SUSE-SU-2024:0506-1: Security update for salt
This update for salt fixes the following issues: Security issues fixed: CVE-2024-22231: Prevent directory traversal when creating syndic cache directory on the master (bsc#1219430) CVE-2024-22232: Prevent directory traversal attacks in the master's servefile method (bsc#1219431) Bugs fixed: Ensure that pillar refresh loads beacons from pillar without restart Fix the aptpkg.py unit test failure Prefer unittest.mock to python-mock in test suite Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) Revert changes to set Salt configured user early in the stack (bsc#1216284) Align behavior of some modules when using salt-call via symlink (bsc#1215963) Fix gitfs "env" and improve cache cleaning (bsc#1193948) Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/salt-masterto a version that resolves this vulnerability.Fixed in 3006.0-150100.117.1 - Upgrade
Upgrade
suse/salt-syndicto a version that resolves this vulnerability.Fixed in 3006.0-150100.117.1 - Upgrade
Upgrade
suse/salt-minionto a version that resolves this vulnerability.Fixed in 3006.0-150100.117.1 - Upgrade
Upgrade
suse/salt-cloudto a version that resolves this vulnerability.Fixed in 3006.0-150100.117.1 - Upgrade
Upgrade
suse/salt-apito a version that resolves this vulnerability.Fixed in 3006.0-150100.117.1 - Upgrade
Upgrade
suse/salt-sshto a version that resolves this vulnerability.Fixed in 3006.0-150100.117.1 - Upgrade
Upgrade
suse/salt-proxyto a version that resolves this vulnerability.Fixed in 3006.0-150100.117.1 - Upgrade
Upgrade
suse/saltto a version that resolves this vulnerability.Fixed in 3006.0-150100.117.1 - Upgrade
Upgrade
suse/python3-saltto a version that resolves this vulnerability.Fixed in 3006.0-150100.117.1 - Upgrade
Upgrade
suse/salt-transactional-updateto a version that resolves this vulnerability.Fixed in 3006.0-150100.117.1 - Upgrade
Upgrade
suse/salt-standalone-formulas-configurationto a version that resolves this vulnerability.Fixed in 3006.0-150100.117.1 - Upgrade
Upgrade
suse/salt-docto a version that resolves this vulnerability.Fixed in 3006.0-150100.117.1 - Upgrade
Upgrade
suse/salt-zsh-completionto a version that resolves this vulnerability.Fixed in 3006.0-150100.117.1 - Upgrade
Upgrade
suse/salt-fish-completionto a version that resolves this vulnerability.Fixed in 3006.0-150100.117.1 - Upgrade
Upgrade
suse/salt-bash-completionto a version that resolves this vulnerability.Fixed in 3006.0-150100.117.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2024-506=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2024-506=1 - Configuration
Enable KeepAlive probes for Salt SSH executions
Salt SSH KeepAlive probes = enabled
Event History
Frequently Asked Questions
Which Salt roles should be prioritized for this update?
Prioritize Salt master deployments. The fixed directory-traversal issues are in the master's syndic cache directory creation and serve_file method; the update also lists salt-syndic among the affected software packages.
Are there operational changes to consider when testing this update?
Yes. The update also changes pillar beacon refresh behavior, enables KeepAlive probes for Salt SSH executions, adjusts salt-call behavior when invoked through a symlink, and changes gitfs environment and cache-cleaning behavior.