An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users. References: https://docs.saltstack.com/en/latest/topics/releases/2019.2.4.html https://github.com/saltstack/salt/blob/v3000.2_docs/doc/topics/releases/3000.2.rst
Created salt tracking bugs for this issue: Affects: epel-all [bug 1832423] Affects: fedora-all [bug 1832422]
Upstream patch: https://github.com/saltstack/salt/commit/cce7abad9c22d9d50ccee2813acabff8deca35dd
Statement: Red Hat Ceph Storage 2 shipped salt for the usage of Red Hat Storage Console 2(RHSCON-2), which required salt to administrate ceph nodes. RHSCON-2 has reached End Of Life, hence salt is no longer used and supported. Therefore, the salt package provided by Red Hat Ceph Storage 2 has been marked as 'will not fix'.
External References: https://docs.saltstack.com/en/latest/topics/releases/3000.2.html https://labs.f-secure.com/advisories/saltstack-authorization-bypass
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-11652