Detections
Analytics
SUSE SLES15 Security Update : SUSE Manager Salt Bundle (SUSE-SU-2024:4021-1)
high Nessus Plugin ID 212577
Synopsis
The remote SUSE host is missing one or more security updates.Description
The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4021-1 advisory.venv-salt-minion:
- Security fixes on Python 3.11 interpreter:
* CVE-2024-7592: Fixed quadratic complexity in parsing -quoted cookie values with backslashes (bsc#1229873, bsc#1230059)
* CVE-2024-8088: Prevent malformed payload to cause infinite loops in zipfile.Path (bsc#1229704, bsc#1230058)
* CVE-2024-6923: Prevent email header injection due to unquoted newlines (bsc#1228780)
* CVE-2024-4032: Rearranging definition of private global IP addresses (bsc#1226448)
* CVE-2024-0397: ssl.SSLContext.cert_store_stats() and ssl.SSLContext.get_ca_certs() now correctly lock access to the certificate store, when the ssl.SSLContext is shared across multiple threads (bsc#1226447)
- Security fixes on Python dependencies:
* CVE-2024-5569: zipp: Fixed a Denial of Service (DoS) vulnerability in the jaraco/zipp library (bsc#1227547, bsc#1229996)
* CVE-2024-6345: setuptools: Sanitize any VCS URL used for download (bsc#1228105, bsc#1229995)
* CVE-2024-3651: idna: Fix a potential DoS via resource consumption via specially crafted inputs to idna.encode() (bsc#1222842, bsc#1229994)
* CVE-2024-37891: urllib3: Added the ``Proxy-Authorization`` header to the list of headers to strip from requests when redirecting to a different host (bsc#1226469, bsc#1229654)
- Other bugs fixed:
* Added passlib Python module to the bundle
* Allow NamedLoaderContexts to be returned from loader
* Avoid crash on wrong output of systemctl version (bsc#1229539)
* Avoid explicit reading of /etc/salt/minion (bsc#1220357)
* Enable post_start_cleanup.sh to work in a transaction
* Fixed cloud Minion configuration for multiple Masters (bsc#1229109)
* Fixed failing x509 tests with OpenSSL < 1.1
* Fixed the SELinux context for Salt Minion service (bsc#1219041)
* Fixed too frequent systemd service restart in test_system test
* Fixed zyppnotify plugin after latest zypp/libzypp upgrades (bsc#1231697, bsc#1231045)
* Improved error handling with different OpenSSL versions
* Increase warn_until_date date for code we still support
* Prevent using SyncWrapper with no reason
* Reverted the change making reactor less blocking (bsc#1230322)
* Use --cachedir for extension_modules in salt-call (bsc#1226141)
* Use Pygit2 id instead of deprecated oid in gitfs
Tenable has extracted the preceding description block directly from the SUSE security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the affected venv-salt-minion package.See Also
https://bugzilla.suse.com/1219041
https://bugzilla.suse.com/1220357
https://bugzilla.suse.com/1222842
https://bugzilla.suse.com/1226141
https://bugzilla.suse.com/1226447
https://bugzilla.suse.com/1226448
https://bugzilla.suse.com/1226469
https://bugzilla.suse.com/1227547
https://bugzilla.suse.com/1228105
https://bugzilla.suse.com/1228780
https://bugzilla.suse.com/1229109
https://bugzilla.suse.com/1229539
https://bugzilla.suse.com/1229654
https://bugzilla.suse.com/1229704
https://bugzilla.suse.com/1229873
https://bugzilla.suse.com/1229994
https://bugzilla.suse.com/1229995
https://bugzilla.suse.com/1229996
https://bugzilla.suse.com/1230058
https://bugzilla.suse.com/1230059
https://bugzilla.suse.com/1230322
https://bugzilla.suse.com/1231045
https://bugzilla.suse.com/1231697
http://www.nessus.org/u?9512c6b5
https://www.suse.com/security/cve/CVE-2024-0397
https://www.suse.com/security/cve/CVE-2024-3651
https://www.suse.com/security/cve/CVE-2024-37891
https://www.suse.com/security/cve/CVE-2024-4032
https://www.suse.com/security/cve/CVE-2024-5569
https://www.suse.com/security/cve/CVE-2024-6345
https://www.suse.com/security/cve/CVE-2024-6923
Plugin Details
Severity: High
ID: 212577
File Name: suse_SU-2024-4021-1.nasl
Version: 1.1
Type: local
Agent: unix
Family: SuSE Local Security Checks
Published: 12/12/2024
Updated: 12/12/2024
Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 6.1
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2024-7592
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
CVSS v4
Risk Factor: High
Base Score: 8.7
Threat Score: 7.7
Threat Vector: CVSS:4.0/E:P
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS Score Source: CVE-2024-8088
Vulnerability Information
CPE: cpe:/o:novell:suse_linux:15, p-cpe:/a:novell:suse_linux:venv-salt-minion
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 11/18/2024
Vulnerability Publication Date: 4/11/2024
Reference Information
CVE: CVE-2024-0397, CVE-2024-3651, CVE-2024-37891, CVE-2024-4032, CVE-2024-5569, CVE-2024-6345, CVE-2024-6923, CVE-2024-7592, CVE-2024-8088
SuSE: SUSE-SU-2024:4021-1