PT-2020-5858 · Saltstack+3 · Saltstack Salt+3

Published 2016-11-21 · Updated 2024-08-08 · CVE-2020-17490

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: SaltStack Salt versions through 3002

Description: The issue is related to the TLS module within SaltStack Salt, where certificates are created with weak file permissions. This weakness can be exploited to gain access to confidential data. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

Recommendations: For SaltStack Salt versions through 3002, consider updating the permissions of the certificates created by the TLS module to prevent unauthorized access. As a temporary workaround, consider restricting access to the certificate files until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

ALT-PU-2016-2317

ALT-PU-2017-2801

ALT-PU-2018-2416

ALT-PU-2019-2322

ALT-PU-2019-2359

ALT-PU-2020-2668

ALT-PU-2020-2697

ALT-PU-2021-1591

ALT-PU-2021-1982

ALT-PU-2022-3218

BDU:2021-01902

CVE-2020-17490

DLA-2480-1

DSA-4837-1

GHSA-3C56-VX6V-Q5VH

OPENSUSE-SU-2020:1833-1

OPENSUSE-SU-2020:1868-1

OPENSUSE-SU-2020_1833-1

OPENSUSE-SU-2020_1868-1

PYSEC-2020-105

SUSE-SU-2020:14538-1

SUSE-SU-2020:3155-1

SUSE-SU-2020:3171-1

SUSE-SU-2020:3235-1

SUSE-SU-2020:3243-1

SUSE-SU-2020:3244-1

SUSE-SU-2020:3245-1

SUSE-SU-2020:3250-1

SUSE-SU-2020:3251-1

SUSE-SU-2020_14570-1

USN-6948-1

Affected Products

Alt Linux

Saltstack Salt

Suse

Ubuntu

References · 103

• https://saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves · Vendor Advisory
• https://debian.org/security/2021/dsa-4837 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA · Vendor Advisory
• https://security.gentoo.org/glsa/202011-13 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-17490 · Security Note
• https://ubuntu.com/security/CVE-2020-16846 · Vendor Advisory
• https://docs.saltstack.com/en/latest/topics/releases/index.html#latest-branch-release · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-17490 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25592 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:3155-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2480-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6948-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-17490 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:3245-1 · Vendor Advisory