Skip to content
OpenAdvisories
Critical SUSE-RU-2017:0171-1 1 CVE

Recommended update for salt

Published Jan 17, 2017 · Updated Feb 4, 2026

Summary

This update for Salt fixes one security issue and several non-security issues.

The following security issue has been fixed:

- Fix possible information leak due to revoked keys still being used. (bsc#1012398, CVE-2016-9639)

The following non-security issues have been fixed:

- Update to 2015.8.12
- Add pre-require to salt for minions.
- Do not restart salt-minion in salt package.
- Add try-restart to sys-v init scripts.
- Add 'Restart=on-failure' for salt-minion systemd service.
- Re-introduce 'KillMode=process' for salt-minion systemd service.
- Successfully exit of salt-api child processes when SIGTERM is received.
- Fix exit codes of sysv init script. (bsc#999852)
- Include resolution parameters in the Zypper debug-solver call during a dry-run dist-upgrade.
- Fix Salt API crash via salt-ssh on empty roster. (bsc#1004723)
- Add 'dist-upgrade' support to zypper module. (fate#320559)
- Fix position of -X option to setfacl. (bsc#1004260)
- Fix generated shebang in scripts on SLES-ES 7. (bsc#1004047)
- Fix changing default-timezone. (bsc#1008933)

Fixed packages 1

ReleasePackageFixed in
SUSE · Enterprise Storage 4 salt 2015.8.12-27.5

Vulnerabilities 1

  • Critical 9.1

    Salt allows deleted minions to read or write to minions with the same id

    Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching.

References

  • report
    https://bugzilla.suse.com/1003449
  • report
    https://bugzilla.suse.com/1004047
  • report
    https://bugzilla.suse.com/1004260
  • report
    https://bugzilla.suse.com/1004723
  • report
    https://bugzilla.suse.com/1008933
  • report
    https://bugzilla.suse.com/1012398
  • report
    https://bugzilla.suse.com/986019
  • report
    https://bugzilla.suse.com/999852
  • web
    https://www.suse.com/security/cve/CVE-2016-9639