ISOMAN

CVE

CVE-2020-11652

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.

Severity
MEDIUM
CVSS
6.5
Published
Modified
NVD detailAll CVEs

Linked Releases

DistributionReleaseStatusEvidence
Ubuntu18.04.6 amd64 desktopunknownsource
Ubuntu18.04.6 amd64 live-serverunknownsource

References

  1. http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00047.html
  2. http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00070.html
  3. http://packetstormsecurity.com/files/157560/Saltstack-3000.1-Remote-Code-Execution.html
  4. http://packetstormsecurity.com/files/157678/SaltStack-Salt-Master-Minion-Unauthenticated-Remote-Code-Execution.html
  5. http://support.blackberry.com/kb/articleDetail?articleNumber=000063758
  6. http://www.vmware.com/security/advisories/VMSA-2020-0009.html
  7. https://docs.saltstack.com/en/latest/topics/releases/2019.2.4.html
  8. https://github.com/saltstack/salt/blob/v3000.2_docs/doc/topics/releases/3000.2.rst
  9. https://lists.debian.org/debian-lts-announce/2020/05/msg00027.html
  10. https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-salt-2vx545AG
  11. https://usn.ubuntu.com/4459-1/
  12. https://www.debian.org/security/2020/dsa-4676
  13. http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00047.html
  14. http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00070.html
  15. http://packetstormsecurity.com/files/157560/Saltstack-3000.1-Remote-Code-Execution.html
  16. http://packetstormsecurity.com/files/157678/SaltStack-Salt-Master-Minion-Unauthenticated-Remote-Code-Execution.html
  17. http://support.blackberry.com/kb/articleDetail?articleNumber=000063758
  18. http://www.vmware.com/security/advisories/VMSA-2020-0009.html
  19. https://docs.saltstack.com/en/latest/topics/releases/2019.2.4.html
  20. https://github.com/saltstack/salt/blob/v3000.2_docs/doc/topics/releases/3000.2.rst