Critical Vulnerability in Salt Requires Immediate Patching

  • Guess this will be coming downstream soon!


    CVE-2020-11651: An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.



    CVE-2020-11652: An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.


    NAS-OMV:~$ sudo apt list --installed |grep salt


    WARNING: apt does not have a stable CLI interface. Use with caution in scripts.


    salt-common/usul,usul,now 2019.2.3+ds-1 all [installed,automatic]

    salt-minion/usul,usul,now 2019.2.3+ds-1 all [installed,automatic]

    NAS-OMV:~$



    https://www.theregister.co.uk/…ation_tool_vulnerable_to/


    https://www.securityweek.com/c…8SecurityWeek+RSS+Feed%29

  • votdev might have a different opinion but I wouldn't think there would be much attack surface on OMV since it isn't running in a master/minion setup. These are OMV supplied packages. So, Volker will have to update them to get the fix.

    omv 5.6.12 usul | 64 bit | 5.11 proxmox kernel | omvextrasorg 5.6.2 | kvm plugin 5.1.6
    omv-extras.org plugins source code and issue tracker - github


    Please read this before posting a question.
    Please don't PM for support... Too many PMs!

Participate now!

Don’t have an account yet? Register yourself now and be a part of our community!