En bref
- CVE-2019-1010259 est une vulnérabilité CRITIQUE (CVSS 9.8) touchant salt, salt 2018 (saltstack), salt 2019 (saltstack).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.9%, plus élevée que 79.7% des vulnérabilités.
- Correctif : mettre à jour vers 2018.3.4 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| salt PyPI | ≥ 2018.3.0, < 2018.3.4< 2018.3.4
| 2018.3.4
|
| salt 2018 | = 3.0
| No fix yet |
| salt 2019 | = 2.0
| No fix yet |
Description
SaltStack Salt 2018.3 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.user_chpass function from the MySQL module for Salt (https://github.com/saltstack/salt/blob/develop/salt/modules/mysql.py#L1462). The attack vector is: specially crafted password string. The fixed version is: 2018.3.4.
NVD description
SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.user_chpass function from the MySQL module for Salt. The attack vector is: specially crafted password string. The fixed version is: 2018.3.4.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free