{"id":"CVE-2021-31607","aliases":["ALPINE-CVE-2021-31607","DLA-2815-1","EUVD-2021-0233","GHSA-hcjf-rp5h-g5h3","PYSEC-2021-56","SUSE-SU-2021:14753-1","SUSE-SU-2021:1688-1","SUSE-SU-2021:1690-1","SUSE-SU-2021:1951-1","SUSE-SU-2021:2098-1","SUSE-SU-2021:2102-1","SUSE-SU-2021:2104-1","SUSE-SU-2021:2105-1","SUSE-SU-2021:2106-1","SUSE-SU-2021:2114-1","UBUNTU-CVE-2021-31607","openSUSE-SU-2021:0899-1","openSUSE-SU-2021:1951-1","openSUSE-SU-2021:2106-1","openSUSE-SU-2024:11364-1"],"status":"published","title":"Command Injection in SaltStack Salt","description":"In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely).","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.05922,"percentile":0.93342,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77","CWE-78"],"published":"2021-04-23T00:00:00Z","modified":"2026-11-03T06:32:33Z","fixes":[{"ecosystem":"PyPI","package":"salt","fixed_in":["3003rc1"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.13","package":"salt","fixed_in":["3003-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"salt","fixed_in":["3003-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"salt","fixed_in":["3003-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"salt","fixed_in":["3003-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"salt","fixed_in":["3003-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"salt","fixed_in":["3003-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"salt","fixed_in":["3003-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"salt","fixed_in":["3003-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"salt","fixed_in":["3003-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"salt","fixed_in":["3003-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"salt","fixed_in":["3003-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"salt","fixed_in":["3003-r0"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"golang-github-wrouesnel-postgres_exporter","fixed_in":["0.4.7-5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"mgr-cfg","fixed_in":["4.2.2-5.15.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"mgr-custom-info","fixed_in":["4.2.1-5.9.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"mgr-daemon","fixed_in":["4.2.7-5.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"mgr-osad","fixed_in":["4.2.5-5.27.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"mgr-push","fixed_in":["4.2.2-5.9.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"mgr-virtualization","fixed_in":["4.2.1-5.17.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"rhnlib","fixed_in":["4.2.3-12.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"salt","fixed_in":["2016.11.10-43.75.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"spacecmd","fixed_in":["4.2.8-18.84.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"spacewalk-client-tools","fixed_in":["4.2.10-27.50.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"spacewalk-koan","fixed_in":["4.2.3-9.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"spacewalk-oscap","fixed_in":["4.2.1-6.15.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"spacewalk-remote-utils","fixed_in":["4.2.1-6.18.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"supportutils-plugin-susemanager-client","fixed_in":["4.2.2-9.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"suseRegisterInfo","fixed_in":["4.2.3-6.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"uyuni-common-libs","fixed_in":["4.2.3-5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"golang-github-wrouesnel-postgres_exporter","fixed_in":["0.4.7-5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"mgr-cfg","fixed_in":["4.2.2-5.15.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"mgr-custom-info","fixed_in":["4.2.1-5.9.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"mgr-daemon","fixed_in":["4.2.7-5.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"mgr-osad","fixed_in":["4.2.5-5.27.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"mgr-push","fixed_in":["4.2.2-5.9.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"mgr-virtualization","fixed_in":["4.2.1-5.17.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"rhnlib","fixed_in":["4.2.3-12.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"salt","fixed_in":["2016.11.10-43.75.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"spacecmd","fixed_in":["4.2.8-18.84.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"spacewalk-client-tools","fixed_in":["4.2.10-27.50.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"spacewalk-koan","fixed_in":["4.2.3-9.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"spacewalk-oscap","fixed_in":["4.2.1-6.15.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"spacewalk-remote-utils","fixed_in":["4.2.1-6.18.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"supportutils-plugin-susemanager-client","fixed_in":["4.2.2-9.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"suseRegisterInfo","fixed_in":["4.2.3-6.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"uyuni-common-libs","fixed_in":["4.2.3-5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"salt","fixed_in":["3002.2-8.41.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"salt","fixed_in":["3002.2-8.41.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Transactional Server 15 SP3","package":"salt","fixed_in":["3002.2-8.41.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Client Tools 12","package":"salt","fixed_in":["3000-46.142.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Advanced Systems Management 12","package":"salt","fixed_in":["3000-46.142.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"salt","fixed_in":["3002.2-8.41.8.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2016.11.0"},{"last_affected":"3002.6"},{"fixed":"3003rc1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2016.9"},{"fixed":"3003-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2016.9"},{"fixed":"3003-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2016.9"},{"fixed":"3003-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2016.9"},{"fixed":"3003-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2016.9"},{"fixed":"3003-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2016.9"},{"fixed":"3003-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2016.9"},{"fixed":"3003-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2016.9"},{"fixed":"3003-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2016.9"},{"fixed":"3003-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2016.9"},{"fixed":"3003-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2016.9"},{"fixed":"3003-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2016.9"},{"fixed":"3003-r0"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.2+ds-1+deb9u7"}]}],"versions":["2016.11.2+ds-1","2016.11.2+ds-1+deb9u1","2016.11.2+ds-1+deb9u2","2016.11.2+ds-1+deb9u3","2016.11.2+ds-1+deb9u4","2016.11.2+ds-1+deb9u5","2016.11.2+ds-1+deb9u6"],"bundled":11},{"source":"osv","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2016.11.0"},{"fixed":"3003rc1"}]}],"versions":["2016.11.0","2016.11.1","2016.11.10","2016.11.2","2016.11.3","2016.11.4","2016.11.5","2016.11.6","2016.11.7","2016.11.8","2016.11.9","2017.7.0","2017.7.0rc1","2017.7.1","2017.7.2","2017.7.3","2017.7.4","2017.7.5","2017.7.6","2017.7.7","2017.7.8","2018.3.0","2018.3.0rc1","2018.3.1","2018.3.2","2018.3.3","2018.3.4","2018.3.5","2019.2.0","2019.2.0rc1","2019.2.0rc2","2019.2.1","2019.2.2","2019.2.3","2019.2.4","2019.2.5","2019.2.6","2019.2.7","2019.2.8","3000","3000.0.0rc1","3000.0.0rc2","3000.1","3000.2","3000.3","3000.4","3000.5","3000.6","3000.7","3000.8","3000.9","3001","3001.1","3001.2","3001.3","3001.4","3001.5","3001.6","3001.7","3001.8","3001rc1","3002","3002.1","3002.2","3002.3","3002.4","3002.5","3002.6","3002.7","3002.8","3002.9","3002rc1"]},{"source":"osv","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2016.11.0"},{"fixed":"3003rc1"}]}],"versions":["2016.11.0","2016.11.1","2016.11.2","2016.11.3","2016.11.4","2016.11.5","2016.11.6","2016.11.7","2016.11.8","2016.11.9","2016.11.10","2017.7.0rc1","2017.7.0","2017.7.1","2017.7.2","2017.7.3","2017.7.4","2017.7.5","2017.7.6","2017.7.7","2017.7.8","2018.3.0rc1","2018.3.0","2018.3.1","2018.3.2","2018.3.3","2018.3.4","2018.3.5","2019.2.0rc1","2019.2.0rc2","2019.2.0","2019.2.1","2019.2.2","2019.2.3","2019.2.4","2019.2.5","2019.2.6","2019.2.7","2019.2.8","3000.0.0rc1","3000.0.0rc2","3000","3000.1","3000.2","3000.3","3000.4","3000.5","3000.6","3000.7","3000.8","3000.9","3001rc1","3001","3001.1","3001.2","3001.3","3001.4","3001.5","3001.6","3001.7","3002rc1","3002","3002.1","3002.2","3002.3","3002.4","3002.5","3002.6","3001.8","3002.7","3002.8","3002.9"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"golang-github-wrouesnel-postgres_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.7-5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"mgr-cfg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.2-5.15.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"mgr-custom-info","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-5.9.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"mgr-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.7-5.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"mgr-osad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.5-5.27.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"mgr-push","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.2-5.9.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"mgr-virtualization","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-5.17.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"rhnlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-12.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.10-43.75.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8-18.84.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.10-27.50.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"spacewalk-koan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-9.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"spacewalk-oscap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-6.15.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"spacewalk-remote-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-6.18.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"supportutils-plugin-susemanager-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.2-9.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"suseRegisterInfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-6.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"uyuni-common-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"golang-github-wrouesnel-postgres_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.7-5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"mgr-cfg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.2-5.15.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"mgr-custom-info","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-5.9.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"mgr-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.7-5.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"mgr-osad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.5-5.27.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"mgr-push","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.2-5.9.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"mgr-virtualization","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-5.17.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"rhnlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-12.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.10-43.75.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8-18.84.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.10-27.50.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"spacewalk-koan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-9.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"spacewalk-oscap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-6.15.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"spacewalk-remote-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-6.18.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"supportutils-plugin-susemanager-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.2-9.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"suseRegisterInfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-6.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"uyuni-common-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-8.41.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-8.41.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Transactional Server 15 SP3","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-8.41.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0+git20190806.32c4bae0-5.11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-3.6.5"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"grafana-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1-3.9.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"patterns-suse-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-6.9.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"prometheus-exporters-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1-3.22.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"py26-compat-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.10-6.14.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"py27-compat-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000.3-6.3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-3.12.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.25-4.32.6"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-branding","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.12-3.12.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.17-3.17.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.36-3.44.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.16-3.18.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.26-3.24.8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.26-3.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-build-keys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.4-3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-doc-indexes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-11.34.8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-11.34.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.21-3.30.6"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.28-3.42.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-sync-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.14-3.23.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"tika-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26-3.5.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"uyuni-common-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.8-3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000-46.142.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Advanced Systems Management 12","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000-46.142.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-8.41.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-8.41.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-8.41.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-8.41.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-37.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-37.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-37.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-37.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-37.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-37.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-37.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-37.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-37.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"python-distro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-3.5.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-37.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"python-distro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-3.5.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 2 15 SP2","package":"python-distro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-3.5.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 2 15 SP3","package":"python-distro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-3.5.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP2","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-37.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Transactional Server 15 SP2","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-37.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"python-distro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-3.5.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-37.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0+git20190806.32c4bae0-7.22.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"grafana-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.3-4.16.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"patterns-suse-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-9.19.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"prometheus-exporters-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.6-3.19.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"pxe-default-image-sle15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.1-20210621145802"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"py26-compat-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.10-10.28.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"py27-compat-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000.3-4.3.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.38-3.47.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.44-3.57.5"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.21-3.30.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.28-3.45.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.34-3.52.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"susemanager-doc-indexes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-10.36.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-10.36.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.35-3.48.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"tika-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26-3.6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2016.11.5+ds-1","2016.11.8+dfsg1-1","2017.7.2+dfsg1-2ubuntu1","2017.7.3+dfsg1-1","2017.7.4+dfsg1-1","2017.7.4+dfsg1-1ubuntu18.04.1","2017.7.4+dfsg1-1ubuntu18.04.2","2017.7.4+dfsg1-1ubuntu18.04.2+esm1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-lp152.3.36.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-8.41.8.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"python-distro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-3.5.1"}]}],"bundled":7}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"saltstack","product":"salt"}],"references":[{"url":"https://sec.stealthcopter.com/saltstack-snapper-minion-privledge-escaltion/","tags":["x_transferred","Exploit","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LDKMAJXYFHM4USVX3H5V2GCCBGASWUSM/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MBAHHSGZLEJRCG4DX6J4RBWJAAWH55RQ/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ACVT7M4YLZRLWWQ6SGRK3C6TOF4FXOXT/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BUWUF5VTENNP2ZYZBVFKPSUHLKLUBD5/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://www.debian.org/security/2021/dsa-5011","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.gentoo.org/glsa/202310-22","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-31607","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2021-56.yaml","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BUWUF5VTENNP2ZYZBVFKPSUHLKLUBD5","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ACVT7M4YLZRLWWQ6SGRK3C6TOF4FXOXT","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LDKMAJXYFHM4USVX3H5V2GCCBGASWUSM","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MBAHHSGZLEJRCG4DX6J4RBWJAAWH55RQ","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BUWUF5VTENNP2ZYZBVFKPSUHLKLUBD5","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ACVT7M4YLZRLWWQ6SGRK3C6TOF4FXOXT","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LDKMAJXYFHM4USVX3H5V2GCCBGASWUSM","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MBAHHSGZLEJRCG4DX6J4RBWJAAWH55RQ","tags":["web"]},{"url":"https://sec.stealthcopter.com/saltstack-snapper-minion-privledge-escaltion","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hcjf-rp5h-g5h3","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-31607","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LDKMAJXYFHM4USVX3H5V2GCCBGASWUSM/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-202114753-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1173557","tags":["report"]},{"url":"https://bugzilla.suse.com/1177884","tags":["report"]},{"url":"https://bugzilla.suse.com/1177928","tags":["report"]},{"url":"https://bugzilla.suse.com/1180583","tags":["report"]},{"url":"https://bugzilla.suse.com/1180584","tags":["report"]},{"url":"https://bugzilla.suse.com/1180585","tags":["report"]},{"url":"https://bugzilla.suse.com/1185178","tags":["report"]},{"url":"https://bugzilla.suse.com/1185281","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31607","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211688-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1173692","tags":["report"]},{"url":"https://bugzilla.suse.com/1185092","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211690-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1099976","tags":["report"]},{"url":"https://bugzilla.suse.com/1171257","tags":["report"]},{"url":"https://bugzilla.suse.com/1172110","tags":["report"]},{"url":"https://bugzilla.suse.com/1174855","tags":["report"]},{"url":"https://bugzilla.suse.com/1176293","tags":["report"]},{"url":"https://bugzilla.suse.com/1177474","tags":["report"]},{"url":"https://bugzilla.suse.com/1179831","tags":["report"]},{"url":"https://bugzilla.suse.com/1180101","tags":["report"]},{"url":"https://bugzilla.suse.com/1180818","tags":["report"]},{"url":"https://bugzilla.suse.com/1181290","tags":["report"]},{"url":"https://bugzilla.suse.com/1181347","tags":["report"]},{"url":"https://bugzilla.suse.com/1181368","tags":["report"]},{"url":"https://bugzilla.suse.com/1181550","tags":["report"]},{"url":"https://bugzilla.suse.com/1181556","tags":["report"]},{"url":"https://bugzilla.suse.com/1181557","tags":["report"]},{"url":"https://bugzilla.suse.com/1181558","tags":["report"]},{"url":"https://bugzilla.suse.com/1181559","tags":["report"]},{"url":"https://bugzilla.suse.com/1181560","tags":["report"]},{"url":"https://bugzilla.suse.com/1181561","tags":["report"]},{"url":"https://bugzilla.suse.com/1181562","tags":["report"]},{"url":"https://bugzilla.suse.com/1181563","tags":["report"]},{"url":"https://bugzilla.suse.com/1181564","tags":["report"]},{"url":"https://bugzilla.suse.com/1181565","tags":["report"]},{"url":"https://bugzilla.suse.com/1182281","tags":["report"]},{"url":"https://bugzilla.suse.com/1182293","tags":["report"]},{"url":"https://bugzilla.suse.com/1182740","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25282","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3197","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211951-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1186674","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212098-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1151558","tags":["report"]},{"url":"https://bugzilla.suse.com/1172711","tags":["report"]},{"url":"https://bugzilla.suse.com/1175216","tags":["report"]},{"url":"https://bugzilla.suse.com/1178767","tags":["report"]},{"url":"https://bugzilla.suse.com/1180673","tags":["report"]},{"url":"https://bugzilla.suse.com/1182744","tags":["report"]},{"url":"https://bugzilla.suse.com/1183573","tags":["report"]},{"url":"https://bugzilla.suse.com/1183649","tags":["report"]},{"url":"https://bugzilla.suse.com/1183845","tags":["report"]},{"url":"https://bugzilla.suse.com/1183864","tags":["report"]},{"url":"https://bugzilla.suse.com/1184005","tags":["report"]},{"url":"https://bugzilla.suse.com/1184286","tags":["report"]},{"url":"https://bugzilla.suse.com/1184311","tags":["report"]},{"url":"https://bugzilla.suse.com/1184332","tags":["report"]},{"url":"https://bugzilla.suse.com/1184351","tags":["report"]},{"url":"https://bugzilla.suse.com/1184361","tags":["report"]},{"url":"https://bugzilla.suse.com/1184471","tags":["report"]},{"url":"https://bugzilla.suse.com/1184475","tags":["report"]},{"url":"https://bugzilla.suse.com/1184561","tags":["report"]},{"url":"https://bugzilla.suse.com/1184617","tags":["report"]},{"url":"https://bugzilla.suse.com/1184849","tags":["report"]},{"url":"https://bugzilla.suse.com/1184892","tags":["report"]},{"url":"https://bugzilla.suse.com/1184929","tags":["report"]},{"url":"https://bugzilla.suse.com/1184940","tags":["report"]},{"url":"https://bugzilla.suse.com/1185042","tags":["report"]},{"url":"https://bugzilla.suse.com/1185097","tags":["report"]},{"url":"https://bugzilla.suse.com/1185506","tags":["report"]},{"url":"https://bugzilla.suse.com/1185568","tags":["report"]},{"url":"https://bugzilla.suse.com/1185965","tags":["report"]},{"url":"https://bugzilla.suse.com/1186025","tags":["report"]},{"url":"https://bugzilla.suse.com/1186124","tags":["report"]},{"url":"https://bugzilla.suse.com/1186346","tags":["report"]},{"url":"https://bugzilla.suse.com/1186508","tags":["report"]},{"url":"https://bugzilla.suse.com/1186765","tags":["report"]},{"url":"https://bugzilla.suse.com/1186852","tags":["report"]},{"url":"https://bugzilla.suse.com/1186858","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28657","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212102-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212104-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1182382","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25315","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212105-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25592","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212106-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212114-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1182817","tags":["report"]},{"url":"https://bugzilla.suse.com/1184283","tags":["report"]},{"url":"https://bugzilla.suse.com/1184861","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-31607","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-31607","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/6E3YAO2VV3WBUS7PMAT26ZYDS3AXW5VL/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BSSCTPCNB3RDCWJ6DOALIIRKDXUAVGPB/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MU6P3NIODW6ZMC4HZLBROO6ZEOD5KAUX/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14695","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21996","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-31607","description":"In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely).","status":"published","published":"2021-04-23T00:00:00Z","modified":"2024-08-03T23:03:33.642Z","updated_at":"2026-11-02T14:33:05.331617Z"}],"euvd":[{"id":"EUVD-2021-0233","description":"In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely).","status":"published","published":"2021-04-23T00:00:00Z","modified":"2024-08-03T23:03:33Z","updated_at":"2026-11-03T03:24:38.977347Z"}],"ghsa":[{"id":"GHSA-hcjf-rp5h-g5h3","title":"Command Injection in SaltStack Salt","description":"In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely).","status":"published","published":"2022-05-24T17:48:21Z","modified":"2024-10-23T18:32:09Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-77","CWE-78"],"updated_at":"2026-11-02T14:38:13.09489Z"}],"nvd":[{"id":"CVE-2021-31607","description":"In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely).","status":"published","published":"2021-04-23T06:15:07.893Z","modified":"2026-06-17T03:52:04.19Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:06:52.03307Z"}],"osv":[{"id":"ALPINE-CVE-2021-31607","description":"In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely).","status":"published","published":"2021-04-23T06:15:07.893Z","modified":"2026-11-03T06:32:33.36233276Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:20.312441Z"},{"id":"CVE-2021-31607","description":"In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely).","status":"published","published":"2021-04-23T06:15:07.893Z","modified":"2026-10-24T10:31:06.533992902Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:19.483607Z"},{"id":"GHSA-hcjf-rp5h-g5h3","title":"Command Injection in SaltStack Salt","description":"In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely).","status":"published","published":"2022-05-24T17:48:21Z","modified":"2024-10-23T18:51:50.437527Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-77","CWE-78"],"updated_at":"2026-11-02T15:46:48.920784Z"},{"id":"UBUNTU-CVE-2021-31607","description":"In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely).","status":"published","published":"2021-04-23T06:15:00Z","modified":"2026-04-02T18:33:22.938165Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:27.332852Z"},{"id":"DLA-2815-1","title":"salt - security update","status":"published","published":"2021-11-10T00:00:00Z","modified":"2026-03-09T01:22:27.852462Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"openSUSE-SU-2021:0899-1","title":"Security update for salt","description":"This update for salt fixes the following issues:\n\nUpdate to Salt release version 3002.2 (jsc#ECO-3212, jsc#SLE-18033, jsc#SLE-18028) \n\n- Check if dpkgnotify is executable (bsc#1186674)\n- Drop support for Python2. Obsoletes `python2-salt` package (jsc#SLE-18028)\n- virt module updates\n  * network: handle missing ipv4 netmask attribute\n  * more network support\n  * PCI/USB host devices passthrough support\n- Set distro requirement to oldest supported version in requirements/base.txt\n- Bring missing part of async batch implementation back (CVE-2021-25315, bsc#1182382)\n- Always require `python3-distro` (bsc#1182293)\n- Remove deprecated warning that breaks minion execution when 'server_id_use_crc' opts is missing\n- Fix pkg states when DEB package has 'all' arch\n- Do not force beacons configuration to be a list.\n- Remove msgpack \u003c 1.0.0 from base requirements (bsc#1176293)\n- msgpack support for version \u003e= 1.0.0 (bsc#1171257)\n- Fix issue parsing errors in ansiblegate state module\n- Prevent command injection in the snapper module (bsc#1185281, CVE-2021-31607)\n- transactional_update: detect recursion in the executor\n- Add subpackage salt-transactional-update (jsc#SLE-18033)\n- Improvements on 'ansiblegate' module (bsc#1185092):\n  * New methods: ansible.targets / ansible.discover_playbooks\n- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)\n- Regression fix of salt-ssh on processing targets\n- Update target fix for salt-ssh and avoiding race condition on salt-ssh event processing (bsc#1179831, bsc#1182281)\n- Add notify beacon for Debian/Ubuntu systems\n- Fix zmq bug that causes salt-call to freeze (bsc#1181368)\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.\n","status":"published","published":"2021-06-23T12:34:14Z","modified":"2026-02-04T02:41:14.130882Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:1951-1","title":"Security update for salt","description":"This update for salt fixes the following issues:\n\n- Check if dpkgnotify is executable (bsc#1186674)\n- Update to Salt release version 3002.2 (jsc#ECO-3212, jsc#SLE-18033, jsc#SLE-18028)\n- Drop support for Python2. Obsoletes `python2-salt` package (jsc#SLE-18028)\n- Fix issue parsing errors in ansiblegate state module\n- Prevent command injection in the snapper module (bsc#1185281, CVE-2021-31607)\n- transactional_update: detect recursion in the executor\n- Add subpackage `salt-transactional-update` (jsc#SLE-18033)\n- Remove duplicate directories\n","status":"published","published":"2021-07-11T09:06:25Z","modified":"2026-02-04T04:01:23.418213Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:2106-1","title":"Security update for salt","description":"This update for salt fixes the following issues:\n\nUpdate to Salt release version 3002.2 (jsc#ECO-3212, jsc#SLE-18033, jsc#SLE-18028) \n\n- Check if dpkgnotify is executable (bsc#1186674)\n- Drop support for Python2. Obsoletes `python2-salt` package (jsc#SLE-18028)\n- virt module updates\n  * network: handle missing ipv4 netmask attribute\n  * more network support\n  * PCI/USB host devices passthrough support\n- Set distro requirement to oldest supported version in requirements/base.txt\n- Bring missing part of async batch implementation back (CVE-2021-25315, bsc#1182382)\n- Always require `python3-distro` (bsc#1182293)\n- Remove deprecated warning that breaks minion execution when 'server_id_use_crc' opts is missing\n- Fix pkg states when DEB package has 'all' arch\n- Do not force beacons configuration to be a list.\n- Remove msgpack \u003c 1.0.0 from base requirements (bsc#1176293)\n- msgpack support for version \u003e= 1.0.0 (bsc#1171257)\n- Fix issue parsing errors in ansiblegate state module\n- Prevent command injection in the snapper module (bsc#1185281, CVE-2021-31607)\n- transactional_update: detect recursion in the executor\n- Add subpackage salt-transactional-update (jsc#SLE-18033)\n- Improvements on 'ansiblegate' module (bsc#1185092):\n  * New methods: ansible.targets / ansible.discover_playbooks\n- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)\n- Regression fix of salt-ssh on processing targets\n- Update target fix for salt-ssh and avoiding race condition on salt-ssh event processing (bsc#1179831, bsc#1182281)\n- Add notify beacon for Debian/Ubuntu systems\n- Fix zmq bug that causes salt-call to freeze (bsc#1181368)\n","status":"published","published":"2021-07-11T12:04:10Z","modified":"2026-02-04T02:51:04.293977Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:11364-1","title":"python3-salt-3002.2-6.1 on GA media","description":"These are all security issues fixed in the python3-salt-3002.2-6.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:54:00.752468Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"PYSEC-2021-56","description":"In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely).","status":"published","published":"2021-04-23T06:15:00Z","modified":"2023-11-08T04:05:50.055462Z","updated_at":"2026-11-02T15:52:53.119977Z"},{"id":"SUSE-SU-2021:14753-1","title":"Security update for SUSE Manager Client Tools","description":"This update fixes the following issues:\n\ngolang-github-wrouesnel-postgres_exporter:\n\n- Add support for aarch64\n\nmgr-cfg:\n\n- SPEC: Updated Python definitions for RHEL8 and quoted text comparisons.\n\nmgr-custom-info:\n\n- Update package version to 4.2.0\n\nmgr-daemon:\n\n- Update translation strings\n- Update the translations from weblate\n- Added quotes around %{_vendor} token for the if statements in spec file.\n- Fix removal of mgr-deamon with selinux enabled (bsc#1177928)\n- Updating translations from weblate\n\nmgr-osad:\n\n- Change the log file permissions as expected by logrotate (bsc#1177884)\n- Change deprecated path /var/run into /run for systemd (bsc#1185178)\n- Python fixes\n- Removal of RHEL5\n\nmgr-push:\n\n- Defined __python for python2.\n- Excluded RHEL8 for Python 2 build.\n\nmgr-virtualization:\n\n- Update package version to 4.2.0\n\nrhnlib:\n\n- Update package version to 4.2.0\n\nsalt:\n\n- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)\n\nspacecmd:\n\n- Rename system migration to system transfer\n- Rename SP to product migration\n- Update translation strings\n- Add group_addconfigchannel and group_removeconfigchannel\n- Add group_listconfigchannels and configchannel_listgroups\n- Fix spacecmd compat with Python 3\n- Deprecated 'Software Crashes' feature\n- Document advanced package search on '--help' (bsc#1180583)\n- Fixed advanced search on 'package_listinstalledsystems'\n- Fixed duplicate results when using multiple search criteria (bsc#1180585)\n- Fixed 'non-advanced' package search when using multiple package names (bsc#1180584)\n- Update translations\n- Fix: make spacecmd build on Debian\n- Add Service Pack migration operations (bsc#1173557)\n\nspacewalk-client-tools:\n\n- Update the translations from weblate\n- Drop the --noSSLServerURL option\n- Updated RHEL Python requirements.\n- Added quotes around %{_vendor}.\n\nspacewalk-koan:\n\n- Fix for spacewalk-koan test\n\nspacewalk-oscap:\n\n- Update package version to 4.2.0\n\nspacewalk-remote-utils:\n\n- Update package version to 4.2.0\n\nsupportutils-plugin-susemanager-client:\n\n- Update package version to 4.2.0\n\nsuseRegisterInfo:\n\n- Add support for Amazon Linux 2\n- Add support for Alibaba Cloud Linux 2\n- Adapted for RHEL build.\n\nuyuni-base:\n- Added Apache as prerequisite for RHEL and Fedora (due to required users).\n- Removed RHEL specific folder rights from SPEC file.\n- Added RHEL8 compatibility.\n\nuyuni-common-libs:\n\n- Cleaning up unused Python 2 build leftovers.\n- Disabled debug package build.\n\n","status":"published","published":"2021-06-21T17:19:45Z","modified":"2026-02-04T02:58:06.527117Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1688-1","title":"Security Beta update for Salt","description":"\nThis update fixes the following issues:\n\nsalt:\n\n- Parsing Epoch out of version provided during pkg remove (bsc#1173692)\n- Fix issue parsing errors in ansiblegate state module\n- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)\n- Transactional_update: detect recursion in the executor\n- Add subpackage salt-transactional-update\n- Remove duplicate directories from specfile\n- Improvements on 'ansiblegate' module (bsc#1185092):\n  * New methods: ansible.targets / ansible.discover_playbooks\n  * General bugfixes\n\n","status":"published","published":"2021-05-21T14:41:54Z","modified":"2026-02-04T02:40:13.623357Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1690-1","title":"Security Beta update for Salt","description":"This update fixes the following issues:\n\nsalt:\n\n- Update to Salt release version 3002.2 (jsc#ECO-3212)  \n- Drop support for Python2. Obsoletes 'python2-salt' package\n- Virt module updates\n  * network: handle missing ipv4 netmask attribute\n  * more network support\n  * PCI/USB host devices passthrough support\n- Set distro requirement to oldest supported version in requirements/base.txt\n- Bring missing part of async batch implementation back\n- Always require python3-distro (bsc#1182293)\n- Remove deprecated warning that breaks minion execution when 'server_id_use_crc' opts is missing\n- Remove msgpack \u003c 1.0.0 from base requirements (bsc#1176293)\n- Msgpack support for version \u003e= 1.0.0 (bsc#1171257)\n- Fix issue parsing errors in ansiblegate state module\n- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)\n- Transactional_update: detect recursion in the executor\n- Add subpackage salt-transactional-update\n- Remove duplicate directories from specfile\n- Improvements on 'ansiblegate' module (bsc#1185092):\n  * New methods: ansible.targets / ansible.discover_playbooks\n- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)\n- Regression fix of salt-ssh on processing targets\n- Update target fix for salt-ssh and avoiding race condition\n  on salt-ssh event processing (bsc#1179831, bsc#1182281)\n- Add notify beacon for Debian/Ubuntu systems\n- Fix zmq bug that causes salt-call to freeze (bsc#1181368)\n- Add core grains support for AlmaLinux\n- Allow vendor change option with zypper\n- Virt: virtual network backports to Salt 3000\n- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)\n- Only require python-certifi for CentOS7\n- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)\n- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)\n- Fix recursion false detection in payload (bsc#1180101)\n- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)\n- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)\n- Always require python-certifi (used by salt.ext.tornado)\n- Exclude SLE 12 from requiring python-certifi\n- Do not crash when unexpected cmd output at listing patches (bsc#1181290)\n- Fix behavior for 'onlyif/unless' when multiple conditions (bsc#1180818)\n- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)\n- Allow extra_filerefs as sanitized kwargs for SSH client\n- Fix errors with virt.update\n- Fix for multiple for security issues\n  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)\n  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)\n  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)\n  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)\n- Virt: search for grub.xen path\n- Xen spicevmc, DNS SRV records backports:\n  Fix virtual network generated DNS XML for SRV records\n  Don't add spicevmc channel to xen VMs\n- Virt UEFI fix: virt.update when efi=True\n- Revert wrong zypper  patch to support vendorchanges flags on pkg.install\n\n","status":"published","published":"2021-05-21T14:42:41Z","modified":"2026-02-04T02:47:49.54557Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1951-1","title":"Security update for salt","description":"This update for salt fixes the following issues:\n\n- Check if dpkgnotify is executable (bsc#1186674)\n- Update to Salt release version 3002.2 (jsc#ECO-3212, jsc#SLE-18033, jsc#SLE-18028)\n- Drop support for Python2. Obsoletes `python2-salt` package (jsc#SLE-18028)\n- Fix issue parsing errors in ansiblegate state module\n- Prevent command injection in the snapper module (bsc#1185281, CVE-2021-31607)\n- transactional_update: detect recursion in the executor\n- Add subpackage `salt-transactional-update` (jsc#SLE-18033)\n- Remove duplicate directories\n","status":"published","published":"2021-06-10T14:06:21Z","modified":"2026-02-04T03:09:01.414661Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:2098-1","title":"Security update for SUSE Manager Server 4.1","description":"This update fixes the following issues:\n\ncobbler:\n\n- Make `fence_ipmitool` a wrapper for `fence_ipmilan` using always `lanplus`. (bsc#1184361)\n- Remove unused template for `fence_ipmitool`.\n- Prevent some race conditions when writting tftpboot files and the destination directory is not existing. (bsc#1186124)\n- Fix trail stripping in case of using UTF symbols. (bsc#1184561)\n\ngolang-github-prometheus-node_exporter:\n\n- Update to 1.1.2\n  * Bug fixes\n    + Handle errors from disabled PSI subsystem\n    + Sanitize strings from /sys/class/power_supply\n    + Silence missing netclass errors\n    + Fix ineffassign issue\n    + Fix some noisy log lines\n    + filesystem_freebsd: Fix label values\n    + Fix various procfs parsing errors\n    + Handle no data from powersupplyclass\n    + udp_queues_linux.go: change upd to udp in two error strings\n    + Fix node_scrape_collector_success behaviour\n    + Fix NodeRAIDDegraded to not use a string rule expressions\n    + Fix node_md_disks state label from fail to failed\n    + Handle EPERM for syscall in timex collector\n    + bcache: fix typo in a metric name\n    + Fix XFS read/write stats\n  * Changes\n    + Improve filter flag names\n    + Add btrfs and powersupplyclass to list of exporters enabled by default\n  * Features\n    + Add fibre channel collector\n    + Expose cpu bugs and flags as info metrics\n    + Add network_route collector\n    + Add zoneinfo collector\n  * Enhancements\n    + Add more InfiniBand counters\n    + Add flag to aggr ipvs metrics to avoid high cardinality metrics\n    + Adding backlog/current queue length to qdisc collector\n    + Include TCP OutRsts in netstat metrics\n    + Add pool size to entropy collector\n    + Remove CGO dependencies for OpenBSD amd64\n    + bcache: add writeback_rate_debug status\n    + Add check state for mdadm arrays via node_md_state metric\n    + Expose XFS inode statistics\n    + Expose zfs zpool state\n    + Added an ability to pass collector.supervisord.url via SUPERVISORD_URL environment variable\n- Do not include sources (bsc#1151558)\n- Remove rc symlink\n\ngrafana-formula:\n\n- Fix Grafana dashboards requiring single series (bsc#1184471)\n\npatterns-suse-manager:\n\n- Add require for py27-compat-salt (salt 3002 does not provide\n  python2-salt anymore) \n\nprometheus-exporter-formula:\n\n- Add support for schema migration (bsc#1186025)\n\npxe-yomi-image-sle15:\n\n- Remove PermitEmptyPasswords from SSH config (Fix bsc#1182744)\n\npy26-compat-salt:\n\n- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)\n\nspacewalk-admin:\n\n- Stop jabberd when osa-dispatcher is enabled (bsc#1185042)\n\nspacewalk-backend:\n\n\n- Fix binary blob corruptions in tradidional config file deployment (bsc#1183864)\n- Fix for GPG checking on synchonizing mirrored dpkg repo (bsc#1184351)\n- switch to www group for satellite logs (bsc#1185097)\n- Fail traditional errata and package actions when they act on retracted items\n- Add advisory_status to reposync and ISS\n- Add minrate/timeout configuration values for downloading DEB/RPM packages\n\nspacewalk-branding:\n\n- Add the CSS class for retracted errata/packages\n\nspacewalk-certs-tools:\n\n\n- Add support of DISABLE_LOCAL_REPOS=0 for salt minions (bsc#1185568)\n- Add missing environment variable SALT_RUNNING for pkg module to the minion configuration\n- Fix typo: activaion -\u003e activation\n\nspacewalk-java:\n\n- Change Prometheus exporters formula data schema to make it more generic and extendable\n- Do not require advisory_status to be set in ErrataHandler.create (bsc#1185965)\n- Speed up pages to compare or add packages to channels (bsc#1178767)\n- Bugfix: Remove the unneeded check that was stopping updating a virtual instance\n  type (bsc#1180673)\n- Exclude minions from the list of locally-managed/sandbox systems when copying config\n  files (bsc#1184940)\n- Lower case fqdn comparation when calculating minion connection path (bsc#1184849)\n- Bugfix: Retracted Patches: Filter minion correctly when executing package\n  install (bsc#1184929)\n- Implement retracted patches\n- For a SUSE system get metadata and package from same source (bsc#1184475)\n- Check if the directory exists prior to modular data cleanup (bsc#1184311)\n- Assign right base product for res8 (bsc#1184005)\n- Fix docs link in my organization configuration (bsc#1184286)\n- Only update the kickstart path in cobbler if necessary (bsc#1175216)\n\nspacewalk-utils:\n\n- Bugfix for ubuntu-18.04 repo urls: multiverse, restricted and backports\n- Add multiverse, restricted and backports to Ubuntu 16.04, 18.04 and 20.04\n\nspacewalk-web:\n\n- Upgrade react-select to 4.3.0 and lodash to 4.17.21\n- Show the info about unsynced patches in the Content Lifecycle Management screens\n\nsusemanager:\n\n- Add bootstrap repo data for SUSE Manager 4.1 Proxy\n- Require gio-branding-SLE for SLE15 but not for openSUSE Leap 15\n- Add bootstrap repo data for OES2018-SP3-x86_64 (bsc#1183845)\n- Enable bootstrap repository creation for openSUSE Leap 15.3 for Uyuni\n- Add python3-distro to RES8, SLE15, Ubuntu20.04 and Debian 10 bootstrap\n  repositories to fix bootstrapping issues (bsc#1184332)\n- Add python3-pycryptodome to Ubuntu and Debian 10 bootstrap repos (bsc#1186346)\n- Add gnupg and its dependencies to debian 10 bootstrap repo\n\nsusemanager-build-keys:\n\n- Add SUSE Linux Enterprise 15-SP3 Updates for openSUSE Leap 15.3 key (bsc#1186852)\n\nsusemanager-doc-indexes:\n\n- Adds additional dependencies for Debian client registration\n  in Client Configuration Guide (bsc#1183649)\n- Remove some openSUSE Leap 15.1 references\n- Add reposync configuration settings to Troubleshooting chapter of\n  the Administration Guide\n- Update the entry about module.run for SAP Guide\n\nsusemanager-docs_en:\n\n- Adds additional dependencies for Debian client registration\n  in Client Configuration Guide (bsc#1183649)\n- Remove some openSUSE Leap 15.1 references\n- Add reposync configuration settings to Troubleshooting chapter of\n  the Administration Guide\n- Update the entry about module.run for SAP Guide\n\nsusemanager-schema:\n\n- DB schema \u0026 migrations for retracted patches\n\nsusemanager-sls:\n\n- Exclude openSUSE Leap 15.3 from product installation (bsc#1186858)\n- Enable certificate deployment for Leap 15.3 clients which is needed for bootstrapping (bsc#1186765)\n- Do not install python2-salt on Salt 3002.2 Docker build hosts (bsc#1185506)\n- Add support for 'disable_local_repos' salt minion config parameter(bsc#1185568)\n- Fix insecure JMX configuration (bsc#1184617)\n- Avoid conflicts with running ioloop on mgr_events engine (bsc#1172711)\n- Keep salt-minion when it is installed to prevent update problems with\n  dependend packages not available in the bootstrap repo (bsc#1183573)\n- Fix installation of gnupg on Debian 10\n\nsusemanager-sync-data:\n\n- Add OES2018 SP3 (bsc#1183845)\n\ntika-core:\n\n- New upstream version 1.26.\n  * Infinite loop in the MP3Parser (bsc#1184892 CVE-2021-28657)\n  * Out of memory error while loading a file in PDFBox before 2.0.23.\n  * Infinite loop while loading a file in PDFBox before 2.0.23.\n  * System.exit vulnerability in Tika's OneNote Parser; out of memory errors and/or infinite loops in Tika's \n    ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser and ImageParser.\n  * Excessive memory usage (DoS) vulnerability in Apache Tika's PSDParser\n  * Infinite Loop (DoS) vulnerability in Apache Tika's PSDParser\n\nuyuni-common-libs:\n\n- Maintainer field in debian packages are only recommended (bsc#1186508)\n\nHow to apply this update:\n\n1. Log in as root user to the SUSE Manager server.\n2. Stop the Spacewalk service:\n`spacewalk-service stop`\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Start the Spacewalk service:\n`spacewalk-service start`\n\n","status":"published","published":"2021-06-21T17:18:22Z","modified":"2026-02-04T02:27:23.930351Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:2102-1","title":"Security update for Salt","description":"This update fixes the following issues:\n\nsalt:\n\n- Parsing Epoch out of version provided during pkg remove (bsc#1173692)\n- Fix issue parsing errors in ansiblegate state module\n- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)\n- Transactional_update: detect recursion in the executor\n- Add subpackage salt-transactional-update\n- Remove duplicate directories from specfile\n- Improvements on 'ansiblegate' module (bsc#1185092):\n  * New methods: ansible.targets / ansible.discover_playbooks\n  * General bugfixes\n- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)\n- Regression fix of salt-ssh on processing targets\n- Update target fix for salt-ssh and avoiding race condition\n  on salt-ssh event processing (bsc#1179831, bsc#1182281)\n- Add notify beacon for Debian/Ubuntu systems\n- Fix zmq bug that causes salt-call to freeze (bsc#1181368)\n\n","status":"published","published":"2021-06-21T17:20:48Z","modified":"2026-02-04T03:54:35.149133Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:2104-1","title":"Security update for Salt","description":"This update fixes the following issues:\n\nsalt:\n\nUpdate to Salt release version 3002.2 (jsc#ECO-3212, jsc#SLE-18033, jsc#SLE-18028)\n\n- Check if dpkgnotify is executable (bsc#1186674)\n- Drop support for Python2. Obsoletes `python2-salt` package (jsc#SLE-18028)\n- Virt module updates\n  * network: handle missing ipv4 netmask attribute\n  * more network support\n  * PCI/USB host devices passthrough support\n- Set distro requirement to oldest supported version in requirements/base.txt\n- Bring missing part of async batch implementation back (bsc#1182382, CVE-2021-25315)\n- Always require python3-distro (bsc#1182293)\n- Remove deprecated warning that breaks minion execution when 'server_id_use_crc' opts is missing\n- Fix pkg states when DEB package has 'all' arch\n- Do not force beacons configuration to be a list.\n- Remove msgpack \u003c 1.0.0 from base requirements (bsc#1176293)\n- Msgpack support for version \u003e= 1.0.0 (bsc#1171257)\n- Fix issue parsing errors in ansiblegate state module\n- Prevent command injection in the snapper module (bsc#1185281, CVE-2021-31607)\n- Transactional_update: detect recursion in the executor\n- Add subpackage salt-transactional-update (jsc#SLE-18033)\n- Remove duplicate directories from specfile\n- Improvements on 'ansiblegate' module (bsc#1185092):\n  * New methods: ansible.targets / ansible.discover_playbooks\n- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)\n- Regression fix of salt-ssh on processing targets\n- Update target fix for salt-ssh and avoiding race condition on salt-ssh event processing (bsc#1179831, bsc#1182281)\n- Add notify beacon for Debian/Ubuntu systems\n- Fix zmq bug that causes salt-call to freeze (bsc#1181368)\n\n","status":"published","published":"2021-06-21T17:24:36Z","modified":"2026-02-04T03:37:37.49403Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:2105-1","title":"Security update for salt","description":"This update for salt fixes the following issues:\n\nUpdate to Salt release version 3002.2 (jsc#ECO-3212, jsc#SLE-18033, jsc#SLE-18028)\n\n- Check if dpkgnotify is executable (bsc#1186674)\n- Drop support for Python2. Obsoletes `python2-salt` package (jsc#SLE-18028)\n- virt module updates\n  * network: handle missing ipv4 netmask attribute\n  * more network support\n  * PCI/USB host devices passthrough support\n- Set distro requirement to oldest supported version in requirements/base.txt\n- Bring missing part of async batch implementation back (bsc#1182382, CVE-2021-25315)\n- Always require python3-distro (bsc#1182293)\n- Remove deprecated warning that breaks minion execution when 'server_id_use_crc' opts is missing\n- Fix pkg states when DEB package has 'all' arch\n- Do not force beacons configuration to be a list.\n- Remove msgpack \u003c 1.0.0 from base requirements (bsc#1176293)\n- msgpack support for version \u003e= 1.0.0 (bsc#1171257)\n- Fix issue parsing errors in ansiblegate state module\n- Prevent command injection in the snapper module (bsc#1185281, CVE-2021-31607)\n- transactional_update: detect recursion in the executor\n- Add subpackage salt-transactional-update (jsc#SLE-18033)\n- Remove duplicate directories from specfile\n- Improvements on 'ansiblegate' module (bsc#1185092):\n  * New methods: ansible.targets / ansible.discover_playbooks\n- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)\n- Regression fix of salt-ssh on processing targets\n- Update target fix for salt-ssh and avoiding race condition on salt-ssh event processing (bsc#1179831, bsc#1182281)\n- Add notify beacon for Debian/Ubuntu systems\n- Fix zmq bug that causes salt-call to freeze (bsc#1181368)\n","status":"published","published":"2021-06-21T17:25:20Z","modified":"2025-05-02T04:29:53.483423Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:2106-1","title":"Security update for salt","description":"This update for salt fixes the following issues:\n\nUpdate to Salt release version 3002.2 (jsc#ECO-3212, jsc#SLE-18033, jsc#SLE-18028) \n\n- Check if dpkgnotify is executable (bsc#1186674)\n- Drop support for Python2. Obsoletes `python2-salt` package (jsc#SLE-18028)\n- virt module updates\n  * network: handle missing ipv4 netmask attribute\n  * more network support\n  * PCI/USB host devices passthrough support\n- Set distro requirement to oldest supported version in requirements/base.txt\n- Bring missing part of async batch implementation back (CVE-2021-25315, bsc#1182382)\n- Always require `python3-distro` (bsc#1182293)\n- Remove deprecated warning that breaks minion execution when 'server_id_use_crc' opts is missing\n- Fix pkg states when DEB package has 'all' arch\n- Do not force beacons configuration to be a list.\n- Remove msgpack \u003c 1.0.0 from base requirements (bsc#1176293)\n- msgpack support for version \u003e= 1.0.0 (bsc#1171257)\n- Fix issue parsing errors in ansiblegate state module\n- Prevent command injection in the snapper module (bsc#1185281, CVE-2021-31607)\n- transactional_update: detect recursion in the executor\n- Add subpackage salt-transactional-update (jsc#SLE-18033)\n- Improvements on 'ansiblegate' module (bsc#1185092):\n  * New methods: ansible.targets / ansible.discover_playbooks\n- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)\n- Regression fix of salt-ssh on processing targets\n- Update target fix for salt-ssh and avoiding race condition on salt-ssh event processing (bsc#1179831, bsc#1182281)\n- Add notify beacon for Debian/Ubuntu systems\n- Fix zmq bug that causes salt-call to freeze (bsc#1181368)\n","status":"published","published":"2021-06-21T17:26:18Z","modified":"2026-02-04T03:32:29.643899Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:2114-1","title":"Security update for SUSE Manager Server 4.0","description":"\nThis update fixes the following issues:\n\ncobbler:\n\n- Make 'fence_ipmitool' a wrapper for 'fence_ipmilan' using always lanplus (bsc#1184361)\n- Remove unused template for fence_ipmitool.\n- Prevent some race conditions when writing tftpboot files and\n  the destination directory is not existing (bsc#1186124)\n- Fix trail stripping in case of using UTF symbols (bsc#1184561)\n\ngrafana-formula:\n\n- Fix Grafana dashboards requiring single series (bsc#1184471)\n\npatterns-suse-manager:\n\n- Add require for py27-compat-salt (salt 3002 does not provide\n  python2-salt anymore) \n\nprometheus-exporters-formula:\n\n- Move exporters configurations to dedicated group `prometheus_exporters`\n- Add formula data schema migration script\n- This version changes the formula data schema and is not backwards compatible.\n  Downgrading from this version will require reconfiguring the formula for all your\n  minions.\n- Add Ubuntu support for Prometheus exporters' reverse proxy\n\npxe-default-image-sle15:\n\n- Adapt rpm-properties.xml for containment-rpm-pxe v0.2.1 and newer\n\npy26-compat-salt:\n\n- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)\n\nspacewalk-backend:\n\n- Maintainer field in debian packages are only recommended (bsc#1186508)\n- Switch to www group for satellite logs (bsc#1185097)\n\nspacewalk-java:\n\n- Change Prometheus exporters formula data schema to make it more generic and extendable\n- Adapt logging for testing accessability of URLs (bsc#1182817)\n- Fix problem reading product_tree.json from wrong location in offline setups (bsc#1184283)\n- For a SUSE system get metadata and package from same source (bsc#1184475)\n- Check if the directory exists prior to modular data cleanup (bsc#1184311)\n- Assign right base product for res8 (bsc#1184005)\n- Fix check for for mirrorlist URLs when refreshing products (bsc#1184861)\n\nspacewalk-utils:\n\n- Bugfix for ubuntu-18.04 repo urls: multiverse, restricted and backports\n- Add multiverse, restricted and backports to Ubuntu 16.04, 18.04 and 20.04\n\nspacewalk-web:\n\n- Update the WebUI version to 4.0.14\n\nsusemanager:\n\n- Add python3-pycryptodome to Ubuntu 18 and 20 bootstrap repos (bsc#1186346)\n- Require gio-branding-SLE for SLE15 but not for openSUSE Leap 15\n- Add python3-distro to RES8, SLE15 and Ubuntu20.04 bootstrap\n  repositories to fix bootstrapping issues (bsc#1184332)\n\nsusemanager-doc-indexes:\n\n- Update for Disconnected Setup chapter in Administration Guide  \n\nsusemanager-docs_en:\n\n- Update for Disconnected Setup chapter in Administration Guide \n\nsusemanager-sls:\n\n- Do not install python2-salt on Salt 3002.2 Docker build hosts (bsc#1185506)\n- Fix insecure JMX configuration (bsc#1184617)\n- Avoid conflicts with running ioloop on mgr_events engine (bsc#1172711)\n\ntika-core:\n\n- New upstream version 1.26. Fixes:\n  * Infinite loop in the MP3Parser (bsc#1184892, CVE-2021-28657)\n  * Out of memory error while loading a file in PDFBox before 2.0.23.\n  * Infinite loop while loading a file in PDFBox before 2.0.23.\n  * System.exit vulnerability in Tika's OneNote Parser; out of memory errors\n     and/or infinite loops in Tika's ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser,\n     OneNoteParser and ImageParser.\n  * Excessive memory usage (DoS) vulnerability in Apache Tika's PSDParser\n  * Infinite Loop (DoS) vulnerability in Apache Tika's PSDParser \n\nHow to apply this update:\n1. Log in as root user to the SUSE Manager server.\n2. Stop the Spacewalk service:\n`spacewalk-service stop`\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Upgrade the database schema:\n`spacewalk-schema-upgrade`\n5. Start the Spacewalk service:\n`spacewalk-service start`\n","status":"published","published":"2021-06-21T17:32:37Z","modified":"2026-02-04T02:46:39.175983Z","updated_at":"2026-11-02T15:53:49.138643Z"}]}}