[Pkg-salt-team] Bug#913475: salt: CVE-2018-15751: remote authentication bypass in salt-api(netapi) allows to execute arbitrary commands

[Salvatore Bonaccorso]

Source: salt
Version: 2017.7.4+dfsg1-1
Severity: grave
Tags: security upstream

Hi,

The following vulnerability was published for salt.

CVE-2018-15751[0]:
| SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow
| remote attackers to bypass authentication and execute arbitrary
| commands via salt-api(netapi).

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2018-15751
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15751
[1] https://bugzilla.novell.com/show_bug.cgi?id=1113699
[2] https://docs.saltstack.com/en/2017.7/topics/releases/2017.7.8.html
    https://docs.saltstack.com/en/latest/topics/releases/2018.3.3.html

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore