Bug 1895449 (CVE-2020-16846)
| Summary: | CVE-2020-16846 salt: sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Guilherme de Almeida Suckevicz <gsuckevi> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED WONTFIX | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | amctagga, brycel, david-dm.murphy, frederic.pierret, hvyas, itamar |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | salt 3002.1, salt 3001.2, salt 3000.4, salt 2019.2.6 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in salt. A shell injection vulnerability was found where an unauthenticated user with network access to the Salt API can use shell injections to run code on the Salt-API using the SSH client. An attacker could use this flaw to cause a denial of service, information disclosure, or privilege escalation. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-11-06 17:35:35 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1895450 | ||
| Bug Blocks: | 1895456 | ||
|
Description
Guilherme de Almeida Suckevicz
2020-11-06 17:17:37 UTC
Created salt tracking bugs for this issue: Affects: fedora-all [bug 1895450] This was already fixed in salt 3001.3 and 3002.1 which have been released in fedora 31, 32, 33, and rawhide. Upstream fix commit: https://github.com/saltstack/salt/commit/a553580971ffe08bc9c684a5071c43d3708f0ad6 External References: https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/ https://docs.saltstack.com/en/latest/topics/releases/3002.1.html https://docs.saltstack.com/en/latest/topics/releases/3001.2.html https://docs.saltstack.com/en/latest/topics/releases/3000.4.html https://docs.saltstack.com/en/latest/topics/releases/2019.2.6.html Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Statement: Red Hat Ceph Storage 2 shipped salt for the usage of Red Hat Storage Console 2 (RHSCON-2), which required salt to administrate ceph nodes. RHSCON-2 has reached End Of Life, hence salt is no longer used and supported. Therefore, the salt package provided by Red Hat Ceph Storage 2 has been marked as 'will not fix'. |