diff options
| author | Graham Christensen <graham@grahamc.com> | 2017-02-08 21:24:10 -0500 |
|---|---|---|
| committer | Graham Christensen <graham@grahamc.com> | 2017-02-08 21:24:10 -0500 |
| commit | 379144f54b2fa0e1568f72d58860393a1e09b92d (patch) | |
| tree | dbd8cdc9877fc45baa2acea3159d76174d878416 /pkgs/development/python-modules/GitPython/hardcode-git-path.patch | |
| parent | e01278b2de9dcb8acf7846a5119b2ec9df2924fc (diff) | |
salt: 2016.3.3 -> 2016.11.2 for multiple CVEs
From the Arch Linux advisory:
- CVE-2017-5192 (arbitrary code execution): The
`LocalClient.cmd_batch()` method client does not accept
`external_auth` credentials and so access to it from salt-api has
been removed for now. This vulnerability allows code execution for
already- authenticated users and is only in effect when running
salt-api as the `root` user.
- CVE-2017-5200 (arbitrary command execution): Salt-api allows
arbitrary command execution on a salt-master via Salt's ssh_client.
Users of Salt-API and salt-ssh could execute a command on the salt
master via a hole when both systems were enabled.
Diffstat (limited to 'pkgs/development/python-modules/GitPython/hardcode-git-path.patch')
0 files changed, 0 insertions, 0 deletions