tocsin

PyPI/salt CVE-2020-16846: critical 9.8, exploited, EPSS 99.59%

SaltStack Salt Command Injection in netapi ssh client

Action: Upgrade salt to 2015.8.13 or later.

pip install salt==2015.8.13
pip install salt==2016.3.8
pip install salt==2016.11.10
pip install salt==2017.7.8
pip install salt==2018.3.5
pip install salt==2019.2.6
pip install salt==3000.4
pip install salt==3001.2
pip install salt==3002.1

Affected

introducedfixedlast affected
02015.8.13-
2016.3.02016.3.8-
2016.11.02016.11.10-
2017.5.02017.7.8-
2018.2.02018.3.5-
2019.2.02019.2.6-
3000.03000.4-
30013001.2-
30023002.1-

Fixed versions

2015.8.132016.3.82016.11.102017.7.82018.3.52019.2.63000.43001.23002.1

Sources

CVE-2020-16846 · published · modified · JSON