جزئیات آسیب‌پذیری

خلاصه‌ی فارسی برای این آسیب‌پذیری هنوز تهیه نشده است.

An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.

• https://github.com/saltstack/salt/releases x_refsource_MISC
• https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/ x_refsource_CONFIRM
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA/ vendor-advisoryx_refsource_FEDORA
• http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.html vendor-advisoryx_refsource_SUSE
• https://security.gentoo.org/glsa/202011-13 vendor-advisoryx_refsource_GENTOO
• http://packetstormsecurity.com/files/160039/SaltStack-Salt-REST-API-Arbitrary-Command-Execution.html x_refsource_MISC
• https://www.zerodayinitiative.com/advisories/ZDI-20-1381/ x_refsource_MISC
• https://www.zerodayinitiative.com/advisories/ZDI-20-1383/ x_refsource_MISC
• https://www.zerodayinitiative.com/advisories/ZDI-20-1380/ x_refsource_MISC
• https://www.zerodayinitiative.com/advisories/ZDI-20-1379/ x_refsource_MISC
• https://www.zerodayinitiative.com/advisories/ZDI-20-1382/ x_refsource_MISC
• https://lists.debian.org/debian-lts-announce/2020/12/msg00007.html mailing-listx_refsource_MLIST
• https://www.debian.org/security/2021/dsa-4837 vendor-advisoryx_refsource_DEBIAN
• https://lists.debian.org/debian-lts-announce/2022/01/msg00000.html mailing-listx_refsource_MLIST
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-16846 government-resource