CVE-2017-5200

Salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 allows arbitrary command execution on a salt-master via Salt's ssh_client. Users of Salt-API and salt-ssh could execute a command on the salt master via a hole when both systems were enabled.

Salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 allows arbitrary command execution on a salt-master via Salt's ssh_client.

This update for salt provides version 2016.11.4 and brings various fixes and improvements:

• Adding a salt-minion watchdog for RHEL6 and SLES11 systems (sysV) to restart salt-minion in case of crashes during upgrade.
• Fix format error. (bsc#1043111)
• Fix ownership for whole master cache directory. (bsc#1035914)
• Disable 3rd party runtime packages to be explicitly recommended. (bsc#1040886)
• Fix insecure permissions in salt-ssh temporary files. (bsc#1035912, CVE-2017-8109)
• Disable custom rosters for Salt SSH via Salt API. (bsc#1011800, CVE-2017-5200)
• Orchestrate and batches don't return false failed information anymore.
• Speed-up cherrypy by removing sleep call.
• Fix os_family grains on SUSE. (bsc#1038855)
• Fix setting the language on SUSE systems. (bsc#1038855)
• Use SUSE specific salt-api.service. (bsc#1039370)
• Fix using hostname for minion ID as '127'.
• Fix core grains constants for timezone. (bsc#1032931)
• Minor fixes on new pkg.list_downloaded.
• Listing all type of advisory patches for Yum module.
• Prevents zero length error on Python 2.6.
• Fixes zypper test error after backporting.
• Raet protocol is no longer supported. (bsc#1020831)
• Fix moving SSH data to the new home. (bsc#1027722)
• Fix logrotating /var/log/salt/minion. (bsc#1030009)
• Fix result of master_tops extension is mutually overwritten. (bsc#1030073)
• Allows to set 'timeout' and 'gather_job_timeout' via kwargs.
• Allows to set custom timeouts for 'manage.up' and 'manage.status'.
• Use salt's ordereddict for comparison.
• Fix scripts for salt-proxy.
• Add openscap module.
• File.get_managed regression fix.
• Fix translate variable arguments if they contain hidden keywords. (bsc#1025896)
• Added unit test for dockerng.sls_build dryrun.
• Added dryrun to dockerng.sls_build.
• Update dockerng minimal version requirements.
• Fix format error in error parsing.
• Keep fix for migrating salt home directory. (bsc#1022562)
• Fix salt pkg.latest raises exception if package is not available. (bsc#1012999)
• Timezone should always be in UTC. (bsc#1017078)
• Fix timezone handling for rpm installtime. (bsc#1017078)
• Increasing timeouts for running integrations tests.
• Add buildargs option to dockerng.build module.
• Fix error when missing ssh-option parameter.
• Re-add yum notify plugin.
• All kwargs to dockerng.create to provide all features to sls_build as well.
• Datetime should be returned always in UTC.
• Fix possible crash while deserialising data on infinite recursion in scheduled state. (bsc#1036125)
• Documentation refresh to 2016.11.4
• For a detailed description, please refer to:
  • https://docs.saltstack.com/en/develop/topics/releases/2016.11.4.html
  • https://docs.saltstack.com/en/develop/topics/releases/2016.11.3.html
  • https://docs.saltstack.com/en/develop/topics/releases/2016.11.2.html
  • https://docs.saltstack.com/en/develop/topics/releases/2016.11.1.html

This update for salt provides version 2016.11.4 and brings various fixes and improvements:

• Adding a salt-minion watchdog for RHEL6 and SLES11 systems (sysV) to restart salt-minion in case of crashes during upgrade.
• Fix format error. (bsc#1043111)
• Fix ownership for whole master cache directory. (bsc#1035914)
• Disable 3rd party runtime packages to be explicitly recommended. (bsc#1040886)
• Fix insecure permissions in salt-ssh temporary files. (bsc#1035912, CVE-2017-8109)
• Disable custom rosters for Salt SSH via Salt API. (bsc#1011800, CVE-2017-5200)
• Orchestrate and batches don't return false failed information anymore.
• Speed-up cherrypy by removing sleep call.
• Fix os_family grains on SUSE. (bsc#1038855)
• Fix setting the language on SUSE systems. (bsc#1038855)
• Use SUSE specific salt-api.service. (bsc#1039370)
• Fix using hostname for minion ID as '127'.
• Fix core grains constants for timezone. (bsc#1032931)
• Minor fixes on new pkg.list_downloaded.
• Listing all type of advisory patches for Yum module.
• Prevents zero length error on Python 2.6.
• Fixes zypper test error after backporting.
• Raet protocol is no longer supported. (bsc#1020831)
• Fix moving SSH data to the new home. (bsc#1027722)
• Fix logrotating /var/log/salt/minion. (bsc#1030009)
• Fix result of master_tops extension is mutually overwritten. (bsc#1030073)
• Allows to set 'timeout' and 'gather_job_timeout' via kwargs.
• Allows to set custom timeouts for 'manage.up' and 'manage.status'.
• Use salt's ordereddict for comparison.
• Fix scripts for salt-proxy.
• Add openscap module.
• File.get_managed regression fix.
• Fix translate variable arguments if they contain hidden keywords. (bsc#1025896)
• Added unit test for dockerng.sls_build dryrun.
• Added dryrun to dockerng.sls_build.
• Update dockerng minimal version requirements.
• Fix format error in error parsing.
• Keep fix for migrating salt home directory. (bsc#1022562)
• Fix salt pkg.latest raises exception if package is not available. (bsc#1012999)
• Timezone should always be in UTC. (bsc#1017078)
• Fix timezone handling for rpm installtime. (bsc#1017078)
• Increasing timeouts for running integrations tests.
• Add buildargs option to dockerng.build module.
• Fix error when missing ssh-option parameter.
• Re-add yum notify plugin.
• All kwargs to dockerng.create to provide all features to sls_build as well.
• Datetime should be returned always in UTC.
• Fix possible crash while deserialising data on infinite recursion in scheduled state. (bsc#1036125)
• Documentation refresh to 2016.11.4
• For a detailed description, please refer to:
  • https://docs.saltstack.com/en/develop/topics/releases/2016.11.4.html
  • https://docs.saltstack.com/en/develop/topics/releases/2016.11.3.html
  • https://docs.saltstack.com/en/develop/topics/releases/2016.11.2.html
  • https://docs.saltstack.com/en/develop/topics/releases/2016.11.1.html