876 matches found
CVE-2020-17490
CVE-2020-17490 affects SaltStack Salt (TLS module) up to version 3002, where the TLS execution module creates certificates with weak file permissions. The root cause is improper permissions on certificate files, potentially exposing private keys and enabling unintended access to sensitive materia...
CVE-2020-17490
The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions...
CVE-2020-17490
Removed by vendor...
CVE-2020-17490
The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions...
CVE-2020-16846
Removed by vendor...
CVE-2020-16846
CVE-2020-16846 affects SaltStack Salt via the Salt API SSH Client. The issue allows an unauthenticated, network-accessible user to execute arbitrary commands by injecting shell commands through crafted requests to the Salt API when the SSH client is enabled. The vulnerability is cited across mult...
CVE-2020-16846
An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection...
CVE-2020-16846
An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection...
CVE-2020-17490
The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions...
CVE-2020-16846 — SaltStack Unauthenticated Shell Injection
An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection. Recent assessments: ccondon-r7 at October 14, 2021 2:31pm UTC reported: Being exploited in the wild as of April 2021. Juniper Networks...
SaltStack < 3002 Multiple Vulnerabilities
According to its self-reported version number, the instance of SaltStack hosted on the remote server is affected by multiple vulnerabilities: - eauth is not sufficiently validated when calling Salt SSH via the salt-api. Any value for 'eauth' or 'token' will allow a user to bypass authentication a...
salt -- multiple vulnerabilities
SaltStack reports multiple security vulnerabilities in Salt 3002: CVE-2020-16846: Prevent shell injections in netapi ssh client. CVE-2020-17490: Prevent creating world readable private keys with the tls execution module. CVE-2020-25592: Properly validate eauth credentials and tokens along with...
CVE-2020-25592
In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH...
CVE-2020-25592 — SaltStack Authentication Bypass and Salt SSH Command Execution
In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH. Recent assessments: wvu-r7 at November 10, 2020 11:51pm UTC reported: Please see the Rapid7 analysis. Assessed Attacker Value: 5 Assessed Attacker...
Fedora 32 : salt (2020-f9fa7892f2)
Update to CVE release 3001.3-1 for Python3 Includes fixes for CVE-2020-16846, CVE-2020-17490, CVE-2020-25592 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it ...
CVE-2020-16846
An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection...
PT-2021-6507 · Saltstack +2 · Saltstack Salt +2
Name of the Vulnerable Software and Affected Versions: SaltStack Salt versions prior to 3003.3 Description: The issue is related to information disclosure in the error data area of the Salt configuration management and remote execution system. Exploitation of this issue allows a remote attacker t...
The vulnerability of the configuration management system and remote execution capabilities of SaltStack Salt—which exists due to the lack of measures to neutralize special elements—allows attackers to access confidential data, compromise its integrity, and cause service failures.
The vulnerability of SaltStack Salt’s configuration management system and remote execution capabilities exists because measures to neutralize specific elements are not taken. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data, compromise its integrity, a...
The vulnerability of the master.py component in the Configuration Management system and the remote execution of SaltStack operations allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service failures.
The vulnerability of the master.py component of the Configuration Management system and the remote execution of SaltStack operations is related to the lack of a mechanism for verifying input data. Exploiting this vulnerability can allow an attacker operating remotely to gain access to confidentia...
The vulnerability of the ClearFuncs component in the configuration management system and the remote execution of SaltStack operations allows a perpetrator to gain access to confidential data.
The vulnerability of the ClearFuncs component in the configuration management system and remote execution of SaltStack operations is related to the lack of a mechanism for verifying input data. Exploiting this vulnerability can allow an attacker operating remotely to gain access to confidential...