Version 2016.3.5 is a bugfix release for 2016.3.0.
CVE-2017-5192 local_batch client external authentication not respected
The LocalClient.cmd_batch()
method client does not accept external_auth
credentials and so access to it from salt-api has been removed for now. This
vulnerability allows code execution for already-authenticated users and is only
in effect when running salt-api as the root
user.
CVE-2017-5200 Salt-api allows arbitrary command execution on a salt-master via Salt’s ssh_client
Users of Salt-API and salt-ssh could execute a command on the salt master via a hole when both systems were enabled.
We recommend everyone on the 2016.3 branch upgrade to a patched release as soon as possible.
file.managed
, archive.extracted
States¶When the source_hash
argument for these states refers to a file containing
checksums, Salt now looks for checksums matching the name of the source URI, as
well as the file being managed. Prior releases only looked for checksums
matching the filename being managed. Additionally, a new argument
(source_hash_name
) has been added, which allows the user to disambiguate
ambiguous matches when more than one matching checksum is found in the
source_hash
file.
A more detailed explanation of this functionality can be found in the
file.managed
documentation, in the
section for the new source_hash_name
argument.
Generated at: 2018-05-27 05:09:33 UTC