CVE-2020-11651

Description

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.

How to fix CVE-2020-11651

To remediate CVE-2020-11651, upgrade the affected package to a fixed version below.

• —upgrade to 2014.1.13+ds-3+deb8u1 or later
• —upgrade to 2016.11.2+ds-1+deb9u4 or later
• —upgrade to 2019.2.4 or later
• —upgrade to 2019.2.4 or later

Is CVE-2020-11651 being exploited?

Yes — CVE-2020-11651 is on the CISA Known Exploited Vulnerabilities (KEV) catalog. Patch immediately.

Affected packages (4)

• from 0, < 2014.1.13+ds-3+deb8u1
• from 0, < 2016.11.2+ds-1+deb9u4
• from 0, < 2019.2.4
• from 0, < 2019.2.4, >= 3000, < 3000.2

CVSS scores

References (16)

• ADVISORYgithub.com/advisories/GHSA-pjhf-vpx3-33r3
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2020-11651
• PATCHgithub.com/saltstack/salt
• WEBlists.opensuse.org/opensuse-security-announce/2020-04/msg00047.html
• WEB