In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH. Reference: https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/
Created salt tracking bugs for this issue: Affects: fedora-all [bug 1895455]
This was already fixed in salt 3001.3 which has already been released in fedora 31 and 32, and 3002.1 which has been released in 33 and rawhide.
Upstream fix commit: https://github.com/saltstack/salt/commit/daa39c58370641913aa8d5a7a0f44254973dd66b
External References: https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/ https://docs.saltstack.com/en/latest/topics/releases/3002.1.html https://docs.saltstack.com/en/latest/topics/releases/3001.3.html https://docs.saltstack.com/en/latest/topics/releases/3000.5.html https://docs.saltstack.com/en/latest/topics/releases/2019.2.7.html
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Statement: Red Hat Ceph Storage 2 shipped salt for the usage of Red Hat Storage Console 2 (RHSCON-2), which required salt to administrate ceph nodes. RHSCON-2 has reached End Of Life, hence salt is no longer used and supported. Therefore, the salt package provided by Red Hat Ceph Storage 2 has been marked as 'will not fix'.