An update of the salt3 package has been released.

This update for salt fixes the following issues :

Fix CVE-2020-11651 and CVE-2020-11652 (bsc#1170595)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in salt, a powerful remote execution manager, which could result in retrieve of user tokens from the salt master, execution of arbitrary commands on salt minions, arbitrary directory access to authenticated users or arbitrary code execution on salt-api hosts.

The version of SaltStack installed on the remote server is affected by an authentication bypass vulnerability in the ClearFuncs class due to improper validation of method calls. An unauthenticated, remote attacker can exploit this by accessing exposed methods to trigger minions to run arbitrary commands as root, or to retrieve the root key to authenticate commands from the local root user on the master server.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6849-1 advisory.

    It was discovered that Salt incorrectly validated method calls and sanitized paths. A remote attacker     could possibly use this issue to access some methods without authentication. (CVE-2020-11651,     CVE-2020-11652)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
164603	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.1)	Nessus	Misc.	2022/9/1	2024/3/5	critical
136695	Photon OS 1.0: Salt3 PHSA-2020-1.0-0294	Nessus	PhotonOS Local Security Checks	2020/5/18	2023/4/25	critical
136169	SUSE SLED15 / SLES15 Security Update : salt (SUSE-SU-2020:1150-1)	Nessus	SuSE Local Security Checks	2020/4/30	2023/4/25	critical
136170	SUSE SLES15 Security Update : salt (SUSE-SU-2020:1151-1)	Nessus	SuSE Local Security Checks	2020/4/30	2023/4/25	critical
136372	Debian DSA-4676-1 : salt - security update	Nessus	Debian Local Security Checks	2020/5/7	2022/12/6	critical
136423	SaltStack < 2019.2.4 / 3000.x < 3000.2 Authentication Bypass (CVE-2020-11651)	Nessus	Misc.	2020/5/8	2024/6/24	critical
201017	Ubuntu 14.04 LTS : Salt vulnerabilities (USN-6849-1)	Nessus	Ubuntu Local Security Checks	2024/6/26	2024/6/27	critical

検出

プラグインの検索

critical

critical

critical

critical

critical

critical

critical