CVE-2020-11651

描述

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.

如何修補 CVE-2020-11651

要修補 CVE-2020-11651,請將受影響套件升級到下列已修補版本。

• —升級至 2014.1.13+ds-3+deb8u1 或更新版本
• —升級至 2016.11.2+ds-1+deb9u4 或更新版本
• —升級至 2019.2.4 或更新版本
• —升級至 2019.2.4 或更新版本

CVE-2020-11651 正在被利用嗎?

是 — CVE-2020-11651 已列入 CISA Known Exploited Vulnerabilities (KEV) 清單,代表正在被實際利用,請立即修補。

受影響套件(4)

• from 0, < 2014.1.13+ds-3+deb8u1
• from 0, < 2016.11.2+ds-1+deb9u4
• from 0, < 2019.2.4
• from 0, < 2019.2.4, >= 3000, < 3000.2

CVSS 分數

參考連結(16)

• ADVISORYgithub.com/advisories/GHSA-pjhf-vpx3-33r3
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2020-11651
• PATCHgithub.com/saltstack/salt
• WEBlists.opensuse.org/opensuse-security-announce/2020-04/msg00047.html
• WEB