Описание
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| salt | fixed | 3002.5+dfsg1-1 | package | |
| salt | fixed | 2018.3.4+dfsg1-6+deb10u3 | buster | package |
Примечания
https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/
Introduced by: https://github.com/saltstack/salt/commit/b8e34e1f6f785bf00634ee561c89c30c45f4c689 (v2018.2)
Fixed by: https://github.com/saltstack/salt/commit/7c1d565465f78a7937f089857f3980045f27fd6e (v3002.3)
EPSS
Связанные уязвимости
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)
SaltStack Salt eauth tokens can be used once after expiration
Уязвимость системы управления конфигурациями и удалённого выполнения операций SaltStack Salt, связанная с ошибками при обработке запросов аутентификации для истекших токенов eauth, позволяющая нарушителю выполнить произвольные команды
EPSS