The developers of SaltStack, an open source software for automated server system configuration, have released security packages and patches for several versions. The fixes address three critical security vulnerabilities. One of them (CVE – 2020 – 17490) the Salt team estimates the hazard potential as “Low” for the time being, but the others (CVE – 2020 – 16846, CVE – 2020 – 25592) as “High” to “Critical”.

SaltStack users should apply the packages (or alternatively: the available patches) as recommended by the team as soon as possible.

Unauthorized code execution possible SaltStacks Security Advisory gives details of the gaps. According to this, unauthenticated attackers with network access to the Salt API CVE – 2020 – 16846 to run code abuse on vulnerable systems via the SSH client (Shell injection).

CVE – 2020 – 25592 is based on insufficient validation of access data and tokens and could Allow attackers to bypass authentication mechanisms in order to execute commands via the SSH client. CVE – 2020 – 17490 summarizes security-relevant bugs in the TLS encryption module.

Security packages and patches SaltStacks Advisory does not limit the Vulnerability to certain versions before; Ultimately, all (unpatched) issues seem to be vulnerable through the three holes.

Security packages are in the SaltStack repository for the versions 3002. x, 3001. x, 3000. x and 019. x ready (select from the dropdown menu).

Patches provided by GitLab secure the following SaltStack versions:

3002 3001.1, 3001. 2 3000. 3, 2020. 4 2019. 2.5, 2019. 2.6 2018. 3.5 2017. 7.4, 2017. 7.8 2016. 11. 3, 2016. 11. 6, 2016. 11. 10 2015 .3.4, 2016. 3.6, 2016. 3.8 2015.8th.10, 2015.8th.13 According to the development team, users of older versions should first update to one of the above versions in order to be able to apply the respective patch.

(ovw)