{"id":"CVE-2019-18897","aliases":["EUVD-2019-8578","GHSA-p48p-8wh6-cj6f","SUSE-RU-2020:0625-1","SUSE-RU-2020:0685-1","SUSE-SU-2020:0684-1","SUSE-SU-2020:0762-1","SUSE-SU-2020:0763-1","SUSE-SU-2020:1971-1","SUSE-SU-2020:1973-1","openSUSE-SU-2020:0357-1","openSUSE-SU-2024:11364-1"],"status":"published","title":"Local privilege escalation from user salt to root","description":"A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of salt of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Factory allows local attackers to escalate privileges from user salt to root. This issue affects: SUSE Linux Enterprise Server 12 salt-master version 2019.2.0-46.83.1 and prior versions. SUSE Linux Enterprise Server 15 salt-master version 2019.2.0-6.21.1 and prior versions. openSUSE Factory salt-master version 2019.2.2-3.1 and prior versions.","severity":{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00386,"percentile":0.33147,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-59"],"published":"2020-03-02T15:20:27Z","modified":"2026-06-17T02:25:32Z","affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.0-5.64.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.0-5.64.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.0-5.64.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.0-5.64.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.0-46.88.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Advanced Systems Management 12","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.0-46.88.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 12 SP2","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.0-46.88.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.2","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.0-46.88.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.0-46.88.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.0-6.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 2 15 SP1","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.0-6.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP1","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.0-6.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"python-singledispatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0.3-1.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000-46.101.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Advanced Systems Management 12","package":"python-singledispatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0.3-1.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Advanced Systems Management 12","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000-46.101.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 12 SP2","package":"python-singledispatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0.3-1.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 12 SP2","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000-46.101.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.2","package":"python-singledispatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0.3-1.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.2","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000-46.101.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"python-singledispatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0.3-1.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000-46.101.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000-5.78.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000-5.78.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000-5.78.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000-5.78.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.0-lp151.5.12.1"}]}],"bundled":2}],"products":[{"vendor":"opensuse","product":"factory"},{"vendor":"opensuse","product":"leap"},{"vendor":"suse","product":"linux_enterprise_server"},{"vendor":"suse","product":"suse linux enterprise server 12"},{"vendor":"suse","product":"suse linux enterprise server 15"}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00026.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link","Mailing List","Vendor Advisory"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1157465","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-18897"},{"url":"https://github.com/advisories/GHSA-p48p-8wh6-cj6f"},{"url":"https://www.suse.com/support/update/announcement/-2020-625/suse-ru-20200625-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1135656","tags":["report"]},{"url":"https://bugzilla.suse.com/1153611","tags":["report"]},{"url":"https://bugzilla.suse.com/1157465","tags":["report"]},{"url":"https://bugzilla.suse.com/1158940","tags":["report"]},{"url":"https://bugzilla.suse.com/1159118","tags":["report"]},{"url":"https://bugzilla.suse.com/1160931","tags":["report"]},{"url":"https://bugzilla.suse.com/1162327","tags":["report"]},{"url":"https://bugzilla.suse.com/1162504","tags":["report"]},{"url":"https://bugzilla.suse.com/1165425","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18897","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/-2020-685/suse-ru-20200685-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200684-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200762-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1163981","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200763-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201971-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1159284","tags":["report"]},{"url":"https://bugzilla.suse.com/1165572","tags":["report"]},{"url":"https://bugzilla.suse.com/1167437","tags":["report"]},{"url":"https://bugzilla.suse.com/1168340","tags":["report"]},{"url":"https://bugzilla.suse.com/1169604","tags":["report"]},{"url":"https://bugzilla.suse.com/1169800","tags":["report"]},{"url":"https://bugzilla.suse.com/1170104","tags":["report"]},{"url":"https://bugzilla.suse.com/1170288","tags":["report"]},{"url":"https://bugzilla.suse.com/1170595","tags":["report"]},{"url":"https://bugzilla.suse.com/1171906","tags":["report"]},{"url":"https://bugzilla.suse.com/1172075","tags":["report"]},{"url":"https://bugzilla.suse.com/1173072","tags":["report"]},{"url":"https://bugzilla.suse.com/1174165","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11652","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201973-1/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PR2PQ3GKS2PLFHVBID4QWOIOSORFRWDH/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14695","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25592","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31607","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-18897","title":"Local privilege escalation from user salt to root","description":"A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of salt of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Factory allows local attackers to escalate privileges from user salt to root. This issue affects: SUSE Linux Enterprise Server 12 salt-master version 2019.2.0-46.83.1 and prior versions. SUSE Linux Enterprise Server 15 salt-master version 2019.2.0-6.21.1 and prior versions. openSUSE Factory salt-master version 2019.2.2-3.1 and prior versions.","status":"published","published":"2020-03-02T15:20:27.294Z","modified":"2024-09-17T01:21:20.067Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:32:23.803059Z"}],"euvd":[{"id":"EUVD-2019-8578","description":"A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of salt of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Factory allows local attackers to escalate privileges from user salt to root. This issue affects: SUSE Linux Enterprise Server 12 salt-master version 2019.2.0-46.83.1 and prior versions. SUSE Linux Enterprise Server 15 salt-master version 2019.2.0-6.21.1 and prior versions. openSUSE Factory salt-master version 2019.2.2-3.1 and prior versions.","status":"published","published":"2020-03-02T15:20:27Z","modified":"2024-09-17T01:21:20Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:28:50.234993Z"}],"ghsa":[{"id":"GHSA-p48p-8wh6-cj6f","title":"A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of salt of SUSE Linux...","description":"A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of salt of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Factory allows local attackers to escalate privileges from user salt to root. This issue affects: SUSE Linux Enterprise Server 12 salt-master version 2019.2.0-46.83.1 and prior versions. SUSE Linux Enterprise Server 15 salt-master version 2019.2.0-6.21.1 and prior versions. openSUSE Factory salt-master version 2019.2.2-3.1 and prior versions.","status":"published","published":"2022-05-24T17:09:59Z","modified":"2023-01-28T05:02:24Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:43:46.253094Z"}],"nvd":[{"id":"CVE-2019-18897","description":"A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of salt of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Factory allows local attackers to escalate privileges from user salt to root. This issue affects: SUSE Linux Enterprise Server 12 salt-master version 2019.2.0-46.83.1 and prior versions. SUSE Linux Enterprise Server 15 salt-master version 2019.2.0-6.21.1 and prior versions. openSUSE Factory salt-master version 2019.2.2-3.1 and prior versions.","status":"published","published":"2020-03-02T16:15:11.847Z","modified":"2026-06-17T02:25:32.633Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:05:43.875329Z"}],"osv":[{"id":"openSUSE-SU-2020:0357-1","title":"Security update for salt","description":"This update for salt fixes the following issues:\n\n- Avoid possible user escalation upgrading salt-master (bsc#1157465) (CVE-2019-18897)\n- Fix unit tests failures in test_batch_async tests\n- Batch Async: Handle exceptions, properly unregister and close instances after\n  running async batching to avoid CPU starvation of the MWorkers (bsc#1162327)\n- RHEL/CentOS 8 uses platform-python instead of python3\n- New configuration option for selection of grains in the minion start event.\n- Fix 'os_family' grain for Astra Linux Common Edition\n- Fix for salt-api NET API where unauthenticated attacker could run\n  arbitrary code (CVE-2019-17361) (bsc#1162504)\n- Adds disabled parameter to mod_repo in aptpkg module\n  Move token with atomic operation\n  Bad API token files get deleted (bsc#1160931)\n- Support for Btrfs and XFS in parted and mkfs added\n- Adds list_downloaded for apt Module to enable pre-downloading support\n  Adds virt.(pool|network)_get_xml functions\n- Various libvirt updates:\n  * Add virt.pool_capabilities function\n  * virt.pool_running improvements\n  * Add virt.pool_deleted state\n  * virt.network_define allow adding IP configuration\n- virt: adding kernel boot parameters to libvirt xml\n- Fix to scheduler when data['run'] does not exist (bsc#1159118)\n- Fix virt states to not fail on VMs already stopped\n- Fix applying of attributes for returner rawfile_json (bsc#1158940)\n- xfs: do not fail if type is not present (bsc#1153611)\n- Fix errors when running virt.get_hypervisor function\n- Align virt.full_info fixes with upstream Salt\n- Fix for log checking in x509 test\n- Read repo info without using interpolation (bsc#1135656)\n- Limiting M2Crypto to \u003e= SLE15\n- Replacing pycrypto with M2Crypto (bsc#1165425)\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2020-03-18T15:18:47Z","modified":"2026-02-04T03:45:15.939882Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:11364-1","title":"python3-salt-3002.2-6.1 on GA media","description":"These are all security issues fixed in the python3-salt-3002.2-6.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:54:00.752468Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-RU-2020:0625-1","title":"Recommended update for Salt","description":"\nThis update fixes the following issues:\n\nsalt:\n\n- RHEL/CentOS 8 uses platform-python instead of python3\n- New configuration option for selection of grains in the minion start event.\n- Fix 'os_family' grain for Astra Linux Common Edition\n- Fix for salt-api NET API where unauthenticated attacker could run\n  arbitrary code (CVE-2019-17361) (bsc#1162504)\n- Adds disabled parameter to mod_repo in aptpkg module\n- Move token with atomic operation\n- Bad API token files get deleted (bsc#1160931)\n- Support for Btrfs and XFS in parted and mkfs added\n- Adds list_downloaded for apt Module to enable pre-downloading support\n- Adds virt.(pool|network)_get_xml functions\n- Virt: adding kernel boot parameters to libvirt xml\n- Fix to scheduler when data['run'] does not exist (bsc#1159118)\n- Fix virt states to not fail on VMs already stopped\n- Fix applying of attributes for returner rawfile_json (bsc#1158940)\n- Xfs: do not fail if type is not present (bsc#1153611)\n- Don't use __python indirection macros on spec file\n  %__python is no longer defined in RPM 4.15 (python2 is going EOL in Jan 2020);\n  additionally, python/python3 are just binaries in the path.\n- Fix errors when running virt.get_hypervisor function\n- Align virt.full_info fixes with upstream Salt\n- Fix for log checking in x509 test\n- Prevent test_mod_del_repo_multiline_values to fail\n- Read repo info without using interpolation (bsc#1135656)\n- Replacing pycrypto with M2Crypto as dependency for \u003e= SLE15 (bsc#1165425)\n- Batch Async: Handle exceptions, properly unregister and close instances\n  after running async batching to avoid CPU starvation of the MWorkers (bsc#1162327)\n- Avoid possible user escalation upgrading salt-master (bsc#1157465) (CVE-2019-18897)\n","status":"published","published":"2020-03-10T09:39:57Z","modified":"2026-02-04T03:37:51.627732Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-RU-2020:0685-1","title":"Recommended update for Salt","description":"\nThis update fixes the following issues:\n\nsalt:\n\n- RHEL/CentOS 8 uses platform-python instead of python3\n- New configuration option for selection of grains in the minion start event.\n- Fix 'os_family' grain for Astra Linux Common Edition\n- Fix for salt-api NET API where unauthenticated attacker could run\n  arbitrary code (CVE-2019-17361) (bsc#1162504)\n- Adds disabled parameter to mod_repo in aptpkg module\n- Move token with atomic operation\n- Bad API token files get deleted (bsc#1160931)\n- Support for Btrfs and XFS in parted and mkfs added\n- Adds list_downloaded for apt Module to enable pre-downloading support\n- Adds virt.(pool|network)_get_xml functions\n- Virt: adding kernel boot parameters to libvirt xml\n- Fix to scheduler when data['run'] does not exist (bsc#1159118)\n- Fix virt states to not fail on VMs already stopped\n- Fix applying of attributes for returner rawfile_json (bsc#1158940)\n- Xfs: do not fail if type is not present (bsc#1153611)\n- Don't use __python indirection macros on spec file\n  %__python is no longer defined in RPM 4.15 (python2 is going EOL in Jan 2020);\n  additionally, python/python3 are just binaries in the path.\n- Fix errors when running virt.get_hypervisor function\n- Align virt.full_info fixes with upstream Salt\n- Fix for log checking in x509 test\n- Prevent test_mod_del_repo_multiline_values to fail\n- Read repo info without using interpolation (bsc#1135656)\n- Replacing pycrypto with M2Crypto as dependency for \u003e= SLE15 (bsc#1165425)\n- Batch Async: Handle exceptions, properly unregister and close instances\n  after running async batching to avoid CPU starvation of the MWorkers (bsc#1162327)\n- Avoid possible user escalation upgrading salt-master (bsc#1157465) (CVE-2019-18897)\n","status":"published","published":"2020-03-13T13:13:12Z","modified":"2026-02-04T02:17:17.023436Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2020:0684-1","title":"Security update for salt","description":"This update for salt fixes the following issues:\n\n- Avoid possible user escalation upgrading salt-master (bsc#1157465) (CVE-2019-18897)\n- Fix unit tests failures in test_batch_async tests\n- Batch Async: Handle exceptions, properly unregister and close instances after\n  running async batching to avoid CPU starvation of the MWorkers (bsc#1162327)\n- RHEL/CentOS 8 uses platform-python instead of python3\n- New configuration option for selection of grains in the minion start event.\n- Fix 'os_family' grain for Astra Linux Common Edition\n- Fix for salt-api NET API where unauthenticated attacker could run\n  arbitrary code (CVE-2019-17361) (bsc#1162504)\n- Adds disabled parameter to mod_repo in aptpkg module\n  Move token with atomic operation\n  Bad API token files get deleted (bsc#1160931)\n- Support for Btrfs and XFS in parted and mkfs added\n- Adds list_downloaded for apt Module to enable pre-downloading support\n  Adds virt.(pool|network)_get_xml functions\n- Various libvirt updates:\n  * Add virt.pool_capabilities function\n  * virt.pool_running improvements\n  * Add virt.pool_deleted state\n  * virt.network_define allow adding IP configuration\n- virt: adding kernel boot parameters to libvirt xml\n- Fix to scheduler when data['run'] does not exist (bsc#1159118)\n- Fix virt states to not fail on VMs already stopped\n- Fix applying of attributes for returner rawfile_json (bsc#1158940)\n- xfs: do not fail if type is not present (bsc#1153611)\n- Fix errors when running virt.get_hypervisor function\n- Align virt.full_info fixes with upstream Salt\n- Fix for log checking in x509 test\n- Read repo info without using interpolation (bsc#1135656)\n- Limiting M2Crypto to \u003e= SLE15\n- Replacing pycrypto with M2Crypto (bsc#1165425)\n","status":"published","published":"2020-03-13T12:42:49Z","modified":"2026-02-04T03:34:11.195793Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0762-1","title":"Security Beta update for Salt","description":"\nThis update fixes the following issues:\n\nsalt:\n- Requiring python3-distro only for openSUSE/SLE \u003e= 15\n- Use full option name instead of undocumented abbreviation for zypper\n- Python-distro is only needed for \u003e Python 3.7. Removing it for Python 2\n- Fixed a local privilege escalation to root (bsc#1157465) (CVE-2019-18897)\n- Fix unit tests failures in test_batch_async tests\n- Batch Async: Handle exceptions, properly unregister and close instances\n  after running async batching to avoid CPU starvation of the MWorkers (bsc#1162327)\n- RHEL/CentOS 8 uses platform-python instead of python3\n- Enable build for Python 3.8\n- Update to Salt version 2019.2.3 (bsc#1163981) (bsc#1162504)\n- Replacing pycrypto with M2Crypto (bsc#1165425)\n\n","status":"published","published":"2020-03-24T14:52:45Z","modified":"2025-05-02T04:09:05.892226Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:0763-1","title":"Security Beta update for Salt","description":"\nThis update fixes the following issues:\n\nsalt:\n- Requiring python3-distro only for openSUSE/SLE \u003e= 15\n- Use full option name instead of undocumented abbreviation for zypper\n- Python-distro is only needed for \u003e Python 3.7. Removing it for Python 2\n- Fixed a local privilege escalation to root (bsc#1157465) (CVE-2019-18897)\n- Fix unit tests failures in test_batch_async tests\n- Batch Async: Handle exceptions, properly unregister and close instances\n  after running async batching to avoid CPU starvation of the MWorkers (bsc#1162327)\n- RHEL/CentOS 8 uses platform-python instead of python3\n- Enable build for Python 3.8\n- Update to Salt version 2019.2.3 (bsc#1163981) (bsc#1162504)\n- Replacing pycrypto with M2Crypto (bsc#1165425)\n\n","status":"published","published":"2020-03-24T14:52:56Z","modified":"2026-02-04T03:27:36.348367Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1971-1","title":"Security update for Salt","description":"\nThis update fixes the following issues:\n\nsalt:\n\n- Fix for TypeError in Tornado importer (bsc#1174165)\n- Require python3-distro only for TW (bsc#1173072)\n- Various virt backports from 3000.2\n- Avoid traceback on debug logging for swarm module (bsc#1172075)\n- Add publish_batch to ClearFuncs exposed methods\n- Update to salt version 3000\n  See release notes: https://docs.saltstack.com/en/latest/topics/releases/3000.html\n- Zypperpkg: filter patterns that start with dot (bsc#1171906)\n- Batch mode now also correctly provides return value (bsc#1168340)\n- Add docker.logout to docker execution module (bsc#1165572)\n- Testsuite fix\n- Add option to enable/disable force refresh for zypper\n- Python3.8 compatibility changes\n- Prevent sporious 'salt-api' stuck processes when managing SSH minions because of logging deadlock (bsc#1159284)\n- Avoid segfault from 'salt-api' under certain conditions of heavy load managing SSH minions (bsc#1169604)\n- Revert broken changes to slspath made on Salt 3000 (saltstack/salt#56341) (bsc#1170104)\n- Returns a the list of IPs filtered by the optional network list\n- Fix CVE-2020-11651 and CVE-2020-11652 (bsc#1170595)\n- Do not require vendored backports-abc (bsc#1170288)\n- Fix partition.mkpart to work without fstype (bsc#1169800)\n- Enable building and installation for Fedora\n- Disable python2 build on Tumbleweed\n  We are removing the python2 interpreter from openSUSE (SLE16).\n  As such disable salt building for python2 there.\n- More robust remote port detection\n- Sanitize grains loaded from roster_grains.json cache during 'state.pkg'\n- Do not make file.recurse state to fail when msgpack 0.5.4 (bsc#1167437)\n- Build: Buildequire pkgconfig(systemd) instead of systemd\n  pkgconfig(systemd) is provided by systemd, so this is de-facto no change.\n  But inside the Open Build Service (OBS), the same symbol is also provided by\n  systemd-mini, which exists to shorten build-chains by only enabling what other\n  packages need to successfully build\n- Add new custom SUSE capability for saltutil state module\n- Fixes status attribute issue in aptpkg test\n- Make setup.py script not to require setuptools greater than 9.1\n- Loop: fix variable names for until_no_eval\n- Drop conflictive module.run state patch (bsc#1167437)\n- Update patches after rebase with upstream v3000 tag (bsc#1167437)\n- Fix some requirements issues depending on Python3 versions\n- Removes obsolete patch\n- Fix for low rpm_lowpkg unit test\n- Add python-singledispatch as dependency for python2-salt\n- Virt._get_domain: don't raise an exception if there is no VM\n- Fix for temp folder definition in loader unit test\n- Adds test for zypper abbreviation fix\n- Improved storage pool or network handling\n- Better import cache handline\n- Make 'salt.ext.tornado.gen' to use 'salt.ext.backports_abc' on Python 2\n- Fix regression in service states with reload argument\n- Fix integration test failure for test_mod_del_repo_multiline_values\n- Fix for unless requisite when pip is not installed\n- Fix errors from unit tests due NO_MOCK and NO_MOCK_REASON deprecation\n- Fix tornado imports and missing _utils after rebasing patches\n- Removes unresolved merge conflict in yumpkg module\n- Use full option name instead of undocumented abbreviation for zypper\n- Requiring python3-distro only for openSUSE/SLE \u003e= 15 and not for Python 2 builds\n- Avoid possible user escalation upgrading salt-master (bsc#1157465) (CVE-2019-18897)\n- Fix unit tests failures in test_batch_async tests\n- Batch Async: Handle exceptions, properly unregister and close instances after\n  running async batching to avoid CPU starvation of the MWorkers (bsc#1162327)\n- RHEL/CentOS 8 uses platform-python instead of python3\n- Loader: invalidate the import cachefor extra modules\n- Zypperpkg: filter patterns that start with dot (bsc#1171906)\n- Batch mode now also correctly provides return value (bsc#1168340)\n- Add docker.logout to docker execution module (bsc#1165572)\n- Improvements for chroot module\n- Add option to enable/disable force refresh for zypper\n- Prevent sporious 'salt-api' stuck processes when managing SSH minions\n  because of logging deadlock (bsc#1159284)\n- Avoid segfault from 'salt-api' under certain conditions of heavy load\n  managing SSH minions (bsc#1169604)\n\n","status":"published","published":"2020-07-21T00:38:31Z","modified":"2026-02-04T03:33:56.209473Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1973-1","title":"Security update for Salt","description":"\nThis update fixes the following issues:\n\nsalt:\n\n- Fix for TypeError in Tornado importer (bsc#1174165)\n- Require python3-distro only for TW (bsc#1173072)\n- Various virt backports from 3000.2\n- Avoid traceback on debug logging for swarm module (bsc#1172075)\n- Add publish_batch to ClearFuncs exposed methods\n- Update to salt version 3000\n  See release notes: https://docs.saltstack.com/en/latest/topics/releases/3000.html\n- Zypperpkg: filter patterns that start with dot (bsc#1171906)\n- Batch mode now also correctly provides return value (bsc#1168340)\n- Add docker.logout to docker execution module (bsc#1165572)\n- Testsuite fix\n- Add option to enable/disable force refresh for zypper\n- Python3.8 compatibility changes\n- Prevent sporious 'salt-api' stuck processes when managing SSH minions because of logging deadlock (bsc#1159284)\n- Avoid segfault from 'salt-api' under certain conditions of heavy load managing SSH minions (bsc#1169604)\n- Revert broken changes to slspath made on Salt 3000 (saltstack/salt#56341) (bsc#1170104)\n- Returns a the list of IPs filtered by the optional network list\n- Fix CVE-2020-11651 and CVE-2020-11652 (bsc#1170595)\n- Do not require vendored backports-abc (bsc#1170288)\n- Fix partition.mkpart to work without fstype (bsc#1169800)\n- Enable building and installation for Fedora\n- Disable python2 build on Tumbleweed\n  We are removing the python2 interpreter from openSUSE (SLE16).\n  As such disable salt building for python2 there.\n- More robust remote port detection\n- Sanitize grains loaded from roster_grains.json cache during 'state.pkg'\n- Do not make file.recurse state to fail when msgpack 0.5.4 (bsc#1167437)\n- Build: Buildequire pkgconfig(systemd) instead of systemd\n  pkgconfig(systemd) is provided by systemd, so this is de-facto no change.\n  But inside the Open Build Service (OBS), the same symbol is also provided by\n  systemd-mini, which exists to shorten build-chains by only enabling what other\n  packages need to successfully build\n- Add new custom SUSE capability for saltutil state module\n- Fixes status attribute issue in aptpkg test\n- Make setup.py script not to require setuptools greater than 9.1\n- Loop: fix variable names for until_no_eval\n- Drop conflictive module.run state patch (bsc#1167437)\n- Update patches after rebase with upstream v3000 tag (bsc#1167437)\n- Fix some requirements issues depending on Python3 versions\n- Removes obsolete patch\n- Fix for low rpm_lowpkg unit test\n- Add python-singledispatch as dependency for python2-salt\n- Virt._get_domain: don't raise an exception if there is no VM\n- Fix for temp folder definition in loader unit test\n- Adds test for zypper abbreviation fix\n- Improved storage pool or network handling\n- Better import cache handline\n- Make 'salt.ext.tornado.gen' to use 'salt.ext.backports_abc' on Python 2\n- Fix regression in service states with reload argument\n- Fix integration test failure for test_mod_del_repo_multiline_values\n- Fix for unless requisite when pip is not installed\n- Fix errors from unit tests due NO_MOCK and NO_MOCK_REASON deprecation\n- Fix tornado imports and missing _utils after rebasing patches\n- Removes unresolved merge conflict in yumpkg module\n- Use full option name instead of undocumented abbreviation for zypper\n- Requiring python3-distro only for openSUSE/SLE \u003e= 15 and not for Python 2 builds\n- Avoid possible user escalation upgrading salt-master (bsc#1157465) (CVE-2019-18897)\n- Fix unit tests failures in test_batch_async tests\n- Batch Async: Handle exceptions, properly unregister and close instances after\n  running async batching to avoid CPU starvation of the MWorkers (bsc#1162327)\n- RHEL/CentOS 8 uses platform-python instead of python3\n- Loader: invalidate the import cachefor extra modules\n- Zypperpkg: filter patterns that start with dot (bsc#1171906)\n- Batch mode now also correctly provides return value (bsc#1168340)\n- Add docker.logout to docker execution module (bsc#1165572)\n- Improvements for chroot module\n- Add option to enable/disable force refresh for zypper\n- Prevent sporious 'salt-api' stuck processes when managing SSH minions\n  because of logging deadlock (bsc#1159284)\n- Avoid segfault from 'salt-api' under certain conditions of heavy load\n  managing SSH minions (bsc#1169604)\n\n","status":"published","published":"2020-07-21T00:39:56Z","modified":"2026-02-04T03:35:02.887637Z","updated_at":"2026-11-02T15:53:47.634847Z"}]}}