drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in Salt
Name: |
Mehrere Probleme in Salt |
|
ID: |
USN-4459-1 |
|
Distribution: |
Ubuntu |
|
Plattformen: |
Ubuntu 16.04 LTS, Ubuntu 18.04 LTS |
|
Datum: |
Fr, 14. August 2020, 22:08 |
|
Referenzen: |
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11652
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15751
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11651
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15750
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17361 |
|
Applikationen: |
Salt |
|
Originalnachricht |
--===============7772656141223989137== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="6k3qax3dmflbtq7y" Content-Disposition: inline
--6k3qax3dmflbtq7y Content-Type: text/plain; charset=us-ascii Content-Disposition: inline
========================================================================== Ubuntu Security Notice USN-4459-1 August 13, 2020
salt vulnerabilities ==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS - Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in Salt.
Software Description: - salt: Infrastructure management built on a dynamic communication bus
Details:
It was discovered that Salt allows remote attackers to determine which files exist on the server. An attacker could use that to extract sensitive information. (CVE-2018-15750)
It was discovered that Salt has a vulnerability that allows an user to bypass authentication. An attacker could use that to extract sensitive information, execute abritrary code or crash the server. (CVE-2018-15751)
It was discovered that Salt is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host. (CVE-2019-17361)
It was discovered that Salt incorrectly validated method calls and sanitized paths. A remote attacker could possibly use this issue to access some methods without authentication. (CVE-2020-11651, CVE-2020-11652)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 18.04 LTS: salt-api 2017.7.4+dfsg1-1ubuntu18.04.2 salt-common 2017.7.4+dfsg1-1ubuntu18.04.2 salt-master 2017.7.4+dfsg1-1ubuntu18.04.2 salt-minion 2017.7.4+dfsg1-1ubuntu18.04.2
Ubuntu 16.04 LTS: salt-api 2015.8.8+ds-1ubuntu0.1 salt-common 2015.8.8+ds-1ubuntu0.1 salt-master 2015.8.8+ds-1ubuntu0.1 salt-minion 2015.8.8+ds-1ubuntu0.1
After a standard system update you need to restart salt to make all the necessary changes.
References: https://usn.ubuntu.com/4459-1 CVE-2018-15750, CVE-2018-15751, CVE-2019-17361, CVE-2020-11651, CVE-2020-11652
Package Information: https://launchpad.net/ubuntu/+source/salt/2017.7.4+dfsg1-1ubuntu18.04.2 https://launchpad.net/ubuntu/+source/salt/2015.8.8+ds-1ubuntu0.1
--6k3qax3dmflbtq7y Content-Type: application/pgp-signature; name="signature.asc"
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEkCdEQ5T6DutSveCybUp5kL3izGYFAl82ue8ACgkQbUp5kL3i zGZCoA/+Jl+8VdwWdJVPprTv5Bp5I35PnTmAPt0aO6J0XfcA9/no14LGs6q7iAtM BNbSCMFswEh1IdA0x9PAiw1U9YNIw54cUWOsECjsSq7y8mTm9r4auioK0VYhqW5V EpYoH/3i0YpOduaU1aBm92bFVKZcSfS1r8ckORB4f+dnXE3F0WSSBqqvt4jBkaWm saPmqIBjKs0Gs+Kk/YcPzGoWWm3bj+AvF+rm2e2fLiltbBbsvoBpFLcAtzDwppsQ Dhc4x62jH2yEKZ8nKVySNFibMxAJcycsa1/u4HDFaj55tA5vvJNsnsG5bTprGTa4 S4+pzSJLNet6kkTLssixqxg1zVh65tSOXt9UzdgO5hfDLlfaLK6fYN2hXJQSqlml EnSRNnUuYOOM2SJRoqR9p7kMl1xCRdeoa8Dsyp3gcrWO5AaCa3+8djI6yb2TuinN iNVQ5vvWwrm+vrV5ZyLI5bGDetXD+igd8an7XTL20dnrHVW4P5LnS0dMXntdevXP bBmYW+B/qdFEY/Uv1+VtjcwK0hp7buWFDBmEJ+8HxCo/mdvgpsCgQionHJFhPR8a u4y2UCvXCdRKLCVvARb83z/ZUBe//ss6N//vFRh8dFmJmudp9TYeq2SVzeinJKqP s9spbvC/e4442qavyuXMzcMhhw4/hA1aEwX66TIbPV2WWqUyXFM= =mqgs -----END PGP SIGNATURE-----
--6k3qax3dmflbtq7y--
--===============7772656141223989137== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline
-- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
|
|
|
|