73 matches found
VulnCheck KEV: CVE-2020-11652
SaltStack Salt contains a path traversal vulnerability in the salt-master process ClearFuncs which allows directory access to authenticated users. Salt users who follow fundamental internet security guidelines and best practices are not affected by this vulnerability...
SUSE SLES15 Security Update : Salt (SUSE-SU-2020:1973-1)
This update fixes the following issues : salt : Fix for TypeError in Tornado importer bsc1174165 Require python3-distro only for TW bsc1173072 Various virt backports from 3000.2 Avoid traceback on debug logging for swarm module bsc1172075 Add publishbatch to ClearFuncs exposed methods Update to...
Security Advisory - Two Vulnerabilities in SaltStack Salt
An authentication bypass vulnerability was discovered in SaltStack Salt. An attacker may exploit the vulnerability to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions. Vulnerability ID: HWPSIRT-2020-05592 This vulnerability has been assigned a Common...
Debian: Security Advisory (DLA-2223-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] [DLA 2223-1] salt security update
Package : salt Version : 2014.1.13+ds-3+deb8u1 CVE ID : CVE-2020-11651 CVE-2020-11652 Debian Bug : 959684 Several vulnerabilities were discovered in package salt, a configuration management and infrastructure automation software. CVE-2020-11651 The salt-master process ClearFuncs class does not...
SUSE-SU-2020:1392-1 Security update for salt
This update for salt fixes the following issues: Security issues fixed: - CVE-2020-11651: Fixed the improper validation of method calls in salt-master, that could have allowed unauthenticated remote users to run arbitrary commands on salt minions bsc1170595. - CVE-2020-11652: Fixed an improper pa...
Photon OS 3.0: Salt3 PHSA-2020-3.0-0091
An update of the salt3 package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-3.0-0091. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid136699;...
Photon OS 1.0: Salt PHSA-2020-1.0-0294
An update of the salt package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-1.0-0294. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid136694;...
Photon OS 1.0: Salt3 PHSA-2020-1.0-0294
An update of the salt3 package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-1.0-0294. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid136695...
SaltStack Salt Master/Minion Unauthenticated Remote Code Execution Exploit
This Metasploit module exploits unauthenticated access to the runner and sendpub methods in the SaltStack Salt master's ZeroMQ request server, for versions 2019.2.3 and earlier and 3000.1 and earlier, to execute code as root on either the master or on select minions. VMware vRealize Operations...
vRealize Operations Application Remote Collector (ARC) addresses Authentication Bypass and Directory Traversal vulnerabilities (CVE-2020-11651, CVE-2020-11652)
3. vRealize Operations Application Remote Collector ARC addresses Authentication Bypass CVE-2020-11651 and Directory Traversal CVE-2020-11652 vulnerabilities. The Application Remote Collector ARC introduced with vRealize Operations 7.5 utilizes Salt which is affected by CVE-2020-11651 and...
[SECURITY] [DSA 4676-2] salt security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4676-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 07, 2020 https://www.debian.org/security/faq -...
[SECURITY] [DSA 4676-2] salt security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4676-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 07, 2020 https://www.debian.org/security/faq -...
Debian: Security Advisory (DSA-4676-2)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Saltstack 3000.1 Remote Code Execution Exploit
Exploit Title: Saltstack 3000.1 - Remote Code Execution Date: 2020-05-04 Exploit Author: Jasper Lievisse Adriaanse Vendor Homepage: https://www.saltstack.com/ Version: 3000.2, 2019.2.4, 2017., 2018. Tested on: Debian 10 with Salt 2019.2.0 CVE : CVE-2020-11651 and CVE-2020-11652 Discription:...
SaltStack < 2019.2.4 / 3000.x < 3000.2 Multiple Vulnerabilities
According to its self-reported version number, the instance of SaltStack hosted on the remote server is prior to 2019.2.4, 3000.x prior to 3000.2. It is, therefore, affected by multiple vulnerabilities: - An authentication bypass vulnerabilities exists in the ClearFuncs class due to improper...
Saltstack Salt Authentication Bypass (CVE-2020-11651; CVE-2020-11652)
An authentication bypass vulnerability exists in Salt management framework. Successful exploitation of this vulnerability could allow a remote attacker to bypass login authentication and execute arbitrary commands on the affected system under the context of root...
Saltstack 3000.1 Remote Code Execution
Exploit Title: Saltstack 3000.1 - Remote Code Execution Date: 2020-05-04 Exploit Author: Jasper Lievisse Adriaanse Vendor Homepage: https://www.saltstack.com/ Version: 3000.2, 2019.2.4, 2017., 2018. Tested on: Debian 10 with Salt 2019.2.0 CVE : CVE-2020-11651 and CVE-2020-11652 Discription:...
Saltstack 3000.1 - Remote Code Execution
Exploit Title: Saltstack 3000.1 - Remote Code Execution Date: 2020-05-04 Exploit Author: Jasper Lievisse Adriaanse Vendor Homepage: https://www.saltstack.com/ Version: 3000.2, 2019.2.4, 2017., 2018. Tested on: Debian 10 with Salt 2019.2.0 CVE : CVE-2020-11651 and CVE-2020-11652 Discription:...
