Описание
In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated.
A flaw was found in Salt where several places did not verify the SSL cert by default. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Отчет
Salt has been deprecated as of Red Hat Ceph Storage 2.5, as Salt was used to install RHSCON-2 and RHSCON-2 has reached End Of Life.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Ceph Storage 2 | salt | Will not fix |
Показывать по
Дополнительная информация
Статус:
EPSS
7.4 High
CVSS3
Связанные уязвимости
In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated.
In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated.
In SaltStack Salt before 3002.5, when authenticating to services using ...
SaltStack Salt Improper SSL Certificate Validation
Уязвимость системы управления конфигурациями и удалённого выполнения операций SaltStack Salt, связанная с ошибками процедуры подтверждения подлинности сертификата, позволяющая нарушителю выполнить атаку типа «человек посередине»
EPSS
7.4 High
CVSS3