Bug 1895454 (CVE-2020-25592)

Summary:	CVE-2020-25592 salt: salt-netapi improperly validates eauth credentials and tokens
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	amctagga, brycel, david-dm.murphy, frederic.pierret, hvyas, itamar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	salt 3002.1, salt 3001.3, salt 3000.5, salt 2019.2.7	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in salt. Invalid eauth credentials and tokens are not handled correctly when calling Salt SSH via the salt-api which could allow an attacker to bypass authentication and gain access to restricted information or to possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-11-06 17:43:25 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1895455
Bug Blocks:	1895456

Description Guilherme de Almeida Suckevicz 2020-11-06 17:32:58 UTC

In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH.

Reference:
https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/

Comment 1 Guilherme de Almeida Suckevicz 2020-11-06 17:33:13 UTC

Created salt tracking bugs for this issue:

Affects: fedora-all [bug 1895455]

Comment 2 Bryce Larson 2020-11-06 17:43:25 UTC

This was already fixed in salt 3001.3 which has already been released in fedora 31 and 32, and 3002.1 which has been released in 33 and rawhide.

Comment 5 Przemyslaw Roguski 2020-11-09 11:41:23 UTC

Upstream fix commit:
https://github.com/saltstack/salt/commit/daa39c58370641913aa8d5a7a0f44254973dd66b

Comment 7 Hardik Vyas 2020-11-09 11:56:15 UTC

External References:

https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/
https://docs.saltstack.com/en/latest/topics/releases/3002.1.html
https://docs.saltstack.com/en/latest/topics/releases/3001.3.html
https://docs.saltstack.com/en/latest/topics/releases/3000.5.html
https://docs.saltstack.com/en/latest/topics/releases/2019.2.7.html

Comment 8 Hardik Vyas 2020-11-09 12:51:13 UTC

Mitigation:

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Comment 9 Eric Christensen 2020-11-09 18:41:26 UTC

Statement:

Red Hat Ceph Storage 2 shipped salt for the usage of Red Hat Storage Console 2 (RHSCON-2), which required salt to administrate ceph nodes. RHSCON-2 has reached End Of Life, hence salt is no longer used and supported. Therefore, the salt package provided by Red Hat Ceph Storage 2 has been marked as 'will not fix'.