Detections
Analytics
CVE-2020-16846
critical
Description
An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.
From the Tenable Blog
CVE-2020-16846, CVE-2020-25592: Critical Vulnerabilities in Salt Framework Disclosed
Published: 2020-11-04
SaltStack recommends immediate patching after their disclosure of three new vulnerabilities, two of which are rated critical and can be remotely exploited without authentication.
References
https://www.zerodayinitiative.com/advisories/ZDI-20-1383/
https://www.zerodayinitiative.com/advisories/ZDI-20-1382/
https://www.zerodayinitiative.com/advisories/ZDI-20-1381/
https://www.zerodayinitiative.com/advisories/ZDI-20-1380/
https://www.zerodayinitiative.com/advisories/ZDI-20-1379/
https://www.debian.org/security/2021/dsa-4837
https://security.gentoo.org/glsa/202011-13
https://lists.debian.org/debian-lts-announce/2022/01/msg00000.html
https://lists.debian.org/debian-lts-announce/2020/12/msg00007.html
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.html