- Vulnerability/
- USN-6948-1
USN-6948-1: Salt vulnerabilities
First published: Thu Aug 08 2024(Updated: )
It was discovered that Salt incorrectly handled crafted web requests. A remote attacker could possibly use this issue to run arbitrary commands. (CVE-2020-16846) It was discovered that Salt incorrectly created certificates with weak file permissions. (CVE-2020-17490) It was discovered that Salt incorrectly handled credential validation. A remote attacker could possibly use this issue to bypass authentication. (CVE-2020-25592) It was discovered that Salt incorrectly handled crafted process names. An attacker could possibly use this issue to run arbitrary commands. This issue only affected Ubuntu 18.04 LTS. (CVE-2020-28243) It was discovered that Salt incorrectly handled validation of SSL/TLS certificates. A remote attacker could possibly use this issue to spoof a trusted entity. (CVE-2020-28972, CVE-2020-35662) It was discovered that Salt incorrectly handled credential validation. A remote attacker could possibly use this issue to run arbitrary code. (CVE-2021-25281) It was discovered that Salt incorrectly handled crafted paths. A remote attacker could possibly use this issue to perform directory traversal. (CVE-2021-25282) It was discovered that Salt incorrectly handled template rendering. A remote attacker could possibly this issue to run arbitrary code. (CVE-2021-25283) It was discovered that Salt incorrectly handled logging. An attacker could possibly use this issue to discover credentials. This issue only affected Ubuntu 18.04 LTS. (CVE-2021-25284) It was discovered that Salt incorrectly handled crafted web requests. A remote attacker could possibly use this issue to run arbitrary commands. This issue only affected Ubuntu 18.04 LTS. (CVE-2021-3148) It was discovered that Salt incorrectly handled input sanitization. A remote attacker could possibly use this issue to run arbitrary commands. (CVE-2021-3197)
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| ubuntu/salt-common | <2017.7.4+dfsg1-1ubuntu18.04.2+esm1 | 2017.7.4+dfsg1-1ubuntu18.04.2+esm1 |
| Ubuntu Ubuntu | =18.04 | |
| All of | ||
| ubuntu/salt-common | <2015.8.8+ds-1ubuntu0.1+esm2 | 2015.8.8+ds-1ubuntu0.1+esm2 |
| Ubuntu Ubuntu | =16.04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://ubuntu.com/security/CVE-2020-16846
- https://ubuntu.com/security/CVE-2020-25592
- https://ubuntu.com/security/CVE-2020-28972
- https://ubuntu.com/security/CVE-2020-28243
- https://ubuntu.com/security/CVE-2021-25281
- https://ubuntu.com/security/CVE-2021-3148
- https://ubuntu.com/security/CVE-2020-17490
- https://ubuntu.com/security/CVE-2020-35662
- https://ubuntu.com/security/CVE-2021-3197
- https://ubuntu.com/security/CVE-2021-25282
- https://ubuntu.com/security/CVE-2021-25284
- https://ubuntu.com/security/CVE-2021-25283
- https://ubuntu.com/security/notices/USN-6948-1 (Advisory)
Child vulnerabilities
(Contains the following vulnerabilities)
- collector/usn
- source/Ubuntu
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/references
- agent/title
- agent/severity
- agent/softwarecombine
- agent/type
- agent/event
- agent/description
- agent/first-publish-date
- agent/tags
- agent/trending
- package-manager/ubuntu
- vendor/ubuntu
- canonical/ubuntu ubuntu
- version/ubuntu ubuntu/18.04
- version/ubuntu ubuntu/16.04