SUSE-SU-2024:0510-1
- Source
- https://www.suse.com/support/update/announcement/2024/suse-su-20240510-1/
- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2024:0510-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/SUSE-SU-2024:0510-1
- Upstream
CVE (2)
- CVE-2024-22231
- CVE-2024-22232
- Related
- Published
- 2024-02-15T13:42:26Z
- Modified
- 2026-02-04T04:04:18Z
- Summary
- Security update for salt
- Details
-
This update for salt fixes the following issues:
Security issues fixed:
- CVE-2024-22231: Prevent directory traversal when creating syndic cache directory on the master (bsc#1219430)
- CVE-2024-22232: Prevent directory traversal attacks in the master's serve_file method (bsc#1219431)
Bugs fixed:
- Ensure that pillar refresh loads beacons from pillar without restart
- Fix the aptpkg.py unit test failure
- Prefer unittest.mock to python-mock in test suite
- Enable 'KeepAlive' probes for Salt SSH executions (bsc#1211649)
- Revert changes to set Salt configured user early in the stack (bsc#1216284)
- Align behavior of some modules when using salt-call via symlink (bsc#1215963)
- Fix gitfs 'env' and improve cache cleaning (bsc#1193948)
- Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed
- References
-
- https://www.suse.com/support/update/announcement/2024/suse-su-20240510-1/
- https://bugzilla.suse.com/1193948
- https://bugzilla.suse.com/1211649
- https://bugzilla.suse.com/1215963
- https://bugzilla.suse.com/1216284
- https://bugzilla.suse.com/1219430
- https://bugzilla.suse.com/1219431
- https://www.suse.com/security/cve/CVE-2024-22231
- https://www.suse.com/security/cve/CVE-2024-22232
Affected packages
openSUSE:Leap 15.5
salt
Package
- Name
- salt
- Purl
- pkg:rpm/opensuse/salt&distro=openSUSE%20Leap%2015.5
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed3006.0-150500.4.29.1
Ecosystem specific
{
"binaries": [
{
"python3-salt": "3006.0-150500.4.29.1",
"salt": "3006.0-150500.4.29.1",
"salt-api": "3006.0-150500.4.29.1",
"salt-bash-completion": "3006.0-150500.4.29.1",
"salt-cloud": "3006.0-150500.4.29.1",
"salt-doc": "3006.0-150500.4.29.1",
"salt-fish-completion": "3006.0-150500.4.29.1",
"salt-master": "3006.0-150500.4.29.1",
"salt-minion": "3006.0-150500.4.29.1",
"salt-proxy": "3006.0-150500.4.29.1",
"salt-ssh": "3006.0-150500.4.29.1",
"salt-standalone-formulas-configuration": "3006.0-150500.4.29.1",
"salt-syndic": "3006.0-150500.4.29.1",
"salt-transactional-update": "3006.0-150500.4.29.1",
"salt-zsh-completion": "3006.0-150500.4.29.1"
}
]
}SUSE:Linux Enterprise Micro 5.5
salt
Package
- Name
- salt
- Purl
- pkg:rpm/suse/salt&distro=SUSE%20Linux%20Enterprise%20Micro%205.5
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed3006.0-150500.4.29.1
SUSE:Linux Enterprise Module for Basesystem 15 SP5
salt
Package
- Name
- salt
- Purl
- pkg:rpm/suse/salt&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP5
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed3006.0-150500.4.29.1
SUSE:Linux Enterprise Module for Server Applications 15 SP5
salt
Package
- Name
- salt
- Purl
- pkg:rpm/suse/salt&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP5
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed3006.0-150500.4.29.1
Ecosystem specific
{
"binaries": [
{
"salt-api": "3006.0-150500.4.29.1",
"salt-cloud": "3006.0-150500.4.29.1",
"salt-fish-completion": "3006.0-150500.4.29.1",
"salt-master": "3006.0-150500.4.29.1",
"salt-proxy": "3006.0-150500.4.29.1",
"salt-ssh": "3006.0-150500.4.29.1",
"salt-standalone-formulas-configuration": "3006.0-150500.4.29.1",
"salt-syndic": "3006.0-150500.4.29.1"
}
]
}