Bug 1832474 (CVE-2020-11651)

Summary:	CVE-2020-11651 salt: salt-master process ClearFuncs class does not properly validate method calls
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	david-dm.murphy, hvyas, itamar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	salt 3000.2, salt 2019.2.4	Doc Type:	If docs needed, set a value
Doc Text:	An authentication bypass vulnerability was found in Salt, where it is susceptible to arbitrary code execution when processing unauthenticated requests by the ClearFuncs class. This flaw allows an attacker to execute arbitrary code on Salt minions as root.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-05-07 16:31:51 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1832475, 1832476
Bug Blocks:	1832426

Description Guilherme de Almeida Suckevicz 2020-05-06 17:23:33 UTC

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.

References:
https://docs.saltstack.com/en/latest/topics/releases/2019.2.4.html
https://github.com/saltstack/salt/blob/v3000.2_docs/doc/topics/releases/3000.2.rst

Comment 1 Guilherme de Almeida Suckevicz 2020-05-06 17:23:56 UTC

Created salt tracking bugs for this issue:

Affects: epel-all [bug 1832475]
Affects: fedora-all [bug 1832476]

Comment 2 Hardik Vyas 2020-05-07 13:08:26 UTC

Statement:

Red Hat Ceph Storage 2 shipped salt for the usage of Red Hat Storage Console 2(RHSCON-2), which required salt to administrate ceph nodes. RHSCON-2 has reached End Of Life, hence salt is no longer used and supported. Therefore, the salt package provided by Red Hat Ceph Storage 2 has been marked as 'will not fix'.

Comment 3 Hardik Vyas 2020-05-07 13:08:29 UTC

External References:

https://docs.saltstack.com/en/latest/topics/releases/3000.2.html
https://labs.f-secure.com/advisories/saltstack-authorization-bypass

Comment 4 Hardik Vyas 2020-05-07 13:08:32 UTC

Mitigation:

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Comment 6 Product Security DevOps Team 2020-05-07 16:31:51 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-11651