Source
r/saltstack•
expressadmin

Saltstack 3000.2 and 2019.2.4 Now Available via Saltstack Official Repo

It took them a few hours to get everything setup, but they now have the packages out there. So if you were using the repos, update now to patch the security exploit on the Salt Master.

Posted Apr 30, 2020, 4:26 AM UTC

10
overyander•

Links? I haven't heard of any master exploits. What versions are affected?

2
tyc1031•

All versions are affected. Warning, upgrading the master to the patch breaks backwards compatibility with some older minions. At a minimum 2017.7.1 and older minions can't run saltutil.sync_all with a 2019.2.4 master because one of the methods required is not exposed anymore. Here is the patch to make backwards compatibility work:

diff --git a/salt/master.py b/salt/master.py
index aae55f1828..b21d2281ed 100644
--- a/salt/master.py
+++ b/salt/master.py
@@ -1181,6 +1181,7 @@ class AESFuncs(TransportMethods):
         'minion_publish', 'revoke_auth', 'run_func', '_serve_file',
         '_file_find', '_file_hash', '_file_find_and_stat', '_file_list',
         '_file_list_emptydirs', '_dir_list', '_symlink_list', '_file_envs',
+        '_file_hash_and_stat',
     )
     def __init__(self, opts):
3
[deleted]•

[deleted]

2
tyc1031•

You cannot run a saltutil.sync_all but other functionality works. Maybe they have't actually tried a 2019.2.4 master with an older minion yet, or they don't have any custom salt modules and may not need to run a sync. As soon as we upgraded everything broke until we figured that patch out. We were working with some of the salt team on their public slack channel and they recommended using the patch above. You will know you are hitting the issue if you see lots of these errors in your salt master logs while trying to run a sync:

2020-04-30 00:21:14,851 [salt.master      :1167][ERROR   ][12103] Requested method not exposed: _file_hash_and_stat
1
targetx•

https://github.com/saltstack/community/blob/master/doc/Community-Message.pdf

2
[deleted]•

[deleted]

2
TinyRickSystems•

Anyone know when Suse will get the updated versions out? Looks like the repo only has salt-master-2019.2.0-28.1.x86_64.rpm

2
expressadminOP•

Looking at the dates on that repo, it looks like they were updated around the same time that the other repos were updated. I don't know if they have the backported patches though.

1
TinyRickSystems•

I think that is the last time any of the repos were touched, sadly they have a weird way of presenting their repo that is in an S3 bucket. But the SLES versions are 2019.2.0 for the latest, I don't see a 3000 or 2019.2.4

2