FreeBSD : salt -- salt-api vulnerability (8c98e643-6008-11ea-af63-38d547003487)

SaltStack reports : With the Salt NetAPI enabled in addition to having a SSH roster defined, unauthenticated access is possible when specifying the client as SSH. Additionally, when the rawshell option is specified any arbitrary command may be run on the Salt master when specifying SSH options. C...

[ASA-202001-7] salt: arbitrary command execution

Arch Linux Security Advisory ASA-202001-7 ========================================= Severity: Medium Date : 2020-01-29 CVE-ID : CVE-2019-17361 Package : salt Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-1087 Summary ======= The package salt before...

Remote Code Execution

salt is vulnerable to remote code execution. A remote attacker is able to obtain unauthenticated access to the application when the NetAPI is enabled with an SSH roster defined. Subsequently, the rawshell parameter used when calling the Salt SSH client via API allows a remote attacker to execute...