critique
CVE-2019-17361
salt: salt-api NET API with the ssh client enabled is vulnerable to command injection
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD, GHSA, Photon OS. Plus basse selon Red Hat (élevée), Ubuntu (moyenne).
Description
In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| Photon OS 1.0 | salt | 2018.3.3-2.ph1 |
| pip::GitHub Security Advisory pip | salt | 2019.2.3 |
| alpine 3.12 | salt | 2019.2.3-r0 |
| alpine 3.13 | salt | 2019.2.3-r0 |
| alpine 3.14 | salt | 2019.2.3-r0 |
| alpine 3.15 | salt | 2019.2.3-r0 |
| alpine 3.16 | salt | 2019.2.3-r0 |
| alpine 3.17 | salt | 2019.2.3-r0 |
| alpine 3.18 | salt | 2019.2.3-r0 |
| alpine 3.19 | salt | 2019.2.3-r0 |
| alpine 3.20 | salt | 2019.2.3-r0 |
| alpine 3.21 | salt | 2019.2.3-r0 |
Afficher les 22 entrées de 22 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| Photon OS 1.0 | salt | 2018.3.3-2.ph1 |
| pip::GitHub Security Advisory pip | salt | 2019.2.3 |
| alpine 3.12 | salt | 2019.2.3-r0 |
| alpine 3.13 | salt | 2019.2.3-r0 |
| alpine 3.14 | salt | 2019.2.3-r0 |
| alpine 3.15 | salt | 2019.2.3-r0 |
| alpine 3.16 | salt | 2019.2.3-r0 |
| alpine 3.17 | salt | 2019.2.3-r0 |
| alpine 3.18 | salt | 2019.2.3-r0 |
| alpine 3.19 | salt | 2019.2.3-r0 |
| alpine 3.20 | salt | 2019.2.3-r0 |
| alpine 3.21 | salt | 2019.2.3-r0 |
| alpine 3.22 | salt | 2019.2.3-r0 |
| alpine 3.23 | salt | 2019.2.3-r0 |
| alpine 3.24 | salt | 2019.2.3-r0 |
| alpine edge | salt | 2019.2.3-r0 |
| debian 10 | salt | 2018.3.4+dfsg1-6+deb10u1 |
| debian 9 | salt | 2016.11.2+ds-1+deb9u3 |
| ubuntu 16.04 | salt | 2015.8.8+ds-1ubuntu0.1 |
| ubuntu 16.04-ESM | salt | 2015.8.8+ds-1ubuntu0.1 |
| ubuntu 18.04 | salt | 2017.7.4+dfsg1-1ubuntu18.04.2 |
| ubuntu 18.04-ESM | salt | 2017.7.4+dfsg1-1ubuntu18.04.2 |
Références
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00026.html
- https://access.redhat.com/security/cve/CVE-2019-17361
- https://docs.saltstack.com/en/latest/topics/releases/2019.2.3.html#security-fix
- https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2020-177.yaml
- https://github.com/saltstack/salt
- https://github.com/saltstack/salt/commits/master
- https://nvd.nist.gov/vuln/detail/CVE-2019-17361
- https://ubuntu.com/security/notices/USN-4459-1