CVE-2020-16846

CRITICAL9.8⚠ KEVEPSS 94.4%

salt - security update

發布日:2022/5/24修改日:2026/3/9加入 CISA KEV 日:2021/11/3

描述

An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.

受影響套件(4)

  • Debian/saltfrom 0, < 2016.11.2+ds-1+deb9u6
  • Debian/saltfrom 0, < 2018.3.4+dfsg1-6+deb10u2
  • PyPI/saltfrom 0, < 2015.8.13
  • PyPI/saltfrom 0, < 2015.8.10, >= 2015.8.11, < 2015.8.13, >= 2016.3.0, < 2016.3.4, >= 2016.3.5, < 2016.3.6, >= 2016.3.7, < 2016.3.8, >= 2016.11.0, < 2016.11.3, >= 2016.11.4, < 2016.11.6, >= 2016.11.7, < 2016.11.10, >= 2017.7.0, < 2017.7.4, >= 2017.7.5, < 2017.7.8, >= 2018.3.0rc1, < 2018.3.5, >= 2019.2.0, < 2019.2.5, >= 3000, < 3000.3

CVSS 分數

來源版本嚴重程度向量
osvCVSS 3.1CRITICAL9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H

參考連結(30)