CVE-2019-17361 | BDVDB-2026-129393 Detail

Description#

In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://github.com/saltstack/salt/commits/master
https://docs.saltstack.com/en/latest/topics/releases/2019.2.3.html#security-fix
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00026.html
https://www.debian.org/security/2020/dsa-4676
https://usn.ubuntu.com/4459-1/

Exploit#

No public exploit known

History#

Version 12020-01-17Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.