saltstack/salt
1
0
Fork 0
mirror of https://github.com/saltstack/salt.git synced 2025-04-17 10:10:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge pull request #39047 from rallytime/merge-2016.3

Browse source 
[2016.3] Merge forward from 2015.8 to 2016.3
This commit is contained in:
Nicole Thomas 2017-01-30 16:48:13 -07:00 • committed by GitHub
commit a24af5ac46
2 changed files with 25 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
doc/topics/releases/2015.8.13.rst
View file

@ -5,6 +5,26 @@ Salt 2015.8.13 Release Notes
Version 2015.8.13 is a bugfix release for :ref:`2015.8.0 <release-2015-8-0>`.
Security Fixes
==============
CVE-2017-5192: local_batch client external authentication not respected
The ``LocalClient.cmd_batch()`` method client does not accept ``external_auth``
credentials and so access to it from salt-api has been removed for now. This
vulnerability allows code execution for already-authenticated users and is only
in effect when running salt-api as the ``root`` user.
CVE-2017-5200: Salt-api allows arbitrary command execution on a salt-master via
Salt's ssh_client
Users of Salt-API and salt-ssh could execute a command on the salt master via a
hole when both systems were enabled.
We recommend everyone on the 2015.8 branch upgrade to a patched release as soon
as possible.
Changes for v2015.8.12..v2015.8.13
----------------------------------

5
doc/topics/releases/2015.8.14.rst Normal file
View file

@ -0,0 +1,5 @@
============================
Salt 2015.8.14 Release Notes
============================
Version 2015.8.14 is a bugfix release for :ref:`2015.8.0 <release-2015-8-0>`.