PT-2020-10006 · Suse+2 · Suse Linux Enterprise Server 15+4

Johannes Segitz · Published 2020-03-02 · Updated 2022-12-03 · CVE-2019-18897

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SUSE Linux Enterprise Server 12 salt-master versions 2019.2.0-46.83.1 and prior versions SUSE Linux Enterprise Server 15 salt-master versions 2019.2.0-6.21.1 and prior versions openSUSE Factory salt-master versions 2019.2.2-3.1 and prior versions

Description A UNIX Symbolic Link (Symlink) Following issue in the packaging of salt allows local attackers to escalate privileges from user salt to root.

Recommendations For SUSE Linux Enterprise Server 12 salt-master versions 2019.2.0-46.83.1 and prior versions, update to a version later than 2019.2.0-46.83.1 to resolve the issue. For SUSE Linux Enterprise Server 15 salt-master versions 2019.2.0-6.21.1 and prior versions, update to a version later than 2019.2.0-6.21.1 to resolve the issue. For openSUSE Factory salt-master versions 2019.2.2-3.1 and prior versions, update to a version later than 2019.2.2-3.1 to resolve the issue.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2019-18897

OPENSUSE-SU-2020:0357-1

OPENSUSE-SU-2020_0357-1

OPENSUSE-SU-2024:11364-1

SUSE-RU-2020:0625-1

SUSE-RU-2020:0685-1

SUSE-SU-2020:0684-1

SUSE-SU-2020:0762-1

SUSE-SU-2020:0763-1

SUSE-SU-2020:1971-1

SUSE-SU-2020:1973-1

Affected Products

Suse Linux Enterprise Server 12

Suse Linux Enterprise Server 15

Suse

Opensuse Factory

Salt-Master

References · 42

• https://osv.dev/vulnerability/SUSE-SU-2020:0684-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-RU-2020:0625-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-18897 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:1971-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-RU-2020:0685-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:1973-1 · Vendor Advisory
• https://bugzilla.suse.com/show_bug.cgi?id=1157465 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0357-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00026.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-18897 · Security Note
• https://bugzilla.suse.com/1165572 · Note
• https://bugzilla.suse.com/1169604 · Note
• https://suse.com/security/cve/CVE-2020-11652 · Note
• https://bugzilla.suse.com/1162504 · Note
• https://bugzilla.suse.com/1159284 · Note