Alerts This Week
Warning Icon 1 923
Alerts This Week
Warning Icon 1 923

SUSE: 2020:1392-1 Important: Salt Remote Command Access Fix

suse
Calendar Grey May 22, 2020
Dist Suse Esm H88
SUSE Security Announcement: Critical update for salt. Addresses significant vulnerabilities to maintain system integrity.
An update that fixes two vulnerabilities is now available

Summary

This update for salt fixes the following issues: Security issues fixed: - CVE-2020-11651: Fixed the improper validation of method calls in salt-master, that could have allowed unauthenticated remote users to run arbitrary commands on salt minions (bsc#1170595). - CVE-2020-11652: Fixed an improper path sanitation in salt-master, that could have allowed authenticated users to access arbitrary directories (bsc#1170595). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Enterprise Storage 5: zypper in -t patch SUSE-Storage-5-2020-1392=1 Package List: - SUSE Enterprise Storage 5 (aarch64 x86_64): salt-2016.11.4-48.10.1

Topics%20covered

Topics Covered

security advisory important unauthenticated access patch instructions SUSE Enterprise Storage salt remote commands

References

#1170595

Cross- CVE-2020-11651 CVE-2020-11652

Affected Products:

SUSE Enterprise Storage 5

https://www.suse.com/security/cve/CVE-2020-11651.html

https://www.suse.com/security/cve/CVE-2020-11652.html

https://bugzilla.suse.com/1170595

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2020:1392-1
Rating: important

Topics%20covered

Topics Covered

security advisory important unauthenticated access patch instructions SUSE Enterprise Storage salt remote commands

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here