masters, allowing users specified in the publisher_acl to bypass permissions, publishing authorized commands to any configured minion.

This update fixes the following issues:

venv-salt-minion:

• Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
• Fix the regression caused by the patch removing strict requirement for OpenSSL 1.1.1 leading to read/write issues with ssl module for SLE 15, SLE 12, CentOS 7, Debian 9 (bsc#1198556)
• Fix salt-ssh opts poisoning (bsc#1197637)
• Fix multiple security issues (bsc#1197417)
  • CVE-2022-22935: Sign authentication replies to prevent MiTM.
  • CVE-2022-22934: Sign pillar data to prevent MiTM attacks.
  • CVE-2022-22936: Prevent job and fileserver replays.
  • CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth.
• Salt version bump to 3004
• Python version bump to 3.10.2
• Clear network interfaces cache on grains request (bsc#1196050)
• Add salt-ssh with Salt Bundle support (venv-salt-minion) (bsc#1182851, bsc#1196432)
• Restrict 'state.orchestrate_single' to pass a pillar value if it exists (bsc#1194632)

This update fixes the following issues:

venv-salt-minion:

• Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
• Fix the regression caused by the patch removing strict requirement for OpenSSL 1.1.1 leading to read/write issues with ssl module for SLE 15, SLE 12, CentOS 7, Debian 9 (bsc#1198556)
• Fix salt-ssh opts poisoning (bsc#1197637)
• Fix multiple security issues (bsc#1197417)
  • CVE-2022-22935: Sign authentication replies to prevent MiTM.
  • CVE-2022-22934: Sign pillar data to prevent MiTM attacks.
  • CVE-2022-22936: Prevent job and fileserver replays
  • CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth.
• Salt version bump to 3004
• Python version bump to 3.10.2
• Clear network interfaces cache on grains request (bsc#1196050)
• Add salt-ssh with Salt Bundle support (venv-salt-minion) (bsc#1182851, bsc#1196432)
• Restrict 'state.orchestrate_single' to pass a pillar value if it exists (bsc#1194632)

This update fixes the following issues:

salt:

• Clear network interfaces cache on grains request (bsc#1196050)
• Handle old qemu-img not supporting -U parameter (bsc#1195221)
• Restrict 'state.orchestrate_single' to pass a pillar value if it exists (bsc#1194632)
• Fix sparse disk errors on Python 2 (virt module)

This update fixes the following issues:

salt:

• Fix regression preventing bootstrapping new clients caused by redundant dependency on psutil (bsc#1197533)
• Prevent data pollution between actions processed at the same time (bsc#1197637)
• Fix salt-ssh opts poisoning (bsc#1197637)
• Remove duplicated method definitions in salt.netapi
• Clear network interfaces cache on grains request (bsc#1196050)
• Add salt-ssh with Salt Bundle support (venv-salt-minion) (bsc#1182851, bsc#1196432)
• Restrict 'state.orchestrate_single' to pass a pillar value if it exists (bsc#1194632)

This update for salt fixes the following issues:

• Fix regression preventing bootstrapping new clients caused by redundant dependency on psutil (bsc#1197533)
• Prevent data pollution between actions processed at the same time (bsc#1197637)
• Fix salt-ssh opts poisoning (bsc#1197637)
• Clear network interfaces cache on grains request (bsc#1196050)
• Add salt-ssh with Salt Bundle support (venv-salt-minion)
• Fix Salt-API failure due to an exception from the scheduled SSH-Push Tasks (bsc#1182851, bsc#1196432)
• Restrict 'state.orchestrate_single' to pass a pillar value if it exists (bsc#1194632)

This update for salt fixes the following issues:

• Fix regression preventing bootstrapping new clients caused by redundant dependency on psutil (bsc#1197533)
• Prevent data pollution between actions processed at the same time (bsc#1197637)
• Fix salt-ssh opts poisoning. (bsc#1197637)
• Clear network interfaces cache on grains request. (bsc#1196050)
• Fix Salt-API failure due to an exception from the scheduled SSH-Push Tasks. (bsc#1182851, bsc#1196432)
• Restrict 'state.orchestrate_single' to pass a pillar value if it exists. (bsc#1194632)

This update for salt fixes the following issues:

• Fix regression preventing bootstrapping new clients caused by redundant dependency on psutil (bsc#1197533)
• Prevent data pollution between actions processed at the same time (bsc#1197637)
• Fix salt-ssh opts poisoning (bsc#1197637)
• Clear network interfaces cache on grains request (bsc#1196050)
• Add salt-ssh with Salt Bundle support (venv-salt-minion)
• Fix Salt-API failure due to an exception from the scheduled SSH-Push Tasks (bsc#1182851, bsc#1196432)
• Restrict 'state.orchestrate_single' to pass a pillar value if it exists (bsc#1194632)

This update for SUSE Manager 4.1.14.1 Release Notes provides the following additions:

Release notes for SUSE Manager:

• Update to 4.1.14.1
  • CVEs fixed CVE-2022-22934, CVE-2022-22935, CVE-2022-22936, CVE-2022-22941
  • Bugs mentioned bsc#1197417

This update for SUSE Manager 4.2.5.1 Release Notes provides the following additions:

Release notes for SUSE Manager:

• Update to 4.2.5.1
  • CVEs fixed CVE-2022-22934, CVE-2022-22935, CVE-2022-22936, CVE-2022-22941
  • Bugs mentioned bsc#1197417

This update for salt fixes the following issues:

• CVE-2022-22935: Sign authentication replies to prevent MiTM (bsc#1197417)
• CVE-2022-22934: Sign pillar data to prevent MiTM attacks. (bsc#1197417)
• CVE-2022-22936: Prevent job and fileserver replays (bsc#1197417)
• CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth. (bsc#1197417)

This update for salt fixes the following issues:

• CVE-2022-22935: Sign authentication replies to prevent MiTM (bsc#1197417)
• CVE-2022-22934: Sign pillar data to prevent MiTM attacks. (bsc#1197417)
• CVE-2022-22936: Prevent job and fileserver replays (bsc#1197417)
• CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth. (bsc#1197417)

This update for salt fixes the following issues:

• CVE-2022-22935: Sign authentication replies to prevent MiTM (bsc#1197417)
• CVE-2022-22934: Sign pillar data to prevent MiTM attacks. (bsc#1197417)
• CVE-2022-22936: Prevent job and fileserver replays (bsc#1197417)
• CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth. (bsc#1197417)

This update for salt fixes the following issues:

• CVE-2022-22935: Sign authentication replies to prevent MiTM (bsc#1197417)
• CVE-2022-22934: Sign pillar data to prevent MiTM attacks. (bsc#1197417)
• CVE-2022-22936: Prevent job and fileserver replays (bsc#1197417)
• CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth. (bsc#1197417)

This update for salt fixes the following issues:

• CVE-2022-22935: Sign authentication replies to prevent MiTM (bsc#1197417)
• CVE-2022-22934: Sign pillar data to prevent MiTM attacks. (bsc#1197417)
• CVE-2022-22936: Prevent job and fileserver replays (bsc#1197417)
• CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth. (bsc#1197417)

This update fixes the following issues:

venv-salt-minion:

• Fix the regression caused by the patch removing strict requirement for OpenSSL 1.1.1 leading to read/write issues with ssl module for SLE 15, SLE 12, CentOS 7, Debian 9 (bsc#1198556)
• Fixes for Python 3.10
• Fix salt-ssh opts poisoning (bsc#1197637)
• Fix multiple security issues (bsc#1197417)
  • CVE-2022-22935: Sign authentication replies to prevent MiTM.
  • CVE-2022-22934: Sign pillar data to prevent MiTM attacks.
  • CVE-2022-22936: Prevent job and fileserver replays.
  • CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth.
• Salt version bump to 3004
• Python version bump to 3.10.2

This update fixes the following issues:

golang-github-prometheus-alertmanager:

• CVE-2022-21698: Update vendor tarball with prometheus/client_golang 1.11.1 (bsc#1196338, jsc#SLE-24077)
• Update to version 0.23.0:
  • amtool: Detect version drift and warn users (#2672)
  • Add ability to skip TLS verification for amtool (#2663)
  • Fix empty isEqual in amtool. (#2668)
  • Fix main tests (#2670)
  • cli: add new template render command (#2538)
  • OpsGenie: refer to alert instead of incident (#2609)
  • Docs: target_match and source_match are DEPRECATED (#2665)
  • Fix test not waiting for cluster member to be ready
• Added hardening to systemd service(s) (bsc#1181400). Modified: prometheus-alertmanager.service

golang-github-prometheus-node_exporter:

• CVE-2022-21698: Update vendor tarball with prometheus/client_golang 1.11.1 (bsc#1196338, jsc#SLE-24238, jsc#SLE-24239)
• Update to 1.3.0
  • [CHANGE] Add path label to rapl collector #2146
  • [CHANGE] Exclude filesystems under /run/credentials #2157
  • [CHANGE] Add TCPTimeouts to netstat default filter #2189
  • [FEATURE] Add lnstat collector for metrics from /proc/net/stat/ #1771
  • [FEATURE] Add darwin powersupply collector #1777
  • [FEATURE] Add support for monitoring GPUs on Linux #1998
  • [FEATURE] Add Darwin thermal collector #2032
  • [FEATURE] Add os release collector #2094
  • [FEATURE] Add netdev.address-info collector #2105
  • [FEATURE] Add clocksource metrics to time collector #2197
  • [ENHANCEMENT] Support glob textfile collector directories #1985
  • [ENHANCEMENT] ethtool: Expose node_ethtool_info metric #2080
  • [ENHANCEMENT] Use include/exclude flags for ethtool filtering #2165
  • [ENHANCEMENT] Add flag to disable guest CPU metrics #2123
  • [ENHANCEMENT] Add DMI collector #2131
  • [ENHANCEMENT] Add threads metrics to processes collector #2164
  • [ENHANCMMENT] Reduce timer GC delays in the Linux filesystem collector #2169
  • [ENHANCMMENT] Add TCPTimeouts to netstat default filter #2189
  • [ENHANCMMENT] Use SysctlTimeval for boottime collector on BSD #2208
  • [BUGFIX] ethtool: Sanitize metric names #2093
  • [BUGFIX] Fix ethtool collector for multiple interfaces #2126
  • [BUGFIX] Fix possible panic on macOS #2133
  • [BUGFIX] Collect flag_info and bug_info only for one core #2156
  • [BUGFIX] Prevent duplicate ethtool metric names #2187
• Update to 1.2.2
  • Bug fixes Fix processes collector long int parsing #2112
• Update to 1.2.1
  • Removed Remove obsolete capture permission denied error patch capture-permission-denied-error-energy_uj.patch: Already included upstream Fix zoneinfo parsing prometheus/procfs#386 Fix nvme collector log noise #2091 Fix rapl collector log noise #2092
• Update to 1.2.0
  • Changes Rename filesystem collector flags to match other collectors #2012 Make node_exporter print usage to STDOUT #203
  • Features Add conntrack statistics metrics #1155 Add ethtool stats collector #1832 Add flag to ignore network speed if it is unknown #1989 Add tapestats collector for Linux #2044 Add nvme collector #2062
  • Enhancements Add ErrorLog plumbing to promhttp #1887 Add more Infiniband counters #2019 netclass: retrieve interface names and filter before parsing #2033 Add time zone offset metric #2060 Handle errors from disabled PSI subsystem #1983 Fix panic when using backwards compatible flags #2000 Fix wrong value for OpenBSD memory buffer cache #2015 Only initiate collectors once #2048 Handle small backwards jumps in CPU idle #2067
• Apply patch to capture permission denied error for 'energy_uj' file (bsc#1190535)

golang-github-prometheus-prometheus:

• Build firewalld-prometheus-config only for SUSE Linux Enterprise 15, 15.1 and 15.2, and require firewalld for it
• Firewalld-prometheus-config needs to be a Recommends, not a Requires, as prometheus does not require it to run
• Create firewalld-prometheus-config…

This update fixes the following issues:

venv-salt-minion:

• Fix the regression caused by the patch removing strict requirement for OpenSSL 1.1.1 leading to read/write issues with ssl module for SLE 15, SLE 12, CentOS 7, Debian 9 (bsc#1198556)
• Fixes for Python 3.10
• Fix salt-ssh opts poisoning (bsc#1197637)
• Fix multiple security issues (bsc#1197417)
  • CVE-2022-22935: Sign authentication replies to prevent MiTM
  • CVE-2022-22934: Sign pillar data to prevent MiTM attacks.
  • CVE-2022-22936: Prevent job and fileserver replays.
  • CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth.
• Salt version bump to 3004
• Python version bump to 3.10.2
• CVE-2022-24302: unauthorized information disclosure for python-paramiko.
• CVE-2021-28957: XSS due to missing input sanitization in python-lxml.
• CVE-2018-19787: XSS attacks due to missing URLs sanitization in python-lxml.
• Security Fix: (bsc#1196249, bsc#1196877, CVE-2022-0778)
  • Allow CRYPTO_THREADID_set_callback to be called with NULL parameter
  • Infinite loop in BN_mod_sqrt() reachable when parsing certificates

This update fixes the following issues:

golang-github-prometheus-alertmanager:

• CVE-2022-21698: Denial of service using InstrumentHandlerCounter
  • Update vendor tarball with prometheus/client_golang 1.11.1 (bsc#1196338, jsc#SLE-24077)
• Update to version 0.23.0:
  • amtool: Detect version drift and warn users (#2672)
  • Add ability to skip TLS verification for amtool (#2663)
  • Fix empty isEqual in amtool. (#2668)
  • Fix main tests (#2670)
  • cli: add new template render command (#2538)
  • OpsGenie: refer to alert instead of incident (#2609)
  • Docs: target_match and source_match are DEPRECATED (#2665)
  • Fix test not waiting for cluster member to be ready
• Added hardening to systemd service(s) (bsc#1181400).

golang-github-prometheus-prometheus:

• Build firewalld-prometheus-config only for SUSE Linux Enterprise 15, 15.1 and 15.2, and require firewalld for it
• Firewalld-prometheus-config needs to be a Recommends, not a Requires, as prometheus does not require it to run
• Create firewalld-prometheus-config subpackage (bsc#1197042)
• CVE-2022-21698: Denial of service using InstrumentHandlerCounter.
  • Update vendor tarball with prometheus/client_golang 1.12.1 (bsc#1196338)

mgr-cfg:

• Version 4.3.6-1
  • Fix the condition for preventing building python 2 subpackage for SLE15 (bsc#1197579)

mgr-osad:

• Version 4.3.6-1
  • Fix the condition for preventing building python 2 subpackage for SLE15

mgr-push:

• Version 4.3.4-1
  • Fix the condition for preventing building python 2 subpackage for SLE15

mgr-virtualization:

• Version 4.3.5-1
  • Fix the condition for preventing building python 2 subpackage for SLE15

rhnlib:

• Version 4.3.4-1
  • Fix the condition for preventing building python 2 subpackage for SLE15

salt:

• Prevent data pollution between actions proceesed at the same time (bsc#1197637)
• Fix regression preventing bootstrapping new clients caused by redundant dependency on psutil (bsc#1197533)
• Fixes for Python 3.10
• Fix salt-ssh opts poisoning (bsc#1197637)
• Fix multiple security issues for salt (bsc#1197417):
  • CVE-2022-22935: Sign authentication replies to prevent MiTM.
  • CVE-2022-22934: Sign pillar data to prevent MiTM attacks.
  • CVE-2022-22936: Prevent job and fileserver replays.
  • CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth.

spacecmd:

• Version 4.3.10-1
  • parse boolean parameters correctly (bsc#1197689)
  • Add parameter to set containerized proxy SSH port

spacewalk-client-tools:

• Version 4.3.9-1
  • Fix the condition for preventing building python 2 subpackage for SLE15

spacewalk-koan:

• Version 4.3.5-1
  • Fix the condition for preventing building python 2 subpackage for SLE15

spacewalk-oscap:

• Version 4.3.5-1
  • Fix the condition for preventing building python 2 subpackage for SLE15

suseRegisterInfo:

• Version 4.3.3-1
  • Fix the condition for preventing building python 2 subpackage for SLE15

uyuni-common-libs:

• Version 4.3.4-1
  • implement more decompression algorithms for reposync (bsc#1196704)

uyuni-proxy-systemd-services:

• Version 4.3.2-1
  • Harmonize systemd services names and container names
  • Adapted to work on Enterprise Linux.
  • Add package to SLE and Client tools (jsc#SLE-24145)