Alerts This Week
Warning Icon 1 764
Alerts This Week
Warning Icon 1 764

Debian 8: DLA-2223-1 Moderate Severity: Issues with Salt Access Rights

debian lts
Calendar Grey May 30, 2020
Dist Debian Esm H88
Multiple security flaws identified in Salt, a configuration management utility, addressed in Debian 8. Upgrade advised for enhanced security.
Several vulnerabilities were discovered in package salt, a configuration management and infrastructure automation software
Topics%20covered

Topics Covered

security advisory Debian configuration management arbitrary access salt

Summary

CVE-2020-11651

The salt-master process ClearFuncs class does not properly validate
method calls. This allows a remote user to access some methods
without authentication. These methods can be used to retrieve user
tokens from the salt master and/or run arbitrary commands on salt
minions.

CVE-2020-11652

The salt-master process ClearFuncs class allows access to some
methods that improperly sanitize paths. These methods allow
arbitrary directory access to authenticated users.

For Debian 8 "Jessie", these problems have been fixed in version
2014.1.13+ds-3+deb8u1.

We recommend that you upgrade your salt packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Package: salt
Version: 2014.1.13+ds-3+deb8u1
CVE ID: CVE-2020-11651 CVE-2020-11652
Debian Bug: 959684

Topics%20covered

Topics Covered

security advisory Debian configuration management arbitrary access salt

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here