tocsin

CVE-2020-25592

2 advisories.

PyPI/salt CVE-2020-25592: critical 9.8

SaltStack Salt Improper Validation of eauth credentials and tokens in salt-netapi

Action: Upgrade salt to 2015.8.13 or later.

pip install salt==2015.8.13
pip install salt==2016.3.8
pip install salt==2016.11.10
pip install salt==2017.7.8
pip install salt==2018.3.5
pip install salt==2019.2.7
pip install salt==3000.5
pip install salt==3001.3
pip install salt==3002.1

Affected

introducedfixedlast affected
02015.8.13-
2016.3.02016.3.8-
2016.11.02016.11.10-
2017.5.02017.7.8-
2018.2.02018.3.5-
2019.2.02019.2.7-
3000.03000.5-
3001.03001.3-
3002.03002.1-

Fixed versions

2015.8.132016.3.82016.11.102017.7.82018.3.52019.2.73000.53001.33002.1

Sources

CVE-2020-25592 · published · modified · JSON

PyPI/salt CVE-2020-25592: unknown

In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH.

Action: Upgrade salt to 2015.8.10 or later.

pip install salt==2015.8.10
pip install salt==2015.8.13
pip install salt==2016.3.4
pip install salt==2016.3.6
pip install salt==2016.3.8
pip install salt==2016.11.3
pip install salt==2016.11.6
pip install salt==2016.11.10
pip install salt==2017.7.4
pip install salt==2017.7.8
pip install salt==2018.3.5
pip install salt==2019.2.5
pip install salt==3000.3

Affected

introducedfixedlast affected
02015.8.10-
2015.8.112015.8.13-
2016.3.02016.3.4-
2016.3.52016.3.6-
2016.3.72016.3.8-
2016.11.02016.11.3-
2016.11.42016.11.6-
2016.11.72016.11.10-
2017.7.02017.7.4-
2017.7.52017.7.8-
2018.3.0rc12018.3.5-
2019.2.02019.2.5-
30003000.3-

Fixed versions

2015.8.102015.8.132016.3.42016.3.62016.3.82016.11.32016.11.62016.11.102017.7.42017.7.82018.3.52019.2.53000.3

Sources

CVE-2020-25592 · published · modified · JSON