-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2020.2494
                         Security update for Salt
                               22 July 2020

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Salt
Publisher:         SUSE
Operating System:  SUSE
Impact/Access:     Execute Arbitrary Code/Commands -- Remote/Unauthenticated
                   Root Compromise                 -- Existing Account      
                   Unauthorised Access             -- Remote/Unauthenticated
                   Access Confidential Data        -- Existing Account      
Resolution:        Patch/Upgrade
CVE Names:         CVE-2020-11652 CVE-2020-11651 CVE-2019-18897
                   CVE-2018-15751 CVE-2018-15750 

Reference:         ESB-2020.1894
                   ESB-2020.1051
                   ESB-2018.3614
                   ESB-2020.1894

Original Bulletin: 
   https://www.suse.com/support/update/announcement/2020/suse-su-20201971-1
   https://www.suse.com/support/update/announcement/2020/suse-su-20201973-1
   https://www.suse.com/support/update/announcement/2020/suse-su-20201974-1

Comment: This bulletin contains three (3) SUSE security advisories.

- --------------------------BEGIN INCLUDED TEXT--------------------

SUSE Security Update: Security update for Salt

______________________________________________________________________________

Announcement ID:   SUSE-SU-2020:1971-1
Rating:            moderate
References:        #1157465 #1159284 #1162327 #1165572 #1167437 #1168340
                   #1169604 #1169800 #1170104 #1170288 #1170595 #1171906
                   #1172075 #1173072 #1174165
Cross-References:  CVE-2019-18897 CVE-2020-11651 CVE-2020-11652
Affected Products:
                   SUSE Manager Tools 12
                   SUSE Manager Server 3.2
                   SUSE Manager Proxy 3.2
                   SUSE Linux Enterprise Point of Sale 12-SP2
                   SUSE Linux Enterprise Module for Advanced Systems Management 12
______________________________________________________________________________

An update that solves three vulnerabilities and has 12 fixes is now available.

Description:


This update fixes the following issues:
salt:

  o Fix for TypeError in Tornado importer (bsc#1174165)
  o Require python3-distro only for TW (bsc#1173072)
  o Various virt backports from 3000.2
  o Avoid traceback on debug logging for swarm module (bsc#1172075)
  o Add publish_batch to ClearFuncs exposed methods
  o Update to salt version 3000 See release notes: https://docs.saltstack.com/
    en/latest/topics/releases/3000.html
  o Zypperpkg: filter patterns that start with dot (bsc#1171906)
  o Batch mode now also correctly provides return value (bsc#1168340)
  o Add docker.logout to docker execution module (bsc#1165572)
  o Testsuite fix
  o Add option to enable/disable force refresh for zypper
  o Python3.8 compatibility changes
  o Prevent sporious "salt-api" stuck processes when managing SSH minions
    because of logging deadlock (bsc#1159284)
  o Avoid segfault from "salt-api" under certain conditions of heavy load
    managing SSH minions (bsc#1169604)
  o Revert broken changes to slspath made on Salt 3000 (saltstack/salt#56341)
    (bsc#1170104)
  o Returns a the list of IPs filtered by the optional network list
  o Fix CVE-2020-11651 and CVE-2020-11652 (bsc#1170595)
  o Do not require vendored backports-abc (bsc#1170288)
  o Fix partition.mkpart to work without fstype (bsc#1169800)
  o Enable building and installation for Fedora
  o Disable python2 build on Tumbleweed We are removing the python2 interpreter
    from openSUSE (SLE16). As such disable salt building for python2 there.
  o More robust remote port detection
  o Sanitize grains loaded from roster_grains.json cache during "state.pkg"
  o Do not make file.recurse state to fail when msgpack 0.5.4 (bsc#1167437)
  o Build: Buildequire pkgconfig(systemd) instead of systemd pkgconfig(systemd)
    is provided by systemd, so this is de-facto no change. But inside the Open
    Build Service (OBS), the same symbol is also provided by systemd-mini,
    which exists to shorten build-chains by only enabling what other packages
    need to successfully build
  o Add new custom SUSE capability for saltutil state module
  o Fixes status attribute issue in aptpkg test
  o Make setup.py script not to require setuptools greater than 9.1
  o Loop: fix variable names for until_no_eval
  o Drop conflictive module.run state patch (bsc#1167437)
  o Update patches after rebase with upstream v3000 tag (bsc#1167437)
  o Fix some requirements issues depending on Python3 versions
  o Removes obsolete patch
  o Fix for low rpm_lowpkg unit test
  o Add python-singledispatch as dependency for python2-salt
  o Virt._get_domain: don't raise an exception if there is no VM
  o Fix for temp folder definition in loader unit test
  o Adds test for zypper abbreviation fix
  o Improved storage pool or network handling
  o Better import cache handline
  o Make "salt.ext.tornado.gen" to use "salt.ext.backports_abc" on Python 2
  o Fix regression in service states with reload argument
  o Fix integration test failure for test_mod_del_repo_multiline_values
  o Fix for unless requisite when pip is not installed
  o Fix errors from unit tests due NO_MOCK and NO_MOCK_REASON deprecation
  o Fix tornado imports and missing _utils after rebasing patches
  o Removes unresolved merge conflict in yumpkg module
  o Use full option name instead of undocumented abbreviation for zypper
  o Requiring python3-distro only for openSUSE/SLE >= 15 and not for Python 2
    builds
  o Avoid possible user escalation upgrading salt-master (bsc#1157465)
    (CVE-2019-18897)
  o Fix unit tests failures in test_batch_async tests
  o Batch Async: Handle exceptions, properly unregister and close instances
    after running async batching to avoid CPU starvation of the MWorkers (bsc#
    1162327)
  o RHEL/CentOS 8 uses platform-python instead of python3
  o Loader: invalidate the import cachefor extra modules
  o Zypperpkg: filter patterns that start with dot (bsc#1171906)
  o Batch mode now also correctly provides return value (bsc#1168340)
  o Add docker.logout to docker execution module (bsc#1165572)
  o Improvements for chroot module
  o Add option to enable/disable force refresh for zypper
  o Prevent sporious "salt-api" stuck processes when managing SSH minions
    because of logging deadlock (bsc#1159284)
  o Avoid segfault from "salt-api" under certain conditions of heavy load
    managing SSH minions (bsc#1169604)

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  o SUSE Manager Tools 12:
    zypper in -t patch SUSE-SLE-Manager-Tools-12-2020-1971=1
  o SUSE Manager Server 3.2:
    zypper in -t patch SUSE-SUSE-Manager-Server-3.2-2020-1971=1
  o SUSE Manager Proxy 3.2:
    zypper in -t patch SUSE-SUSE-Manager-Proxy-3.2-2020-1971=1
  o SUSE Linux Enterprise Point of Sale 12-SP2:
    zypper in -t patch SUSE-SLE-POS-12-SP2-2020-1971=1
  o SUSE Linux Enterprise Module for Advanced Systems Management 12:
    zypper in -t patch SUSE-SLE-Module-Adv-Systems-Management-12-2020-1971=1

Package List:

  o SUSE Manager Tools 12 (aarch64 ppc64le s390x x86_64):
       python2-salt-3000-46.101.1
       python3-salt-3000-46.101.1
       salt-3000-46.101.1
       salt-doc-3000-46.101.1
       salt-minion-3000-46.101.1
  o SUSE Manager Tools 12 (noarch):
       python-singledispatch-3.4.0.3-1.5.1
  o SUSE Manager Server 3.2 (ppc64le s390x x86_64):
       python2-salt-3000-46.101.1
       python3-salt-3000-46.101.1
       salt-3000-46.101.1
       salt-api-3000-46.101.1
       salt-cloud-3000-46.101.1
       salt-doc-3000-46.101.1
       salt-master-3000-46.101.1
       salt-minion-3000-46.101.1
       salt-proxy-3000-46.101.1
       salt-ssh-3000-46.101.1
       salt-standalone-formulas-configuration-3000-46.101.1
       salt-syndic-3000-46.101.1
  o SUSE Manager Server 3.2 (noarch):
       python-singledispatch-3.4.0.3-1.5.1
       salt-bash-completion-3000-46.101.1
       salt-zsh-completion-3000-46.101.1
  o SUSE Manager Proxy 3.2 (noarch):
       python-singledispatch-3.4.0.3-1.5.1
  o SUSE Manager Proxy 3.2 (x86_64):
       python2-salt-3000-46.101.1
       python3-salt-3000-46.101.1
       salt-3000-46.101.1
       salt-minion-3000-46.101.1
  o SUSE Linux Enterprise Point of Sale 12-SP2 (noarch):
       python-singledispatch-3.4.0.3-1.5.1
  o SUSE Linux Enterprise Point of Sale 12-SP2 (x86_64):
       python2-salt-3000-46.101.1
       salt-3000-46.101.1
       salt-minion-3000-46.101.1
  o SUSE Linux Enterprise Module for Advanced Systems Management 12 (ppc64le
    s390x x86_64):
       python2-salt-3000-46.101.1
       salt-3000-46.101.1
       salt-api-3000-46.101.1
       salt-cloud-3000-46.101.1
       salt-doc-3000-46.101.1
       salt-master-3000-46.101.1
       salt-minion-3000-46.101.1
       salt-proxy-3000-46.101.1
       salt-ssh-3000-46.101.1
       salt-standalone-formulas-configuration-3000-46.101.1
       salt-syndic-3000-46.101.1
  o SUSE Linux Enterprise Module for Advanced Systems Management 12 (noarch):
       python-singledispatch-3.4.0.3-1.5.1
       salt-bash-completion-3000-46.101.1
       salt-zsh-completion-3000-46.101.1


References:

  o https://www.suse.com/security/cve/CVE-2019-18897.html
  o https://www.suse.com/security/cve/CVE-2020-11651.html
  o https://www.suse.com/security/cve/CVE-2020-11652.html
  o https://bugzilla.suse.com/1157465
  o https://bugzilla.suse.com/1159284
  o https://bugzilla.suse.com/1162327
  o https://bugzilla.suse.com/1165572
  o https://bugzilla.suse.com/1167437
  o https://bugzilla.suse.com/1168340
  o https://bugzilla.suse.com/1169604
  o https://bugzilla.suse.com/1169800
  o https://bugzilla.suse.com/1170104
  o https://bugzilla.suse.com/1170288
  o https://bugzilla.suse.com/1170595
  o https://bugzilla.suse.com/1171906
  o https://bugzilla.suse.com/1172075
  o https://bugzilla.suse.com/1173072
  o https://bugzilla.suse.com/1174165

- --------------------------------------------------------------------------------

SUSE Security Update: Security update for Salt

______________________________________________________________________________

Announcement ID:   SUSE-SU-2020:1973-1
Rating:            moderate
References:        #1157465 #1159284 #1162327 #1165572 #1167437 #1168340
                   #1169604 #1169800 #1170104 #1170288 #1170595 #1171906
                   #1172075 #1173072 #1174165
Cross-References:  CVE-2019-18897 CVE-2020-11651 CVE-2020-11652
Affected Products:
                   SUSE Linux Enterprise Server for SAP 15
                   SUSE Linux Enterprise Server 15-LTSS
                   SUSE Linux Enterprise High Performance Computing 15-LTSS
                   SUSE Linux Enterprise High Performance Computing 15-ESPOS
______________________________________________________________________________

An update that solves three vulnerabilities and has 12 fixes is now available.

Description:


This update fixes the following issues:
salt:

  o Fix for TypeError in Tornado importer (bsc#1174165)
  o Require python3-distro only for TW (bsc#1173072)
  o Various virt backports from 3000.2
  o Avoid traceback on debug logging for swarm module (bsc#1172075)
  o Add publish_batch to ClearFuncs exposed methods
  o Update to salt version 3000 See release notes: https://docs.saltstack.com/
    en/latest/topics/releases/3000.html
  o Zypperpkg: filter patterns that start with dot (bsc#1171906)
  o Batch mode now also correctly provides return value (bsc#1168340)
  o Add docker.logout to docker execution module (bsc#1165572)
  o Testsuite fix
  o Add option to enable/disable force refresh for zypper
  o Python3.8 compatibility changes
  o Prevent sporious "salt-api" stuck processes when managing SSH minions
    because of logging deadlock (bsc#1159284)
  o Avoid segfault from "salt-api" under certain conditions of heavy load
    managing SSH minions (bsc#1169604)
  o Revert broken changes to slspath made on Salt 3000 (saltstack/salt#56341)
    (bsc#1170104)
  o Returns a the list of IPs filtered by the optional network list
  o Fix CVE-2020-11651 and CVE-2020-11652 (bsc#1170595)
  o Do not require vendored backports-abc (bsc#1170288)
  o Fix partition.mkpart to work without fstype (bsc#1169800)
  o Enable building and installation for Fedora
  o Disable python2 build on Tumbleweed We are removing the python2 interpreter
    from openSUSE (SLE16). As such disable salt building for python2 there.
  o More robust remote port detection
  o Sanitize grains loaded from roster_grains.json cache during "state.pkg"
  o Do not make file.recurse state to fail when msgpack 0.5.4 (bsc#1167437)
  o Build: Buildequire pkgconfig(systemd) instead of systemd pkgconfig(systemd)
    is provided by systemd, so this is de-facto no change. But inside the Open
    Build Service (OBS), the same symbol is also provided by systemd-mini,
    which exists to shorten build-chains by only enabling what other packages
    need to successfully build
  o Add new custom SUSE capability for saltutil state module
  o Fixes status attribute issue in aptpkg test
  o Make setup.py script not to require setuptools greater than 9.1
  o Loop: fix variable names for until_no_eval
  o Drop conflictive module.run state patch (bsc#1167437)
  o Update patches after rebase with upstream v3000 tag (bsc#1167437)
  o Fix some requirements issues depending on Python3 versions
  o Removes obsolete patch
  o Fix for low rpm_lowpkg unit test
  o Add python-singledispatch as dependency for python2-salt
  o Virt._get_domain: don't raise an exception if there is no VM
  o Fix for temp folder definition in loader unit test
  o Adds test for zypper abbreviation fix
  o Improved storage pool or network handling
  o Better import cache handline
  o Make "salt.ext.tornado.gen" to use "salt.ext.backports_abc" on Python 2
  o Fix regression in service states with reload argument
  o Fix integration test failure for test_mod_del_repo_multiline_values
  o Fix for unless requisite when pip is not installed
  o Fix errors from unit tests due NO_MOCK and NO_MOCK_REASON deprecation
  o Fix tornado imports and missing _utils after rebasing patches
  o Removes unresolved merge conflict in yumpkg module
  o Use full option name instead of undocumented abbreviation for zypper
  o Requiring python3-distro only for openSUSE/SLE >= 15 and not for Python 2
    builds
  o Avoid possible user escalation upgrading salt-master (bsc#1157465)
    (CVE-2019-18897)
  o Fix unit tests failures in test_batch_async tests
  o Batch Async: Handle exceptions, properly unregister and close instances
    after running async batching to avoid CPU starvation of the MWorkers (bsc#
    1162327)
  o RHEL/CentOS 8 uses platform-python instead of python3
  o Loader: invalidate the import cachefor extra modules
  o Zypperpkg: filter patterns that start with dot (bsc#1171906)
  o Batch mode now also correctly provides return value (bsc#1168340)
  o Add docker.logout to docker execution module (bsc#1165572)
  o Improvements for chroot module
  o Add option to enable/disable force refresh for zypper
  o Prevent sporious "salt-api" stuck processes when managing SSH minions
    because of logging deadlock (bsc#1159284)
  o Avoid segfault from "salt-api" under certain conditions of heavy load
    managing SSH minions (bsc#1169604)

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  o SUSE Linux Enterprise Server for SAP 15:
    zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2020-1973=1
  o SUSE Linux Enterprise Server 15-LTSS:
    zypper in -t patch SUSE-SLE-Product-SLES-15-2020-1973=1
  o SUSE Linux Enterprise High Performance Computing 15-LTSS:
    zypper in -t patch SUSE-SLE-Product-HPC-15-2020-1973=1
  o SUSE Linux Enterprise High Performance Computing 15-ESPOS:
    zypper in -t patch SUSE-SLE-Product-HPC-15-2020-1973=1

Package List:

  o SUSE Linux Enterprise Server for SAP 15 (ppc64le x86_64):
       python2-salt-3000-5.78.1
       python3-salt-3000-5.78.1
       salt-3000-5.78.1
       salt-api-3000-5.78.1
       salt-cloud-3000-5.78.1
       salt-doc-3000-5.78.1
       salt-master-3000-5.78.1
       salt-minion-3000-5.78.1
       salt-proxy-3000-5.78.1
       salt-ssh-3000-5.78.1
       salt-standalone-formulas-configuration-3000-5.78.1
       salt-syndic-3000-5.78.1
  o SUSE Linux Enterprise Server for SAP 15 (noarch):
       salt-bash-completion-3000-5.78.1
       salt-fish-completion-3000-5.78.1
       salt-zsh-completion-3000-5.78.1
  o SUSE Linux Enterprise Server 15-LTSS (aarch64 s390x):
       python2-salt-3000-5.78.1
       python3-salt-3000-5.78.1
       salt-3000-5.78.1
       salt-api-3000-5.78.1
       salt-cloud-3000-5.78.1
       salt-doc-3000-5.78.1
       salt-master-3000-5.78.1
       salt-minion-3000-5.78.1
       salt-proxy-3000-5.78.1
       salt-ssh-3000-5.78.1
       salt-standalone-formulas-configuration-3000-5.78.1
       salt-syndic-3000-5.78.1
  o SUSE Linux Enterprise Server 15-LTSS (noarch):
       salt-bash-completion-3000-5.78.1
       salt-fish-completion-3000-5.78.1
       salt-zsh-completion-3000-5.78.1
  o SUSE Linux Enterprise High Performance Computing 15-LTSS (aarch64 x86_64):
       python2-salt-3000-5.78.1
       python3-salt-3000-5.78.1
       salt-3000-5.78.1
       salt-api-3000-5.78.1
       salt-cloud-3000-5.78.1
       salt-doc-3000-5.78.1
       salt-master-3000-5.78.1
       salt-minion-3000-5.78.1
       salt-proxy-3000-5.78.1
       salt-ssh-3000-5.78.1
       salt-standalone-formulas-configuration-3000-5.78.1
       salt-syndic-3000-5.78.1
  o SUSE Linux Enterprise High Performance Computing 15-LTSS (noarch):
       salt-bash-completion-3000-5.78.1
       salt-fish-completion-3000-5.78.1
       salt-zsh-completion-3000-5.78.1
  o SUSE Linux Enterprise High Performance Computing 15-ESPOS (aarch64 x86_64):
       python2-salt-3000-5.78.1
       python3-salt-3000-5.78.1
       salt-3000-5.78.1
       salt-api-3000-5.78.1
       salt-cloud-3000-5.78.1
       salt-doc-3000-5.78.1
       salt-master-3000-5.78.1
       salt-minion-3000-5.78.1
       salt-proxy-3000-5.78.1
       salt-ssh-3000-5.78.1
       salt-standalone-formulas-configuration-3000-5.78.1
       salt-syndic-3000-5.78.1
  o SUSE Linux Enterprise High Performance Computing 15-ESPOS (noarch):
       salt-bash-completion-3000-5.78.1
       salt-fish-completion-3000-5.78.1
       salt-zsh-completion-3000-5.78.1


References:

  o https://www.suse.com/security/cve/CVE-2019-18897.html
  o https://www.suse.com/security/cve/CVE-2020-11651.html
  o https://www.suse.com/security/cve/CVE-2020-11652.html
  o https://bugzilla.suse.com/1157465
  o https://bugzilla.suse.com/1159284
  o https://bugzilla.suse.com/1162327
  o https://bugzilla.suse.com/1165572
  o https://bugzilla.suse.com/1167437
  o https://bugzilla.suse.com/1168340
  o https://bugzilla.suse.com/1169604
  o https://bugzilla.suse.com/1169800
  o https://bugzilla.suse.com/1170104
  o https://bugzilla.suse.com/1170288
  o https://bugzilla.suse.com/1170595
  o https://bugzilla.suse.com/1171906
  o https://bugzilla.suse.com/1172075
  o https://bugzilla.suse.com/1173072
  o https://bugzilla.suse.com/1174165

- --------------------------------------------------------------------------------

SUSE Security Update: Security update for salt

______________________________________________________________________________

Announcement ID:   SUSE-SU-2020:1974-1
Rating:            moderate
References:        #1159284 #1165572 #1167437 #1168340 #1169604 #1170104
                   #1170288 #1171906 #1172075 #1173072 #1174165
Cross-References:  CVE-2018-15750 CVE-2018-15751 CVE-2020-11651 CVE-2020-11652
Affected Products:
                   SUSE Linux Enterprise Module for Server Applications 15-SP1
                   SUSE Linux Enterprise Module for Python2 15-SP1
                   SUSE Linux Enterprise Module for Basesystem 15-SP1
______________________________________________________________________________

An update that solves four vulnerabilities and has 7 fixes is now available.

Description:

This update for salt contains the following fixes:

  o Fix for TypeError in Tornado importer (bsc#1174165)
  o Require python3-distro only for TW (bsc#1173072)
  o Update to Salt version 3000: See release notes: https://docs.saltstack.com/
    en/latest/topics/releases/3000.html


  o Add docker.logout to docker execution module. (bsc#1165572)
  o Add option to enable/disable force refresh for zypper.
  o Add publish_batch to ClearFuncs exposed methods.
  o Adds test for zypper abbreviation fix.
  o Avoid segfault from "salt-api" under certain conditions of heavy load
    managing SSH minions. (bsc#1169604)
  o Avoid traceback on debug logging for swarm module. (bsc#1172075)
  o Batch mode now also correctly provides return value. (bsc#1168340)
  o Better import cache handline.
  o Do not make file.recurse state to fail when msgpack 0.5.4. (bsc#1167437)
  o Do not require vendored backports-abc. (bsc#1170288)
  o Fix errors from unit tests due NO_MOCK and NO_MOCK_REASON deprecation.
  o Fix for low rpm_lowpkg unit test.
  o Fix for temp folder definition in loader unit test.
  o Fix for unless requisite when pip is not installed.
  o Fix integration test failure for test_mod_del_repo_multiline_values.
  o Fix regression in service states with reload argument.
  o Fix tornado imports and missing _utils after rebasing patches.
  o Fix status attribute issue in aptpkg test.
  o Improved storage pool or network handling.
  o loop: fix variable names for until_no_eval.
  o Make "salt.ext.tornado.gen" to use "salt.ext.backports_abc" on Python 2.
  o Make setup.py script not to require setuptools greater than 9.1.
  o More robust remote port detection.
  o Prevent sporious "salt-api" stuck processes when managing SSH minions.
    because of logging deadlock. (bsc#1159284)
  o Python3.8 compatibility changes.
  o Removes unresolved merge conflict in yumpkg module.
  o Returns a the list of IPs filtered by the optional network list.
  o Revert broken changes to slspath made on Salt 3000 (saltstack/salt#56341).
    (bsc#1170104)
  o Sanitize grains loaded from roster_grains.json cache during "state.pkg".
  o Various virt backports from 3000.2.
  o zypperpkg: filter patterns that start with dot. (bsc#1171906)

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  o SUSE Linux Enterprise Module for Server Applications 15-SP1:
    zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP1-2020-1974=1
  o SUSE Linux Enterprise Module for Python2 15-SP1:
    zypper in -t patch SUSE-SLE-Module-Python2-15-SP1-2020-1974=1
  o SUSE Linux Enterprise Module for Basesystem 15-SP1:
    zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP1-2020-1974=1

Package List:

  o SUSE Linux Enterprise Module for Server Applications 15-SP1 (aarch64
    ppc64le s390x x86_64):
       salt-api-3000-6.37.1
       salt-cloud-3000-6.37.1
       salt-master-3000-6.37.1
       salt-proxy-3000-6.37.1
       salt-ssh-3000-6.37.1
       salt-standalone-formulas-configuration-3000-6.37.1
       salt-syndic-3000-6.37.1
  o SUSE Linux Enterprise Module for Server Applications 15-SP1 (noarch):
       salt-fish-completion-3000-6.37.1
  o SUSE Linux Enterprise Module for Python2 15-SP1 (aarch64 ppc64le s390x
    x86_64):
       python2-salt-3000-6.37.1
  o SUSE Linux Enterprise Module for Basesystem 15-SP1 (aarch64 ppc64le s390x
    x86_64):
       python3-salt-3000-6.37.1
       salt-3000-6.37.1
       salt-doc-3000-6.37.1
       salt-minion-3000-6.37.1
  o SUSE Linux Enterprise Module for Basesystem 15-SP1 (noarch):
       salt-bash-completion-3000-6.37.1
       salt-zsh-completion-3000-6.37.1


References:

  o https://www.suse.com/security/cve/CVE-2018-15750.html
  o https://www.suse.com/security/cve/CVE-2018-15751.html
  o https://www.suse.com/security/cve/CVE-2020-11651.html
  o https://www.suse.com/security/cve/CVE-2020-11652.html
  o https://bugzilla.suse.com/1159284
  o https://bugzilla.suse.com/1165572
  o https://bugzilla.suse.com/1167437
  o https://bugzilla.suse.com/1168340
  o https://bugzilla.suse.com/1169604
  o https://bugzilla.suse.com/1170104
  o https://bugzilla.suse.com/1170288
  o https://bugzilla.suse.com/1171906
  o https://bugzilla.suse.com/1172075
  o https://bugzilla.suse.com/1173072
  o https://bugzilla.suse.com/1174165

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBXxfHI+NLKJtyKPYoAQjRLA/9HsianfjtUWZC8hsCJY3bb0KyW8nradS5
sOgIOzuoJgzIXDjKV8teUXjVSnqcNuPXkfhwnjgUrfrS4ii4wKRQdmx2xskPQY6R
e8oxWCP0XA1rjUK7UuM6h6uzh0lMmEHURGAu+ZaspPMlB5Xn+Tlc03u2aj26dauI
CkqEbYte96k3OuDEsLJi/IQ3HSIm+kBT7C5oRql9bt1WiqhUq0vjG0Djr6K3aa2w
9VWiH7bJRtv2i2G+wnxU3sUnDo84K1rQMx6Y6R/KQmvDe1YRabYw1bqJ4AZckTkL
K8j9RQPSGb4nl0dkUTSXWkowcyleXQMSzkMYbN6ZVCcfVTGDxyVkXL2aOkxlB5eo
L9VlCjFkiMKtnRkS0k52Wc0NYAg8vvCRCURv3Y7azGepN3n1ep4QnL4l6V9L1S1a
7p3awsMSj9o7Yuu5Sczj77XCvvMgjJSiuThb1t6eMVrbvMxv10x4Gnnzz+18hAUb
5qKwYwA4swn5DBCxQLPIM/8I/xsf77epqRXuyJNvUZ5++RV29vqaYzPc/ifX466q
Gp8I+UHRdGvR3d34aBwoeq/YNmyys8z+2Mrnw9s7ysaSKrrWbh7VlxgdROIJREyN
7Tpi9yE8wq1umQV///Iyg7yiAZhgnJoNYvNohymB2ITXg+eKrny5SlWHS1ayTspz
5XcGLYcLKvs=
=RhcZ
-----END PGP SIGNATURE-----