Ubuntu Security Notice 6849-1 - It was discovered that Salt incorrectly validated method calls and sanitized paths. A remote attacker could possibly use this issue to access some methods without authentication.
7580a38cbbc4ed8e546b6ed84f7622ed5e212a8f84449645aa4233700f716799Debian Linux Security Advisory 4676-1 - Several vulnerabilities were discovered in salt, a powerful remote execution manager, which could result in retrieve of user tokens from the salt master, execution of arbitrary commands on salt minions, arbitrary directory access to authenticated users or arbitrary code execution on salt-api hosts.
bc8f6fb80beef063b1481154a0f467f4fb6d9239d5d229f48d3dffa80f9fa57eDebian Linux Security Advisory 4676-2 - The update for salt for the oldstable distribution (stretch) released as DSA 4676-1 contained an incomplete fix to address CVE-2020-11651 and CVE-2020-11652. Updated salt packages are now available to correct this issue. For reference, the original advisory text follows.
796842d23e3e132487d82a2497387a92aa2770d53d6f95db179b90ce2981e9eeThis Metasploit module exploits unauthenticated access to the runner() and _send_pub() methods in the SaltStack Salt master's ZeroMQ request server, for versions 2019.2.3 and earlier and 3000.1 and earlier, to execute code as root on either the master or on select minions. VMware vRealize Operations Manager versions 7.5.0 through 8.1.0 are known to be affected by the Salt vulnerabilities. Tested against SaltStack Salt 2019.2.3 and 3000.1 on Ubuntu 18.04, as well as Vulhub's Docker image.
8a5e7d31040e1c21ab99f881d936f3d17aadab8f8786980255feab1b1b628534Saltstack version 3000.1 suffers from a remote code execution vulnerability.
30e13e1ef114715477d92359a46e21130fb5b89d01ac65ed3cd4a9c4dd5ac0d7
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed