[SECURITY] [DLA 2480-1] salt security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-2480-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Abhijith PA
December 04, 2020 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : salt
Version : 2016.11.2+ds-1+deb9u6
CVE ID : CVE-2020-16846 CVE-2020-17490 CVE-2020-25592
Several vulnerabilities were discovered in salt.
CVE-2020-16846
An unauthenticated user with network access to the Salt API can use
shell injections to run code on the Salt-API using the SSH client
CVE-2020-17490
When using the functions create_ca, create_csr, and
create_self_signed_cert in the tls execution module, it would not
ensure the key was created with the correct permissions.
CVE-2020-25592
Properly validate eauth credentials and tokens along with their Access
Control Lists – ACLs. Prior to this change, eauth was not properly
validated when calling Salt SSH via the salt-api. Any value for “eauth”
or “token” would allow a user to bypass authentication and make calls
to Salt SSH
For Debian 9 stretch, these problems have been fixed in version
2016.11.2+ds-1+deb9u6.
We recommend that you upgrade your salt packages.
For the detailed security status of salt please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/salt
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE7xPqJqaY/zX9fJAuhj1N8u2cKO8FAl/Kcv8ACgkQhj1N8u2c
KO/vwBAAk9zioBQsnvx2iyCoizykykTKXwAEvKXJaAp84W4Pfwz2+r+8+AXkmWkI
Pwr8l793iFmitVsRmHCZkkC5fwHe5E/WFqSWRIYxVawy8VVdSdfMeMhhaAAZbTFW
9JRiAQSprSbs30RkUeo8xAJEpu8HjFOkbPQJfiOdbcxPdbvXyjtuhCbtZ39kEh98
4tvA1VZ+vRcHav3okz+bVlmIm+v3E2+BbEKBs7Boo9JsdDzxUPQCnAy/PXNP6lyE
1zJXUTbuRfeYWjLKlHHtQt/qbeiwP4e2OQ+J37MXMNfhxbRp2N5OwYZvLgpz8Ant
UEucw9qKOisSi2JNj9xDLw09f/zpEzIH87d9mut0ZL52+Luz0achHip5WA/mjn1r
Yv1QIotN0xXPfaKccIx27AWfFFjAvtoikX7Xc0Bh9Kyh3dJ20iCORSbZohpudVzO
l+CoOaIT4E8qefDP4RLbkwfH2qvX3YXqHBBvZBi3g8A8F97OMg4SDsorgTaalk8X
yAtJdZHKJgnRvXwxJhGYgYqYlKbvo8eBrufPquy6d/d5h1hlM7W9x+T7H7yeFTKk
73xaBuMsge4FP/DF6GAyGqBItJDFG3e4BPmmY1KvX8ysBQndmEiWomugpU4ROG0p
KCH+pCClIeX565C1waQsCJai1P1wIYfAM7z6/NnhC4J7lhyLOxw=
=cwDM
-----END PGP SIGNATURE-----
Reply to: