SUSE-SU-2018:3862-1: important: Security update for salt

sle-security-updates at lists.suse.com sle-security-updates at lists.suse.com
Thu Nov 22 13:10:07 MST 2018 

   SUSE Security Update: Security update for salt
______________________________________________________________________________

Announcement ID:    SUSE-SU-2018:3862-1
Rating:             important
References:         #1110938 #1113698 #1113699 #1113784 #1114197 
                    
Cross-References:   CVE-2018-15750 CVE-2018-15751
Affected Products:
                    SUSE Manager Tools 12
                    SUSE Manager Server 3.2
                    SUSE Manager Server 3.1
                    SUSE Manager Server 3.0
                    SUSE Manager Proxy 3.2
                    SUSE Manager Proxy 3.1
                    SUSE Manager Proxy 3.0
                    SUSE Linux Enterprise Point of Sale 12-SP2
                    SUSE Linux Enterprise Module for Advanced Systems Management 12
                    SUSE CaaS Platform 3.0
                    OpenStack Cloud Magnum Orchestration 7
______________________________________________________________________________

   An update that solves two vulnerabilities and has three
   fixes is now available.

Description:

   This update for salt fixes the following issues:

   Security issues fixed:

   - CVE-2018-15750: Fixed directory traversal vulnerability in salt-api
     (bsc#1113698).
   - CVE-2018-15751: Fixed remote authentication bypass in salt-api(netapi)
     that allows to execute arbitrary commands (bsc#1113699).

   Non-security issues fixed:

   - Improved handling of LDAP group id. gid is no longer treated as a
     string, which could have lead to faulty group creations (bsc#1113784).
   - Fix async call to process manager (bsc#1110938).
   - Fixed OS arch detection when RPM is not installed (bsc#1114197).


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Manager Tools 12:

      zypper in -t patch SUSE-SLE-Manager-Tools-12-2018-2745=1

   - SUSE Manager Server 3.2:

      zypper in -t patch SUSE-SUSE-Manager-Server-3.2-2018-2745=1

   - SUSE Manager Server 3.1:

      zypper in -t patch SUSE-SUSE-Manager-Server-3.1-2018-2745=1

   - SUSE Manager Server 3.0:

      zypper in -t patch SUSE-SUSE-Manager-Server-3.0-2018-2745=1

   - SUSE Manager Proxy 3.2:

      zypper in -t patch SUSE-SUSE-Manager-Proxy-3.2-2018-2745=1

   - SUSE Manager Proxy 3.1:

      zypper in -t patch SUSE-SUSE-Manager-Proxy-3.1-2018-2745=1

   - SUSE Manager Proxy 3.0:

      zypper in -t patch SUSE-SUSE-Manager-Proxy-3.0-2018-2745=1

   - SUSE Linux Enterprise Point of Sale 12-SP2:

      zypper in -t patch SUSE-SLE-POS-12-SP2-2018-2745=1

   - SUSE Linux Enterprise Module for Advanced Systems Management 12:

      zypper in -t patch SUSE-SLE-Module-Adv-Systems-Management-12-2018-2745=1

   - SUSE CaaS Platform 3.0:

      To install this update, use the SUSE CaaS Platform Velum dashboard.
      It will inform you if it detects new updates and let you then trigger
      updating of the complete cluster in a controlled way.

   - OpenStack Cloud Magnum Orchestration 7:

      zypper in -t patch SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2018-2745=1



Package List:

   - SUSE Manager Tools 12 (aarch64 ppc64le s390x x86_64):

      python2-salt-2018.3.0-46.44.1
      python3-salt-2018.3.0-46.44.1
      salt-2018.3.0-46.44.1
      salt-doc-2018.3.0-46.44.1
      salt-minion-2018.3.0-46.44.1

   - SUSE Manager Server 3.2 (ppc64le s390x x86_64):

      python2-salt-2018.3.0-46.44.1
      python3-salt-2018.3.0-46.44.1
      salt-2018.3.0-46.44.1
      salt-api-2018.3.0-46.44.1
      salt-cloud-2018.3.0-46.44.1
      salt-doc-2018.3.0-46.44.1
      salt-master-2018.3.0-46.44.1
      salt-minion-2018.3.0-46.44.1
      salt-proxy-2018.3.0-46.44.1
      salt-ssh-2018.3.0-46.44.1
      salt-syndic-2018.3.0-46.44.1

   - SUSE Manager Server 3.2 (noarch):

      salt-bash-completion-2018.3.0-46.44.1
      salt-zsh-completion-2018.3.0-46.44.1

   - SUSE Manager Server 3.1 (ppc64le s390x x86_64):

      python2-salt-2018.3.0-46.44.1
      python3-salt-2018.3.0-46.44.1
      salt-2018.3.0-46.44.1
      salt-api-2018.3.0-46.44.1
      salt-cloud-2018.3.0-46.44.1
      salt-doc-2018.3.0-46.44.1
      salt-master-2018.3.0-46.44.1
      salt-minion-2018.3.0-46.44.1
      salt-proxy-2018.3.0-46.44.1
      salt-ssh-2018.3.0-46.44.1
      salt-syndic-2018.3.0-46.44.1

   - SUSE Manager Server 3.1 (noarch):

      salt-bash-completion-2018.3.0-46.44.1
      salt-zsh-completion-2018.3.0-46.44.1

   - SUSE Manager Server 3.0 (s390x x86_64):

      python2-salt-2018.3.0-46.44.1
      salt-2018.3.0-46.44.1
      salt-api-2018.3.0-46.44.1
      salt-doc-2018.3.0-46.44.1
      salt-master-2018.3.0-46.44.1
      salt-minion-2018.3.0-46.44.1
      salt-proxy-2018.3.0-46.44.1
      salt-ssh-2018.3.0-46.44.1
      salt-syndic-2018.3.0-46.44.1

   - SUSE Manager Server 3.0 (noarch):

      salt-bash-completion-2018.3.0-46.44.1
      salt-zsh-completion-2018.3.0-46.44.1

   - SUSE Manager Proxy 3.2 (x86_64):

      python2-salt-2018.3.0-46.44.1
      python3-salt-2018.3.0-46.44.1
      salt-2018.3.0-46.44.1
      salt-minion-2018.3.0-46.44.1

   - SUSE Manager Proxy 3.1 (ppc64le x86_64):

      python2-salt-2018.3.0-46.44.1
      python3-salt-2018.3.0-46.44.1
      salt-2018.3.0-46.44.1
      salt-minion-2018.3.0-46.44.1

   - SUSE Manager Proxy 3.0 (x86_64):

      python2-salt-2018.3.0-46.44.1
      salt-2018.3.0-46.44.1
      salt-api-2018.3.0-46.44.1
      salt-doc-2018.3.0-46.44.1
      salt-master-2018.3.0-46.44.1
      salt-minion-2018.3.0-46.44.1
      salt-proxy-2018.3.0-46.44.1
      salt-ssh-2018.3.0-46.44.1
      salt-syndic-2018.3.0-46.44.1

   - SUSE Manager Proxy 3.0 (noarch):

      salt-bash-completion-2018.3.0-46.44.1
      salt-zsh-completion-2018.3.0-46.44.1

   - SUSE Linux Enterprise Point of Sale 12-SP2 (x86_64):

      python2-salt-2018.3.0-46.44.1
      salt-2018.3.0-46.44.1
      salt-minion-2018.3.0-46.44.1

   - SUSE Linux Enterprise Module for Advanced Systems Management 12 (ppc64le s390x x86_64):

      python2-salt-2018.3.0-46.44.1
      salt-2018.3.0-46.44.1
      salt-api-2018.3.0-46.44.1
      salt-cloud-2018.3.0-46.44.1
      salt-doc-2018.3.0-46.44.1
      salt-master-2018.3.0-46.44.1
      salt-minion-2018.3.0-46.44.1
      salt-proxy-2018.3.0-46.44.1
      salt-ssh-2018.3.0-46.44.1
      salt-syndic-2018.3.0-46.44.1

   - SUSE Linux Enterprise Module for Advanced Systems Management 12 (noarch):

      salt-bash-completion-2018.3.0-46.44.1
      salt-zsh-completion-2018.3.0-46.44.1

   - SUSE CaaS Platform 3.0 (x86_64):

      python2-salt-2018.3.0-46.44.1
      salt-2018.3.0-46.44.1
      salt-minion-2018.3.0-46.44.1

   - OpenStack Cloud Magnum Orchestration 7 (x86_64):

      salt-2018.3.0-46.44.1
      salt-minion-2018.3.0-46.44.1


References:

   https://www.suse.com/security/cve/CVE-2018-15750.html
   https://www.suse.com/security/cve/CVE-2018-15751.html
   https://bugzilla.suse.com/1110938
   https://bugzilla.suse.com/1113698
   https://bugzilla.suse.com/1113699
   https://bugzilla.suse.com/1113784
   https://bugzilla.suse.com/1114197

More information about the sle-security-updates mailing list