An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions. References: https://docs.saltstack.com/en/latest/topics/releases/2019.2.4.html https://github.com/saltstack/salt/blob/v3000.2_docs/doc/topics/releases/3000.2.rst
Created salt tracking bugs for this issue: Affects: epel-all [bug 1832475] Affects: fedora-all [bug 1832476]
Statement: Red Hat Ceph Storage 2 shipped salt for the usage of Red Hat Storage Console 2(RHSCON-2), which required salt to administrate ceph nodes. RHSCON-2 has reached End Of Life, hence salt is no longer used and supported. Therefore, the salt package provided by Red Hat Ceph Storage 2 has been marked as 'will not fix'.
External References: https://docs.saltstack.com/en/latest/topics/releases/3000.2.html https://labs.f-secure.com/advisories/saltstack-authorization-bypass
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-11651