CVE-2020-16846
2 advisories.
PyPI/salt CVE-2020-16846: critical 9.8, exploited
SaltStack Salt Command Injection in netapi ssh client
Action: Upgrade salt to 2015.8.13 or later.
pip install salt==2015.8.13pip install salt==2016.3.8pip install salt==2016.11.10pip install salt==2017.7.8pip install salt==2018.3.5pip install salt==2019.2.6pip install salt==3000.4pip install salt==3001.2pip install salt==3002.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2015.8.13 | - |
| 2016.3.0 | 2016.3.8 | - |
| 2016.11.0 | 2016.11.10 | - |
| 2017.5.0 | 2017.7.8 | - |
| 2018.2.0 | 2018.3.5 | - |
| 2019.2.0 | 2019.2.6 | - |
| 3000.0 | 3000.4 | - |
| 3001 | 3001.2 | - |
| 3002 | 3002.1 | - |
Fixed versions
| 2015.8.13 | 2016.3.8 | 2016.11.10 | 2017.7.8 | 2018.3.5 | 2019.2.6 | 3000.4 | 3001.2 | 3002.1 |
Sources
- osv: GHSA-qr38-h96j-2j3w
- kev: CVE-2020-16846
- https://nvd.nist.gov/vuln/detail/CVE-2020-16846
- https://www.zerodayinitiative.com/advisories/ZDI-20-1383
- https://www.zerodayinitiative.com/advisories/ZDI-20-1382
- https://www.zerodayinitiative.com/advisories/ZDI-20-1381
- https://www.zerodayinitiative.com/advisories/ZDI-20-1380
- https://www.zerodayinitiative.com/advisories/ZDI-20-1379
- https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves
- https://www.debian.org/security/2021/dsa-4837
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-16846
- https://security.gentoo.org/glsa/202011-13
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA
- https://lists.debian.org/debian-lts-announce/2022/01/msg00000.html
- https://lists.debian.org/debian-lts-announce/2020/12/msg00007.html
- https://github.com/saltstack/salt/releases
- https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3002.1.rst#L12
- https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3001.2.rst#L10
- https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3000.4.rst#L10
- https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/2019.2.6.rst#L10
- https://github.com/saltstack/salt
- https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2020-104.yaml
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.html
- http://packetstormsecurity.com/files/160039/SaltStack-Salt-REST-API-Arbitrary-Command-Execution.html
CVE-2020-16846 · published · modified · JSON
PyPI/salt CVE-2020-16846: unknown, exploited
An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.
Action: Upgrade salt to 2015.8.10 or later.
pip install salt==2015.8.10pip install salt==2015.8.13pip install salt==2016.3.4pip install salt==2016.3.6pip install salt==2016.3.8pip install salt==2016.11.3pip install salt==2016.11.6pip install salt==2016.11.10pip install salt==2017.7.4pip install salt==2017.7.8pip install salt==2018.3.5pip install salt==2019.2.5pip install salt==3000.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2015.8.10 | - |
| 2015.8.11 | 2015.8.13 | - |
| 2016.3.0 | 2016.3.4 | - |
| 2016.3.5 | 2016.3.6 | - |
| 2016.3.7 | 2016.3.8 | - |
| 2016.11.0 | 2016.11.3 | - |
| 2016.11.4 | 2016.11.6 | - |
| 2016.11.7 | 2016.11.10 | - |
| 2017.7.0 | 2017.7.4 | - |
| 2017.7.5 | 2017.7.8 | - |
| 2018.3.0rc1 | 2018.3.5 | - |
| 2019.2.0 | 2019.2.5 | - |
| 3000 | 3000.3 | - |
Fixed versions
| 2015.8.10 | 2015.8.13 | 2016.3.4 | 2016.3.6 | 2016.3.8 | 2016.11.3 | 2016.11.6 | 2016.11.10 | 2017.7.4 | 2017.7.8 | 2018.3.5 | 2019.2.5 | 3000.3 |
Sources
- osv: PYSEC-2020-104
- kev: CVE-2020-16846
- https://github.com/saltstack/salt/releases
- https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA/
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.html
- https://security.gentoo.org/glsa/202011-13
- http://packetstormsecurity.com/files/160039/SaltStack-Salt-REST-API-Arbitrary-Command-Execution.html
- https://www.zerodayinitiative.com/advisories/ZDI-20-1380/
- https://www.zerodayinitiative.com/advisories/ZDI-20-1379/
- https://www.zerodayinitiative.com/advisories/ZDI-20-1383/
- https://www.zerodayinitiative.com/advisories/ZDI-20-1381/
- https://www.zerodayinitiative.com/advisories/ZDI-20-1382/
- https://lists.debian.org/debian-lts-announce/2020/12/msg00007.html
- https://www.debian.org/security/2021/dsa-4837
- https://github.com/advisories/GHSA-qr38-h96j-2j3w
CVE-2020-16846 · published · modified · JSON