CVE-2017-14695

Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12791.

These are all security issues fixed in the python3-salt-3002.2-6.1 package on the GA media of openSUSE Tumbleweed.

Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12791.

This update for salt fixes one security issue and bugs.

The following security issues have been fixed:

• CVE-2017-14695: A directory traversal vulnerability in minion id validation allowed remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. (bsc#1062462)
• CVE-2017-14696: It was possible to force a remote Denial of Service with a specially crafted authentication request. (bsc#1062464)

Additionally, the following non-security issues have been fixed:

• Removed deprecation warning for beacon configuration using dictionaries. (bsc#1041993)
• Fixed beacons failure when pillar-based suppressing config-based. (bsc#1060230)
• Fixed minion resource exhaustion when many functions are being executed in parallel. (bsc#1059758)
• Remove 'TasksTask' attribute from salt-master.service in older versions of systemd. (bsc#985112)
• Fix for delete_deployment in Kubernetes module. (bsc#1059291)
• Catching error when PIDfile cannot be deleted. (bsc#1050003)
• Use $HOME to get the user home directory instead using '~' char. (bsc#1042749)

This update for salt fixes one security issue and bugs.

The following security issues have been fixed:

• CVE-2017-14695: A directory traversal vulnerability in minion id validation allowed remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. (bsc#1062462)
• CVE-2017-14696: It was possible to force a remote Denial of Service with a specially crafted authentication request. (bsc#1062464)

Additionally, the following non-security issues have been fixed:

• Removed deprecation warning for beacon configuration using dictionaries. (bsc#1041993)
• Fixed beacons failure when pillar-based suppressing config-based. (bsc#1060230)
• Fixed minion resource exhaustion when many functions are being executed in parallel. (bsc#1059758)
• Remove 'TasksTask' attribute from salt-master.service in older versions of systemd. (bsc#985112)
• Fix for delete_deployment in Kubernetes module. (bsc#1059291)
• Catching error when PIDfile cannot be deleted. (bsc#1050003)
• Use $HOME to get the user home directory instead using '~' char. (bsc#1042749)

This update for salt provides version 2018.3 and brings many fixes and improvements:

• Fix for sorting of multi-version packages (bsc#1097174 and bsc#1097413)
• Align SUSE salt-master.service 'LimitNOFILES' limit with upstream Salt
• Add 'other' attribute to GECOS fields to avoid inconsistencies with chfn
• Prevent zypper from parsing repo configuration from not .repo files (bsc#1094055)
• Collect all versions of installed packages on SUSE and RHEL systems (bsc#1089526)
• No more AWS EC2 rate limitations in salt-cloud. (bsc#1088888)
• MySQL returner now also allows to use Unix sockets. (bsc#1091371)
• Do not override jid on returners, only sending back to master. (bsc#1092373)
• Remove minion/thin/version if exists to force thin regeneration. (bsc#1092161)
• Fix minion scheduler to return a 'retcode' attribute. (bsc#1089112)
• Fix for logging during network interface querying. (bsc#1087581)
• Fix rhel packages requires both net-tools and iproute. (bsc#1087055)
• Fix patchinstall on yum module. Bad comparison. (bsc#1087278)
• Strip trailing commas on Linux user's GECOS fields. (bsc#1089362)
• Fallback to PyMySQL. (bsc#1087891)
• Fix for [Errno 0] Resolver Error 0 (no error). (bsc#1087581)
• Add python-2.6 support to salt-ssh.
• Make it possible to use docker login, pull and push from module.run and detect errors.
• Fix unicode decode error with salt-ssh.
• Fix cp.push empty file. (bsc#1075950)
• Fix grains containing trailing '\n'.
• Remove salt-minion python2 requirement when python3 is default. (bsc#1081592)
• Restoring installation of packages for Rhel 6 and 7.
• Prevent queryformat pattern from expanding. (bsc#1079048)
• Fix for delete_deployment in Kubernetes module. (bsc#1059291)
• Fix bsc#1062464 and CVE-2017-14696 already included in 2017.7.2.
• Fix wrong version reported by Salt. (bsc#1061407)
• Run salt-api as user salt. (bsc#1064520)

For a detailed description, please refer to the upstream-changelog at https://docs.saltstack.com/en/latest/topics/releases/index.html or to the rpm-changelog.

supportutils-plugin-salt:

• Collect salt-api, salt-broker and salt-ssh log files (bsc#1090242)

This update includes the following new features:

• Add support for postgresql 10 (fate#325659)

This update fixes the following issues:

py26-compat-salt:

• Update Salt version to 2016.11.10

• CVE-2018-15750: Fixed directory traversal vulnerability in salt-api (bsc#1113698).

• CVE-2018-15751: Fixed remote authentication bypass in salt-api(netapi) that allows to execute arbitrary commands (bsc#1113699).

• Fix wrong recurse behavior on for linux_acl.present (bsc#1106164)

• Adding backport for string arg normalization and fix for SUSE ES os

• Prepend current directory when path is just filename (bsc#1095942)

smdba:

• Add support for postgresql 10 (fate#325659)

spacecmd:

• Show group id on group_details (bsc#1111542)
• State channels handling: Existing commands configchannel_create and configchannel_import were updated while system_scheduleapplyconfigchannels and configchannel_updateinitsls were added.

spacewalk:

• Add support for postgresql10 (fate#325659)

spacewalk-backend:

• Channels to be actually un-subscribed from the assigned systems when being removed using spacewalk-remove-channel tool(bsc#1104120)

spacewalk-branding:

• New messages are added for XMLRPC API for state channels

spacewalk-doc-indexes:

• Use nutch-core dependency instead of nutch

spacewalk-java:

• Change Requires to allow installing with both Tomcat 8 (SLE-12SP3) and 9 (SLE12-SP4)
• Fix typo in messages (bsc#1111249)
• Remove restrictions on SUSE Manager Channel subscriptions (bsc#1105724)
• Added shortcut for editing Software Channel
• Fix NullPointerException when refreshing deleted software channel (bsc#1094992)
• Add last_boot to listSystems() API call
• Check valid postgresql database version
• Fix displayed number of systems requiring reboot in Tasks pane (bsc#1106875)
• Changed localization strings for file summaries (bsc#1090676)
• Added menu item entries for creating/deleting file preservation lists (bsc#1034030)
• Better error handling when a websocket connection is aborted (bsc#1080474)
• Remove the reference of channel from revision before deleting it(bsc#1107850)
• Added link from virtualization tab to Scheduled > Pending Actions (bsc#1037389)
• Speedup package listings(bsc#1100852)
• Method to Unsubscribe channel from system(bsc#1104120)
• Fix mgr-sync refresh when subscription was removed (bsc#1105720)
• Fix an error in the system software channels UI due to SUSE product channels missing a corresponding synced channel (bsc#1105886)
• XMLRPC API for state channels
• Optimize execution of actions in minions (bsc#1099857)
• Reschedule taskomatic jobs if task threads limit reached (bsc#1096511)
• Logic constraint: results must be ordered and grouped by systemId first (bsc#1101033)
• Do not wrap output if stderr is not present (bsc#1105074)

spacewalk-search:

• Discard commons-logging.properties removal on spec file, as OBS package does not contain it
• Upgrade tika-core to 0.19.1 and adjust nutch-core (bsc#1109235)
• Remove lib jar files and add them as build dependencies on spec
• Limit number of old java logfiles (bsc#1107869)

spacewalk-utils:

• Fix typo at --phases option help

spacewalk-web:

• Fix typo in messages (bsc#1111249)
• Fix Sles name in base channel filter (Visualization tab) (bsc#1042184)

subscription-matcher:

• Set core dumps location for IBM java (bsc#1107302)
• Fix OutOfMemoryError crashes (bsc#1094524)
• Updated to version 0.20
• Update partnumbers rule file (bsc#1095972)
• Use intermediate object to store confirmed matches within a penalty group and prevent infinite reactivation of Inherited virtualization rule (bsc#1094524)

susemanager:

• Add new option --with-parent-channel to mgr-create-bootrap-repo to specify parent channel to use if multiple options are available (bsc#1104487)
• Add support for postgresql10 (fate#325659)
• Bootstrap repos for SLE12 SP4 (bsc#1107117)

susemanager-branding-oss:

• Use ASCII quotation marks in license file (bsc#1098970)

susemanager-schema:

• Check…

It was discovered that Salt allowed remote attackers to write to arbitrary files via a special crafted file. An attacker could use this vulnerability to cause a DoS or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 ESM. (CVE-2014-3563)

Andreas Stieger discovered that Salt exposed git usernames and passwords in log files. An attacker could use this issue to retrieve sensitive information. This issue only affected Ubuntu 14.04 ESM. (CVE-2015-6918).

It was discovered that Salt exposed password authentication credentials in log files. An attacker could use this issue to retrieve sensitive information. This issue only affected Ubuntu 14.04 ESM. (CVE-2015-6941)

It was discovered that Salt allowed remote attackers to write to arbitrary files via a special crafted file. An attacker could use this issue to cause a DoS or possibly execute arbitrary code. (CVE-2017-12791, CVE-2017-14695, CVE-2017-14696)

It was discovered that Salt allowed remote attackers to determine which files exist on the server. An attacker could use this issue to extract sensitive information. This issue only affected Ubuntu 16.04 ESM. (CVE-2018-15750)

It was discovered that Salt allowed users to bypass authentication. An attacker could use this issue to extract sensitive information, execute arbitrary code or crash the server. This issue only affected Ubuntu 16.04 ESM. (CVE-2018-15751)