Bug 1832420 (CVE-2020-11652)

Summary:	CVE-2020-11652 salt: salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	david-dm.murphy, hvyas, itamar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	salt 3000.2, salt 2019.2.4	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in salt. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-05-07 16:31:48 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1832422, 1832423
Bug Blocks:	1832426

Description Guilherme de Almeida Suckevicz 2020-05-06 17:14:56 UTC

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.

References:
https://docs.saltstack.com/en/latest/topics/releases/2019.2.4.html
https://github.com/saltstack/salt/blob/v3000.2_docs/doc/topics/releases/3000.2.rst

Comment 1 Guilherme de Almeida Suckevicz 2020-05-06 17:15:45 UTC

Created salt tracking bugs for this issue:

Affects: epel-all [bug 1832423]
Affects: fedora-all [bug 1832422]

Comment 2 Hardik Vyas 2020-05-07 12:26:21 UTC

Upstream patch: https://github.com/saltstack/salt/commit/cce7abad9c22d9d50ccee2813acabff8deca35dd

Comment 3 Hardik Vyas 2020-05-07 12:26:30 UTC

Statement:

Red Hat Ceph Storage 2 shipped salt for the usage of Red Hat Storage Console 2(RHSCON-2), which required salt to administrate ceph nodes. RHSCON-2 has reached End Of Life, hence salt is no longer used and supported. Therefore, the salt package provided by Red Hat Ceph Storage 2 has been marked as 'will not fix'.

Comment 4 Hardik Vyas 2020-05-07 12:26:34 UTC

External References:

https://docs.saltstack.com/en/latest/topics/releases/3000.2.html
https://labs.f-secure.com/advisories/saltstack-authorization-bypass

Comment 5 Hardik Vyas 2020-05-07 12:26:38 UTC

Mitigation:

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Comment 7 Product Security DevOps Team 2020-05-07 16:31:48 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-11652