CVE-2024-22232

A specially crafted url can be created which leads to a directory traversal in the salt file server. A malicious user can read an arbitrary file from a Salt master’s filesystem.

A specially crafted url can be created which leads to a directory traversal in the salt file server. A malicious user can read an arbitrary file from a Salt master’s filesystem.

These are all security issues fixed in the python3-salt-3006.0-7.1 package on the GA media of openSUSE Tumbleweed.

This update fixes the following issues:

venv-salt-minion:

• CVE-2024-22231: Prevent directory traversal when creating syndic cache directory on the master (bsc#1219430)
• CVE-2024-22232: Prevent directory traversal attacks in the master's serve_file method (bsc#1219431)
• Convert oscap output to UTF-8
• Make Salt compatible with Python 3.11
• Ignore non-ascii chars in oscap output (bsc#1219001)
• Fix detected issues in Salt tests when running on VMs
• Make importing seco.range thread safe (bsc#1211649)
• Fix problematic tests and allow smooth tests executions on containers
• Discover Ansible playbook files as '.yml' or '.yaml' files (bsc#1211888)
• Prevent exceptions with fileserver.update when called via state (bsc#1218482)
• Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850)
• Fixed KeyError in logs when running a state that fails

This update for salt fixes the following issues:

Security issues fixed:

• CVE-2024-22231: Prevent directory traversal when creating syndic cache directory on the master (bsc#1219430)
• CVE-2024-22232: Prevent directory traversal attacks in the master's serve_file method (bsc#1219431)

Bugs fixed:

• Ensure that pillar refresh loads beacons from pillar without restart
• Fix the aptpkg.py unit test failure
• Prefer unittest.mock to python-mock in test suite
• Enable 'KeepAlive' probes for Salt SSH executions (bsc#1211649)
• Revert changes to set Salt configured user early in the stack (bsc#1216284)
• Align behavior of some modules when using salt-call via symlink (bsc#1215963)
• Fix gitfs 'env' and improve cache cleaning (bsc#1193948)
• Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed

This update for salt fixes the following issues:

Security issues fixed:

• CVE-2024-22231: Prevent directory traversal when creating syndic cache directory on the master (bsc#1219430)
• CVE-2024-22232: Prevent directory traversal attacks in the master's serve_file method (bsc#1219431)

Bugs fixed:

• Ensure that pillar refresh loads beacons from pillar without restart
• Fix the aptpkg.py unit test failure
• Prefer unittest.mock to python-mock in test suite
• Enable 'KeepAlive' probes for Salt SSH executions (bsc#1211649)
• Revert changes to set Salt configured user early in the stack (bsc#1216284)
• Align behavior of some modules when using salt-call via symlink (bsc#1215963)
• Fix gitfs 'env' and improve cache cleaning (bsc#1193948)
• Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed

This update for salt fixes the following issues:

Security issues fixed:

• CVE-2024-22231: Prevent directory traversal when creating syndic cache directory on the master (bsc#1219430)
• CVE-2024-22232: Prevent directory traversal attacks in the master's serve_file method (bsc#1219431)

Bugs fixed:

• Ensure that pillar refresh loads beacons from pillar without restart
• Fix the aptpkg.py unit test failure
• Prefer unittest.mock to python-mock in test suite
• Enable 'KeepAlive' probes for Salt SSH executions (bsc#1211649)
• Revert changes to set Salt configured user early in the stack (bsc#1216284)
• Align behavior of some modules when using salt-call via symlink (bsc#1215963)
• Fix gitfs 'env' and improve cache cleaning (bsc#1193948)
• Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed

This update for salt fixes the following issues:

Security issues fixed:

• CVE-2024-22231: Prevent directory traversal when creating syndic cache directory on the master (bsc#1219430)
• CVE-2024-22232: Prevent directory traversal attacks in the master's serve_file method (bsc#1219431)

Bugs fixed:

• Ensure that pillar refresh loads beacons from pillar without restart
• Fix the aptpkg.py unit test failure
• Prefer unittest.mock to python-mock in test suite
• Enable 'KeepAlive' probes for Salt SSH executions (bsc#1211649)
• Revert changes to set Salt configured user early in the stack (bsc#1216284)
• Align behavior of some modules when using salt-call via symlink (bsc#1215963)
• Fix gitfs 'env' and improve cache cleaning (bsc#1193948)
• Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed

This update for salt fixes the following issues:

Security issues fixed:

• CVE-2024-22231: Prevent directory traversal when creating syndic cache directory on the master (bsc#1219430)
• CVE-2024-22232: Prevent directory traversal attacks in the master's serve_file method (bsc#1219431)

Bugs fixed:

• Ensure that pillar refresh loads beacons from pillar without restart
• Fix the aptpkg.py unit test failure
• Prefer unittest.mock to python-mock in test suite
• Enable 'KeepAlive' probes for Salt SSH executions (bsc#1211649)
• Revert changes to set Salt configured user early in the stack (bsc#1216284)
• Align behavior of some modules when using salt-call via symlink (bsc#1215963)
• Fix gitfs 'env' and improve cache cleaning (bsc#1193948)
• Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed

This update fixes the following issues:

release-notes-susemanager:

• Update to SUSE Manager 4.3.11
  • Migrate from RHEL and its clones to SUSE Liberty Linux
  • Reboot required indication for non-SUSE distributions
  • SSH key rotation for enhanced security
  • Configure remote command execution
  • End of Debian 10 support
  • CVEs fixed: CVE-2023-32189, CVE-2024-22231, CVE-2024-22232
  • Bugs mentioned:
    bsc#1170848, bsc#1210911, bsc#1211254, bsc#1211560, bsc#1211912 bsc#1213079, bsc#1213507, bsc#1213738, bsc#1213981, bsc#1214077 bsc#1214791, bsc#1215166, bsc#1215514, bsc#1215769, bsc#1215810 bsc#1215813, bsc#1215982, bsc#1216114, bsc#1216394, bsc#1216437 bsc#1216550, bsc#1216657, bsc#1216753, bsc#1216781, bsc#1216988 bsc#1217069, bsc#1217209, bsc#1217588, bsc#1217784, bsc#1217869 bsc#1218019, bsc#1218074, bsc#1218075, bsc#1218089, bsc#1218094 bsc#1218490, bsc#1218615, bsc#1218669, bsc#1218849, bsc#1219577 bsc#1219850, bsc#1218146

This update fixes the following issues:

venv-salt-minion:

• Security issues fixed:

  • CVE-2024-22231: Prevent directory traversal when creating syndic cache directory on the master (bsc#1219430)
  • CVE-2024-22232: Prevent directory traversal attacks in the master's serve_file method (bsc#1219431)

• Bugs fixed:

  • Convert oscap output to UTF-8
  • Make Salt compatible with Python 3.11
  • Ignore non-ascii chars in oscap output (bsc#1219001)
  • Fix detected issues in Salt tests when running on VMs
  • Make importing seco.range thread safe (bsc#1211649)
  • Fix problematic tests and allow smooth tests executions on containers
  • Discover Ansible playbook files as '.yml' or '.yaml' files (bsc#1211888)
  • Prevent exceptions with fileserver.update when called via state (bsc#1218482)
  • Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850)
  • Fixed KeyError in logs when running a state that fails

This update fixes the following issues:

venv-salt-minion:

• Security issues fixed:

  • CVE-2024-22231: Prevent directory traversal when creating syndic cache directory on the master (bsc#1219430)
  • CVE-2024-22232: Prevent directory traversal attacks in the master's serve_file method (bsc#1219431)

• Bugs fixed:

  • Convert oscap output to UTF-8
  • Make Salt compatible with Python 3.11
  • Ignore non-ascii chars in oscap output (bsc#1219001)
  • Fix detected issues in Salt tests when running on VMs
  • Make importing seco.range thread safe (bsc#1211649)
  • Fix problematic tests and allow smooth tests executions on containers
  • Discover Ansible playbook files as '.yml' or '.yaml' files (bsc#1211888)
  • Prevent exceptions with fileserver.update when called via state (bsc#1218482)
  • Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850)
  • Fixed KeyError in logs when running a state that fails

This update fixes the following issues:

venv-salt-minion:

• CVE-2024-22231: Prevent directory traversal when creating syndic cache directory on the master (bsc#1219430)
• CVE-2024-22232: Prevent directory traversal attacks in the master's serve_file method (bsc#1219431)
• Convert oscap output to UTF-8
• Make Salt compatible with Python 3.11
• Ignore non-ascii chars in oscap output (bsc#1219001)
• Fix detected issues in Salt tests when running on VMs
• Make importing seco.range thread safe (bsc#1211649)
• Fix problematic tests and allow smooth tests executions on containers
• Discover Ansible playbook files as '.yml' or '.yaml' files (bsc#1211888)
• Prevent exceptions with fileserver.update when called via state (bsc#1218482)
• Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850)
• Fixed KeyError in logs when running a state that fails