CVE-2023-20897

Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted.

Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted.

These are all security issues fixed in the python3-salt-3006.0-4.1 package on the GA media of openSUSE Tumbleweed.

This update fixes the following issues:

venv-salt-minion:

• Security issues fixed:
  • CVE-2023-20897: Do not fail on bad message pack message (bsc#1213441)
  • CVE-2023-20898: Fixed Git Providers can read from the wrong environment because they get the same cache directory base name. (bsc#1214797, bsc#1193948)
• Bugs fixed:
  • Revert usage of long running REQ channel to prevent possible missing responses on requests and duplicated responses (bsc#1213960, bsc#1213630, bsc#1213257)
  • Create minion_id with reproducible mtime
  • Do not recompile SELinux policy module on building. Use precompiled module instead to avoid incompatibility errors.
  • Fix broken tests to make them running in the testsuite
  • Fix detection of Salt codename by 'salt_version' execution module
  • Fix inconsistency in reported version by egg-info metadata (bsc#1215489)
  • Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844)
  • Fix the regression of user.present state when group is unset (bsc#1212855)
  • Fix utf8 handling in 'pass' renderer and make it more robust
  • Fix zypper repositories always being reconfigured
  • Make sure configured user is properly set by Salt (bsc#1210994)
  • Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794)
  • Ship SELinux policy module version 19 to make it compatible with broader list of Linux distributions

This update for salt fixes the following issues:

Security issues fixed:

• CVE-2023-20897: Fixed DOS in minion return. (bsc#1214796, bsc#1213441)
• CVE-2023-20898: Fixed Git Providers can read from the wrong environment because they get the same cache directory base name. (bsc#1214797, bsc#1193948)

Bugs fixed:

• Create minion_id with reproducible mtime
• Fix broken tests to make them running in the testsuite
• Fix detection of Salt codename by 'salt_version' execution module
• Fix inconsistency in reported version by egg-info metadata (bsc#1215489)
• Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844)
• Fix the regression of user.present state when group is unset (bsc#1212855)
• Fix utf8 handling in 'pass' renderer and make it more robust
• Fix zypper repositories always being reconfigured
• Make sure configured user is properly set by Salt (bsc#1210994)
• Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794)
• Revert usage of long running REQ channel to prevent possible missing responses on requests and duplicated responses (bsc#1213960, bsc#1213630, bsc#1213257)

This update for salt fixes the following issues:

Security issues fixed:

• CVE-2023-20897: Fixed DOS in minion return. (bsc#1214796, bsc#1213441)
• CVE-2023-20898: Fixed Git Providers can read from the wrong environment because they get the same cache directory base name. (bsc#1214797, bsc#1193948)

Bugs fixed:

• Create minion_id with reproducible mtime
• Fix broken tests to make them running in the testsuite
• Fix detection of Salt codename by 'salt_version' execution module
• Fix inconsistency in reported version by egg-info metadata (bsc#1215489)
• Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844)
• Fix the regression of user.present state when group is unset (bsc#1212855)
• Fix utf8 handling in 'pass' renderer and make it more robust
• Fix zypper repositories always being reconfigured
• Make sure configured user is properly set by Salt (bsc#1210994)
• Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794)
• Revert usage of long running REQ channel to prevent possible missing responses on requests and duplicated responses (bsc#1213960, bsc#1213630, bsc#1213257)

This update for salt fixes the following issues:

Security issues fixed:

• CVE-2023-20897: Fixed DOS in minion return. (bsc#1214796, bsc#1213441)
• CVE-2023-20898: Fixed Git Providers can read from the wrong environment because they get the same cache directory base name. (bsc#1214797, bsc#1193948)

Bugs fixed:

• Create minion_id with reproducible mtime
• Fix broken tests to make them running in the testsuite
• Fix detection of Salt codename by 'salt_version' execution module
• Fix inconsistency in reported version by egg-info metadata (bsc#1215489)
• Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844)
• Fix the regression of user.present state when group is unset (bsc#1212855)
• Fix utf8 handling in 'pass' renderer and make it more robust
• Fix zypper repositories always being reconfigured
• Make sure configured user is properly set by Salt (bsc#1210994)
• Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794)
• Revert usage of long running REQ channel to prevent possible missing responses on requests and duplicated responses (bsc#1213960, bsc#1213630, bsc#1213257)

This update for salt fixes the following issues:

Security issues fixed:

• CVE-2023-20897: Fixed DOS in minion return. (bsc#1214796, bsc#1213441)
• CVE-2023-20898: Fixed Git Providers can read from the wrong environment because they get the same cache directory base name. (bsc#1214797, bsc#1193948)

Bugs fixed:

• Create minion_id with reproducible mtime
• Fix broken tests to make them running in the testsuite
• Fix detection of Salt codename by 'salt_version' execution module
• Fix inconsistency in reported version by egg-info metadata (bsc#1215489)
• Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844)
• Fix the regression of user.present state when group is unset (bsc#1212855)
• Fix utf8 handling in 'pass' renderer and make it more robust
• Fix zypper repositories always being reconfigured
• Make sure configured user is properly set by Salt (bsc#1210994)
• Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794)
• Revert usage of long running REQ channel to prevent possible missing responses on requests and duplicated responses (bsc#1213960, bsc#1213630, bsc#1213257)

This update for salt fixes the following issues:

Security issues fixed:

• CVE-2023-20897: Fixed DOS in minion return. (bsc#1214796, bsc#1213441)
• CVE-2023-20898: Fixed Git Providers can read from the wrong environment because they get the same cache directory base name. (bsc#1214797, bsc#1193948)

Bugs fixed:

• Create minion_id with reproducible mtime
• Fix broken tests to make them running in the testsuite
• Fix detection of Salt codename by 'salt_version' execution module
• Fix inconsistency in reported version by egg-info metadata (bsc#1215489)
• Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844)
• Fix the regression of user.present state when group is unset (bsc#1212855)
• Fix utf8 handling in 'pass' renderer and make it more robust
• Fix zypper repositories always being reconfigured
• Make sure configured user is properly set by Salt (bsc#1210994)
• Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794)
• Revert usage of long running REQ channel to prevent possible missing responses on requests and duplicated responses (bsc#1213960, bsc#1213630, bsc#1213257)

This update fixes the following issues:

venv-salt-minion:

• Security issues fixed:
  • CVE-2023-20897: Do not fail on bad message pack message (bsc#1213441)
  • CVE-2023-20898: Fixed Git Providers can read from the wrong environment because they get the same cache directory base name. (bsc#1214797, bsc#1193948)
• Bugs fixed:
  • Revert usage of long running REQ channel to prevent possible missing responses on requests and duplicated responses (bsc#1213960, bsc#1213630, bsc#1213257)
  • Create minion_id with reproducible mtime
  • Do not recompile SELinux policy module on building. Use precompiled module instead to avoid incompatibility errors.
  • Fix broken tests to make them running in the testsuite
  • Fix detection of Salt codename by 'salt_version' execution module
  • Fix inconsistency in reported version by egg-info metadata (bsc#1215489)
  • Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844)
  • Fix the regression of user.present state when group is unset (bsc#1212855)
  • Fix utf8 handling in 'pass' renderer and make it more robust
  • Fix zypper repositories always being reconfigured
  • Make sure configured user is properly set by Salt (bsc#1210994)
  • Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794)
  • Ship SELinux policy module version 19 to make it compatible with broader list of Linux distributions

This update fixes the following issues:

venv-salt-minion:

• Security issues fixed:
  • CVE-2023-20897: Do not fail on bad message pack message (bsc#1213441)
  • CVE-2023-20898: Fixed Git Providers can read from the wrong environment because they get the same cache directory base name. (bsc#1214797, bsc#1193948)
• Bugs fixed:
  • Revert usage of long running REQ channel to prevent possible missing responses on requests and duplicated responses (bsc#1213960, bsc#1213630, bsc#1213257)
  • Create minion_id with reproducible mtime
  • Do not recompile SELinux policy module on building. Use precompiled module instead to avoid incompatibility errors.
  • Fix broken tests to make them running in the testsuite
  • Fix detection of Salt codename by 'salt_version' execution module
  • Fix inconsistency in reported version by egg-info metadata (bsc#1215489)
  • Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844)
  • Fix the regression of user.present state when group is unset (bsc#1212855)
  • Fix utf8 handling in 'pass' renderer and make it more robust
  • Fix zypper repositories always being reconfigured
  • Make sure configured user is properly set by Salt (bsc#1210994)
  • Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794)
  • Ship SELinux policy module version 19 to make it compatible with broader list of Linux distributions

This update fixes the following issues:

venv-salt-minion:

• Security issues fixed:
  • CVE-2023-20897: Do not fail on bad message pack message (bsc#1213441)
  • CVE-2023-20898: Fixed Git Providers can read from the wrong environment because they get the same cache directory base name. (bsc#1214797, bsc#1193948)
• Bugs fixed:
  • Revert usage of long running REQ channel to prevent possible missing responses on requests and duplicated responses (bsc#1213960, bsc#1213630, bsc#1213257)
  • Create minion_id with reproducible mtime
  • Do not recompile SELinux policy module on building. Use precompiled module instead to avoid incompatibility errors.
  • Fix broken tests to make them running in the testsuite
  • Fix detection of Salt codename by 'salt_version' execution module
  • Fix inconsistency in reported version by egg-info metadata (bsc#1215489)
  • Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844)
  • Fix the regression of user.present state when group is unset (bsc#1212855)
  • Fix utf8 handling in 'pass' renderer and make it more robust
  • Fix zypper repositories always being reconfigured
  • Make sure configured user is properly set by Salt (bsc#1210994)
  • Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794)
  • Ship SELinux policy module version 19 to make it compatible with broader list of Linux distributions

This update fixes the following issues:

release-notes-susemanager:

• Update to SUSE Manager 4.3.8
  • Important Salt minion update
  • SUSE Manager Pay-as-you-go (PAYG)
  • Automated RHUI credential update
  • Monitoring: Prometheus upgraded to 2.45.0
  • Monitoring: Apache exporter updated to version 1.0.0
  • Expose lastBuildDate property (last build/promote date of an environment) through contentlifecycle API (jsc#SUMA-280)
  • Add saltboot redeploy and repartition based on pillars (jsc#SUMA-158)
  • Security CVE issues fixed: CVE-2023-29409, CVE-2023-20897, CVE-2023-20898
  • Bugs mentioned bsc#1207330, bsc#1208692, bsc#1210935, bsc#1211525, bsc#1211874 bsc#1211884, bsc#1212246, bsc#1212730, bsc#1212814, bsc#1212827 bsc#1212856, bsc#1212943, bsc#1213009, bsc#1213077, bsc#1213288 bsc#1213445, bsc#1213675, bsc#1213716, bsc#1213880, bsc#1214002 bsc#1214121, bsc#1214124, bsc#1214187, bsc#1214266, bsc#1214280 bsc#1214889, bsc#1214982, bsc#1215352, bsc#1215362, bsc#1215497 bsc#1193948, bsc#1214797, bsc#1213441, bsc#1214796, bsc#1213469 bsc#1215413, bsc#1215756