Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 544
Alerts This Week
Warning Icon 1 544

SUSE: 2021:2102-1 Important: Command Injection in Salt Fix

suse
Calendar Grey June 21, 2021
Scroller Suse
SUSE has released an important security update for Salt, addressing a significant command injection vulnerability while also adding improvements and bug fixes for system stability
An update that solves one vulnerability and has 5 fixes is now available

Summary

This update fixes the following issues: salt: - Parsing Epoch out of version provided during pkg remove (bsc#1173692) - Fix issue parsing errors in ansiblegate state module - Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607) - Transactional_update: detect recursion in the executor - Add subpackage salt-transactional-update - Remove duplicate directories from specfile - Improvements on "ansiblegate" module (bsc#1185092): * New methods: ansible.targets / ansible.discover_playbooks * General bugfixes - Add support for Alibaba Cloud Linux 2 (Aliyun Linux) - Regression fix of salt-ssh on processing targets - Update target fix for salt-ssh and avoiding race condition on salt-ssh event processing (bsc#1179831, bsc#1182281) - Add notify beacon for Debian/Ubuntu systems

Topics%20covered

Topics Covered

security advisory patch important software fix SUSE command injection salt

References

#1173692 #1179831 #1181368 #1182281 #1185092

#1185281

Cross- CVE-2021-31607

CVSS scores:

CVE-2021-31607 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2021-31607 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products:

SUSE Manager Tools 12

SUSE Linux Enterprise Module for Advanced Systems Management 12

https://www.suse.com/security/cve/CVE-2021-31607.html

https://bugzilla.suse.com/1173692

https://bugzilla.suse.com/1179831

https://bugzilla.suse.com/1181368

https://bugzilla.suse.com/1182281

https://bugzilla.suse.com/1185092

https://bugzilla.suse.com/1185281

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2021:2102-1
Rating: important

Topics%20covered

Topics Covered

security advisory patch important software fix SUSE command injection salt

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.