An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection. Reference: https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/
Created salt tracking bugs for this issue: Affects: fedora-all [bug 1895450]
This was already fixed in salt 3001.3 and 3002.1 which have been released in fedora 31, 32, 33, and rawhide.
Upstream fix commit: https://github.com/saltstack/salt/commit/a553580971ffe08bc9c684a5071c43d3708f0ad6
External References: https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/ https://docs.saltstack.com/en/latest/topics/releases/3002.1.html https://docs.saltstack.com/en/latest/topics/releases/3001.2.html https://docs.saltstack.com/en/latest/topics/releases/3000.4.html https://docs.saltstack.com/en/latest/topics/releases/2019.2.6.html
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Statement: Red Hat Ceph Storage 2 shipped salt for the usage of Red Hat Storage Console 2 (RHSCON-2), which required salt to administrate ceph nodes. RHSCON-2 has reached End Of Life, hence salt is no longer used and supported. Therefore, the salt package provided by Red Hat Ceph Storage 2 has been marked as 'will not fix'.