SUSE-SU-2020:14564-1: moderate: Security update for SUSE Manager Client Tools

[sle-security-updates at lists.suse.com]

   SUSE Security Update: Security update for SUSE Manager Client Tools
______________________________________________________________________________

Announcement ID:    SUSE-SU-2020:14564-1
Rating:             moderate
References:         #1102248 #1178485 
Cross-References:   CVE-2020-25592
Affected Products:
                    SUSE Manager Ubuntu 16.04-CLIENT-TOOLS
______________________________________________________________________________

   An update that solves one vulnerability and has one errata
   is now available.

Description:


   This update fixes the following issues:

   salt:

   - Fix syntax error on pkgrepo state with Python 2.7
   - Transactional_update: unify with chroot.call
   - Add "migrated" state and GPG key management functions
   - Master can read grains
   - Fix for broken psutil (bsc#1102248)
   - Fix novendorchange handling in zypperpkg module
   - Avoid regression on "salt-master": set passphrase for salt-ssh keys to
     empty string (bsc#1178485)

   spacecmd:

   - Fix: make spacecmd build on Debian


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Manager Ubuntu 16.04-CLIENT-TOOLS:

      zypper in -t patch suse-ubu164ct-client-tools-202011-14564=1



Package List:

   - SUSE Manager Ubuntu 16.04-CLIENT-TOOLS (all):

      salt-common-3000+ds-1+61.1
      salt-minion-3000+ds-1+61.1
      spacecmd-4.1.9-17.1


References:

   https://www.suse.com/security/cve/CVE-2020-25592.html
   https://bugzilla.suse.com/1102248
   https://bugzilla.suse.com/1178485