Security update for salt


Salt was updated to 2017.7.2 and also to fix various bugs and security issues.

See https://docs.saltstack.com/en/develop/topics/releases/2017.7.2.html for full changelog.

Security issues fixed:

- CVE-2017-14695: A directory traversal during minion id validation was fixed. (boo#1062462)
- CVE-2017-14696: A remote denial of service attack with a specially crafted authentication request was fixed. (boo#1062464)

Non security issues fixed:

- Add possibility to generate _version.py at the build time for
raw builds: https://github.com/saltstack/salt/pull/43955
- Fix salt target-type field returns "String" for existing
jids but an empty "Array" for non existing jids. (issue #1711)
- Fixed minion resource exhaustion when many functions are being
executed in parallel (boo#1059758)
- Remove 'TasksTask' attribute from salt-master.service in older
versions of systemd (boo#985112)
- Provide custom SUSE salt-master.service file.
- Fix wrong version reported by Salt (boo#1061407)
- list_pkgs: add parameter for returned attribute selection (boo#1052264)
- Adding the leftover for zypper and yum list_pkgs functionality.
- Use $HOME to get the user home directory instead using '~' char (boo#1042749)

Fixed bugs
bnc#1059758
Minion resource exhaustion when many functions are being executing in parallel
bnc#1062462
VUL-0: CVE-2017-14695: salt: directory traversal vulnerability in minion id validation
bnc#1062464
VUL-0: CVE-2017-14696: salt: Remote DoS with a specially crafted authentication request
bnc#1042749
salt-bash-completion creates /some/where/~/.cache/salt-comp-cache_functions
bnc#1061407
Wrong version reported by Salt 2017.7.1 on the CLI and grains (products:next)
bnc#1052264
Add patches to salt to support SUSE Manager scalability features
bnc#985112
salt-master process reaches 'TasksMax' on SLES12 SP2 and fails
Selected Binaries
openSUSE Build Service is sponsored by