opensuse-su-2021:2106-1
Vulnerability from csaf_opensuse
Published
2021-07-11 12:04
Modified
2021-07-11 12:04
Summary
Security update for salt

Notes

Title of the patch
Security update for salt
Description of the patch
This update for salt fixes the following issues: Update to Salt release version 3002.2 (jsc#ECO-3212, jsc#SLE-18033, jsc#SLE-18028) - Check if dpkgnotify is executable (bsc#1186674) - Drop support for Python2. Obsoletes `python2-salt` package (jsc#SLE-18028) - virt module updates * network: handle missing ipv4 netmask attribute * more network support * PCI/USB host devices passthrough support - Set distro requirement to oldest supported version in requirements/base.txt - Bring missing part of async batch implementation back (CVE-2021-25315, bsc#1182382) - Always require `python3-distro` (bsc#1182293) - Remove deprecated warning that breaks minion execution when 'server_id_use_crc' opts is missing - Fix pkg states when DEB package has 'all' arch - Do not force beacons configuration to be a list. - Remove msgpack < 1.0.0 from base requirements (bsc#1176293) - msgpack support for version >= 1.0.0 (bsc#1171257) - Fix issue parsing errors in ansiblegate state module - Prevent command injection in the snapper module (bsc#1185281, CVE-2021-31607) - transactional_update: detect recursion in the executor - Add subpackage salt-transactional-update (jsc#SLE-18033) - Improvements on 'ansiblegate' module (bsc#1185092): * New methods: ansible.targets / ansible.discover_playbooks - Add support for Alibaba Cloud Linux 2 (Aliyun Linux) - Regression fix of salt-ssh on processing targets - Update target fix for salt-ssh and avoiding race condition on salt-ssh event processing (bsc#1179831, bsc#1182281) - Add notify beacon for Debian/Ubuntu systems - Fix zmq bug that causes salt-call to freeze (bsc#1181368)
Patchnames
openSUSE-SLE-15.3-2021-2106
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for salt",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for salt fixes the following issues:\n\nUpdate to Salt release version 3002.2 (jsc#ECO-3212, jsc#SLE-18033, jsc#SLE-18028) \n\n- Check if dpkgnotify is executable (bsc#1186674)\n- Drop support for Python2. Obsoletes `python2-salt` package (jsc#SLE-18028)\n- virt module updates\n  * network: handle missing ipv4 netmask attribute\n  * more network support\n  * PCI/USB host devices passthrough support\n- Set distro requirement to oldest supported version in requirements/base.txt\n- Bring missing part of async batch implementation back (CVE-2021-25315, bsc#1182382)\n- Always require `python3-distro` (bsc#1182293)\n- Remove deprecated warning that breaks minion execution when \u0027server_id_use_crc\u0027 opts is missing\n- Fix pkg states when DEB package has \u0027all\u0027 arch\n- Do not force beacons configuration to be a list.\n- Remove msgpack \u003c 1.0.0 from base requirements (bsc#1176293)\n- msgpack support for version \u003e= 1.0.0 (bsc#1171257)\n- Fix issue parsing errors in ansiblegate state module\n- Prevent command injection in the snapper module (bsc#1185281, CVE-2021-31607)\n- transactional_update: detect recursion in the executor\n- Add subpackage salt-transactional-update (jsc#SLE-18033)\n- Improvements on \u0027ansiblegate\u0027 module (bsc#1185092):\n  * New methods: ansible.targets / ansible.discover_playbooks\n- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)\n- Regression fix of salt-ssh on processing targets\n- Update target fix for salt-ssh and avoiding race condition on salt-ssh event processing (bsc#1179831, bsc#1182281)\n- Add notify beacon for Debian/Ubuntu systems\n- Fix zmq bug that causes salt-call to freeze (bsc#1181368)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-SLE-15.3-2021-2106",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2021_2106-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2021:2106-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MU6P3NIODW6ZMC4HZLBROO6ZEOD5KAUX/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2021:2106-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MU6P3NIODW6ZMC4HZLBROO6ZEOD5KAUX/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1171257",
        "url": "https://bugzilla.suse.com/1171257"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1176293",
        "url": "https://bugzilla.suse.com/1176293"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179831",
        "url": "https://bugzilla.suse.com/1179831"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1181368",
        "url": "https://bugzilla.suse.com/1181368"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1182281",
        "url": "https://bugzilla.suse.com/1182281"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1182293",
        "url": "https://bugzilla.suse.com/1182293"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1182382",
        "url": "https://bugzilla.suse.com/1182382"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1185092",
        "url": "https://bugzilla.suse.com/1185092"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1185281",
        "url": "https://bugzilla.suse.com/1185281"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1186674",
        "url": "https://bugzilla.suse.com/1186674"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-15750 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-15750/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-15751 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-15751/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-11651 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-11651/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-11652 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-11652/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-25592 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-25592/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-25315 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-25315/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-31607 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-31607/"
      }
    ],
    "title": "Security update for salt",
    "tracking": {
      "current_release_date": "2021-07-11T12:04:10Z",
      "generator": {
        "date": "2021-07-11T12:04:10Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2021:2106-1",
      "initial_release_date": "2021-07-11T12:04:10Z",
      "revision_history": [
        {
          "date": "2021-07-11T12:04:10Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python2-distro-1.5.0-3.5.1.noarch",
                "product": {
                  "name": "python2-distro-1.5.0-3.5.1.noarch",
                  "product_id": "python2-distro-1.5.0-3.5.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "python3-distro-1.5.0-3.5.1.noarch",
                "product": {
                  "name": "python3-distro-1.5.0-3.5.1.noarch",
                  "product_id": "python3-distro-1.5.0-3.5.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.3",
                "product": {
                  "name": "openSUSE Leap 15.3",
                  "product_id": "openSUSE Leap 15.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python2-distro-1.5.0-3.5.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:python2-distro-1.5.0-3.5.1.noarch"
        },
        "product_reference": "python2-distro-1.5.0-3.5.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-distro-1.5.0-3.5.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:python3-distro-1.5.0-3.5.1.noarch"
        },
        "product_reference": "python3-distro-1.5.0-3.5.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2018-15750",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-15750"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to determine which files exist on the server.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.3:python2-distro-1.5.0-3.5.1.noarch",
          "openSUSE Leap 15.3:python3-distro-1.5.0-3.5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-15750",
          "url": "https://www.suse.com/security/cve/CVE-2018-15750"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1113698 for CVE-2018-15750",
          "url": "https://bugzilla.suse.com/1113698"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.3:python2-distro-1.5.0-3.5.1.noarch",
            "openSUSE Leap 15.3:python3-distro-1.5.0-3.5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.3:python2-distro-1.5.0-3.5.1.noarch",
            "openSUSE Leap 15.3:python3-distro-1.5.0-3.5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-07-11T12:04:10Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-15750"
    },
    {
      "cve": "CVE-2018-15751",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-15751"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands via salt-api(netapi).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.3:python2-distro-1.5.0-3.5.1.noarch",
          "openSUSE Leap 15.3:python3-distro-1.5.0-3.5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-15751",
          "url": "https://www.suse.com/security/cve/CVE-2018-15751"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1113698 for CVE-2018-15751",
          "url": "https://bugzilla.suse.com/1113698"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1113699 for CVE-2018-15751",
          "url": "https://bugzilla.suse.com/1113699"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.3:python2-distro-1.5.0-3.5.1.noarch",
            "openSUSE Leap 15.3:python3-distro-1.5.0-3.5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.3:python2-distro-1.5.0-3.5.1.noarch",
            "openSUSE Leap 15.3:python3-distro-1.5.0-3.5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-07-11T12:04:10Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-15751"
    },
    {
      "cve": "CVE-2020-11651",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-11651"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.3:python2-distro-1.5.0-3.5.1.noarch",
          "openSUSE Leap 15.3:python3-distro-1.5.0-3.5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-11651",
          "url": "https://www.suse.com/security/cve/CVE-2020-11651"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1170595 for CVE-2020-11651",
          "url": "https://bugzilla.suse.com/1170595"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.3:python2-distro-1.5.0-3.5.1.noarch",
            "openSUSE Leap 15.3:python3-distro-1.5.0-3.5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.3:python2-distro-1.5.0-3.5.1.noarch",
            "openSUSE Leap 15.3:python3-distro-1.5.0-3.5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-07-11T12:04:10Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2020-11651"
    },
    {
      "cve": "CVE-2020-11652",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-11652"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.3:python2-distro-1.5.0-3.5.1.noarch",
          "openSUSE Leap 15.3:python3-distro-1.5.0-3.5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-11652",
          "url": "https://www.suse.com/security/cve/CVE-2020-11652"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1170595 for CVE-2020-11652",
          "url": "https://bugzilla.suse.com/1170595"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.3:python2-distro-1.5.0-3.5.1.noarch",
            "openSUSE Leap 15.3:python3-distro-1.5.0-3.5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.3:python2-distro-1.5.0-3.5.1.noarch",
            "openSUSE Leap 15.3:python3-distro-1.5.0-3.5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-07-11T12:04:10Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2020-11652"
    },
    {
      "cve": "CVE-2020-25592",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-25592"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.3:python2-distro-1.5.0-3.5.1.noarch",
          "openSUSE Leap 15.3:python3-distro-1.5.0-3.5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-25592",
          "url": "https://www.suse.com/security/cve/CVE-2020-25592"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178319 for CVE-2020-25592",
          "url": "https://bugzilla.suse.com/1178319"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.3:python2-distro-1.5.0-3.5.1.noarch",
            "openSUSE Leap 15.3:python3-distro-1.5.0-3.5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.3:python2-distro-1.5.0-3.5.1.noarch",
            "openSUSE Leap 15.3:python3-distro-1.5.0-3.5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-07-11T12:04:10Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2020-25592"
    },
    {
      "cve": "CVE-2021-25315",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-25315"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.3:python2-distro-1.5.0-3.5.1.noarch",
          "openSUSE Leap 15.3:python3-distro-1.5.0-3.5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-25315",
          "url": "https://www.suse.com/security/cve/CVE-2021-25315"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1182382 for CVE-2021-25315",
          "url": "https://bugzilla.suse.com/1182382"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.3:python2-distro-1.5.0-3.5.1.noarch",
            "openSUSE Leap 15.3:python3-distro-1.5.0-3.5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.3:python2-distro-1.5.0-3.5.1.noarch",
            "openSUSE Leap 15.3:python3-distro-1.5.0-3.5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-07-11T12:04:10Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2021-25315"
    },
    {
      "cve": "CVE-2021-31607",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-31607"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.3:python2-distro-1.5.0-3.5.1.noarch",
          "openSUSE Leap 15.3:python3-distro-1.5.0-3.5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-31607",
          "url": "https://www.suse.com/security/cve/CVE-2021-31607"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1185281 for CVE-2021-31607",
          "url": "https://bugzilla.suse.com/1185281"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1210934 for CVE-2021-31607",
          "url": "https://bugzilla.suse.com/1210934"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.3:python2-distro-1.5.0-3.5.1.noarch",
            "openSUSE Leap 15.3:python3-distro-1.5.0-3.5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.3:python2-distro-1.5.0-3.5.1.noarch",
            "openSUSE Leap 15.3:python3-distro-1.5.0-3.5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-07-11T12:04:10Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-31607"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.