ALT-PU-2019-2322

Критический

ALT-PU-2019-2322: package salt update to version 2019.8-alt1

Источник

errata.altlinux.org

Дата публикации

29.07.2019

Дата обновления

04.02.2026

Устраненные уязвимости

ALT Linux branch p11

ALT Container

ALT Education

ALT Workstation

ALT Workstation K

ALT Server

ALT Virtualization PVE Edition

ALT Linux branch p10

ALT Server

ALT Virtualization Server

ALT Workstation

ALT Workstation K

ALT Education

Simply Linux

Starterkit

ALT Container

Описание

This update upgrades salt to version 2019.8-alt1.

Устраненные уязвимости31

BDU:2020-03941

Критический 9.8

Дата публикации: 14.08.2020

Уязвимость компонента master.py системы управления конфигурациями и удалённого выполнения операций SaltStack, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании

CVSS 3.1

Критический 9.8

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS 2.0

Критический 10

AV:N/AC:L/Au:N/C:C/I:C/A:C

Access vector: Network
Complexity: Low
Authentication: None
Confidentiality: Complete
Integrity: Complete
Availability: Complete

Ссылки

BDU:2020-03941 https://bdu.fstec.ru/vul/2020-03941

Ссылки17

ALT-PU-2019-2322 https://errata.altlinux.org/ALT-PU-2019-2322

GHSA-29j3-2446-5j4w

https://github.com/advisories/GHSA-29j3-2446-5j4w

GHSA-3c56-vx6v-q5vh

https://github.com/advisories/GHSA-3c56-vx6v-q5vh

GHSA-76x4-x3p6-rpr9

https://github.com/advisories/GHSA-76x4-x3p6-rpr9

GHSA-8rp6-x3r7-5qw3

https://github.com/advisories/GHSA-8rp6-x3r7-5qw3

GHSA-ghc2-hx3w-jqmp

https://github.com/advisories/GHSA-ghc2-hx3w-jqmp

GHSA-phhw-3wc9-8q75

https://github.com/advisories/GHSA-phhw-3wc9-8q75

GHSA-pjhf-vpx3-33r3

https://github.com/advisories/GHSA-pjhf-vpx3-33r3

GHSA-q53j-p6r2-g2v4

https://github.com/advisories/GHSA-q53j-p6r2-g2v4

GHSA-qr38-h96j-2j3w

https://github.com/advisories/GHSA-qr38-h96j-2j3w

GHSA-qx72-q6w3-qgc7

https://github.com/advisories/GHSA-qx72-q6w3-qgc7

GHSA-r55w-xph5-xvx2

https://github.com/advisories/GHSA-r55w-xph5-xvx2

GHSA-vp49-2g4r-m3x3

https://github.com/advisories/GHSA-vp49-2g4r-m3x3

GHSA-w2hr-3mc8-46gh

https://github.com/advisories/GHSA-w2hr-3mc8-46gh

GHSA-w589-r335-4f55

https://github.com/advisories/GHSA-w589-r335-4f55

GHSA-xgmh-gfxw-2hvv

https://github.com/advisories/GHSA-xgmh-gfxw-2hvv

GHSA-xxw3-765m-f37p

https://github.com/advisories/GHSA-xxw3-765m-f37p

Связанные уязвимости

CVE-2019-17361

CVSS3: 9.8

ubuntu

почти 7 лет назад

In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.