SUSE: 2022:3172-1 moderate: SUSE Manager Salt Bundle | LinuxSecurit...

Advisories


   SUSE Security Update: Security update for SUSE Manager Salt Bundle
______________________________________________________________________________

Announcement ID:    SUSE-SU-2022:3172-1
Rating:             moderate
References:         #1195895 #1197288 #1198489 #1198744 #1199372 
                    #1200566 #1201082 
Cross-References:   CVE-2022-22967
CVSS scores:
                    CVE-2022-22967 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
                    CVE-2022-22967 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products:
                    SUSE Linux Enterprise Module for SUSE Manager Proxy 4.3
                    SUSE Linux Enterprise Module for SUSE Manager Server 4.3
                    SUSE Manager Proxy 4.3
                    SUSE Manager Server 4.3
                    SUSE Manager Tools 15
______________________________________________________________________________

   An update that solves one vulnerability and has 6 fixes is
   now available.

Description:

   This update fixes the following issues:

   venv-salt-minion:

   - Add support for gpgautoimport in zypperpkg module
   - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744)
   - Fix salt.states.file.managed() for follow_symlinks=True and test=True
     (bsc#1199372)
   - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082)
   - Add support for name, pkgs and diff_attr parameters to upgrade function
     for zypper and yum (bsc#1198489)
   - Fix possible errors on running post install script if semanage is
     present on the system, but SELinux is not configured
   - Remove unused imports in the venv wrappers
   - Set VENV_PIP_TARGET to /var/lib/venv-salt-minion/local to force PIP use
     it as the destination to install modules
   - Fix ownership of salt thin directory when using the Salt Bundle
   - Set default target for pip from VENV_PIP_TARGET environment variable
   - Normalize package names once with pkg.installed/removed using yum
     (bsc#1195895)
   - Save log to logfile with docker.build
   - Use Salt Bundle in dockermod
   - Ignore errors on reading license files with dpkg_lowpkg (bsc#1197288)
   - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value
     (CVE-2022-22967) (bsc#1200566)


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Manager Tools 15:

      zypper in -t patch SUSE-SLE-Manager-Tools-15-2022-3172=1

   - SUSE Linux Enterprise Module for SUSE Manager Server 4.3:

      zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Server-4.3-2022-3172=1

   - SUSE Linux Enterprise Module for SUSE Manager Proxy 4.3:

      zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Proxy-4.3-2022-3172=1



Package List:

   - SUSE Manager Tools 15 (aarch64 ppc64le s390x x86_64):

      venv-salt-minion-3004-150000.3.11.1

   - SUSE Linux Enterprise Module for SUSE Manager Server 4.3 (aarch64 ppc64le s390x x86_64):

      venv-salt-minion-3004-150000.3.11.1

   - SUSE Linux Enterprise Module for SUSE Manager Proxy 4.3 (aarch64 ppc64le s390x x86_64):

      venv-salt-minion-3004-150000.3.11.1


References:

   https://www.suse.com/security/cve/CVE-2022-22967.html
   https://bugzilla.suse.com/1195895
   https://bugzilla.suse.com/1197288
   https://bugzilla.suse.com/1198489
   https://bugzilla.suse.com/1198744
   https://bugzilla.suse.com/1199372
   https://bugzilla.suse.com/1200566
   https://bugzilla.suse.com/1201082

SUSE: 2022:3172-1 moderate: SUSE Manager Salt Bundle

September 8, 2022
An update that solves one vulnerability and has 6 fixes is now available

Summary

This update fixes the following issues: venv-salt-minion: - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix possible errors on running post install script if semanage is present on the system, but SELinux is not configured - Remove unused imports in the venv wrappers - Set VENV_PIP_TARGET to /var/lib/venv-salt-minion/local to force PIP use it as the destination to install modules - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore errors on reading license files with dpkg_lowpkg (bsc#1197288) - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Manager Tools 15: zypper in -t patch SUSE-SLE-Manager-Tools-15-2022-3172=1 - SUSE Linux Enterprise Module for SUSE Manager Server 4.3: zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Server-4.3-2022-3172=1 - SUSE Linux Enterprise Module for SUSE Manager Proxy 4.3: zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Proxy-4.3-2022-3172=1 Package List: - SUSE Manager Tools 15 (aarch64 ppc64le s390x x86_64): venv-salt-minion-3004-150000.3.11.1 - SUSE Linux Enterprise Module for SUSE Manager Server 4.3 (aarch64 ppc64le s390x x86_64): venv-salt-minion-3004-150000.3.11.1 - SUSE Linux Enterprise Module for SUSE Manager Proxy 4.3 (aarch64 ppc64le s390x x86_64): venv-salt-minion-3004-150000.3.11.1

References

#1195895 #1197288 #1198489 #1198744 #1199372

#1200566 #1201082

Cross- CVE-2022-22967

CVSS scores:

CVE-2022-22967 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2022-22967 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products:

SUSE Linux Enterprise Module for SUSE Manager Proxy 4.3

SUSE Linux Enterprise Module for SUSE Manager Server 4.3

SUSE Manager Proxy 4.3

SUSE Manager Server 4.3

SUSE Manager Tools 15

https://www.suse.com/security/cve/CVE-2022-22967.html

https://bugzilla.suse.com/1195895

https://bugzilla.suse.com/1197288

https://bugzilla.suse.com/1198489

https://bugzilla.suse.com/1198744

https://bugzilla.suse.com/1199372

https://bugzilla.suse.com/1200566

https://bugzilla.suse.com/1201082

Severity
Announcement ID: SUSE-SU-2022:3172-1
Rating: moderate

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.