27aee8f99b
- Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * fix-the-regression-of-user.present-state-when-group-.patch * make-master_tops-compatible-with-salt-3000-and-older.patch * avoid-conflicts-with-dependencies-versions-bsc-12116.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch * fix-regression-multiple-values-for-keyword-argument-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * mark-salt-3006-as-released-586.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * define-__virtualname__-for-transactional_update-modu.patch * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch OBS-URL: https://build.opensuse.org/request/show/1103185 OBS-URL: https://build.opensuse.org/package/show/systemsmanagement:saltstack/salt?expand=0&rev=212
36 lines
1.5 KiB
Diff
36 lines
1.5 KiB
Diff
From 78f5a76315891168d24e923d2b08211baefefb4f Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Pablo=20Su=C3=A1rez=20Hern=C3=A1ndez?=
|
|
<psuarezhernandez@suse.com>
|
|
Date: Thu, 22 Jun 2023 16:36:20 +0100
|
|
Subject: [PATCH] tornado: Fix an open redirect in StaticFileHandler
|
|
(CVE-2023-28370, bsc#1211741) (#583)
|
|
|
|
---
|
|
salt/ext/tornado/web.py | 9 +++++++++
|
|
1 file changed, 9 insertions(+)
|
|
|
|
diff --git a/salt/ext/tornado/web.py b/salt/ext/tornado/web.py
|
|
index 60bde695d3..97fadcf87d 100644
|
|
--- a/salt/ext/tornado/web.py
|
|
+++ b/salt/ext/tornado/web.py
|
|
@@ -2544,6 +2544,15 @@ class StaticFileHandler(RequestHandler):
|
|
# but there is some prefix to the path that was already
|
|
# trimmed by the routing
|
|
if not self.request.path.endswith("/"):
|
|
+ if self.request.path.startswith("//"):
|
|
+ # A redirect with two initial slashes is a "protocol-relative" URL.
|
|
+ # This means the next path segment is treated as a hostname instead
|
|
+ # of a part of the path, making this effectively an open redirect.
|
|
+ # Reject paths starting with two slashes to prevent this.
|
|
+ # This is only reachable under certain configurations.
|
|
+ raise HTTPError(
|
|
+ 403, "cannot redirect path with two initial slashes"
|
|
+ )
|
|
self.redirect(self.request.path + "/", permanent=True)
|
|
return
|
|
absolute_path = os.path.join(absolute_path, self.default_filename)
|
|
--
|
|
2.41.0
|
|
|
|
|