SB2022050452 - SUSE update for Security Beta update for SUSE Manager Salt Bundle
Published: May 4, 2022
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 secuirty vulnerabilities.
1) Cross-site scripting (CVE-ID: CVE-2018-19787)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to lxml/html/clean.py in the lxml.html.clean module does not remove javascript. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
2) Cross-site scripting (CVE-ID: CVE-2021-28957)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
3) Infinite loop (CVE-ID: CVE-2022-0778)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop within the BN_mod_sqrt() function when processing an ASN.1 certificate that contains elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. A remote attacker can supply a specially crafted certificate to the TLS server or client, consume all available system resources and cause denial of service conditions.
4) Cryptographic issues (CVE-ID: CVE-2022-22934)
The vulnerability allows a remote attacker to manipulate data.
The vulnerability exists due to Salt Masters do not sign pillar data with the minion’s public key. A remote attacker can manipulate arbitrary pillar data.
5) Insufficient verification of data authenticity (CVE-ID: CVE-2022-22935)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper verification of data authenticity. A remote attacker with ability to perform MitM attack can impersonate a master and force a minion process to stop.
6) Authentication Bypass by Capture-replay (CVE-ID: CVE-2022-22936)
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to improper authentication in jobs. A remote attacker can perform a replay attack and force minions to run old jobs.
7) Incorrect permission assignment for critical resource (CVE-ID: CVE-2022-22941)
The vulnerability allows a remote user to compromise third-party minions.
The vulnerability exists due to improper permissions checks. A remote user can target any minion connected to the Syndic when configured as a Master-of-Masters, bypass publisher_acl and execute on any configured minion.
8) Race condition (CVE-ID: CVE-2022-24302)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to a race condition in the write_private_key_file() function between creation and chmod operations. A local user can exploit the race and gain unauthorized access to sensitive information.
Remediation
Install update from vendor's website.