crítica
CVE-2019-17361
salt: salt-api NET API with the ssh client enabled is vulnerable to command injection
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA, Photon OS. Más baja según Red Hat (alta), Ubuntu (media).
Descripción
In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| Photon OS 1.0 | salt | 2018.3.3-2.ph1 |
| pip::GitHub Security Advisory pip | salt | 2019.2.3 |
| alpine 3.12 | salt | 2019.2.3-r0 |
| alpine 3.13 | salt | 2019.2.3-r0 |
| alpine 3.14 | salt | 2019.2.3-r0 |
| alpine 3.15 | salt | 2019.2.3-r0 |
| alpine 3.16 | salt | 2019.2.3-r0 |
| alpine 3.17 | salt | 2019.2.3-r0 |
| alpine 3.18 | salt | 2019.2.3-r0 |
| alpine 3.19 | salt | 2019.2.3-r0 |
| alpine 3.20 | salt | 2019.2.3-r0 |
| alpine 3.21 | salt | 2019.2.3-r0 |
Mostrar las 22 entradas de 22 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| Photon OS 1.0 | salt | 2018.3.3-2.ph1 |
| pip::GitHub Security Advisory pip | salt | 2019.2.3 |
| alpine 3.12 | salt | 2019.2.3-r0 |
| alpine 3.13 | salt | 2019.2.3-r0 |
| alpine 3.14 | salt | 2019.2.3-r0 |
| alpine 3.15 | salt | 2019.2.3-r0 |
| alpine 3.16 | salt | 2019.2.3-r0 |
| alpine 3.17 | salt | 2019.2.3-r0 |
| alpine 3.18 | salt | 2019.2.3-r0 |
| alpine 3.19 | salt | 2019.2.3-r0 |
| alpine 3.20 | salt | 2019.2.3-r0 |
| alpine 3.21 | salt | 2019.2.3-r0 |
| alpine 3.22 | salt | 2019.2.3-r0 |
| alpine 3.23 | salt | 2019.2.3-r0 |
| alpine 3.24 | salt | 2019.2.3-r0 |
| alpine edge | salt | 2019.2.3-r0 |
| debian 10 | salt | 2018.3.4+dfsg1-6+deb10u1 |
| debian 9 | salt | 2016.11.2+ds-1+deb9u3 |
| ubuntu 16.04 | salt | 2015.8.8+ds-1ubuntu0.1 |
| ubuntu 16.04-ESM | salt | 2015.8.8+ds-1ubuntu0.1 |
| ubuntu 18.04 | salt | 2017.7.4+dfsg1-1ubuntu18.04.2 |
| ubuntu 18.04-ESM | salt | 2017.7.4+dfsg1-1ubuntu18.04.2 |
Referencias
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00026.html
- https://access.redhat.com/security/cve/CVE-2019-17361
- https://docs.saltstack.com/en/latest/topics/releases/2019.2.3.html#security-fix
- https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2020-177.yaml
- https://github.com/saltstack/salt
- https://github.com/saltstack/salt/commits/master
- https://nvd.nist.gov/vuln/detail/CVE-2019-17361
- https://ubuntu.com/security/notices/USN-4459-1