CVE-2019-18897
Fixed in a distro release EPSS <1%CVSS 8.4
A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of salt of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Factory allows local attackers to escalate privileges from user salt to root. This issue affects: SUSE Linux Enterprise Server 12 salt-master version 2019.2.0-46.83.1 and prior versions. SUSE Linux Enterprise Server 15 salt-master version 2019.2.0-6.21.1 and prior versions. openSUSE Factory salt-master version 2019.2.2-3.1 and prior versions.
Products: SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, openSUSE Factory
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| SUSE Linux Enterprise High Performance Computing 15-ESPOS | salt | 2019.2.0-5.64.1 |
| SUSE Linux Enterprise High Performance Computing 15-ESPOS | salt | 3000-5.78.1 |
| SUSE Linux Enterprise High Performance Computing 15-LTSS | salt | 2019.2.0-5.64.1 |
| SUSE Linux Enterprise High Performance Computing 15-LTSS | salt | 3000-5.78.1 |
| SUSE Linux Enterprise Module for Advanced Systems Management 12 | python-singledispatch | 3.4.0.3-1.5.1 |
| SUSE Linux Enterprise Module for Advanced Systems Management 12 | salt | 3000-46.101.1 |
| SUSE Linux Enterprise Module for Advanced Systems Management 12 | salt | 2019.2.0-46.88.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP1 | salt | 2019.2.0-6.24.1 |
| SUSE Linux Enterprise Module for Python 2 15 SP1 | salt | 2019.2.0-6.24.1 |
| SUSE Linux Enterprise Module for Server Applications 15 SP1 | salt | 2019.2.0-6.24.1 |
| SUSE Linux Enterprise Point of Sale 12 SP2 | python-singledispatch | 3.4.0.3-1.5.1 |
| SUSE Linux Enterprise Point of Sale 12 SP2 | salt | 3000-46.101.1 |
| SUSE Linux Enterprise Point of Sale 12 SP2 | salt | 2019.2.0-46.88.1 |
| SUSE Linux Enterprise Server 15-LTSS | salt | 3000-5.78.1 |
| SUSE Linux Enterprise Server 15-LTSS | salt | 2019.2.0-5.64.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 | salt | 3000-5.78.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 | salt | 2019.2.0-5.64.1 |
| SUSE Manager Client Tools 12 | python-singledispatch | 3.4.0.3-1.5.1 |
| SUSE Manager Client Tools 12 | salt | 3000-46.101.1 |
| SUSE Manager Client Tools 12 | salt | 2019.2.0-46.88.1 |
| SUSE Manager Proxy 3.2 | python-singledispatch | 3.4.0.3-1.5.1 |
| SUSE Manager Proxy 3.2 | salt | 3000-46.101.1 |
| SUSE Manager Proxy 3.2 | salt | 2019.2.0-46.88.1 |
| SUSE Manager Server 3.2 | python-singledispatch | 3.4.0.3-1.5.1 |
| SUSE Manager Server 3.2 | salt | 3000-46.101.1 |
| SUSE Manager Server 3.2 | salt | 2019.2.0-46.88.1 |
| openSUSE Leap 15.1 | salt | 2019.2.0-lp151.5.12.1 |