Salt's salt.auth.pki module does not properly authenticate callers
The salt.auth.pki module does not properly authenticate callers. The "password" field contains a public certificate which is validated against a CA certificate by the module. This is not pki authentication, as the caller does not need access to the corresponding private key for the authentication attempt to be accepted.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-38825US | — | — | ||
The salt.auth.pki module does not properly authenticate callers. The "password" field contains a public certificate which is validated against a CA certificate by the module. This… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://docs.saltproject.io/en/3006/topics/releases/3006.12.htmlWEB
- https://docs.saltproject.io/en/3007/topics/releases/3007.4.htmlWEB
- https://github.com/saltstack/saltPACKAGE
- https://github.com/saltstack/salt/commit/5ff18fd0ececdfd083ddce693c3ccef30e44f155WEB
- https://github.com/saltstack/salt/commit/d7cb64e44db5f82fd615373f5dca2eb1fb29bbabWEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-38825ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan