CVE-2019-1010259: SQL Injection
SaltStack Salt 2018.3 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.userchpass function from the MySQL module for Salt (https://github.com/saltstack/salt/blob/develop/salt/modules/mysql.py#L1462). The attack vector is: specially crafted password string. The fixed version is: 2018.3.4.
Other sources
SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.userchpass function from the MySQL module for Salt. The attack vector is: specially crafted password string. The fixed version is: 2018.3.4.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-1010259?
CVE-2019-1010259 is a vulnerability in SaltStack Salt 2018.3 and 2019.2 that allows for SQL injection, leading to privilege escalation and remote code execution.
How severe is CVE-2019-1010259?
CVE-2019-1010259 is considered to be a critical vulnerability with a severity score of 9.8.
What is the impact of CVE-2019-1010259?
The impact of CVE-2019-1010259 is that an attacker could escalate privileges on a MySQL server deployed by a cloud provider, leading to remote code execution.
Which component is affected by CVE-2019-1010259?
The mysql.user_chpass function from the MySQL module for Salt is the component affected by CVE-2019-1010259.
How can I fix CVE-2019-1010259?
To fix CVE-2019-1010259, you should upgrade to the following versions: SaltStack Salt 2018.3.4+dfsg1-6+deb10u3, SaltStack Salt 3002.6+dfsg1-4+deb11u1, or SaltStack Salt 3004.1+dfsg-2.2.