CVE-2020-28972: Medium severity SaltStack Salt vulnerability
In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the vmware.py files) does not always validate the SSL/TLS certificate.
Other sources
In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the vmware.py files) does not always validate the SSL/TLS certificate.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/saltto a version that resolves this vulnerability.Fixed in 3002.3 - Upgrade
Upgrade
pip/saltto a version that resolves this vulnerability.Fixed in 3001.5 - Upgrade
Upgrade
pip/saltto a version that resolves this vulnerability.Fixed in 3000.7 - Upgrade
Upgrade
pip/saltto a version that resolves this vulnerability.Fixed in 2019.2.8 - Upgrade
Upgrade
pip/saltto a version that resolves this vulnerability.Fixed in 2017.7.8 - Upgrade
Upgrade
pip/saltto a version that resolves this vulnerability.Fixed in 2016.11.10 - Upgrade
Upgrade
pip/saltto a version that resolves this vulnerability.Fixed in 2016.11.5 - Upgrade
Upgrade
pip/saltto a version that resolves this vulnerability.Fixed in 2015.8.13 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3002.2Fixed in 3001.4Fixed in 3000.6Fixed in 2019.2.8Fixed in 2019.2.5Fixed in 2018.3.5Fixed in 2017.7.8Fixed in 2016.11.10Fixed in 2016.11.6Fixed in 2016.11.5Fixed in 2016.11.3Fixed in 2016.3.8Fixed in 2016.3.6Fixed in 2016.3.4Fixed in 2015.8.13Fixed in 2015.8.10Fixed in 3002.5Fixed in 3001.6Fixed in 3000.8Fixed in 3002.5Fixed in 3001.6Fixed in 3000.8 - Upgrade
Upgrade
SaltStack Saltto a version that resolves this vulnerability.Fixed in 3002.5
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-28972?
CVE-2020-28972 is a vulnerability in SaltStack Salt that allows authentication to VMware vcenter, vsphere, and esxi servers without validating the SSL/TLS certificate.
How severe is CVE-2020-28972?
CVE-2020-28972 has a severity rating of 5.9 (medium).
Which software versions are affected by CVE-2020-28972?
The affected software versions include SaltStack Salt 2018.3.4 and later, and SaltStack Salt 3002.6 and later.
How can I fix CVE-2020-28972?
To fix CVE-2020-28972, update your SaltStack Salt installation to version 3002.5 or later.
Where can I find more information about CVE-2020-28972?
You can find more information about CVE-2020-28972 at the following references: [Reference 1](https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html), [Reference 2](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/), [Reference 3](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/)