CVEvulnerability
CVE-2019-17361
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2020-01-17
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-77
Description
In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.
Affected configurations
• saltstack salt (<= 2019.2.0)
• debian debian linux 9.0
• debian debian linux 10.0
• opensuse leap 15.1
• canonical ubuntu linux 16.04
• canonical ubuntu linux 18.04
Related
Weakness · CWE (1)
- CWE-77 Improper Neutralization of Special Elements used in a Command weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00026.html Mailing List, Third Party Advisory
- https://docs.saltstack.com/en/latest/topics/releases/2019.2.3.html#security-fix Release Notes, Third Party Advisory
- https://github.com/saltstack/salt/commits/master Patch, Third Party Advisory
- https://usn.ubuntu.com/4459-1/ Third Party Advisory
- https://www.debian.org/security/2020/dsa-4676 Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00026.html Mailing List, Third Party Advisory
- https://docs.saltstack.com/en/latest/topics/releases/2019.2.3.html#security-fix Release Notes, Third Party Advisory
- https://github.com/saltstack/salt/commits/master Patch, Third Party Advisory
- https://usn.ubuntu.com/4459-1/ Third Party Advisory
- https://www.debian.org/security/2020/dsa-4676 Third Party Advisory