An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blacklisted directory.

The remote host is affected by the vulnerability described in GLSA-202310-22 (Salt: Multiple Vulnerabilities)

  - An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to     command injection via a crafted process name. This allows for a local privilege escalation by any user     able to create a files on the minion in a non-blacklisted directory. (CVE-2020-28243)

  - In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the     vmware.py files) does not always validate the SSL/TLS certificate. (CVE-2020-28972)

  - In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL     certificate is not always validated. (CVE-2020-35662)

  - In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to     run command against the salt master or minions.) (CVE-2021-3144)

  - An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can     result in salt.utils.thin.gen_thin() command injection because of different handling of single versus     double quotes. This is related to salt/utils/thin.py. (CVE-2021-3148)

  - An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a     shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request.
    (CVE-2021-3197)

  - An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and     source_hash URLs can gain full file system access as root on a salt minion. (CVE-2021-21996)

  - An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials     for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master.
    (CVE-2021-25281)

  - An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method     is vulnerable to directory traversal. (CVE-2021-25282)

  - An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect     against server side template injection attacks. (CVE-2021-25283)

  - An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials     to the info or error log level. (CVE-2021-25284)

  - In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module     that allows for local privilege escalation on a minion. The attack requires that a file is created with a     pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes     popen unsafely). (CVE-2021-31607)

  - An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not     sign pillar data with the minion's public key, which can result in attackers substituting arbitrary pillar     data. (CVE-2022-22934)

  - An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion     authentication denial of service can cause a MiTM attacker to force a minion process to stop by     impersonating a master. (CVE-2022-22935)

  - An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Job publishes and     file server replies are susceptible to replay attacks, which can result in an attacker replaying job     publishes causing minions to run old jobs. File server replies can also be re-played. A sufficient craft     attacker could gain root access on minion under certain scenarios. (CVE-2022-22936)

  - An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a     Master-of-Masters, with a publisher_acl, if a user configured in the publisher_acl targets any minion     connected to the Syndic, the Salt Master incorrectly interpreted no valid targets as valid, allowing     configured users to target any of the minions connected to the syndic with their configured commands. This     requires a syndic master combined with publisher_acl configured on the Master-of-Masters, allowing users     specified in the publisher_acl to bypass permissions, publishing authorized commands to any configured     minion. (CVE-2022-22941)

  - An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to     reject locked accounts, which allows a previously authorized user whose account is locked still run Salt     commands when their account is locked. This affects both local shell accounts with an active session and     salt-api users that authenticate via PAM eauth. (CVE-2022-22967)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5011 advisory.

  - An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to     command injection via a crafted process name. This allows for a local privilege escalation by any user     able to create a files on the minion in a non-blacklisted directory. (CVE-2020-28243)

  - In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the     vmware.py files) does not always validate the SSL/TLS certificate. (CVE-2020-28972)

  - In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL     certificate is not always validated. (CVE-2020-35662)

  - An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and     source_hash URLs can gain full file system access as root on a salt minion. (CVE-2021-21996)

  - An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials     for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master.
    (CVE-2021-25281)

  - An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method     is vulnerable to directory traversal. (CVE-2021-25282)

  - An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect     against server side template injection attacks. (CVE-2021-25283)

  - An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials     to the info or error log level. (CVE-2021-25284)

  - In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to     run command against the salt master or minions.) (CVE-2021-3144)

  - An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can     result in salt.utils.thin.gen_thin() command injection because of different handling of single versus     double quotes. This is related to salt/utils/thin.py. (CVE-2021-3148)

  - In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module     that allows for local privilege escalation on a minion. The attack requires that a file is created with a     pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes     popen unsafely). (CVE-2021-31607)

  - An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a     shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request.
    (CVE-2021-3197)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2815 advisory.

  - An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to     command injection via a crafted process name. This allows for a local privilege escalation by any user     able to create a files on the minion in a non-blacklisted directory. (CVE-2020-28243)

  - In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the     vmware.py files) does not always validate the SSL/TLS certificate. (CVE-2020-28972)

  - In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL     certificate is not always validated. (CVE-2020-35662)

  - An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials     for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master.
    (CVE-2021-25281)

  - An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method     is vulnerable to directory traversal. (CVE-2021-25282)

  - An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect     against server side template injection attacks. (CVE-2021-25283)

  - An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials     to the info or error log level. (CVE-2021-25284)

  - In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to     run command against the salt master or minions.) (CVE-2021-3144)

  - An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can     result in salt.utils.thin.gen_thin() command injection because of different handling of single versus     double quotes. This is related to salt/utils/thin.py. (CVE-2021-3148)

  - In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module     that allows for local privilege escalation on a minion. The attack requires that a file is created with a     pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes     popen unsafely). (CVE-2021-31607)

  - An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a     shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request.
    (CVE-2021-3197)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the salt3 package has been released.

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:14650-1 advisory.

  - An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to     command injection via a crafted process name. This allows for a local privilege escalation by any user     able to create a files on the minion in a non-blacklisted directory. (CVE-2020-28243)

  - In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the     vmware.py files) does not always validate the SSL/TLS certificate. (CVE-2020-28972)

  - In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL     certificate is not always validated. (CVE-2020-35662)

  - An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials     for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master.
    (CVE-2021-25281)

  - An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method     is vulnerable to directory traversal. (CVE-2021-25282)

  - An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect     against server side template injection attacks. (CVE-2021-25283)

  - An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials     to the info or error log level. (CVE-2021-25284)

  - In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to     run command against the salt master or minions.) (CVE-2021-3144)

  - An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can     result in salt.utils.thin.gen_thin() command injection because of different handling of single versus     double quotes. This is related to salt/utils/thin.py. (CVE-2021-3148)

  - An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a     shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request.
    (CVE-2021-3197)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202103-01 (Salt: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Salt. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary commands via       salt-api, cause a Denial of Service condition, bypass access restrictions       or disclose sensitive information.
  Workaround :

    There is no known workaround at this time.

According to its self-reported version number, the instance of SaltStack hosted on the remote server is affected by multiple vulnerabilities:

  - The Salt-API’s SSH client is vulnerable to a shell injection by including ProxyCommand in an argument,     or via ssh_options provided in an API request. (CVE-2021-3197)

  - The Salt-API does not have eAuth credentials for the wheel_async client. Thus, an attacker can remotely     run any wheel modules on the master. (CVE-2021-25281)

  - eauth tokens can be used once after expiration. They can be used to run command against the salt master    or minions. (CVE-2021-3144)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version

SaltStack reports multiple security vulnerabilities in Salt

- CVE-2021-3197: The Salt-API.s SSH client is vulnerable to a shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request.

- CVE-2021-25281: The Salt-API does not have eAuth credentials for the wheel_async client.

- CVE-2021-25282: The salt.wheel.pillar_roots.write method is vulnerable to directory traversal.

- CVE-2021-25283: The jinja renderer does not protect against server-side template injection attacks.

- CVE-2021-25284: webutils write passwords in cleartext to /var/log/salt/minion

- CVE-2021-3148: command injection in salt.utils.thin.gen_thin()

- CVE-2020-35662: Several places where Salt was not verifying the SSL cert by default.

- CVE-2021-3144: eauth Token can be used once after expiration.

- CVE-2020-28972: Code base not validating SSL/TLS certificate of the server, which might allow attackers to obtain sensitive information via a man-in-the-middle attack

- CVE-2020-28243: Local Privilege Escalation in the Minion.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-5756fbf8a6 advisory.

  - An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to     command injection via a crafted process name. This allows for a local privilege escalation by any user     able to create a files on the minion in a non-blacklisted directory. (CVE-2020-28243)

  - In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the     vmware.py files) does not always validate the SSL/TLS certificate. (CVE-2020-28972)

  - In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL     certificate is not always validated. (CVE-2020-35662)

  - In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to     run command against the salt master or minions.) (CVE-2021-3144)

  - An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can     result in salt.utils.thin.gen_thin() command injection because of different handling of single versus     double quotes. This is related to salt/utils/thin.py. (CVE-2021-3148)

  - An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a     shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request.
    (CVE-2021-3197)

  - An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials     for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master.
    (CVE-2021-25281)

  - An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method     is vulnerable to directory traversal. (CVE-2021-25282)

  - An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect     against server side template injection attacks. (CVE-2021-25283)

  - An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials     to the info or error log level. (CVE-2021-25284)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-904a2dbc0c advisory.

  - An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to     command injection via a crafted process name. This allows for a local privilege escalation by any user     able to create a files on the minion in a non-blacklisted directory. (CVE-2020-28243)

  - In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the     vmware.py files) does not always validate the SSL/TLS certificate. (CVE-2020-28972)

  - In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL     certificate is not always validated. (CVE-2020-35662)

  - In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to     run command against the salt master or minions.) (CVE-2021-3144)

  - An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can     result in salt.utils.thin.gen_thin() command injection because of different handling of single versus     double quotes. This is related to salt/utils/thin.py. (CVE-2021-3148)

  - An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a     shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request.
    (CVE-2021-3197)

  - An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials     for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master.
    (CVE-2021-25281)

  - An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method     is vulnerable to directory traversal. (CVE-2021-25282)

  - An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect     against server side template injection attacks. (CVE-2021-25283)

  - An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials     to the info or error log level. (CVE-2021-25284)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for salt fixes the following issues :

Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)

Allow `extra_filerefs` as sanitized `kwargs` for SSH client

Fix errors with virt.update

Fix for multiple for security issues (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144) (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197) (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560) (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)

virt: search for `grub.xen` path

Xen spicevmc, DNS SRV records backports :

  - Fix virtual network generated DNS XML for SRV records

  - Don't add spicevmc channel to xen VMs

virt UEFI fix: virt.update when `efi=True`

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for salt fixes the following issues :

  - Fix regression on cmd.run when passing tuples as cmd     (bsc#1182740)

  - Allow `extra_filerefs` as sanitized `kwargs` for SSH     client

  - Fix errors with virt.update

  - Fix for multiple for security issues (CVE-2020-28243)     (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148)     (CVE-2021-3144) (CVE-2021-25281) (CVE-2021-25282)     (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)     (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558)     (bsc#1181559) (bsc#1181560) (bsc#1181561) (bsc#1181562)     (bsc#1181563) (bsc#1181564) (bsc#1181565)

  - virt: search for `grub.xen` path

  - Xen spicevmc, DNS SRV records backports :

  - Fix virtual network generated DNS XML for SRV records

  - Don't add spicevmc channel to xen VMs

  - virt UEFI fix: virt.update when `efi=True` 

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for salt fixes the following issues :

Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)

Allow extra_filerefs as sanitized kwargs for SSH client

Fix errors with virt.update

Fix for multiple for security issues (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144) (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197) (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560) (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)

virt: search for grub.xen path

Xen spicevmc, DNS SRV records backports: Fix virtual network generated DNS XML for SRV records Don't add spicevmc channel to xen VMs

virt UEFI fix: virt.update when efi=True

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the salt package has been released.

Past security updates of Salt, a remote execution manager, introduced regressions for which follow-up fixes were published :

CVE 2020-16846 regression

'salt-ssh' master key initialization fails

CVE 2021-3197 regression

Valid parameters are discarded for the SSHClient

CVE 2020-28243 follow-up

Prevent argument injection in restartcheck

CVE 2021-25282 regression

pillar_roots.write cannot write to subdirs

CVE 2021-25284 regression

The 'cmd.run' function crashes if passing tuple arg

For Debian 9 stretch, this problem has been fixed in version 2016.11.2+ds-1+deb9u10.

We recommend that you upgrade your salt packages.

For the detailed security status of salt please refer to its security tracker page at: https://security-tracker.debian.org/tracker/salt

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
184073	GLSA-202310-22 : Salt: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
155634	Debian DSA-5011-1 : salt - security update	Nessus	Debian Local Security Checks	critical
155123	Debian DLA-2815-1 : salt - LTS security update	Nessus	Debian Local Security Checks	critical
150920	Photon OS 4.0: Salt3 PHSA-2021-4.0-0047	Nessus	PhotonOS Local Security Checks	critical
150586	SUSE SLES11 Security Update : salt (SUSE-SU-2021:14650-1)	Nessus	SuSE Local Security Checks	critical
148273	GLSA-202103-01 : Salt: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
148112	SaltStack < 3002.5 Multiple Vulnerabilities	Nessus	Misc.	critical
146985	FreeBSD : salt -- multiple vulnerabilities (a1e03a3d-7be0-11eb-b392-20cf30e32f6d)	Nessus	FreeBSD Local Security Checks	critical
146977	Fedora 33 : salt (2021-5756fbf8a6)	Nessus	Fedora Local Security Checks	critical
146970	Fedora 32 : salt (2021-904a2dbc0c)	Nessus	Fedora Local Security Checks	critical
146921	SUSE SLES15 Security Update : salt (SUSE-SU-2021:0628-1)	Nessus	SuSE Local Security Checks	critical
146904	SUSE SLED15 / SLES15 Security Update : salt (SUSE-SU-2021:0630-1)	Nessus	SuSE Local Security Checks	critical
146897	openSUSE Security Update : salt (openSUSE-2021-347)	Nessus	SuSE Local Security Checks	critical
146885	SUSE SLES15 Security Update : salt (SUSE-SU-2021:0631-1)	Nessus	SuSE Local Security Checks	critical
146878	Photon OS 1.0: Salt PHSA-2021-1.0-0364	Nessus	PhotonOS Local Security Checks	critical
146877	Photon OS 1.0: Salt3 PHSA-2021-1.0-0364	Nessus	PhotonOS Local Security Checks	critical
146874	Photon OS 3.0: Salt3 PHSA-2021-3.0-0200	Nessus	PhotonOS Local Security Checks	critical
143512	Debian DLA-2480-2 : salt regression update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2020-28243

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical