In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2019-17361US | critical9.8 | — | ||
In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00026.htmlWEB
- https://docs.saltstack.com/en/latest/topics/releases/2019.2.3.html#security-fixWEB
- https://github.com/advisories/GHSA-q53j-p6r2-g2v4ADVISORY
- https://github.com/saltstack/salt/commits/masterWEB
- https://usn.ubuntu.com/4459-1/WEB
- https://www.debian.org/security/2020/dsa-4676ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan