[Pkg-salt-team] Bug#861219: salt: CVE-2017-8109

[Salvatore Bonaccorso]

Source: salt
Version: 2016.11.2+ds-1
Severity: important
Tags: security patch upstream
Forwarded: https://github.com/saltstack/salt/issues/40075

Hi,

the following vulnerability was published for salt.

CVE-2017-8109[0]:
| The salt-ssh minion code in SaltStack Salt before 2016.11.4 copied over
| configuration from the Salt Master without adjusting permissions, which
| might leak credentials to local attackers on configured minions
| (clients).

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-8109
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8109
[1] https://github.com/saltstack/salt/issues/40075
[2] https://github.com/saltstack/salt/pull/40609
[3] https://github.com/saltstack/salt/commit/8492cef7a5c8871a3978ffc2f6e48b3b960e0151

Please adjust the affected versions in the BTS as needed, I only
quickly checked the sid version for the affected source code, no
checks for jessie done yet.

Regards,
Salvatore