Security update for SUSE Manager Salt Bundle SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2024:4021-1 Final 1 1 2024-11-18T13:25:44Z current 2024-11-18T13:25:44Z 2024-11-18T13:25:44Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for SUSE Manager Salt Bundle This update fixes the following issues: venv-salt-minion: - Security fixes on Python 3.11 interpreter: * CVE-2024-7592: Fixed quadratic complexity in parsing -quoted cookie values with backslashes (bsc#1229873, bsc#1230059) * CVE-2024-8088: Prevent malformed payload to cause infinite loops in zipfile.Path (bsc#1229704, bsc#1230058) * CVE-2024-6923: Prevent email header injection due to unquoted newlines (bsc#1228780) * CVE-2024-4032: Rearranging definition of private global IP addresses (bsc#1226448) * CVE-2024-0397: ssl.SSLContext.cert_store_stats() and ssl.SSLContext.get_ca_certs() now correctly lock access to the certificate store, when the ssl.SSLContext is shared across multiple threads (bsc#1226447) - Security fixes on Python dependencies: * CVE-2024-5569: zipp: Fixed a Denial of Service (DoS) vulnerability in the jaraco/zipp library (bsc#1227547, bsc#1229996) * CVE-2024-6345: setuptools: Sanitize any VCS URL used for download (bsc#1228105, bsc#1229995) * CVE-2024-3651: idna: Fix a potential DoS via resource consumption via specially crafted inputs to idna.encode() (bsc#1222842, bsc#1229994) * CVE-2024-37891: urllib3: Added the ``Proxy-Authorization`` header to the list of headers to strip from requests when redirecting to a different host (bsc#1226469, bsc#1229654) - Other bugs fixed: * Added passlib Python module to the bundle * Allow NamedLoaderContexts to be returned from loader * Avoid crash on wrong output of systemctl version (bsc#1229539) * Avoid explicit reading of /etc/salt/minion (bsc#1220357) * Enable post_start_cleanup.sh to work in a transaction * Fixed cloud Minion configuration for multiple Masters (bsc#1229109) * Fixed failing x509 tests with OpenSSL < 1.1 * Fixed the SELinux context for Salt Minion service (bsc#1219041) * Fixed too frequent systemd service restart in test_system test * Fixed zyppnotify plugin after latest zypp/libzypp upgrades (bsc#1231697, bsc#1231045) * Improved error handling with different OpenSSL versions * Increase warn_until_date date for code we still support * Prevent using SyncWrapper with no reason * Reverted the change making reactor less blocking (bsc#1230322) * Use --cachedir for extension_modules in salt-call (bsc#1226141) * Use Pygit2 id instead of deprecated oid in gitfs The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2024-4021,SUSE-SLE-Manager-Tools-15-2024-4021,SUSE-SLE-Manager-Tools-For-Micro-5-2024-4021,SUSE-SLE-Module-SUSE-Manager-Proxy-4.3-2024-4021,SUSE-SLE-Module-SUSE-Manager-Server-4.3-2024-4021 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2024/suse-su-20244021-1/ Link for SUSE-SU-2024:4021-1 https://lists.suse.com/pipermail/sle-security-updates/2024-November/019830.html E-Mail link for SUSE-SU-2024:4021-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1219041 SUSE Bug 1219041 https://bugzilla.suse.com/1220357 SUSE Bug 1220357 https://bugzilla.suse.com/1222842 SUSE Bug 1222842 https://bugzilla.suse.com/1226141 SUSE Bug 1226141 https://bugzilla.suse.com/1226447 SUSE Bug 1226447 https://bugzilla.suse.com/1226448 SUSE Bug 1226448 https://bugzilla.suse.com/1226469 SUSE Bug 1226469 https://bugzilla.suse.com/1227547 SUSE Bug 1227547 https://bugzilla.suse.com/1228105 SUSE Bug 1228105 https://bugzilla.suse.com/1228780 SUSE Bug 1228780 https://bugzilla.suse.com/1229109 SUSE Bug 1229109 https://bugzilla.suse.com/1229539 SUSE Bug 1229539 https://bugzilla.suse.com/1229654 SUSE Bug 1229654 https://bugzilla.suse.com/1229704 SUSE Bug 1229704 https://bugzilla.suse.com/1229873 SUSE Bug 1229873 https://bugzilla.suse.com/1229994 SUSE Bug 1229994 https://bugzilla.suse.com/1229995 SUSE Bug 1229995 https://bugzilla.suse.com/1229996 SUSE Bug 1229996 https://bugzilla.suse.com/1230058 SUSE Bug 1230058 https://bugzilla.suse.com/1230059 SUSE Bug 1230059 https://bugzilla.suse.com/1230322 SUSE Bug 1230322 https://bugzilla.suse.com/1231045 SUSE Bug 1231045 https://bugzilla.suse.com/1231697 SUSE Bug 1231697 https://www.suse.com/security/cve/CVE-2024-0397/ SUSE CVE CVE-2024-0397 page https://www.suse.com/security/cve/CVE-2024-3651/ SUSE CVE CVE-2024-3651 page https://www.suse.com/security/cve/CVE-2024-37891/ SUSE CVE CVE-2024-37891 page https://www.suse.com/security/cve/CVE-2024-4032/ SUSE CVE CVE-2024-4032 page https://www.suse.com/security/cve/CVE-2024-5569/ SUSE CVE CVE-2024-5569 page https://www.suse.com/security/cve/CVE-2024-6345/ SUSE CVE CVE-2024-6345 page https://www.suse.com/security/cve/CVE-2024-6923/ SUSE CVE CVE-2024-6923 page https://www.suse.com/security/cve/CVE-2024-7592/ SUSE CVE CVE-2024-7592 page https://www.suse.com/security/cve/CVE-2024-8088/ SUSE CVE CVE-2024-8088 page SUSE Manager Client Tools 15 SUSE Manager Client Tools for SLE Micro 5 SUSE Manager Proxy Module 4.3 SUSE Manager Server Module 4.3 saltbundlepy-3.11.9-150000.3.35.2 saltbundlepy-base-3.11.9-150000.3.35.2 saltbundlepy-cryptography-3.3.2-150000.3.27.1 saltbundlepy-curses-3.11.9-150000.3.35.2 saltbundlepy-dbm-3.11.9-150000.3.35.2 saltbundlepy-devel-3.11.9-150000.3.35.2 saltbundlepy-docker-7.0.0-150000.3.11.1 saltbundlepy-idna-3.4-150000.3.12.1 saltbundlepy-libs-3.11.9-150000.3.35.2 saltbundlepy-passlib-1.7.4-150000.3.3.1 saltbundlepy-setuptools-67.7.2-150000.3.15.1 saltbundlepy-testsuite-3.11.9-150000.3.35.2 saltbundlepy-tools-3.11.9-150000.3.35.2 saltbundlepy-urllib3-2.0.7-150000.3.18.1 saltbundlepy-zipp-3.15.0-150000.3.12.1 saltbundlepy-zypp-plugin-0.6.4-150000.3.11.1 venv-salt-minion-3006.0-150000.3.67.1 venv-salt-minion-3006.0-150000.3.67.1 as a component of SUSE Manager Client Tools 15 venv-salt-minion-3006.0-150000.3.67.1 as a component of SUSE Manager Client Tools for SLE Micro 5 venv-salt-minion-3006.0-150000.3.67.1 as a component of SUSE Manager Proxy Module 4.3 venv-salt-minion-3006.0-150000.3.67.1 as a component of SUSE Manager Server Module 4.3 A defect was discovered in the Python "ssl" module where there is a memory race condition with the ssl.SSLContext methods "cert_store_stats()" and "get_ca_certs()". The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory configured. This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5. CVE-2024-0397 SUSE Manager Client Tools 15:venv-salt-minion-3006.0-150000.3.67.1 SUSE Manager Client Tools for SLE Micro 5:venv-salt-minion-3006.0-150000.3.67.1 SUSE Manager Proxy Module 4.3:venv-salt-minion-3006.0-150000.3.67.1 SUSE Manager Server Module 4.3:venv-salt-minion-3006.0-150000.3.67.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20244021-1/ https://www.suse.com/security/cve/CVE-2024-0397.html CVE-2024-0397 https://bugzilla.suse.com/1226447 SUSE Bug 1226447 A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is triggered by a crafted input that causes the `idna.encode()` function to process the input with considerable computational load, significantly increasing the processing time in a quadratic manner relative to the input size. CVE-2024-3651 SUSE Manager Client Tools 15:venv-salt-minion-3006.0-150000.3.67.1 SUSE Manager Client Tools for SLE Micro 5:venv-salt-minion-3006.0-150000.3.67.1 SUSE Manager Proxy Module 4.3:venv-salt-minion-3006.0-150000.3.67.1 SUSE Manager Server Module 4.3:venv-salt-minion-3006.0-150000.3.67.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20244021-1/ https://www.suse.com/security/cve/CVE-2024-3651.html CVE-2024-3651 https://bugzilla.suse.com/1222842 SUSE Bug 1222842 urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, when sending HTTP requests *without* using urllib3's proxy support, it's possible to accidentally configure the `Proxy-Authorization` header even though it won't have any effect as the request is not using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat the `Proxy-Authorization` HTTP header as one carrying authentication material and thus doesn't strip the header on cross-origin redirects. Because this is a highly unlikely scenario, we believe the severity of this vulnerability is low for almost all users. Out of an abundance of caution urllib3 will automatically strip the `Proxy-Authorization` header during cross-origin redirects to avoid the small chance that users are doing this on accident. Users should use urllib3's proxy support or disable automatic redirects to achieve safe processing of the `Proxy-Authorization` header, but we still decided to strip the header by default in order to further protect users who aren't using the correct approach. We believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited: 1. Setting the `Proxy-Authorization` header without using urllib3's built-in proxy support. 2. Not disabling HTTP redirects. 3. Either not using an HTTPS origin server or for the proxy or target origin to redirect to a malicious origin. Users are advised to update to either version 1.26.19 or version 2.2.2. Users unable to upgrade may use the `Proxy-Authorization` header with urllib3's `ProxyManager`, disable HTTP redirects using `redirects=False` when sending requests, or not user the `Proxy-Authorization` header as mitigations. CVE-2024-37891 SUSE Manager Client Tools 15:venv-salt-minion-3006.0-150000.3.67.1 SUSE Manager Client Tools for SLE Micro 5:venv-salt-minion-3006.0-150000.3.67.1 SUSE Manager Proxy Module 4.3:venv-salt-minion-3006.0-150000.3.67.1 SUSE Manager Server Module 4.3:venv-salt-minion-3006.0-150000.3.67.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20244021-1/ https://www.suse.com/security/cve/CVE-2024-37891.html CVE-2024-37891 https://bugzilla.suse.com/1226469 SUSE Bug 1226469 The "ipaddress" module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as "globally reachable" or "private". This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn't be returned in accordance with the latest information from the IANA Special-Purpose Address Registries. CPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior. CVE-2024-4032 SUSE Manager Client Tools 15:venv-salt-minion-3006.0-150000.3.67.1 SUSE Manager Client Tools for SLE Micro 5:venv-salt-minion-3006.0-150000.3.67.1 SUSE Manager Proxy Module 4.3:venv-salt-minion-3006.0-150000.3.67.1 SUSE Manager Server Module 4.3:venv-salt-minion-3006.0-150000.3.67.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20244021-1/ https://www.suse.com/security/cve/CVE-2024-4032.html CVE-2024-4032 https://bugzilla.suse.com/1226448 SUSE Bug 1226448 A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is identical in both projects. The infinite loop can be initiated through the use of functions affecting the `Path` module in both zipp and zipfile, such as `joinpath`, the overloaded division operator, and `iterdir`. Although the infinite loop is not resource exhaustive, it prevents the application from responding. The vulnerability was addressed in version 3.19.1 of jaraco/zipp. CVE-2024-5569 SUSE Manager Client Tools 15:venv-salt-minion-3006.0-150000.3.67.1 SUSE Manager Client Tools for SLE Micro 5:venv-salt-minion-3006.0-150000.3.67.1 SUSE Manager Proxy Module 4.3:venv-salt-minion-3006.0-150000.3.67.1 SUSE Manager Server Module 4.3:venv-salt-minion-3006.0-150000.3.67.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20244021-1/ https://www.suse.com/security/cve/CVE-2024-5569.html CVE-2024-5569 https://bugzilla.suse.com/1227547 SUSE Bug 1227547 A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0. CVE-2024-6345 SUSE Manager Client Tools 15:venv-salt-minion-3006.0-150000.3.67.1 SUSE Manager Client Tools for SLE Micro 5:venv-salt-minion-3006.0-150000.3.67.1 SUSE Manager Proxy Module 4.3:venv-salt-minion-3006.0-150000.3.67.1 SUSE Manager Server Module 4.3:venv-salt-minion-3006.0-150000.3.67.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20244021-1/ https://www.suse.com/security/cve/CVE-2024-6345.html CVE-2024-6345 https://bugzilla.suse.com/1228105 SUSE Bug 1228105 There is a MEDIUM severity vulnerability affecting CPython. The email module didn't properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. CVE-2024-6923 SUSE Manager Client Tools 15:venv-salt-minion-3006.0-150000.3.67.1 SUSE Manager Client Tools for SLE Micro 5:venv-salt-minion-3006.0-150000.3.67.1 SUSE Manager Proxy Module 4.3:venv-salt-minion-3006.0-150000.3.67.1 SUSE Manager Server Module 4.3:venv-salt-minion-3006.0-150000.3.67.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20244021-1/ https://www.suse.com/security/cve/CVE-2024-6923.html CVE-2024-6923 https://bugzilla.suse.com/1228780 SUSE Bug 1228780 There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value. CVE-2024-7592 SUSE Manager Client Tools 15:venv-salt-minion-3006.0-150000.3.67.1 SUSE Manager Client Tools for SLE Micro 5:venv-salt-minion-3006.0-150000.3.67.1 SUSE Manager Proxy Module 4.3:venv-salt-minion-3006.0-150000.3.67.1 SUSE Manager Server Module 4.3:venv-salt-minion-3006.0-150000.3.67.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20244021-1/ https://www.suse.com/security/cve/CVE-2024-7592.html CVE-2024-7592 https://bugzilla.suse.com/1229596 SUSE Bug 1229596 There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected. When iterating over names of entries in a zip archive (for example, methods of "zipfile.Path" like "namelist()", "iterdir()", etc) the process can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading only metadata or extracting the contents of the zip archive. Programs that are not handling user-controlled zip archives are not affected. CVE-2024-8088 SUSE Manager Client Tools 15:venv-salt-minion-3006.0-150000.3.67.1 SUSE Manager Client Tools for SLE Micro 5:venv-salt-minion-3006.0-150000.3.67.1 SUSE Manager Proxy Module 4.3:venv-salt-minion-3006.0-150000.3.67.1 SUSE Manager Server Module 4.3:venv-salt-minion-3006.0-150000.3.67.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20244021-1/ https://www.suse.com/security/cve/CVE-2024-8088.html CVE-2024-8088 https://bugzilla.suse.com/1229704 SUSE Bug 1229704