Patchfirst
Patchfirst
CVE-2020-25592 Public exploit EPSS 56.8%

In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens

Summary

The flaw lies in salt-netapi, the network API component of SaltStack Salt through version 3002, which improperly validates eauth credentials and tokens.

Official description · CVE.org

In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH.

Breakdown
24.8 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Public exploit code (Metasploit) was available 3 days before disclosure.

  1. Public exploit codeMetasploit3 days before
  2. Disclosedday 0

10 fixes in salt over 10 months. The latest fix listed for salt is 3002.5.

Fixes in saltPyPI package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 3000.2CVE-2020-1165230 Apr 2020KEV
  2. 3002.1CVE-2020-168466 Nov 2020KEV
  3. 3002.1CVE-2020-174906 Nov 2020
  4. 3002.1CVE-2020-255926 Nov 2020
  5. 3002.2CVE-2021-253153 Mar 2021
  6. 3002.3CVE-2020-2824327 Feb 2021
  7. 3002.3CVE-2020-2897227 Feb 2021
  8. 3002.5CVE-2021-2528127 Feb 2021
  9. 3002.5CVE-2021-2528227 Feb 2021
  10. 3002.5CVE-2021-319727 Feb 2021Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: salt.

PyPIsaltGHSA-29j3-2446-5j4wPYSEC-2020-106

Upgrade to 3002.5 or later

Fixes this CVE and 4 other known vulnerabilities in this package (CVE-2020-16846, CVE-2021-25281, +2).

pippip install "salt>=3002.5"

First fixed in 3002.1 for CVE-2020-25592.

Affected versions, by release line

If you runUpgrade to
3002.0 up to 3002.13002.5first fix for this CVE: 3002.1
3001.0 up to 3001.33001.5first fix for this CVE: 3001.3
3000.0 up to 3000.53000.7first fix for this CVE: 3000.5
3000 up to 3000.3

Still affected on this line by CVE-2020-16846 (fixed in 3000.4, a newer line); CVE-2021-25281 (fixed in 3000.6, a newer line); CVE-2021-25282 (fixed in 3000.6, a newer line); CVE-2021-3197 (fixed in 3000.6, a newer line).

3000.3
2019.2.0 up to 2019.2.72019.2.8first fix for this CVE: 2019.2.7
2019.2.0 up to 2019.2.5

Still affected on this line by CVE-2020-16846 (fixed in 2019.2.6, a newer line); CVE-2021-25281 (fixed in 2019.2.8, a newer line); CVE-2021-25282 (fixed in 2019.2.8, a newer line); CVE-2021-3197 (fixed in 2019.2.8, a newer line).

2019.2.5
2018.3.0rc1 up to 2018.3.5

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line).

2019.2.0rc1first fix for this CVE: 2018.3.5
2018.2.0 up to 2018.3.5

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line); CVE-2021-25281 (fixed in 2019.2.0rc1, a newer line); CVE-2021-25282 (fixed in 2019.2.0rc1, a newer line); CVE-2021-3197 (fixed in 2019.2.0rc1, a newer line).

2018.3.5
2017.7.5 up to 2017.7.8

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line).

2017.7.8
2017.7.0 up to 2017.7.4

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line); CVE-2020-16846 (fixed in 2017.7.8, a newer line); CVE-2021-25281 (fixed in 2017.7.8, a newer line); CVE-2021-25282 (fixed in 2017.7.8, a newer line); CVE-2021-3197 (fixed in 2017.7.8, a newer line).

2017.7.4
2017.5.0 up to 2017.7.8

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line).

2017.7.8
2016.11.7 up to 2016.11.10

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line).

2016.11.10
2016.11.4 up to 2016.11.6

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line); CVE-2020-16846 (fixed in 2016.11.10, a newer line).

2016.11.6
2016.11.0 up to 2016.11.10

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line).

2016.11.10
2016.11.0 up to 2016.11.3

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line); CVE-2020-16846 (fixed in 2016.11.10, a newer line); CVE-2021-25281 (fixed in 2016.11.5, a newer line); CVE-2021-25282 (fixed in 2016.11.5, a newer line); CVE-2021-3197 (fixed in 2016.11.5, a newer line).

2016.11.3
2016.3.7 up to 2016.3.8

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line); CVE-2021-25281 (fixed in 2016.11.5, a newer line); CVE-2021-25282 (fixed in 2016.11.5, a newer line); CVE-2021-3197 (fixed in 2016.11.5, a newer line).

2016.3.8
2016.3.5 up to 2016.3.6

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line); CVE-2020-16846 (fixed in 2016.3.8, a newer line); CVE-2021-25281 (fixed in 2016.11.5, a newer line); CVE-2021-25282 (fixed in 2016.11.5, a newer line); CVE-2021-3197 (fixed in 2016.11.5, a newer line).

2016.3.6
2016.3.0 up to 2016.3.8

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line); CVE-2021-25281 (fixed in 2016.11.5, a newer line); CVE-2021-25282 (fixed in 2016.11.5, a newer line); CVE-2021-3197 (fixed in 2016.11.5, a newer line).

2016.3.8
2016.3.0 up to 2016.3.4

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line); CVE-2020-16846 (fixed in 2016.3.8, a newer line); CVE-2021-25281 (fixed in 2016.11.5, a newer line); CVE-2021-25282 (fixed in 2016.11.5, a newer line); CVE-2021-3197 (fixed in 2016.11.5, a newer line).

2016.3.4
All versions before 2015.8.13

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line).

2015.8.13
All versions before 2015.8.10

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line).

2015.8.13first fix for this CVE: 2015.8.10

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

8 links, grouped by NVD tag

x_refsource_MISC 2

docs.saltstack.com/en/latest/topics/releases/index.htmlpacketstormsecurity.com/files/160039/SaltStack-Salt-REST-API-Arbitrary-Command-Execution.html

x_refsource_CONFIRM 1

saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/

vendor-advisory 4

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA/lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.htmlsecurity.gentoo.org/glsa/202011-13debian.org/security/2021/dsa-4837

mailing-list 1

lists.debian.org/debian-lts-announce/2020/12/msg00007.html
↑ ↓ chooseEnter openEsc close