SaltStack Salt is vulnerable to command injection
In SaltStack Salt before 2019.2.3, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2019-17361US | critical9.8 | — | ||
In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00026.htmlWEB
- https://docs.saltstack.com/en/latest/topics/releases/2019.2.3.html#security-fixWEB
- https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2020-177.yamlWEB
- https://github.com/saltstack/saltPACKAGE
- https://nvd.nist.gov/vuln/detail/CVE-2019-17361ADVISORY
- https://usn.ubuntu.com/4459-1WEB
- https://www.debian.org/security/2020/dsa-4676WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan