salt/doc/topics/releases/2016.11.2.rst
Benjamin Drung ae899aee64 Fix various spelling mistakes in release notes
There are various spelling mistakes in the git commit messages in the
release notes.

Fix those spelling mistakes. Since each commit is either referenced by
the commit has or pull request, fixing those spelling mistakes has no
negative effect on finding those commit.

Signed-off-by: Benjamin Drung <benjamin.drung@ionos.com>
2022-03-16 16:45:52 -04:00

62 KiB

Salt 2016.11.2 Release Notes

Version 2016.11.2 is a bugfix release for 2016.11.0 <release-2016-11-0>.

Statistics

Security Fixes

CVE-2017-5192 local_batch client external authentication not respected

The LocalClient.cmd_batch() method client does not accept external_auth credentials and so access to it from salt-api has been removed for now. This vulnerability allows code execution for already-authenticated users and is only in effect when running salt-api as the root user.

CVE-2017-5200 Salt-api allows arbitrary command execution on a salt-master via Salt's ssh_client

Users of Salt-API and salt-ssh could execute a command on the salt master via a hole when both systems were enabled.

We recommend everyone upgrade to 2016.11.2 as soon as possible.

Changelog for v2016.11.1..v2016.11.2

Generated at: 2018-05-27 19:28:11 UTC