CVE-2020-25592: Input Validation

Published Nov 2, 2020
·
Updated

In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH.

Other sources

In SaltStack the salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH.

— GitHub

Properly validate eauth credentials and tokens along with their Access Control Lists – ACLs. Prior to this change, eauth was not properly validated when calling Salt SSH via the salt-api. Any value for “eauth” or “token” would allow a user to bypass authentication and make calls to Salt SSH.

— Salt Project

Affected Software

39 affected componentsFixes available
debian/salt
pip/salt>=3002.0<3002.1
3002.1
pip/salt>=3001.0<3001.3
3001.3
pip/salt>=3000.0<3000.5
3000.5
pip/salt>=2019.2.0<2019.2.7
2019.2.7
pip/salt>=2018.2.0<2018.3.5
2018.3.5
pip/salt>=2017.5.0<2017.7.8
2017.7.8
pip/salt>=2016.11.0<2016.11.10
2016.11.10
pip/salt>=2016.3.0<2016.3.8
2016.3.8
pip/salt<2015.8.13
2015.8.13
SaltStack Salt<3002, <3001.1, 3001.2, <3000.3, 3000.4, <2019.2.5, 2019.2.6, <2018.3.5, <2017.7.4, 2017.7.8, <2016.11.3, 2016.11.6, 2016.11.10, <2016.3.4, 2016.3.6, 2016.3.8, <2015.8.10, 2015.8.13, <3002.x, <3001.x, <3000.x, <2019.x
30023001.1, 3001.23000.3, 3000.42019.2.5, 2019.2.62018.3.52017.7.4, 2017.7.82016.11.3, 2016.11.6, 2016.11.102016.3.4, 2016.3.6, 2016.3.82015.8.10, 2015.8.133002.x3001.x3000.x2019.x
SaltStack Salt<2015.8.10
SaltStack Salt>=2015.8.11<2015.8.13
SaltStack Salt>=2016.3.0<2016.3.4
SaltStack Salt>=2016.3.5<2016.3.6
SaltStack Salt>=2016.3.7<2016.3.8
SaltStack Salt>=2016.11.0<2016.11.3
SaltStack Salt>=2016.11.4<2016.11.6
SaltStack Salt>=2016.11.7<2016.11.10
SaltStack Salt>=2017.5.0<2017.7.4
SaltStack Salt>=2017.7.5<2017.7.8
SaltStack Salt>=2018.2.0<2018.3.5
SaltStack Salt>=2019.2.0<2019.2.5
SaltStack Salt>=3000.0<3000.3
SaltStack Salt=3001
Debian Debian Linux=9.0
Debian Debian Linux=10.0
alpine/salt>=2015.8.11<3002-r1
3002-r1
alpine/salt>=2015.8.11<3002-r1
3002-r1
alpine/salt>=2015.8.11<3002-r1
3002-r1
alpine/salt>=2015.8.11<3002-r1
3002-r1
alpine/salt>=2015.8.11<3002-r1
3002-r1
alpine/salt>=2015.8.11<3002-r1
3002-r1
alpine/salt>=2015.8.11<3002-r1
3002-r1
alpine/salt>=2015.8.11<3002-r1
3002-r1
alpine/salt>=2015.8.11<3002-r1
3002-r1
alpine/salt>=2015.8.11<3002-r1
3002-r1
alpine/salt>=2015.8.11<3002-r1
3002-r1
alpine/salt>=2015.8.11<3002-r1
3002-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade pip/salt to a version that resolves this vulnerability.

    Fixed in 3002.1
  2. Upgrade

    Upgrade pip/salt to a version that resolves this vulnerability.

    Fixed in 3001.3
  3. Upgrade

    Upgrade pip/salt to a version that resolves this vulnerability.

    Fixed in 3000.5
  4. Upgrade

    Upgrade pip/salt to a version that resolves this vulnerability.

    Fixed in 2019.2.7
  5. Upgrade

    Upgrade pip/salt to a version that resolves this vulnerability.

    Fixed in 2018.3.5
  6. Upgrade

    Upgrade pip/salt to a version that resolves this vulnerability.

    Fixed in 2017.7.8
  7. Upgrade

    Upgrade pip/salt to a version that resolves this vulnerability.

    Fixed in 2016.11.10
  8. Upgrade

    Upgrade pip/salt to a version that resolves this vulnerability.

    Fixed in 2016.3.8
  9. Upgrade

    Upgrade pip/salt to a version that resolves this vulnerability.

    Fixed in 2015.8.13
  10. Upgrade

    Upgrade alpine/salt to a version that resolves this vulnerability.

    Fixed in 3002-r1
  11. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 3002Fixed in 3001.1, 3001.2Fixed in 3000.3, 3000.4Fixed in 2019.2.5, 2019.2.6Fixed in 2018.3.5Fixed in 2017.7.4, 2017.7.8Fixed in 2016.11.3, 2016.11.6, 2016.11.10Fixed in 2016.3.4, 2016.3.6, 2016.3.8Fixed in 2015.8.10, 2015.8.13Fixed in 3002.xFixed in 3001.xFixed in 3000.xFixed in 2019.x
  12. Operational

    Restart Salt-API after installing the patch.

Event History

Nov 2, 2020
CVE Published
via Salt Project·12:00 AM
Data Sourced
via Salt Project·12:00 AM
RemedyDescriptionSeverityWeaknessAffected Software
Nov 6, 2020
CVE Published
via MITRE·07:31 AM
Data Sourced
via MITRE·07:31 AM
Description
Data Sourced
via OSV·08:15 AM
DescriptionSeverityAffected Software
May 24, 2022
Advisory Published
via GitHub·05:33 PM

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is CVE-2020-25592?

CVE-2020-25592 is a vulnerability in SaltStack Salt that allows an attacker to bypass authentication and invoke Salt SSH.

2

What is the severity of CVE-2020-25592?

CVE-2020-25592 has a severity rating of 9.8 / 10, which is considered critical.

3

Which versions of SaltStack Salt are affected by CVE-2020-25592?

SaltStack Salt versions 2018.3.4+dfsg1-6+deb10u3, 3002.6+dfsg1-4+deb11u1, and 3004.1+dfsg-2.2 are affected by CVE-2020-25592.

4

How can an attacker exploit CVE-2020-25592?

An attacker can exploit CVE-2020-25592 by bypassing authentication and invoking Salt SSH.

5

Are there any remedies available for CVE-2020-25592?

Yes, SaltStack has released fixes for CVE-2020-25592. Please refer to the official SaltStack documentation for more information on how to apply the fixes.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203