Lucene search

K

Veracode Vulnerability DatabaseVERACODE:27855

HistoryNov 10, 2020 - 5:27 a.m.

Shell Injection

2020-11-1005:27:00

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

14

0.973 High

EPSS

Percentile

99.9%

Salt is vulnerable to shell injection. An attacker can send malicious web requests to the Salt API to execute arbitrary shell commands when the SSH client is enabled.

CPENameOperatorVersion
saltle3000.3
saltle3001.1
saltle2019.2.5
saltle3002
salt:edgeeq3000.3-r0
salt:edgeeq3000.2-r0
salt:edgeeq3000.1-r2
salt:edgeeq2019.2.3-r0
salt:edgeeq3000.1-r1
salt:edgeeq3000.1-r0

Rows per page:

1-10 of 201

References

lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.html

packetstormsecurity.com/files/160039/SaltStack-Salt-REST-API-Arbitrary-Command-Execution.html

github.com/saltstack/salt/commit/a553580971ffe08bc9c684a5071c43d3708f0ad6

github.com/saltstack/salt/releases

lists.debian.org/debian-lts-announce/2020/12/msg00007.html

lists.debian.org/debian-lts-announce/2022/01/msg00000.html

lists.fedoraproject.org/archives/list/[email protected]/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA/

security.gentoo.org/glsa/202011-13

www.debian.org/security/2021/dsa-4837

www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves

www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/

www.zerodayinitiative.com/advisories/ZDI-20-1379/

www.zerodayinitiative.com/advisories/ZDI-20-1380/

www.zerodayinitiative.com/advisories/ZDI-20-1381/

www.zerodayinitiative.com/advisories/ZDI-20-1382/

www.zerodayinitiative.com/advisories/ZDI-20-1383/

0.973 High

EPSS

Percentile

99.9%