[ASA-202001-7] salt: arbitrary command execution
foxboron at archlinux.org
Tue Feb 4 08:00:38 UTC 2020
Arch Linux Security Advisory ASA-202001-7
Date : 2020-01-29
CVE-ID : CVE-2019-17361
Package : salt
Type : arbitrary command execution
Remote : Yes
Link : https://security.archlinux.org/AVG-1087
The package salt before version 2019.2.3-1 is vulnerable to arbitrary
Upgrade to 2019.2.3-1.
# pacman -Syu "salt>=2019.2.3-1"
The problem has been fixed upstream in version 2019.2.3.
With the Salt NetAPI enabled in addition to having a SSH roster
defined, unauthenticated access is possible when specifying the client
as SSH. Additionally, when the raw_shell option is specified any
arbitrary command may be run on the Salt master when specifying SSH
A remote unauthenticated attacker is able to execute arbitrary code on
the affected host.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: not available
More information about the arch-security