CVE-2020-16846

Description

An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.

From the Tenable Blog

CVE-2020-16846, CVE-2020-25592: Critical Vulnerabilities in Salt Framework Disclosed

Published: 2020-11-04

SaltStack recommends immediate patching after their disclosure of three new vulnerabilities, two of which are rated critical and can be remotely exploited without authentication.

References

https://www.tenable.com/blog/cve-2020-16846-cve-2020-25592-critical-vulnerabilities-in-salt-framework-disclosed

https://www.zerodayinitiative.com/advisories/ZDI-20-1383/

https://www.zerodayinitiative.com/advisories/ZDI-20-1382/

https://www.zerodayinitiative.com/advisories/ZDI-20-1381/

https://www.zerodayinitiative.com/advisories/ZDI-20-1380/

https://www.zerodayinitiative.com/advisories/ZDI-20-1379/

https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/

https://www.debian.org/security/2021/dsa-4837

https://security.gentoo.org/glsa/202011-13

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA/

https://lists.debian.org/debian-lts-announce/2022/01/msg00000.html

https://lists.debian.org/debian-lts-announce/2020/12/msg00007.html

https://github.com/saltstack/salt/releases

http://packetstormsecurity.com/files/160039/SaltStack-Salt-REST-API-Arbitrary-Command-Execution.html

http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3