CVE-2020-16846

An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.

An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.

An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.

This update for salt fixes the following issues:

• Properly validate eauth credentials and tokens on SSH calls made by Salt API (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846)
• Fix disk.blkid to avoid unexpected keyword argument '__pub_user'. (bsc#1177867)
• Ensure virt.update stop_on_reboot is updated with its default value.
• Do not break package building for systemd OSes.
• Drop wrong mock from chroot unit test.
• Support systemd versions with dot. (bsc#1176294)
• Fix for grains.test_core unit test.
• Fix file/directory user and group ownership containing UTF-8 characters. (bsc#1176024)
• Several changes to virtualization:
  • Fix virt update when cpu and memory are changed.
  • Memory Tuning GSoC.
  • Properly fix memory setting regression in virt.update.
  • Expose libvirt on_reboot in virt states.
• Support transactional systems (MicroOS).
• zypperpkg module ignores retcode 104 for search(). (bsc#1159670)
• Xen disk fixes. No longer generates volumes for Xen disks, but the corresponding file or block disk. (bsc#1175987)
• Invalidate file list cache when cache file modified time is in the future. (bsc#1176397)
• Prevent import errors when running test_btrfs unit tests.

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for salt fixes the following issues:

• Avoid regression on 'salt-master': set passphrase for salt-ssh keys to empty string (bsc#1178485)
• Properly validate eauth credentials and tokens on SSH calls made by Salt API (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846)
• Fix disk.blkid to avoid unexpected keyword argument '__pub_user'. (bsc#1177867)
• Ensure virt.update stop_on_reboot is updated with its default value.
• Do not break package building for systemd OSes.
• Drop wrong mock from chroot unit test.
• Support systemd versions with dot. (bsc#1176294)
• Fix for grains.test_core unit test.
• Fix file/directory user and group ownership containing UTF-8 characters. (bsc#1176024)
• Several changes to virtualization:
  • Fix virt update when cpu and memory are changed.
  • Memory Tuning GSoC.
  • Properly fix memory setting regression in virt.update.
  • Expose libvirt on_reboot in virt states.
• Support transactional systems (MicroOS).
• zypperpkg module ignores retcode 104 for search(). (bsc#1159670)
• Xen disk fixes. No longer generates volumes for Xen disks, but the corresponding file or block disk. (bsc#1175987)
• Invalidate file list cache when cache file modified time is in the future. (bsc#1176397)
• Prevent import errors when running test_btrfs unit tests

This update was imported from the SUSE:SLE-15-SP1:Update update project.

An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.

This update fixes the following issues:

cobbler:

• Fix parsing cobbler dictionary options with values containing '=', e.g. kernel params containing '=' (bsc#1176978)

mgr-daemon:

• Update translation strings

salt:

• Properly validate eauth credentials and tokens on SSH calls made by Salt API (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846)

spacecmd:

• Python3 fixes for errata in spacecmd (bsc#1169664)
• Added support for i18n of user-facing strings
• Python3 fix for sorted usage (bsc#1167907)

spacewalk-client-tools:

• Remove RH references in Python/Ruby localization and use the product name instead

This update for salt fixes the following issues:

• Properly validate eauth credentials and tokens on SSH calls made by Salt API (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846)
• Fix disk.blkid to avoid unexpected keyword argument '__pub_user'. (bsc#1177867)
• Ensure virt.update stop_on_reboot is updated with its default value.
• Do not break package building for systemd OSes.
• Drop wrong mock from chroot unit test.
• Support systemd versions with dot. (bsc#1176294)
• Fix for grains.test_core unit test.
• Fix file/directory user and group ownership containing UTF-8 characters. (bsc#1176024)
• Several changes to virtualization:
  • Fix virt update when cpu and memory are changed.
  • Memory Tuning GSoC.
  • Properly fix memory setting regression in virt.update.
  • Expose libvirt on_reboot in virt states.
• Support transactional systems (MicroOS).
• zypperpkg module ignores retcode 104 for search(). (bsc#1159670)
• Xen disk fixes. No longer generates volumes for Xen disks, but the corresponding file or block disk. (bsc#1175987)
• Invalidate file list cache when cache file modified time is in the future. (bsc#1176397)
• Prevent import errors when running test_btrfs unit tests.

This update for salt fixes the following issues:

• Fix for CVE-2020-25592 (bsc#1178319), CVE-2020-16846, (bsc#1178361), and CVE-2020-17490 (bsc#1178362).

This update fixes the following issues:

bind-formula:

• Temporarily disable dnssec-validation as hotfix for bsc#1177790

grafana-formula:

• Use variable for product name
• Add HA/SAP dashboards
• Add support for system groups in Client Systems dashboard

image-sync-formula:

• Do not use .gz suffix for default initrd symlink
• Keep the old symlink 'initrd.gz' for compatibility

prometheus-exporters-formula:

• Fix empty directory values initialization
• Add systemd collector as default for node_exporters since otherwise some SAP/HA grafana dashboards will be empty
• Disable reverse proxy on default

prometheus-formula:

• Disable Alertmanager clustering (bsc#1178145)
• Use variable for product name

pxe-formula:

• Change default to 'initrd' without .gz suffix

py26-compat-salt:

• Properly validate eauth credentials and tokens on SSH calls made by Salt API (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846)

python-susemanager-retail:

• Use name 'initrd' without .gz suffix

salt-netapi-client:

• Version 0.18.0 See: https://github.com/SUSE/salt-netapi-client/releases/tag/v0.18.0

saltboot-formula:

• Allow setting terminal kernel parameters in saltboot formula

spacecmd:

• Python3 fixes for errata in spacecmd (bsc#1169664)
• Added support for i18n of user-facing strings
• Python3 fix for sorted usage (bsc#1167907)

spacewalk-admin:

• Show info message when applying schema upgrade

spacewalk-backend:

• Prevent IntegrityError during mgr-inter-sync execution (bsc#1177235)

spacewalk-branding:

• Enable to switch to multiple webUI theme

spacewalk-client-tools:

• Remove RH references in Python/Ruby localization and use the product name instead

spacewalk-java:

• Use correct eauth module and credentials for Salt SSH calls (bsc#1178319)
• Remove expiration date from ics files (bsc#1177892)
• Execute Salt SSH actions in parallel (bsc#1173199)
• Enable to switch to multiple webUI theme
• Fix action chain resuming when patches updating salt-minion don't cause service to be restarted (bsc#1144447)
• Renaming autoinstall distro didn't change the name of the Cobbler distro (bsc#1175876)
• Fix the links for downloading the binaries in the package details UI (bsc#1176603)
• Allow nightly ISS sync to also cover custom channels
• Fix: reinspecting a container image (bsc#1177092)
• Add power management xmlrpc api
• Remove hostname from /var/lib/salt/.ssh/known_hosts when deleting system (bsc#1176159)
• Log exception trace on fatal Taskomatic startup error
• Fix max password length check at user creation (bsc#1176765)
• Notify about missing libvirt or hypervisor on virtual host
• Redesign maintenance schedule systems table to use paginated data from server
• Fix SP migration after dry run for cloned channels (bsc#1176307)
• Filter not available optional channels out

spacewalk-search:

• Change default maximum memory to 512 MB, preventing OutOfMemoryError

spacewalk-web:

• Enable to switch to multiple webUI theme
• Only refresh the virtual storage list when pool events are received
• Drop node-fetch to fix CVE-2020-15168
• Notify about missing libvirt or hypervisor on virtual host
• Redesign maintenance schedule systems table to use paginated data from server

susemanager:

• Create bootstrap repo should not flush by default (bsc#1175843)
• Improve detection of base channels for products (bsc#1177478)
• Add LTSS PIDs for SLE12SP1, SLE12SP2, SLE12SP3 and SLE12SP4 to the bootstrap definitions as some packages from LTSS are required (bsc#1177524)
• Fix logrotate config
• Add missing packages to ubuntu20.04 bootstrap data (bsc#1176629)

susemanager-build-keys:

• Replace 'SuSE' user-facing references with 'SUSE'

susemanager-doc-indexes:

• Documented zypper autorefresh feature in Upgrade Guide
• Update SP Migration chapter in Client Configuration Guide
• In Client Configuration and Upgrade Guide, add link to valid autoyast upgrade settings
• Move client upgrade related sections from…

This update for salt fixes the following issues:

• Avoid regression on 'salt-master': set passphrase for salt-ssh keys to empty string (bsc#1178485)
• Properly validate eauth credentials and tokens on SSH calls made by Salt API (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846)
• Fix disk.blkid to avoid unexpected keyword argument '__pub_user'. (bsc#1177867)
• Ensure virt.update stop_on_reboot is updated with its default value.
• Do not break package building for systemd OSes.
• Drop wrong mock from chroot unit test.
• Support systemd versions with dot. (bsc#1176294)
• Fix for grains.test_core unit test.
• Fix file/directory user and group ownership containing UTF-8 characters. (bsc#1176024)
• Several changes to virtualization:
  • Fix virt update when cpu and memory are changed.
  • Memory Tuning GSoC.
  • Properly fix memory setting regression in virt.update.
  • Expose libvirt on_reboot in virt states.
• Support transactional systems (MicroOS).
• zypperpkg module ignores retcode 104 for search(). (bsc#1159670)
• Xen disk fixes. No longer generates volumes for Xen disks, but the corresponding file or block disk. (bsc#1175987)
• Invalidate file list cache when cache file modified time is in the future. (bsc#1176397)
• Prevent import errors when running test_btrfs unit tests

This update fixes the following issues:

salt:

• Avoid regression on 'salt-master': set passphrase for salt-ssh keys to empty string (bsc#1178485)
• Properly validate eauth credentials and tokens on SSH calls made by Salt API (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846)
• Fix disk.blkid to avoid unexpected keyword argument '__pub_user' (bsc#1177867)
• Ensure virt.update stop_on_reboot is updated with its default value
• Do not break package building for systemd OSes
• Drop wrong mock from chroot unit test
• Support systemd versions with dot (bsc#1176294)
• Fix for grains.test_core unit test
• Fix file/directory user and group ownership containing UTF-8 characters (bsc#1176024)
• Several changes to virtualization:
  • Fix virt update when cpu and memory are changed
  • Memory Tuning GSoC
  • Properly fix memory setting regression in virt.update
  • Expose libvirt on_reboot in virt states
• Support transactional systems (MicroOS)
• Zypperpkg module ignores retcode 104 for search() (bsc#1159670)
• Xen disk fixes. No longer generates volumes for Xen disks, but the corresponding file or block disk (bsc#1175987)
• Invalidate file list cache when cache file modified time is in the future (bsc#1176397)
• Prevent import errors when running test_btrfs unit tests

This update fixes the following issues:

salt:

• Fix disk.blkid to avoid unexpected keyword argument '__pub_user' (bsc#1177867)
• Ensure virt.update stop_on_reboot is updated with its default value
• Do not break package building for systemd OSes
• Drop wrong mock from chroot unit test
• Support systemd versions with dot (bsc#1176294)
• Fix for grains.test_core unit test
• Fix file/directory user and group ownership containing UTF-8 characters (bsc#1176024)
• Several changes to virtualization:
  • Fix virt update when cpu and memory are changed
  • Memory Tuning GSoC
  • Properly fix memory setting regression in virt.update
  • Expose libvirt on_reboot in virt states
• Support transactional systems (MicroOS)
• Zypperpkg module ignores retcode 104 for search() (bsc#1159670)
• Xen disk fixes. No longer generates volumes for Xen disks, but the corresponding file or block disk (bsc#1175987)
• Invalidate file list cache when cache file modified time is in the future (bsc#1176397)
• Prevent import errors when running test_btrfs unit tests
• Properly validate eauth credentials and tokens on SSH calls made by Salt API (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846)
• Avoid regression on 'salt-master': set passphrase for salt-ssh keys to empty string (bsc#1178485)

This security update for SUSE Manager 4.0 provides the following fixes:

py26-compat-salt:

• Properly validate eauth credentials and tokens on SSH calls made by Salt API (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846)

spacewalk-java:

• Use correct eauth module and credentials for Salt SSH calls. (bsc#1178319, CVE-2020-25592)

This security update for SUSE Manager 3.2 fixes the following issues:

py26-compat-salt:

• Properly validate eauth credentials and tokens on SSH calls made by Salt API (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846)

spacewalk-java:

• Use correct eauth module and credentials for Salt SSH calls (bsc#1178319, CVE-2020-25592)

It was discovered that Salt incorrectly handled crafted web requests. A remote attacker could possibly use this issue to run arbitrary commands. (CVE-2020-16846)

It was discovered that Salt incorrectly created certificates with weak file permissions. (CVE-2020-17490)

It was discovered that Salt incorrectly handled credential validation. A remote attacker could possibly use this issue to bypass authentication. (CVE-2020-25592)

It was discovered that Salt incorrectly handled crafted process names. An attacker could possibly use this issue to run arbitrary commands. This issue only affected Ubuntu 18.04 LTS. (CVE-2020-28243)

It was discovered that Salt incorrectly handled validation of SSL/TLS certificates. A remote attacker could possibly use this issue to spoof a trusted entity. (CVE-2020-28972, CVE-2020-35662)

It was discovered that Salt incorrectly handled credential validation. A remote attacker could possibly use this issue to run arbitrary code. (CVE-2021-25281)

It was discovered that Salt incorrectly handled crafted paths. A remote attacker could possibly use this issue to perform directory traversal. (CVE-2021-25282)

It was discovered that Salt incorrectly handled template rendering. A remote attacker could possibly this issue to run arbitrary code. (CVE-2021-25283)

It was discovered that Salt incorrectly handled logging. An attacker could possibly use this issue to discover credentials. This issue only affected Ubuntu 18.04 LTS. (CVE-2021-25284)

It was discovered that Salt incorrectly handled crafted web requests. A remote attacker could possibly use this issue to run arbitrary commands. This issue only affected Ubuntu 18.04 LTS. (CVE-2021-3148)

It was discovered that Salt incorrectly handled input sanitization. A remote attacker could possibly use this issue to run arbitrary commands. (CVE-2021-3197)

It was discovered that Salt incorrectly handled web requests when the SSH client was enabled. An attacker could possibly use this issue to achieve remote code execution or obtain sensitive information.