CVE-2020-11651

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.

This update for salt fixes the following issues:

• Fix CVE-2020-11651 and CVE-2020-11652 (bsc#1170595)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for salt contains the following fixes:

• Fix for TypeError in Tornado importer (bsc#1174165)

• Require python3-distro only for TW (bsc#1173072)

• Update to Salt version 3000: See release notes: https://docs.saltstack.com/en/latest/topics/releases/3000.html

• Add docker.logout to docker execution module. (bsc#1165572)

• Add option to enable/disable force refresh for zypper.

• Add publish_batch to ClearFuncs exposed methods.

• Adds test for zypper abbreviation fix.

• Avoid segfault from 'salt-api' under certain conditions of heavy load managing SSH minions. (bsc#1169604)

• Avoid traceback on debug logging for swarm module. (bsc#1172075)

• Batch mode now also correctly provides return value. (bsc#1168340)

• Better import cache handline.

• Do not make file.recurse state to fail when msgpack 0.5.4. (bsc#1167437)

• Do not require vendored backports-abc. (bsc#1170288)

• Fix errors from unit tests due NO_MOCK and NO_MOCK_REASON deprecation.

• Fix for low rpm_lowpkg unit test.

• Fix for temp folder definition in loader unit test.

• Fix for unless requisite when pip is not installed.

• Fix integration test failure for test_mod_del_repo_multiline_values.

• Fix regression in service states with reload argument.

• Fix tornado imports and missing _utils after rebasing patches.

• Fix status attribute issue in aptpkg test.

• Improved storage pool or network handling.

• loop: fix variable names for until_no_eval.

• Make 'salt.ext.tornado.gen' to use 'salt.ext.backports_abc' on Python 2.

• Make setup.py script not to require setuptools greater than 9.1.

• More robust remote port detection.

• Prevent sporious 'salt-api' stuck processes when managing SSH minions. because of logging deadlock. (bsc#1159284)

• Python3.8 compatibility changes.

• Removes unresolved merge conflict in yumpkg module.

• Returns a the list of IPs filtered by the optional network list.

• Revert broken changes to slspath made on Salt 3000 (saltstack/salt#56341). (bsc#1170104)

• Sanitize grains loaded from roster_grains.json cache during 'state.pkg'.

• Various virt backports from 3000.2.

• zypperpkg: filter patterns that start with dot. (bsc#1171906)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for salt fixes the following issues:

Update to Salt release version 3002.2 (jsc#ECO-3212, jsc#SLE-18033, jsc#SLE-18028)

• Check if dpkgnotify is executable (bsc#1186674)
• Drop support for Python2. Obsoletes python2-salt package (jsc#SLE-18028)
• virt module updates
  • network: handle missing ipv4 netmask attribute
  • more network support
  • PCI/USB host devices passthrough support
• Set distro requirement to oldest supported version in requirements/base.txt
• Bring missing part of async batch implementation back (CVE-2021-25315, bsc#1182382)
• Always require python3-distro (bsc#1182293)
• Remove deprecated warning that breaks minion execution when 'server_id_use_crc' opts is missing
• Fix pkg states when DEB package has 'all' arch
• Do not force beacons configuration to be a list.
• Remove msgpack < 1.0.0 from base requirements (bsc#1176293)
• msgpack support for version >= 1.0.0 (bsc#1171257)
• Fix issue parsing errors in ansiblegate state module
• Prevent command injection in the snapper module (bsc#1185281, CVE-2021-31607)
• transactional_update: detect recursion in the executor
• Add subpackage salt-transactional-update (jsc#SLE-18033)
• Improvements on 'ansiblegate' module (bsc#1185092):
  • New methods: ansible.targets / ansible.discover_playbooks
• Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
• Regression fix of salt-ssh on processing targets
• Update target fix for salt-ssh and avoiding race condition on salt-ssh event processing (bsc#1179831, bsc#1182281)
• Add notify beacon for Debian/Ubuntu systems
• Fix zmq bug that causes salt-call to freeze (bsc#1181368)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for salt fixes the following issues:

Update to Salt release version 3002.2 (jsc#ECO-3212, jsc#SLE-18033, jsc#SLE-18028)

• Check if dpkgnotify is executable (bsc#1186674)
• Drop support for Python2. Obsoletes python2-salt package (jsc#SLE-18028)
• virt module updates
  • network: handle missing ipv4 netmask attribute
  • more network support
  • PCI/USB host devices passthrough support
• Set distro requirement to oldest supported version in requirements/base.txt
• Bring missing part of async batch implementation back (CVE-2021-25315, bsc#1182382)
• Always require python3-distro (bsc#1182293)
• Remove deprecated warning that breaks minion execution when 'server_id_use_crc' opts is missing
• Fix pkg states when DEB package has 'all' arch
• Do not force beacons configuration to be a list.
• Remove msgpack < 1.0.0 from base requirements (bsc#1176293)
• msgpack support for version >= 1.0.0 (bsc#1171257)
• Fix issue parsing errors in ansiblegate state module
• Prevent command injection in the snapper module (bsc#1185281, CVE-2021-31607)
• transactional_update: detect recursion in the executor
• Add subpackage salt-transactional-update (jsc#SLE-18033)
• Improvements on 'ansiblegate' module (bsc#1185092):
  • New methods: ansible.targets / ansible.discover_playbooks
• Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
• Regression fix of salt-ssh on processing targets
• Update target fix for salt-ssh and avoiding race condition on salt-ssh event processing (bsc#1179831, bsc#1182281)
• Add notify beacon for Debian/Ubuntu systems
• Fix zmq bug that causes salt-call to freeze (bsc#1181368)

These are all security issues fixed in the python3-salt-3002.2-6.1 package on the GA media of openSUSE Tumbleweed.

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.

This update for salt fixes the following issues:

• Fix CVE-2020-11651 and CVE-2020-11652 (bsc#1170595)

This update for salt fixes the following issues:

• Fix CVE-2020-11651 and CVE-2020-11652 (bsc#1170595)

This update for salt fixes the following issues:

• Fix CVE-2020-11651 and CVE-2020-11652 (bsc#1170595)

This update for salt fixes the following issues:

Security issues fixed:

• CVE-2020-11651: Fixed the improper validation of method calls in salt-master, that could have allowed unauthenticated remote users to run arbitrary commands on salt minions (bsc#1170595).
• CVE-2020-11652: Fixed an improper path sanitation in salt-master, that could have allowed authenticated users to access arbitrary directories (bsc#1170595).

This update fixes the following issues:

dracut-saltboot:

• Print a list of available disk devices (bsc#1170824)
• Install wipefs to initrd
• Force install crypt modules
• Add missing terminal naming modifiers as exported veriables

golang-github-prometheus-prometheus:

• Update change log and spec file
  • Modified spec file: default to golang 1.14 to avoid 'have choice' build issues in OBS.
  • Rebase and update patches for version 2.18.0
  • Changed:
    • 0002-Default-settings.patch Changed
• Update to 2.18.0
  • Features
    • Tracing: Added experimental Jaeger support #7148
  • Changes
    • Federation: Only use local TSDB for federation (ignore remote read). #7096
    • Rules: rule_evaluations_total and rule_evaluation_failures_total have a rule_group label now. #7094
  • Enhancements
    • TSDB: Significantly reduce WAL size kept around after a block cut. #7098
    • Discovery: Add architecture meta label for EC2. #7000
  • Bug fixes
    • UI: Fixed wrong MinTime reported by /status. #7182
    • React UI: Fixed multiselect legend on OSX. #6880
    • Remote Write: Fixed blocked resharding edge case. #7122
    • Remote Write: Fixed remote write not updating on relabel configs change. #7073
• Changes from 2.17.2
  • Bug fixes
    • Federation: Register federation metrics #7081
    • PromQL: Fix panic in parser error handling #7132
    • Rules: Fix reloads hanging when deleting a rule group that is being evaluated #7138
    • TSDB: Fix a memory leak when prometheus starts with an empty TSDB WAL #7135
    • TSDB: Make isolation more robust to panics in web handlers #7129 #7136
• Changes from 2.17.1
  • Bug fixes
    • TSDB: Fix query performance regression that increased memory and CPU usage #7051
• Changes from 2.17.0
  • Features
    • TSDB: Support isolation #6841
    • This release implements isolation in TSDB. API queries and recording rules are guaranteed to only see full scrapes and full recording rules. This comes with a certain overhead in resource usage. Depending on the situation, there might be some increase in memory usage, CPU usage, or query latency.
  • Enhancements
    • PromQL: Allow more keywords as metric names #6933
    • React UI: Add normalization of localhost URLs in targets page #6794
    • Remote read: Read from remote storage concurrently #6770
    • Rules: Mark deleted rule series as stale after a reload #6745
    • Scrape: Log scrape append failures as debug rather than warn #6852
    • TSDB: Improve query performance for queries that partially hit the head #6676
    • Consul SD: Expose service health as meta label #5313
    • EC2 SD: Expose EC2 instance lifecycle as meta label #6914
    • Kubernetes SD: Expose service type as meta label for K8s service role #6684
    • Kubernetes SD: Expose label_selector and field_selector #6807
    • Openstack SD: Expose hypervisor id as meta label #6962
  • Bug fixes
    • PromQL: Do not escape HTML-like chars in query log #6834 #6795
    • React UI: Fix data table matrix values #6896
    • React UI: Fix new targets page not loading when using non-ASCII characters #6892
    • Remote read: Fix duplication of metrics read from remote storage with external labels #6967 #7018
    • Remote write: Register WAL watcher and live reader metrics for all remotes, not just the first one #6998
    • Scrape: Prevent removal of metric names upon relabeling #6891
    • Scrape: Fix 'superfluous response.WriteHeader call' errors when scrape fails under some circonstances #6986
    • Scrape: Fix crash when reloads are separated by two scrape intervals #7011
• Changes from 2.16.0
  • Features
    • React UI: Support local timezone on /graph #6692
    • PromQL: add absent_over_time query function #6490
    • Adding optional logging of queries to their own file #6520
  • Enhancements
    • React UI: Add support for rules page and 'Xs ago' duration displays #6503
    • React UI: alerts page, replace filtering togglers tabs with checkboxes #6543 …

This update fixes the following issues:

cobbler:

• Calculate relative path for kernel and inited when generating grub entry (bsc#1170231) Added: fix-grub2-entry-paths.diff
• Fix os-release version detection for SUSE Modified: sles15.patch
• Jinja2 template library fix (bsc#1141661)
• Removes string replace for textmode fix (bsc#1134195)

golang-github-prometheus-prometheus:

• Update change log and spec file
  • Modified spec file: default to golang 1.14 to avoid 'have choice' build issues in OBS.
  • Rebase and update patches for version 2.18.0
  • Changed:
    • 0002-Default-settings.patch Changed
• Update to 2.18.0
  • Features
    • Tracing: Added experimental Jaeger support #7148
  • Changes
    • Federation: Only use local TSDB for federation (ignore remote read). #7096
    • Rules: rule_evaluations_total and rule_evaluation_failures_total have a rule_group label now. #7094
  • Enhancements
    • TSDB: Significantly reduce WAL size kept around after a block cut. #7098
    • Discovery: Add architecture meta label for EC2. #7000
  • Bug fixes
    • UI: Fixed wrong MinTime reported by /status. #7182
    • React UI: Fixed multiselect legend on OSX. #6880
    • Remote Write: Fixed blocked resharding edge case. #7122
    • Remote Write: Fixed remote write not updating on relabel configs change. #7073
• Changes from 2.17.2
  • Bug fixes
    • Federation: Register federation metrics #7081
    • PromQL: Fix panic in parser error handling #7132
    • Rules: Fix reloads hanging when deleting a rule group that is being evaluated #7138
    • TSDB: Fix a memory leak when prometheus starts with an empty TSDB WAL #7135
    • TSDB: Make isolation more robust to panics in web handlers #7129 #7136
• Changes from 2.17.1
  • Bug fixes
    • TSDB: Fix query performance regression that increased memory and CPU usage #7051
• Changes from 2.17.0
  • Features
    • TSDB: Support isolation #6841
    • This release implements isolation in TSDB. API queries and recording rules are guaranteed to only see full scrapes and full recording rules. This comes with a certain overhead in resource usage. Depending on the situation, there might be some increase in memory usage, CPU usage, or query latency.
  • Enhancements
    • PromQL: Allow more keywords as metric names #6933
    • React UI: Add normalization of localhost URLs in targets page #6794
    • Remote read: Read from remote storage concurrently #6770
    • Rules: Mark deleted rule series as stale after a reload #6745
    • Scrape: Log scrape append failures as debug rather than warn #6852
    • TSDB: Improve query performance for queries that partially hit the head #6676
    • Consul SD: Expose service health as meta label #5313
    • EC2 SD: Expose EC2 instance lifecycle as meta label #6914
    • Kubernetes SD: Expose service type as meta label for K8s service role #6684
    • Kubernetes SD: Expose label_selector and field_selector #6807
    • Openstack SD: Expose hypervisor id as meta label #6962
  • Bug fixes
    • PromQL: Do not escape HTML-like chars in query log #6834 #6795
    • React UI: Fix data table matrix values #6896
    • React UI: Fix new targets page not loading when using non-ASCII characters #6892
    • Remote read: Fix duplication of metrics read from remote storage with external labels #6967 #7018
    • Remote write: Register WAL watcher and live reader metrics for all remotes, not just the first one #6998
    • Scrape: Prevent removal of metric names upon relabeling #6891
    • Scrape: Fix 'superfluous response.WriteHeader call' errors when scrape fails under some circonstances #6986
    • Scrape: Fix crash when reloads are separated by two scrape intervals #7011
• Changes from 2.16.0
  • Features
    • React UI: Support local timezone on /graph #6692
    • PromQL: add absent_over_time query function #6490
    • Adding optional logging of queries to their own file #6520
  • Enhancements
    • React UI: Add support for rules page and…

This update fixes the following issues:

salt:

• Fix for TypeError in Tornado importer (bsc#1174165)
• Require python3-distro only for TW (bsc#1173072)
• Various virt backports from 3000.2
• Avoid traceback on debug logging for swarm module (bsc#1172075)
• Add publish_batch to ClearFuncs exposed methods
• Update to salt version 3000 See release notes: https://docs.saltstack.com/en/latest/topics/releases/3000.html
• Zypperpkg: filter patterns that start with dot (bsc#1171906)
• Batch mode now also correctly provides return value (bsc#1168340)
• Add docker.logout to docker execution module (bsc#1165572)
• Testsuite fix
• Add option to enable/disable force refresh for zypper
• Python3.8 compatibility changes
• Prevent sporious 'salt-api' stuck processes when managing SSH minions because of logging deadlock (bsc#1159284)
• Avoid segfault from 'salt-api' under certain conditions of heavy load managing SSH minions (bsc#1169604)
• Revert broken changes to slspath made on Salt 3000 (saltstack/salt#56341) (bsc#1170104)
• Returns a the list of IPs filtered by the optional network list
• Fix CVE-2020-11651 and CVE-2020-11652 (bsc#1170595)
• Do not require vendored backports-abc (bsc#1170288)
• Fix partition.mkpart to work without fstype (bsc#1169800)
• Enable building and installation for Fedora
• Disable python2 build on Tumbleweed We are removing the python2 interpreter from openSUSE (SLE16). As such disable salt building for python2 there.
• More robust remote port detection
• Sanitize grains loaded from roster_grains.json cache during 'state.pkg'
• Do not make file.recurse state to fail when msgpack 0.5.4 (bsc#1167437)
• Build: Buildequire pkgconfig(systemd) instead of systemd pkgconfig(systemd) is provided by systemd, so this is de-facto no change. But inside the Open Build Service (OBS), the same symbol is also provided by systemd-mini, which exists to shorten build-chains by only enabling what other packages need to successfully build
• Add new custom SUSE capability for saltutil state module
• Fixes status attribute issue in aptpkg test
• Make setup.py script not to require setuptools greater than 9.1
• Loop: fix variable names for until_no_eval
• Drop conflictive module.run state patch (bsc#1167437)
• Update patches after rebase with upstream v3000 tag (bsc#1167437)
• Fix some requirements issues depending on Python3 versions
• Removes obsolete patch
• Fix for low rpm_lowpkg unit test
• Add python-singledispatch as dependency for python2-salt
• Virt._get_domain: don't raise an exception if there is no VM
• Fix for temp folder definition in loader unit test
• Adds test for zypper abbreviation fix
• Improved storage pool or network handling
• Better import cache handline
• Make 'salt.ext.tornado.gen' to use 'salt.ext.backports_abc' on Python 2
• Fix regression in service states with reload argument
• Fix integration test failure for test_mod_del_repo_multiline_values
• Fix for unless requisite when pip is not installed
• Fix errors from unit tests due NO_MOCK and NO_MOCK_REASON deprecation
• Fix tornado imports and missing _utils after rebasing patches
• Removes unresolved merge conflict in yumpkg module
• Use full option name instead of undocumented abbreviation for zypper
• Requiring python3-distro only for openSUSE/SLE >= 15 and not for Python 2 builds
• Avoid possible user escalation upgrading salt-master (bsc#1157465) (CVE-2019-18897)
• Fix unit tests failures in test_batch_async tests
• Batch Async: Handle exceptions, properly unregister and close instances after running async batching to avoid CPU starvation of the MWorkers (bsc#1162327)
• RHEL/CentOS 8 uses platform-python instead of python3
• Loader: invalidate the import cachefor extra modules
• Zypperpkg: filter patterns that start with dot (bsc#1171906)
• Batch mode now also correctly provides return value (bsc#1168340)
• Add docker.logout to docker execution module (bsc#1165572)
• Improvements for chroot module
• Add option to enable/disable force…

This update fixes the following issues:

salt:

• Fix for TypeError in Tornado importer (bsc#1174165)
• Require python3-distro only for TW (bsc#1173072)
• Various virt backports from 3000.2
• Avoid traceback on debug logging for swarm module (bsc#1172075)
• Add publish_batch to ClearFuncs exposed methods
• Update to salt version 3000 See release notes: https://docs.saltstack.com/en/latest/topics/releases/3000.html
• Zypperpkg: filter patterns that start with dot (bsc#1171906)
• Batch mode now also correctly provides return value (bsc#1168340)
• Add docker.logout to docker execution module (bsc#1165572)
• Testsuite fix
• Add option to enable/disable force refresh for zypper
• Python3.8 compatibility changes
• Prevent sporious 'salt-api' stuck processes when managing SSH minions because of logging deadlock (bsc#1159284)
• Avoid segfault from 'salt-api' under certain conditions of heavy load managing SSH minions (bsc#1169604)
• Revert broken changes to slspath made on Salt 3000 (saltstack/salt#56341) (bsc#1170104)
• Returns a the list of IPs filtered by the optional network list
• Fix CVE-2020-11651 and CVE-2020-11652 (bsc#1170595)
• Do not require vendored backports-abc (bsc#1170288)
• Fix partition.mkpart to work without fstype (bsc#1169800)
• Enable building and installation for Fedora
• Disable python2 build on Tumbleweed We are removing the python2 interpreter from openSUSE (SLE16). As such disable salt building for python2 there.
• More robust remote port detection
• Sanitize grains loaded from roster_grains.json cache during 'state.pkg'
• Do not make file.recurse state to fail when msgpack 0.5.4 (bsc#1167437)
• Build: Buildequire pkgconfig(systemd) instead of systemd pkgconfig(systemd) is provided by systemd, so this is de-facto no change. But inside the Open Build Service (OBS), the same symbol is also provided by systemd-mini, which exists to shorten build-chains by only enabling what other packages need to successfully build
• Add new custom SUSE capability for saltutil state module
• Fixes status attribute issue in aptpkg test
• Make setup.py script not to require setuptools greater than 9.1
• Loop: fix variable names for until_no_eval
• Drop conflictive module.run state patch (bsc#1167437)
• Update patches after rebase with upstream v3000 tag (bsc#1167437)
• Fix some requirements issues depending on Python3 versions
• Removes obsolete patch
• Fix for low rpm_lowpkg unit test
• Add python-singledispatch as dependency for python2-salt
• Virt._get_domain: don't raise an exception if there is no VM
• Fix for temp folder definition in loader unit test
• Adds test for zypper abbreviation fix
• Improved storage pool or network handling
• Better import cache handline
• Make 'salt.ext.tornado.gen' to use 'salt.ext.backports_abc' on Python 2
• Fix regression in service states with reload argument
• Fix integration test failure for test_mod_del_repo_multiline_values
• Fix for unless requisite when pip is not installed
• Fix errors from unit tests due NO_MOCK and NO_MOCK_REASON deprecation
• Fix tornado imports and missing _utils after rebasing patches
• Removes unresolved merge conflict in yumpkg module
• Use full option name instead of undocumented abbreviation for zypper
• Requiring python3-distro only for openSUSE/SLE >= 15 and not for Python 2 builds
• Avoid possible user escalation upgrading salt-master (bsc#1157465) (CVE-2019-18897)
• Fix unit tests failures in test_batch_async tests
• Batch Async: Handle exceptions, properly unregister and close instances after running async batching to avoid CPU starvation of the MWorkers (bsc#1162327)
• RHEL/CentOS 8 uses platform-python instead of python3
• Loader: invalidate the import cachefor extra modules
• Zypperpkg: filter patterns that start with dot (bsc#1171906)
• Batch mode now also correctly provides return value (bsc#1168340)
• Add docker.logout to docker execution module (bsc#1165572)
• Improvements for chroot module
• Add option to enable/disable force…

This update for salt contains the following fixes:

• Fix for TypeError in Tornado importer (bsc#1174165)

• Require python3-distro only for TW (bsc#1173072)

• Update to Salt version 3000: See release notes: https://docs.saltstack.com/en/latest/topics/releases/3000.html

• Add docker.logout to docker execution module. (bsc#1165572)

• Add option to enable/disable force refresh for zypper.

• Add publish_batch to ClearFuncs exposed methods.

• Adds test for zypper abbreviation fix.

• Avoid segfault from 'salt-api' under certain conditions of heavy load managing SSH minions. (bsc#1169604)

• Avoid traceback on debug logging for swarm module. (bsc#1172075)

• Batch mode now also correctly provides return value. (bsc#1168340)

• Better import cache handline.

• Do not make file.recurse state to fail when msgpack 0.5.4. (bsc#1167437)

• Do not require vendored backports-abc. (bsc#1170288)

• Fix errors from unit tests due NO_MOCK and NO_MOCK_REASON deprecation.

• Fix for low rpm_lowpkg unit test.

• Fix for temp folder definition in loader unit test.

• Fix for unless requisite when pip is not installed.

• Fix integration test failure for test_mod_del_repo_multiline_values.

• Fix regression in service states with reload argument.

• Fix tornado imports and missing _utils after rebasing patches.

• Fix status attribute issue in aptpkg test.

• Improved storage pool or network handling.

• loop: fix variable names for until_no_eval.

• Make 'salt.ext.tornado.gen' to use 'salt.ext.backports_abc' on Python 2.

• Make setup.py script not to require setuptools greater than 9.1.

• More robust remote port detection.

• Prevent sporious 'salt-api' stuck processes when managing SSH minions. because of logging deadlock. (bsc#1159284)

• Python3.8 compatibility changes.

• Removes unresolved merge conflict in yumpkg module.

• Returns a the list of IPs filtered by the optional network list.

• Revert broken changes to slspath made on Salt 3000 (saltstack/salt#56341). (bsc#1170104)

• Sanitize grains loaded from roster_grains.json cache during 'state.pkg'.

• Various virt backports from 3000.2.

• zypperpkg: filter patterns that start with dot. (bsc#1171906)

This update for salt fixes the following issues:

Update to Salt release version 3002.2 (jsc#ECO-3212, jsc#SLE-18033, jsc#SLE-18028)

• Check if dpkgnotify is executable (bsc#1186674)
• Drop support for Python2. Obsoletes python2-salt package (jsc#SLE-18028)
• virt module updates
  • network: handle missing ipv4 netmask attribute
  • more network support
  • PCI/USB host devices passthrough support
• Set distro requirement to oldest supported version in requirements/base.txt
• Bring missing part of async batch implementation back (bsc#1182382, CVE-2021-25315)
• Always require python3-distro (bsc#1182293)
• Remove deprecated warning that breaks minion execution when 'server_id_use_crc' opts is missing
• Fix pkg states when DEB package has 'all' arch
• Do not force beacons configuration to be a list.
• Remove msgpack < 1.0.0 from base requirements (bsc#1176293)
• msgpack support for version >= 1.0.0 (bsc#1171257)
• Fix issue parsing errors in ansiblegate state module
• Prevent command injection in the snapper module (bsc#1185281, CVE-2021-31607)
• transactional_update: detect recursion in the executor
• Add subpackage salt-transactional-update (jsc#SLE-18033)
• Remove duplicate directories from specfile
• Improvements on 'ansiblegate' module (bsc#1185092):
  • New methods: ansible.targets / ansible.discover_playbooks
• Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
• Regression fix of salt-ssh on processing targets
• Update target fix for salt-ssh and avoiding race condition on salt-ssh event processing (bsc#1179831, bsc#1182281)
• Add notify beacon for Debian/Ubuntu systems
• Fix zmq bug that causes salt-call to freeze (bsc#1181368)

This update for salt fixes the following issues:

Update to Salt release version 3002.2 (jsc#ECO-3212, jsc#SLE-18033, jsc#SLE-18028)

• Check if dpkgnotify is executable (bsc#1186674)
• Drop support for Python2. Obsoletes python2-salt package (jsc#SLE-18028)
• virt module updates
  • network: handle missing ipv4 netmask attribute
  • more network support
  • PCI/USB host devices passthrough support
• Set distro requirement to oldest supported version in requirements/base.txt
• Bring missing part of async batch implementation back (CVE-2021-25315, bsc#1182382)
• Always require python3-distro (bsc#1182293)
• Remove deprecated warning that breaks minion execution when 'server_id_use_crc' opts is missing
• Fix pkg states when DEB package has 'all' arch
• Do not force beacons configuration to be a list.
• Remove msgpack < 1.0.0 from base requirements (bsc#1176293)
• msgpack support for version >= 1.0.0 (bsc#1171257)
• Fix issue parsing errors in ansiblegate state module
• Prevent command injection in the snapper module (bsc#1185281, CVE-2021-31607)
• transactional_update: detect recursion in the executor
• Add subpackage salt-transactional-update (jsc#SLE-18033)
• Improvements on 'ansiblegate' module (bsc#1185092):
  • New methods: ansible.targets / ansible.discover_playbooks
• Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
• Regression fix of salt-ssh on processing targets
• Update target fix for salt-ssh and avoiding race condition on salt-ssh event processing (bsc#1179831, bsc#1182281)
• Add notify beacon for Debian/Ubuntu systems
• Fix zmq bug that causes salt-call to freeze (bsc#1181368)

It was discovered that Salt allows remote attackers to determine which files exist on the server. An attacker could use that to extract sensitive information. (CVE-2018-15750)

It was discovered that Salt has a vulnerability that allows an user to bypass authentication. An attacker could use that to extract sensitive information, execute abritrary code or crash the server. (CVE-2018-15751)

It was discovered that Salt is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host. (CVE-2019-17361)

It was discovered that Salt incorrectly validated method calls and sanitized paths. A remote attacker could possibly use this issue to access some methods without authentication. (CVE-2020-11651, CVE-2020-11652)

It was discovered that Salt incorrectly validated method calls and sanitized paths. A remote attacker could possibly use this issue to access some methods without authentication. (CVE-2020-11651, CVE-2020-11652)