SB2022050540 - SUSE update for Security Beta update for SUSE Manager Client Tools
Published: May 5, 2022
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 secuirty vulnerabilities.
1) Input validation error (CVE-ID: CVE-2022-21698)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input within method label cardinality. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
2) Cryptographic issues (CVE-ID: CVE-2022-22934)
The vulnerability allows a remote attacker to manipulate data.
The vulnerability exists due to Salt Masters do not sign pillar data with the minion’s public key. A remote attacker can manipulate arbitrary pillar data.
3) Insufficient verification of data authenticity (CVE-ID: CVE-2022-22935)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper verification of data authenticity. A remote attacker with ability to perform MitM attack can impersonate a master and force a minion process to stop.
4) Authentication Bypass by Capture-replay (CVE-ID: CVE-2022-22936)
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to improper authentication in jobs. A remote attacker can perform a replay attack and force minions to run old jobs.
5) Incorrect permission assignment for critical resource (CVE-ID: CVE-2022-22941)
The vulnerability allows a remote user to compromise third-party minions.
The vulnerability exists due to improper permissions checks. A remote user can target any minion connected to the Syndic when configured as a Master-of-Masters, bypass publisher_acl and execute on any configured minion.
Remediation
Install update from vendor's website.