SUSE-SU-2018:0571-1: moderate: Security update for puppet

Thu Mar 1 10:09:02 MST 2018

   SUSE Security Update: Security update for puppet
______________________________________________________________________________

Announcement ID:    SUSE-SU-2018:0571-1
Rating:             moderate
References:         #1080288 
Cross-References:   CVE-2017-10689
Affected Products:
                    SUSE Linux Enterprise Module for Advanced Systems Management 12
                    SUSE Linux Enterprise Desktop 12-SP3
                    SUSE Linux Enterprise Desktop 12-SP2
______________________________________________________________________________

   An update that fixes one vulnerability is now available.

Description:

   This update for puppet fixes the following issues:

   - CVE-2017-10689: Reset permissions when unpacking tar in PMT. When using
     minitar, files were unpacked with whatever permissions are in the
     tarball. This is potentially unsafe, as tarballs can be easily created
     with weird permissions (bsc#1080288)

Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Module for Advanced Systems Management 12:

      zypper in -t patch SUSE-SLE-Module-Adv-Systems-Management-12-2018-379=1

   - SUSE Linux Enterprise Desktop 12-SP3:

      zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2018-379=1

   - SUSE Linux Enterprise Desktop 12-SP2:

      zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2018-379=1

   To bring your system up-to-date, use "zypper patch".

Package List:

   - SUSE Linux Enterprise Module for Advanced Systems Management 12 (ppc64le s390x x86_64):

      puppet-3.8.5-15.9.1
      puppet-server-3.8.5-15.9.1

   - SUSE Linux Enterprise Desktop 12-SP3 (x86_64):

      puppet-3.8.5-15.9.1

   - SUSE Linux Enterprise Desktop 12-SP2 (x86_64):

      puppet-3.8.5-15.9.1

References:

   https://www.suse.com/security/cve/CVE-2017-10689.html
   https://bugzilla.suse.com/1080288