{"id":"CVE-2020-17490","published":"2020-11-06T07:29:11Z","modified":"2024-08-04T14:00:47Z","title":"The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions","vendor":null,"product":null,"tier":"tail","description":{"text":"The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00416,"percentile":0.35822,"provenance":"source"},"cwes":[],"references":[{"url":"https://docs.saltstack.com/en/latest/topics/releases/index.html#latest-branch-release","tags":["x_refsource_MISC"]},{"url":"https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/","tags":["x_refsource_CONFIRM"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://security.gentoo.org/glsa/202011-13","tags":["vendor-advisory","x_refsource_GENTOO"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/12/msg00007.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.debian.org/security/2021/dsa-4837","tags":["vendor-advisory","x_refsource_DEBIAN"]}],"priority":{"score":7.2,"factors":[{"name":"EPSS percentile","points":7.16}]},"affected":[{"ecosystem":"PyPI","package":"salt","vulnerableRanges":["<2015.8.13",">=2016.3.0, <2016.3.8",">=2016.11.0, <2016.11.10",">=2017.5.0, <2017.7.8",">=2018.2.0, <2018.3.5",">=2019.2.0, <2019.2.6",">=3000, <3000.4",">=3001, <3001.2",">=3002, <3002.1","<2015.8.10"],"patched":["2015.8.13","2016.3.8","2016.11.10","2017.7.8","2018.3.5","2019.2.6","3000.4","3001.2","3002.1","2015.8.10"],"from":["GHSA-3c56-vx6v-q5vh","PYSEC-2020-105"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-0174","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2020-11651","published":"2020-04-30","fixed":"3000.2","kev":true},{"cve":"CVE-2020-11652","published":"2020-04-30","fixed":"3000.2","kev":true},{"cve":"CVE-2020-16846","published":"2020-11-06","fixed":"3002.1","kev":true,"link":{"from":"CVE-2020-16846","to":"CVE-2020-17490","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:salt","fromFixed":"3000.3","toFixed":"3000.4","daysApart":0}]}},{"cve":"CVE-2020-17490","published":"2020-11-06","fixed":"3002.1","kev":false},{"cve":"CVE-2020-25592","published":"2020-11-06","fixed":"3002.1","kev":false},{"cve":"CVE-2021-25315","published":"2021-03-03","fixed":"3002.2","kev":false},{"cve":"CVE-2020-28243","published":"2021-02-27","fixed":"3002.3","kev":false}],"package":"PyPI:salt"}}