saltstack/salt
1
0
Fork 0
mirror of https://github.com/saltstack/salt.git synced 2025-04-17 10:10:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Update 2016.11.2 release notes (#39039)

Browse source
This commit is contained in:
Nicole Thomas 2017-01-30 15:40:00 -07:00 • committed by GitHub
parent a7fc02e196
commit 424e68436e
1 changed files with 21 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
doc/topics/releases/2016.11.2.rst
View file

@ -4,8 +4,28 @@ Salt 2016.11.2 Release Notes
Version 2016.11.2 is a bugfix release for :ref:`2016.11.0 <release-2016-11-0>`.
Security Fixes
==============
CVE-2017-5192: local_batch client external authentication not respected
The ``LocalClient.cmd_batch()`` method client does not accept ``external_auth``
credentials and so access to it from salt-api has been removed for now. This
vulnerability allows code execution for already-authenticated users and is only
in effect when running salt-api as the ``root`` user.
CVE-2017-5200: Salt-api allows arbitrary command execution on a salt-master via
Salt's ssh_client
Users of Salt-API and salt-ssh could execute a command on the salt master via a
hole when both systems were enabled.
We recommend everyone upgrade to 2016.11.2 as soon as possible.
Changes for v2016.11.1..v2016.11.2
----------------------------------------
----------------------------------
Extended changelog courtesy of Todd Stansell (https://github.com/tjstansell/salt-changelogs):