Salt 0.17.1 Release Notes¶
- release
2013-10-17
Note
THIS RELEASE IS NOT COMPATIBLE WITH PREVIOUS VERSIONS. If you update your master to 0.17.1, you must update your minions as well. Sorry for the inconvenience -- this is a result of one of the security fixes listed below.
The 0.17.1 release comes with a number of improvements to salt-ssh, many bugfixes, and a number of security updates.
Salt SSH has been improved to be faster, more featureful and more secure. Since the original release of Salt SSH was primarily a proof of concept, it has been very exciting to see its rapid adoption. We appreciate the willingness of security experts to review Salt SSH and help discover oversights and ensure that security issues only exist for such a tiny window of time.
SSH Enhancements¶
Shell Improvements¶
Improvements to Salt SSH's communication have been added that improve routine execution regardless of the target system's login shell.
Performance¶
Deployment of routines is now faster and takes fewer commands to execute.
Security Updates¶
Be advised that these security issues all apply to a small subset of Salt users and mostly apply to Salt SSH.
Insufficient Argument Validation¶
This issue allowed for a user with limited privileges to embed executions inside of routines to execute routines that should be restricted. This applies to users using external auth or client ACL and opening up specific routines.
Be advised that these patches address the direct issue. Additional commits have been applied to help mitigate this issue from resurfacing.
CVE¶
CVE-2013-4435
Affected Versions¶
0.15.0 - 0.17.0
Patches¶
https://github.com/saltstack/salt/commit/6d8ef68b605fd63c36bb8ed96122a75ad2e80269 https://github.com/saltstack/salt/commit/ebdef37b7e5d2b95a01d34b211c61c61da67e46a https://github.com/saltstack/salt/commit/7f190ff890e47cdd591d9d7cefa5126574660824 https://github.com/saltstack/salt/commit/8e5afe59cef6743fe5dbd510dcf463dbdfca1ced https://github.com/saltstack/salt/commit/aca78f314481082862e96d4f0c1b75fa382bb885 https://github.com/saltstack/salt/commit/6a9752cdb1e8df2c9505ea910434c79d132eb1e2 https://github.com/saltstack/salt/commit/b73677435ba54ecfc93c1c2d840a7f9ba6f53410 https://github.com/saltstack/salt/commit/07972eb0a6f985749a55d8d4a2e471596591c80d https://github.com/saltstack/salt/commit/1e3f197726aa13ac5c3f2416000089f477f489b5
Found By¶
Feth Arezki, of Majerti
MITM SSH attack in salt-ssh¶
SSH host keys were being accepted by default and not enforced on future SSH connections. These patches set SSH host key checking by default and can be overridden by passing the -i flag to salt-ssh.
CVE¶
CVE-2013-4436
Affected Versions¶
0.17.0
Found By¶
Michael Scherer, Red Hat
Insecure Usage of /tmp in salt-ssh¶
The initial release of salt-ssh used the /tmp directory in an insecure way. These patches not only secure usage of files under /tmp in salt-ssh, but also add checksum validation for all packages sent into the now secure locations on target systems.
CVE¶
CVE-2013-4438
Affected Versions¶
0.17.0
Patches¶
https://github.com/saltstack/salt/commit/aa4bb77ef230758cad84381dde0ec660d2dc340a https://github.com/saltstack/salt/commit/8f92b6b2cb2e4ec3af8783eb6bf4ff06f5a352cf https://github.com/saltstack/salt/commit/c58e56811d5a50c908df0597a0ba0b643b45ebfd https://github.com/saltstack/salt/commit/0359db9b46e47614cff35a66ea6a6a76846885d2 https://github.com/saltstack/salt/commit/4348392860e0fd43701c331ac3e681cf1a8c17b0 https://github.com/saltstack/salt/commit/664d1a1cac05602fad2693f6f97092d98a72bf61 https://github.com/saltstack/salt/commit/bab92775a576e28ff9db262f32db9cf2375bba87 https://github.com/saltstack/salt/commit/c6d34f1acf64900a3c87a2d37618ff414e5a704e
Found By¶
Michael Scherer, Red Hat
YAML Calling Unsafe Loading Routine¶
It has been argued that this is not a valid security issue, as the YAML loading that was happening was only being called after an initial gateway filter in Salt has already safely loaded the YAML and would fail if non-safe routines were embedded. Nonetheless, the CVE was filed and patches applied.
CVE¶
CVE-2013-4438
Patches¶
https://github.com/saltstack/salt/commit/339b0a51befae6b6b218ebcb55daa9cd3329a1c5
Found By¶
Michael Scherer, Red Hat
Failure to Drop Supplementary Group on Salt Master¶
If a salt master was started as a non-root user by the root user, root's groups would still be applied to the running process. This fix changes the process to have only the groups of the running user.
CVE¶
CVE not considered necessary by submitter.
Affected Versions¶
0.11.0 - 0.17.0
Found By¶
Michael Scherer, Red Hat
Fix Reference¶
Version 0.17.1 is the first bugfix release for 0.17.0. The changes include:
Fix symbolic links in thin.tgz (issue #7482)
Pass env through to file.patch state (issue #7452)
Service provider fixes and reporting improvements (issue #7361)
Add
--privoption for specifying salt-ssh private keyFix salt-thin's salt-call on setuptools installations (issue #7516)
Fix salt-ssh to support passwords with spaces (issue #7480)
Fix regression in wildcard includes (issue #7455)
Fix salt-call outputter regression (issue #7456)
Fix custom returner support for startup states (issue #7540)
Fix value handling in augeas (issue #7605)
Fix regression in apt (issue #7624)
Fix minion ID guessing to use
socket.getfqdn()first (issue #7558)Add minion ID caching (issue #7558)
Fix salt-key race condition (issue #7304)
Add
--include-allflag to salt-key (issue #7399)Fix custom grains in pillar (part of issue #5716, issue #6083)
Fix race condition in salt-key (issue #7304)
Fix regression in minion ID guessing, prioritize
socket.getfqdn()(issue #7558)Cache minion ID on first guess (issue #7558)
Allow trailing slash in
file.directorystateFix reporting of file_roots in pillar return (issue #5449 and issue #5951)
Remove pillar matching for mine.get (issue #7197)
Sanitize args for multiple execution modules
Fix yumpkg mod_repo functions to filter hidden args (issue #7656)
Fix conflicting IDs in state includes (issue #7526)
Fix mysql_grants.absent string formatting issue (issue #7827)
Fix postgres.version so it won't return None (issue #7695)
Fix for trailing slashes in mount.mounted state
Fix rogue AttributErrors in the outputter system (issue #7845)
Fix for incorrect ssh key encodings resulting in incorrect key added (issue #7718)
Fix for pillar/grains naming regression in python renderer (issue #7693)
Fix args/kwargs handling in the scheduler (issue #7422)
Fix logfile handling for file://, tcp://, and udp:// (issue #7754)
Fix error handling in config file parsing (issue #6714)
Fix RVM using sudo when running as non-root user (issue #2193)
Fix client ACL and underlying logging bugs (issue #7706)
Fix scheduler bug with returner (issue #7367)
Fix user management bug related to default groups (issue #7690)
Fix various salt-ssh bugs (issue #7528)
Many various documentation fixes
