~ / search / GHSA-q53j-p6r2-g2v4

GHSA-q53j-p6r2-g2v4

SaltStack Salt is vulnerable to command injection

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-17361

Packages

EcosystemPackageAffectedFixed in
PyPI salt < 2019.2.3 2019.2.3

Details

As written in the advisory (Markdown source, shown as plain text).

In SaltStack Salt before 2019.2.3, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.

References

External links from the advisory. They lead to third-party sites.