CVE-2020-16846

SaltStack Salt Shell Injection Vulnerability

Salt

An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.

6. Nov 2020

Ausgewertete Quellen

• Debian
  https://lists.debian.org/debian-lts-announce/2020/12/msg00007.html
• Debian
  https://lists.debian.org/debian-lts-announce/2022/01/msg00000.html
• Debian
  https://www.debian.org/security/2021/dsa-4837
• Hersteller
  https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/
• Hinweis
  http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.html
• Hinweis
  http://packetstormsecurity.com/files/160039/SaltStack-Salt-REST-API-Arbitrary-Command-Execution.html
• Hinweis
  https://security.gentoo.org/glsa/202011-13
• Hinweis
  https://www.zerodayinitiative.com/advisories/ZDI-20-1379/
• Hinweis
  https://www.zerodayinitiative.com/advisories/ZDI-20-1380/
• Hinweis
  https://www.zerodayinitiative.com/advisories/ZDI-20-1381/
• Hinweis
  https://www.zerodayinitiative.com/advisories/ZDI-20-1382/
• Hinweis
  https://www.zerodayinitiative.com/advisories/ZDI-20-1383/
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-16846
• CISA
  SaltStack Salt Shell Injection Vulnerability
• NVD
  CVE-2020-16846