saltstack/salt
1
0
Fork 0
mirror of https://github.com/saltstack/salt.git synced 2025-04-16 09:40:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2
salt/doc/topics/releases/2016.3.5.rst
Benjamin Drung ae899aee64 Fix various spelling mistakes in release notes 
There are various spelling mistakes in the git commit messages in the
release notes.

Fix those spelling mistakes. Since each commit is either referenced by
the commit has or pull request, fixing those spelling mistakes has no
negative effect on finding those commit.

Signed-off-by: Benjamin Drung <benjamin.drung@ionos.com>
2022-03-16 16:45:52 -04:00

108 KiB
Raw Blame History

Salt 2016.3.5 Release Notes

Version 2016.3.5 is a bugfix release for 2016.3.0 <release-2016-3-0>.

Statistics

Security Fixes

CVE-2017-5192 local_batch client external authentication not respected

The LocalClient.cmd_batch() method client does not accept external_auth credentials and so access to it from salt-api has been removed for now. This vulnerability allows code execution for already-authenticated users and is only in effect when running salt-api as the root user.

CVE-2017-5200 Salt-api allows arbitrary command execution on a salt-master via Salt's ssh_client

Users of Salt-API and salt-ssh could execute a command on the salt master via a hole when both systems were enabled.

We recommend everyone on the 2016.3 branch upgrade to a patched release as soon as possible.

Improved Checksum Handling in file.managed <salt.states.file.managed>, archive.extracted <salt.states.archive.extracted> States

When the source_hash argument for these states refers to a file containing checksums, Salt now looks for checksums matching the name of the source URI, as well as the file being managed. Prior releases only looked for checksums matching the filename being managed. Additionally, a new argument (source_hash_name) has been added, which allows the user to disambiguate ambiguous matches when more than one matching checksum is found in the source_hash file.

A more detailed explanation of this functionality can be found in the file.managed <salt.states.file.managed> documentation, in the section for the new source_hash_name argument.

Changelog for v2016.3.4..v2016.3.5

Generated at: 2018-05-27 05:09:33 UTC