CVE-2020-17490: Medium severity saltstack vulnerability
Last updated 8 August 2024
Other sources
The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.
When using the functions createca, createcsr, and createselfsignedcert in the tls execution module, it would not ensure the key was created with the correct permissions. With the CVE fix, the keys are no longer created with world-readable permissions and use 600.
— Salt Project
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-17490?
CVE-2020-17490 is a vulnerability related to the TLS module within SaltStack Salt through 3002 creating certificates with weak file permissions.
What is the severity of CVE-2020-17490?
CVE-2020-17490 is rated as medium severity with a severity value of 5.5.
Which software versions are affected by CVE-2020-17490?
The affected software versions include SaltStack Salt 2018.3.4+dfsg1-6+deb10u3, 3002.6+dfsg1-4+deb11u1, and 3004.1+dfsg-2.2.
How do I fix CVE-2020-17490?
To fix CVE-2020-17490, upgrade to the latest version of SaltStack Salt.
Where can I find more information about CVE-2020-17490?
You can find more information about CVE-2020-17490 in the references provided: [link1], [link2], [link3].