Login
Newsletter
Werbung

Sicherheit: Mehrere Probleme in Salt
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in Salt
ID: USN-4459-1
Distribution: Ubuntu
Plattformen: Ubuntu 16.04 LTS, Ubuntu 18.04 LTS
Datum: Fr, 14. August 2020, 22:08
Referenzen: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11652
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15751
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11651
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15750
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17361
Applikationen: Salt

Originalnachricht


--===============7772656141223989137==
Content-Type: multipart/signed; micalg=pgp-sha512;
protocol="application/pgp-signature";
boundary="6k3qax3dmflbtq7y"
Content-Disposition: inline


--6k3qax3dmflbtq7y
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

==========================================================================
Ubuntu Security Notice USN-4459-1
August 13, 2020

salt vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in Salt.

Software Description:
- salt: Infrastructure management built on a dynamic communication bus

Details:

It was discovered that Salt allows remote attackers to determine which files
exist on the server. An attacker could use that to extract sensitive
information. (CVE-2018-15750)

It was discovered that Salt has a vulnerability that allows an user to bypass
authentication. An attacker could use that to extract sensitive information,
execute abritrary code or crash the server. (CVE-2018-15751)

It was discovered that Salt is vulnerable to command injection. This allows
an unauthenticated attacker with network access to the API endpoint to
execute arbitrary code on the salt-api host. (CVE-2019-17361)

It was discovered that Salt incorrectly validated method calls and
sanitized paths. A remote attacker could possibly use this issue to access
some methods without authentication. (CVE-2020-11651, CVE-2020-11652)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS:
salt-api 2017.7.4+dfsg1-1ubuntu18.04.2
salt-common 2017.7.4+dfsg1-1ubuntu18.04.2
salt-master 2017.7.4+dfsg1-1ubuntu18.04.2
salt-minion 2017.7.4+dfsg1-1ubuntu18.04.2

Ubuntu 16.04 LTS:
salt-api 2015.8.8+ds-1ubuntu0.1
salt-common 2015.8.8+ds-1ubuntu0.1
salt-master 2015.8.8+ds-1ubuntu0.1
salt-minion 2015.8.8+ds-1ubuntu0.1

After a standard system update you need to restart salt to make all the
necessary changes.

References:
https://usn.ubuntu.com/4459-1
CVE-2018-15750, CVE-2018-15751, CVE-2019-17361, CVE-2020-11651,
CVE-2020-11652

Package Information:
https://launchpad.net/ubuntu/+source/salt/2017.7.4+dfsg1-1ubuntu18.04.2
https://launchpad.net/ubuntu/+source/salt/2015.8.8+ds-1ubuntu0.1

--6k3qax3dmflbtq7y
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEkCdEQ5T6DutSveCybUp5kL3izGYFAl82ue8ACgkQbUp5kL3i
zGZCoA/+Jl+8VdwWdJVPprTv5Bp5I35PnTmAPt0aO6J0XfcA9/no14LGs6q7iAtM
BNbSCMFswEh1IdA0x9PAiw1U9YNIw54cUWOsECjsSq7y8mTm9r4auioK0VYhqW5V
EpYoH/3i0YpOduaU1aBm92bFVKZcSfS1r8ckORB4f+dnXE3F0WSSBqqvt4jBkaWm
saPmqIBjKs0Gs+Kk/YcPzGoWWm3bj+AvF+rm2e2fLiltbBbsvoBpFLcAtzDwppsQ
Dhc4x62jH2yEKZ8nKVySNFibMxAJcycsa1/u4HDFaj55tA5vvJNsnsG5bTprGTa4
S4+pzSJLNet6kkTLssixqxg1zVh65tSOXt9UzdgO5hfDLlfaLK6fYN2hXJQSqlml
EnSRNnUuYOOM2SJRoqR9p7kMl1xCRdeoa8Dsyp3gcrWO5AaCa3+8djI6yb2TuinN
iNVQ5vvWwrm+vrV5ZyLI5bGDetXD+igd8an7XTL20dnrHVW4P5LnS0dMXntdevXP
bBmYW+B/qdFEY/Uv1+VtjcwK0hp7buWFDBmEJ+8HxCo/mdvgpsCgQionHJFhPR8a
u4y2UCvXCdRKLCVvARb83z/ZUBe//ss6N//vFRh8dFmJmudp9TYeq2SVzeinJKqP
s9spbvC/e4442qavyuXMzcMhhw4/hA1aEwX66TIbPV2WWqUyXFM=
=mqgs
-----END PGP SIGNATURE-----

--6k3qax3dmflbtq7y--


--===============7772656141223989137==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung