CVE-2019-17361

In SaltStack Salt before 2019.2.3, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.

In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.

This update for salt fixes the following issues:

• Avoid possible user escalation upgrading salt-master (bsc#1157465) (CVE-2019-18897)
• Fix unit tests failures in test_batch_async tests
• Batch Async: Handle exceptions, properly unregister and close instances after running async batching to avoid CPU starvation of the MWorkers (bsc#1162327)
• RHEL/CentOS 8 uses platform-python instead of python3
• New configuration option for selection of grains in the minion start event.
• Fix 'os_family' grain for Astra Linux Common Edition
• Fix for salt-api NET API where unauthenticated attacker could run arbitrary code (CVE-2019-17361) (bsc#1162504)
• Adds disabled parameter to mod_repo in aptpkg module Move token with atomic operation Bad API token files get deleted (bsc#1160931)
• Support for Btrfs and XFS in parted and mkfs added
• Adds list_downloaded for apt Module to enable pre-downloading support Adds virt.(pool|network)_get_xml functions
• Various libvirt updates:
  • Add virt.pool_capabilities function
  • virt.pool_running improvements
  • Add virt.pool_deleted state
  • virt.network_define allow adding IP configuration
• virt: adding kernel boot parameters to libvirt xml
• Fix to scheduler when data['run'] does not exist (bsc#1159118)
• Fix virt states to not fail on VMs already stopped
• Fix applying of attributes for returner rawfile_json (bsc#1158940)
• xfs: do not fail if type is not present (bsc#1153611)
• Fix errors when running virt.get_hypervisor function
• Align virt.full_info fixes with upstream Salt
• Fix for log checking in x509 test
• Read repo info without using interpolation (bsc#1135656)
• Limiting M2Crypto to >= SLE15
• Replacing pycrypto with M2Crypto (bsc#1165425)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

These are all security issues fixed in the python3-salt-3002.2-6.1 package on the GA media of openSUSE Tumbleweed.

In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.

This update fixes the following issues:

salt:

• RHEL/CentOS 8 uses platform-python instead of python3
• New configuration option for selection of grains in the minion start event.
• Fix 'os_family' grain for Astra Linux Common Edition
• Fix for salt-api NET API where unauthenticated attacker could run arbitrary code (CVE-2019-17361) (bsc#1162504)
• Adds disabled parameter to mod_repo in aptpkg module
• Move token with atomic operation
• Bad API token files get deleted (bsc#1160931)
• Support for Btrfs and XFS in parted and mkfs added
• Adds list_downloaded for apt Module to enable pre-downloading support
• Adds virt.(pool|network)_get_xml functions
• Virt: adding kernel boot parameters to libvirt xml
• Fix to scheduler when data['run'] does not exist (bsc#1159118)
• Fix virt states to not fail on VMs already stopped
• Fix applying of attributes for returner rawfile_json (bsc#1158940)
• Xfs: do not fail if type is not present (bsc#1153611)
• Don't use __python indirection macros on spec file %__python is no longer defined in RPM 4.15 (python2 is going EOL in Jan 2020); additionally, python/python3 are just binaries in the path.
• Fix errors when running virt.get_hypervisor function
• Align virt.full_info fixes with upstream Salt
• Fix for log checking in x509 test
• Prevent test_mod_del_repo_multiline_values to fail
• Read repo info without using interpolation (bsc#1135656)
• Replacing pycrypto with M2Crypto as dependency for >= SLE15 (bsc#1165425)
• Batch Async: Handle exceptions, properly unregister and close instances after running async batching to avoid CPU starvation of the MWorkers (bsc#1162327)
• Avoid possible user escalation upgrading salt-master (bsc#1157465) (CVE-2019-18897)

This update fixes the following issues:

salt:

• RHEL/CentOS 8 uses platform-python instead of python3
• New configuration option for selection of grains in the minion start event.
• Fix 'os_family' grain for Astra Linux Common Edition
• Fix for salt-api NET API where unauthenticated attacker could run arbitrary code (CVE-2019-17361) (bsc#1162504)
• Adds disabled parameter to mod_repo in aptpkg module
• Move token with atomic operation
• Bad API token files get deleted (bsc#1160931)
• Support for Btrfs and XFS in parted and mkfs added
• Adds list_downloaded for apt Module to enable pre-downloading support
• Adds virt.(pool|network)_get_xml functions
• Virt: adding kernel boot parameters to libvirt xml
• Fix to scheduler when data['run'] does not exist (bsc#1159118)
• Fix virt states to not fail on VMs already stopped
• Fix applying of attributes for returner rawfile_json (bsc#1158940)
• Xfs: do not fail if type is not present (bsc#1153611)
• Don't use __python indirection macros on spec file %__python is no longer defined in RPM 4.15 (python2 is going EOL in Jan 2020); additionally, python/python3 are just binaries in the path.
• Fix errors when running virt.get_hypervisor function
• Align virt.full_info fixes with upstream Salt
• Fix for log checking in x509 test
• Prevent test_mod_del_repo_multiline_values to fail
• Read repo info without using interpolation (bsc#1135656)
• Replacing pycrypto with M2Crypto as dependency for >= SLE15 (bsc#1165425)
• Batch Async: Handle exceptions, properly unregister and close instances after running async batching to avoid CPU starvation of the MWorkers (bsc#1162327)
• Avoid possible user escalation upgrading salt-master (bsc#1157465) (CVE-2019-18897)

This update fixes the following issues:

salt:

• Fix 'os_family' grain for Astra Linux Common Edition
• Update to Salt version 2019.2.3 (CVE-2019-17361) (bsc#1163981) See release notes: https://docs.saltstack.com/en/latest/topics/releases/2019.2.3.html
• Enable passing grains to start event based on 'start_event_grains' configuration parameter

This update fixes the following issues:

salt:

• Fix 'os_family' grain for Astra Linux Common Edition
• Update to Salt version 2019.2.3 (CVE-2019-17361) (bsc#1163981) See release notes: https://docs.saltstack.com/en/latest/topics/releases/2019.2.3.html
• Enable passing grains to start event based on 'start_event_grains' configuration parameter

This update for salt fixes the following issues:

• Avoid possible user escalation upgrading salt-master (bsc#1157465) (CVE-2019-18897)
• Fix unit tests failures in test_batch_async tests
• Batch Async: Handle exceptions, properly unregister and close instances after running async batching to avoid CPU starvation of the MWorkers (bsc#1162327)
• RHEL/CentOS 8 uses platform-python instead of python3
• New configuration option for selection of grains in the minion start event.
• Fix 'os_family' grain for Astra Linux Common Edition
• Fix for salt-api NET API where unauthenticated attacker could run arbitrary code (CVE-2019-17361) (bsc#1162504)
• Adds disabled parameter to mod_repo in aptpkg module Move token with atomic operation Bad API token files get deleted (bsc#1160931)
• Support for Btrfs and XFS in parted and mkfs added
• Adds list_downloaded for apt Module to enable pre-downloading support Adds virt.(pool|network)_get_xml functions
• Various libvirt updates:
  • Add virt.pool_capabilities function
  • virt.pool_running improvements
  • Add virt.pool_deleted state
  • virt.network_define allow adding IP configuration
• virt: adding kernel boot parameters to libvirt xml
• Fix to scheduler when data['run'] does not exist (bsc#1159118)
• Fix virt states to not fail on VMs already stopped
• Fix applying of attributes for returner rawfile_json (bsc#1158940)
• xfs: do not fail if type is not present (bsc#1153611)
• Fix errors when running virt.get_hypervisor function
• Align virt.full_info fixes with upstream Salt
• Fix for log checking in x509 test
• Read repo info without using interpolation (bsc#1135656)
• Limiting M2Crypto to >= SLE15
• Replacing pycrypto with M2Crypto (bsc#1165425)

It was discovered that Salt allows remote attackers to determine which files exist on the server. An attacker could use that to extract sensitive information. (CVE-2018-15750)

It was discovered that Salt has a vulnerability that allows an user to bypass authentication. An attacker could use that to extract sensitive information, execute abritrary code or crash the server. (CVE-2018-15751)

It was discovered that Salt is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host. (CVE-2019-17361)

It was discovered that Salt incorrectly validated method calls and sanitized paths. A remote attacker could possibly use this issue to access some methods without authentication. (CVE-2020-11651, CVE-2020-11652)