CVE-2020-17490: Medium severity SaltStack Salt vulnerability
Last updated 8 August 2024
Other sources
The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.
When using the functions createca, createcsr, and createselfsignedcert in the tls execution module, it would not ensure the key was created with the correct permissions. With the CVE fix, the keys are no longer created with world-readable permissions and use 600.
— Salt Project
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/saltto a version that resolves this vulnerability.Fixed in 3002.1 - Upgrade
Upgrade
pip/saltto a version that resolves this vulnerability.Fixed in 3001.2 - Upgrade
Upgrade
pip/saltto a version that resolves this vulnerability.Fixed in 3000.4 - Upgrade
Upgrade
pip/saltto a version that resolves this vulnerability.Fixed in 2019.2.6 - Upgrade
Upgrade
pip/saltto a version that resolves this vulnerability.Fixed in 2018.3.5 - Upgrade
Upgrade
pip/saltto a version that resolves this vulnerability.Fixed in 2017.7.8 - Upgrade
Upgrade
pip/saltto a version that resolves this vulnerability.Fixed in 2016.11.10 - Upgrade
Upgrade
pip/saltto a version that resolves this vulnerability.Fixed in 2016.3.8 - Upgrade
Upgrade
pip/saltto a version that resolves this vulnerability.Fixed in 2015.8.13 - Upgrade
Upgrade
alpine/saltto a version that resolves this vulnerability.Fixed in 3002-r1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3002Fixed in 3001.1, 3001.2Fixed in 3000.3, 3000.4Fixed in 2019.2.5, 2019.2.6Fixed in 2018.3.5Fixed in 2017.7.4, 2017.7.8Fixed in 2016.11.3, 2016.11.6, 2016.11.10Fixed in 2016.3.4, 2016.3.6, 2016.3.8Fixed in 2015.8.10, 2015.8.13Fixed in 3002.xFixed in 3001.xFixed in 3000.xFixed in 2019.x - Configuration
Ensure keys created by create_ca, create_csr, and create_self_signed_cert use file permissions 600 instead of world-readable permissions.
SaltStack Salt TLS execution module key file permissions = 600
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-17490?
CVE-2020-17490 is a vulnerability related to the TLS module within SaltStack Salt through 3002 creating certificates with weak file permissions.
What is the severity of CVE-2020-17490?
CVE-2020-17490 is rated as medium severity with a severity value of 5.5.
Which software versions are affected by CVE-2020-17490?
The affected software versions include SaltStack Salt 2018.3.4+dfsg1-6+deb10u3, 3002.6+dfsg1-4+deb11u1, and 3004.1+dfsg-2.2.
How do I fix CVE-2020-17490?
To fix CVE-2020-17490, upgrade to the latest version of SaltStack Salt.
Where can I find more information about CVE-2020-17490?
You can find more information about CVE-2020-17490 in the references provided: [link1], [link2], [link3].