SUSE-SU-2022:3177-1

    Dashboard / Vulnerabilities / SUSE-SU-2022:3177-1

    SUSE-SU-2022:3177-1

    Published: 8 Sept 2022Last Modified: 4 Feb 2026
    Upstream:
    CVE-2022-22967

    Summary: Security update for SUSE Manager Salt Bundle

    Details: This update fixes the following issues: venv-salt-minion: - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix possible errors on running post install script if semanage is present on the system, but SELinux is not configured - Remove unused imports in the venv wrappers - Set VENV_PIP_TARGET to /var/lib/venv-salt-minion/local to force PIP use it as the destination to install modules - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore errors on reading license files with dpkg_lowpkg (bsc#1197288) - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)

    References: https://www.suse.com/support/update/announcement/2022/suse-su-20223177-1/, https://bugzilla.suse.com/1195895, https://bugzilla.suse.com/1197288, https://bugzilla.suse.com/1198489, https://bugzilla.suse.com/1198744, https://bugzilla.suse.com/1199372, https://bugzilla.suse.com/1200566, https://bugzilla.suse.com/1201082, https://www.suse.com/security/cve/CVE-2022-22967

    Affected packages

    Package

    Name: venv-salt-minion

    Purl: pkg:rpm/suse/venv-salt-minion&distro=SUSE%20Manager%20Client%20Tools%2012

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -3004-3.11.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    SUSE-SU-2022:3177-1 | CVE-DB