{"id":"SUSE-SU-2024:1525-1","summary":"Security update for SUSE Manager Salt Bundle","details":"\nThis update fixes the following issues:\n\nvenv-salt-minion:\n\n- CVE-2024-22231: Prevent directory traversal when creating syndic cache directory\n  on the master (bsc#1219430)\n- CVE-2024-22232: Prevent directory traversal attacks in the master's serve_file\n  method (bsc#1219431)\n- Convert oscap output to UTF-8\n- Make Salt compatible with Python 3.11\n- Ignore non-ascii chars in oscap output (bsc#1219001)\n- Fix detected issues in Salt tests when running on VMs\n- Make importing seco.range thread safe (bsc#1211649)\n- Fix problematic tests and allow smooth tests executions on containers\n- Discover Ansible playbook files as '*.yml' or '*.yaml' files (bsc#1211888)\n- Prevent exceptions with fileserver.update when called via state (bsc#1218482)\n- Improve pip target override condition with VENV_PIP_TARGET\n  environment variable (bsc#1216850)\n- Fixed KeyError in logs when running a state that fails\n\n","modified":"2026-02-04T04:02:29.850966Z","published":"2024-05-06T09:50:25Z","related":["CVE-2024-22231","CVE-2024-22232"],"upstream":["CVE-2024-22231","CVE-2024-22232"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241525-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1211649"},{"type":"REPORT","url":"https://bugzilla.suse.com/1211888"},{"type":"REPORT","url":"https://bugzilla.suse.com/1216850"},{"type":"REPORT","url":"https://bugzilla.suse.com/1218482"},{"type":"REPORT","url":"https://bugzilla.suse.com/1219001"},{"type":"REPORT","url":"https://bugzilla.suse.com/1219430"},{"type":"REPORT","url":"https://bugzilla.suse.com/1219431"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2024-22231"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2024-22232"}],"affected":[{"package":{"name":"saltbundlepy","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","purl":"pkg:rpm/suse/saltbundlepy&distro=SUSE:EL-9:Update:Products:SaltBundle:Update"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.14-1.20.1"}]}],"ecosystem_specific":{"binaries":[{"saltbundlepy-devel":"3.10.14-1.20.1","saltbundlepy-libs":"3.10.14-1.20.1","saltbundlepy-lxml-devel":"4.9.3-1.15.2","saltbundlepy-lxml-doc":"4.9.3-1.15.2","saltbundlepy-testsuite":"3.10.14-1.20.1","saltbundlepy-tk":"3.10.14-1.20.1","saltbundlepy-tools":"3.10.14-1.20.1","saltbundlepy":"3.10.14-1.20.1","saltbundlepy-base":"3.10.14-1.20.1","saltbundlepy-curses":"3.10.14-1.20.1","saltbundlepy-dbm":"3.10.14-1.20.1","saltbundlepy-lxml":"4.9.3-1.15.2","venv-salt-minion":"3006.0-1.36.3"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2024:1525-1.json"}},{"package":{"name":"saltbundlepy-core","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","purl":"pkg:rpm/suse/saltbundlepy-core&distro=SUSE:EL-9:Update:Products:SaltBundle:Update"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.14-1.20.1"}]}],"ecosystem_specific":{"binaries":[{"saltbundlepy-libs":"3.10.14-1.20.1","saltbundlepy-lxml-doc":"4.9.3-1.15.2","saltbundlepy-lxml":"4.9.3-1.15.2","saltbundlepy-tk":"3.10.14-1.20.1","saltbundlepy-tools":"3.10.14-1.20.1","saltbundlepy-curses":"3.10.14-1.20.1","saltbundlepy-dbm":"3.10.14-1.20.1","saltbundlepy-lxml-devel":"4.9.3-1.15.2","saltbundlepy-testsuite":"3.10.14-1.20.1","saltbundlepy":"3.10.14-1.20.1","venv-salt-minion":"3006.0-1.36.3","saltbundlepy-base":"3.10.14-1.20.1","saltbundlepy-devel":"3.10.14-1.20.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2024:1525-1.json"}},{"package":{"name":"saltbundlepy-lxml","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","purl":"pkg:rpm/suse/saltbundlepy-lxml&distro=SUSE:EL-9:Update:Products:SaltBundle:Update"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.3-1.15.2"}]}],"ecosystem_specific":{"binaries":[{"saltbundlepy-devel":"3.10.14-1.20.1","saltbundlepy-lxml-devel":"4.9.3-1.15.2","saltbundlepy-lxml-doc":"4.9.3-1.15.2","saltbundlepy-lxml":"4.9.3-1.15.2","saltbundlepy-testsuite":"3.10.14-1.20.1","saltbundlepy-dbm":"3.10.14-1.20.1","saltbundlepy-libs":"3.10.14-1.20.1","saltbundlepy-tk":"3.10.14-1.20.1","saltbundlepy-tools":"3.10.14-1.20.1","saltbundlepy":"3.10.14-1.20.1","venv-salt-minion":"3006.0-1.36.3","saltbundlepy-base":"3.10.14-1.20.1","saltbundlepy-curses":"3.10.14-1.20.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2024:1525-1.json"}},{"package":{"name":"venv-salt-minion","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","purl":"pkg:rpm/suse/venv-salt-minion&distro=SUSE:EL-9:Update:Products:SaltBundle:Update"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-1.36.3"}]}],"ecosystem_specific":{"binaries":[{"saltbundlepy-base":"3.10.14-1.20.1","saltbundlepy-curses":"3.10.14-1.20.1","saltbundlepy-dbm":"3.10.14-1.20.1","saltbundlepy-devel":"3.10.14-1.20.1","saltbundlepy-libs":"3.10.14-1.20.1","saltbundlepy-lxml-doc":"4.9.3-1.15.2","saltbundlepy-lxml":"4.9.3-1.15.2","saltbundlepy-testsuite":"3.10.14-1.20.1","saltbundlepy-lxml-devel":"4.9.3-1.15.2","saltbundlepy-tk":"3.10.14-1.20.1","saltbundlepy-tools":"3.10.14-1.20.1","saltbundlepy":"3.10.14-1.20.1","venv-salt-minion":"3006.0-1.36.3"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2024:1525-1.json"}},{"package":{"name":"venv-salt-minion","ecosystem":"SUSE:Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS","purl":"pkg:rpm/suse/venv-salt-minion&distro=SUSE%20Manager%20Client%20Tools%20for%20RHEL,%20Liberty%20and%20Clones%209-CLIENT-TOOLS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-1.36.3"}]}],"ecosystem_specific":{"binaries":[{"venv-salt-minion":"3006.0-1.36.3"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2024:1525-1.json"}}],"schema_version":"1.7.3"}