2422 matches found
CVE-2020-25592
Removed by vendor...
CVE-2020-25592
In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH...
CVE-2020-25592
In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH...
CVE-2020-25592
CVE-2020-25592 affects SaltStack Salt via salt-netapi, where eauth credentials/tokens are not properly validated, allowing an unauthenticated user to bypass authentication and invoke Salt SSH. Evidence in connected advisories confirms the issue and that multiple distributions issued fixes (e.g., ...
CVE-2020-17490
CVE-2020-17490 affects SaltStack Salt (TLS module) up to version 3002, where the TLS execution module creates certificates with weak file permissions. The root cause is improper permissions on certificate files, potentially exposing private keys and enabling unintended access to sensitive materia...
CVE-2020-16846
CVE-2020-16846 affects SaltStack Salt via the Salt API SSH Client. The issue allows an unauthenticated, network-accessible user to execute arbitrary commands by injecting shell commands through crafted requests to the Salt API when the SSH client is enabled. The vulnerability is cited across mult...
CVE-2020-16846
An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection...
CVE-2020-16846
An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection...
[SECURITY] Fedora 32 Update: salt-3001.3-1.fc32
Salt is a distributed remote execution system used to execute commands and query data. It was developed in order to bring the best solutions found in the world of remote execution together and make them better, faster and more malleable. Salt accomplishes this via its ability to handle larger loa...
Vulnerabilities fixed in Salt
Vulnerabilities have been fixed in Salt. Salt is used used in VMware vRealize Operations Manager and RSA NetWitness. Exploiting the vulnerabilities allows an unauthenticated malicious person to execute willful code with permissions of the application. To do this, the malicious party must have...
SaltStack < 3002 Multiple Vulnerabilities
According to its self-reported version number, the instance of SaltStack hosted on the remote server is affected by multiple vulnerabilities: - eauth is not sufficiently validated when calling Salt SSH via the salt-api. Any value for 'eauth' or 'token' will allow a user to bypass authentication a...
openSUSE: Security Advisory for salt (openSUSE-SU-2020:1833-1)
The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
openSUSE Security Update : salt (openSUSE-2020-1833)
This update for salt fixes the following issues : - Properly validate eauth credentials and tokens on SSH calls made by Salt API bsc1178319, bsc1178362, bsc1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846 - Fix disk.blkid to avoid unexpected keyword argument 'pubuser'. bsc1177867 - Ensure...
Fedora 33 : salt (2020-5f08623da1)
Update to CVE release 3002.1-1 for Python3 Includes fixes for CVE-2020-16846, CVE-2020-17490, CVE-2020-25592 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it ...
Fedora 31 : salt (2020-9e040bd6dd)
Update to CVE release 3001.3-1 for Python3 Includes fixes for CVE-2020-16846, CVE-2020-17490, CVE-2020-25592 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it ...
CVE-2020-25592 — SaltStack Authentication Bypass and Salt SSH Command Execution
In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH. Recent assessments: wvu-r7 at November 10, 2020 11:51pm UTC reported: Please see the Rapid7 analysis. Assessed Attacker Value: 5 Assessed Attacker...
SUSE-SU-2020:3171-1 Security update for salt
This update for salt fixes the following issues: - Fix for CVE-2020-25592 bsc1178319, CVE-2020-16846, bsc1178361, and CVE-2020-17490 bsc1178362...
OPENSUSE-SU-2020:1833-1 Security update for salt
This update for salt fixes the following issues: - Properly validate eauth credentials and tokens on SSH calls made by Salt API bsc1178319, bsc1178362, bsc1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846 - Fix disk.blkid to avoid unexpected keyword argument 'pubuser'. bsc1177867 - Ensure...
Security update for salt (critical)
openSUSE Security Update: Security update for salt Announcement ID: openSUSE-SU-2020:1833-1 Rating: critical References: 1159670 1175987 1176024 1176294 1176397 1177867 1178319 1178361 1178362 Cross-References: CVE-2020-16846 CVE-2020-17490 CVE-2020-25592 Affected Products: openSUSE Leap 15.2 An...
SUSE-SU-2020:3155-1 Security update for salt
This update for salt fixes the following issues: - Properly validate eauth credentials and tokens on SSH calls made by Salt API bsc1178319, bsc1178362, bsc1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846 - Fix disk.blkid to avoid unexpected keyword argument 'pubuser'. bsc1177867 - Ensure...