GHSA-29j3-2446-5j4wCriticalCVSS 9.8

SaltStack Salt Improper Validation of eauth credentials and tokens in salt-netapi

Published
May 24, 2022
Last Modified
October 22, 2024

🔗 CVE IDs covered (1)

CVE-2020-25592 →

📋 Description

In SaltStack the salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH.

🎯 Affected products9

  • pip/salt:< 2015.8.13
  • pip/salt:>= 2016.3.0, < 2016.3.8
  • pip/salt:>= 2016.11.0, < 2016.11.10
  • pip/salt:>= 2017.5.0, < 2017.7.8
  • pip/salt:>= 2018.2.0, < 2018.3.5
  • pip/salt:>= 2019.2.0, < 2019.2.7
  • pip/salt:>= 3000.0, < 3000.5
  • pip/salt:>= 3001.0, < 3001.3
  • pip/salt:>= 3002.0, < 3002.1

🔗 References (15)