En resumen
- CVE-2019-1010259 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a salt, salt 2018 (saltstack), salt 2019 (saltstack).
- Probabilidad de explotación en los próximos 30 días (EPSS): 1.9%, mayor que el 79.7% de las vulnerabilidades.
- Solución: actualizar a 2018.3.4 o posterior.
| Package | Affected versions | Patched versions |
|---|
| salt PyPI | ≥ 2018.3.0, < 2018.3.4< 2018.3.4
| 2018.3.4
|
| salt 2018 | = 3.0
| No fix yet |
| salt 2019 | = 2.0
| No fix yet |
Description
SaltStack Salt 2018.3 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.user_chpass function from the MySQL module for Salt (https://github.com/saltstack/salt/blob/develop/salt/modules/mysql.py#L1462). The attack vector is: specially crafted password string. The fixed version is: 2018.3.4.
NVD description
SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.user_chpass function from the MySQL module for Salt. The attack vector is: specially crafted password string. The fixed version is: 2018.3.4.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free