CVE-2020-16846
CVE-2020-16846
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.
CVSS 9.8 · Critical · EPSS 99.6% · In KEV · Public exploit · Fix available
- Published
- Updated
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
salt PyPI
- Versions
- 0.10.0
- 0.10.1
- 0.10.2
- 0.10.3
- 0.10.4
- 0.10.5
- 0.11.0
- 0.11.1
- 0.12.0
- 0.12.1
- 0.13.0
- 0.13.1
- 0.13.2
- 0.13.3
- 0.14.0
- 0.14.1
- 0.15.0
- 0.15.1
- 0.15.2
- 0.15.3
- 0.15.90
- 0.16.0
- 0.16.1
- 0.16.2
- 0.16.3
- 0.16.4
- 0.17.0
- 0.17.0rc1
- 0.17.1
- 0.17.2
- 0.17.3
- 0.17.4
- 0.17.5
- 0.8.7
- 0.8.9
- 0.9.0
- 0.9.1
- 0.9.2
- 0.9.3
- 0.9.4
- 0.9.5
- 0.9.6
- 0.9.7
- 0.9.8
- 0.9.9
- 0.9.9.1
- 2014.1.0
- 2014.1.0rc1
- 2014.1.0rc2
- 2014.1.0rc3
- 2014.1.1
- 2014.1.10
- 2014.1.11
- 2014.1.12
- 2014.1.13
- 2014.1.2
- 2014.1.3
- 2014.1.4
- 2014.1.5
- 2014.1.6
- 2014.1.7
- 2014.1.8
- 2014.1.9
- 2014.7.0
- 2014.7.0rc1
- 2014.7.0rc2
- 2014.7.0rc3
- 2014.7.0rc4
- 2014.7.0rc5
- 2014.7.0rc6
- 2014.7.0rc7
- 2014.7.1
- 2014.7.2
- 2014.7.3
- 2014.7.4
- 2014.7.5
- 2014.7.6
- 2014.7.7
- 2015.2.0rc1
- 2015.2.0rc2
- 2015.5.0
- 2015.5.1
- 2015.5.10
- 2015.5.11
- 2015.5.2
- 2015.5.3
- 2015.5.4
- 2015.5.5
- 2015.5.6
- 2015.5.7
- 2015.5.8
- 2015.5.9
- 2015.8.0
- 2015.8.0rc1
- 2015.8.0rc2
- 2015.8.0rc3
- 2015.8.0rc4
- 2015.8.0rc5
- 2015.8.1
- 2015.8.10
- 2015.8.11
- 2015.8.12
- 2015.8.2
- 2015.8.3
- 2015.8.4
- 2015.8.5
- 2015.8.7
- 2015.8.8
- 2015.8.8.2
- 2015.8.9
- Affected ranges
- ECOSYSTEM: < 2015.8.13
Update to 2015.8.13
salt PyPI
- Versions
- 2016.3.0
- 2016.3.1
- 2016.3.2
- 2016.3.3
- 2016.3.4
- 2016.3.5
- 2016.3.6
- 2016.3.7
- Affected ranges
- ECOSYSTEM: ≥ 2016.3.0, < 2016.3.8
Update to 2016.3.8
salt PyPI
- Versions
- 2016.11.0
- 2016.11.1
- 2016.11.2
- 2016.11.3
- 2016.11.4
- 2016.11.5
- 2016.11.6
- 2016.11.7
- 2016.11.8
- 2016.11.9
- Affected ranges
- ECOSYSTEM: ≥ 2016.11.0, < 2016.11.10
Update to 2016.11.10
salt PyPI
- Versions
- 2017.7.0
- 2017.7.0rc1
- 2017.7.1
- 2017.7.2
- 2017.7.3
- 2017.7.4
- 2017.7.5
- 2017.7.6
- 2017.7.7
- Affected ranges
- ECOSYSTEM: ≥ 2017.5.0, < 2017.7.8
Update to 2017.7.8
salt PyPI
- Versions
- 2018.3.0
- 2018.3.0rc1
- 2018.3.1
- 2018.3.2
- 2018.3.3
- 2018.3.4
- Affected ranges
- ECOSYSTEM: ≥ 2018.2.0, < 2018.3.5
Update to 2018.3.5
salt PyPI
- Versions
- 2019.2.0
- 2019.2.1
- 2019.2.2
- 2019.2.3
- 2019.2.4
- 2019.2.5
- Affected ranges
- ECOSYSTEM: ≥ 2019.2.0, < 2019.2.6
Update to 2019.2.6
salt PyPI
- Versions
- 3000
- 3000.1
- 3000.2
- 3000.3
- Affected ranges
- ECOSYSTEM: ≥ 3000.0, < 3000.4
Update to 3000.4
salt PyPI
- Versions
- 3001
- 3001.1
- Affected ranges
- ECOSYSTEM: ≥ 3001, < 3001.2
Update to 3001.2
salt PyPI
- Versions
- 3002
- Affected ranges
- ECOSYSTEM: ≥ 3002, < 3002.1
Update to 3002.1
salt PyPI
- Versions
- 0.10.0
- 0.10.1
- 0.10.2
- 0.10.3
- 0.10.4
- 0.10.5
- 0.11.0
- 0.11.1
- 0.12.0
- 0.12.1
- 0.13.0
- 0.13.1
- 0.13.2
- 0.13.3
- 0.14.0
- 0.14.1
- 0.15.0
- 0.15.1
- 0.15.2
- 0.15.3
- 0.15.90
- 0.16.0
- 0.16.1
- 0.16.2
- 0.16.3
- 0.16.4
- 0.17.0
- 0.17.0rc1
- 0.17.1
- 0.17.2
- 0.17.3
- 0.17.4
- 0.17.5
- 0.8.7
- 0.8.9
- 0.9.0
- 0.9.1
- 0.9.2
- 0.9.3
- 0.9.4
- 0.9.5
- 0.9.6
- 0.9.7
- 0.9.8
- 0.9.9
- 0.9.9.1
- 2014.1.0
- 2014.1.0rc1
- 2014.1.0rc2
- 2014.1.0rc3
- 2014.1.1
- 2014.1.10
- 2014.1.11
- 2014.1.12
- 2014.1.13
- 2014.1.2
- 2014.1.3
- 2014.1.4
- 2014.1.5
- 2014.1.6
- 2014.1.7
- 2014.1.8
- 2014.1.9
- 2014.7.0
- 2014.7.0rc1
- 2014.7.0rc2
- 2014.7.0rc3
- 2014.7.0rc4
- 2014.7.0rc5
- 2014.7.0rc6
- 2014.7.0rc7
- 2014.7.1
- 2014.7.2
- 2014.7.3
- 2014.7.4
- 2014.7.5
- 2014.7.6
- 2014.7.7
- 2015.2.0rc1
- 2015.2.0rc2
- 2015.5.0
- 2015.5.1
- 2015.5.10
- 2015.5.11
- 2015.5.2
- 2015.5.3
- 2015.5.4
- 2015.5.5
- 2015.5.6
- 2015.5.7
- 2015.5.8
- 2015.5.9
- 2015.8.0
- 2015.8.0rc1
- 2015.8.0rc2
- 2015.8.0rc3
- 2015.8.0rc4
- 2015.8.0rc5
- 2015.8.1
- 2015.8.11
- 2015.8.12
- 2015.8.2
- 2015.8.3
- 2015.8.4
- 2015.8.5
- 2015.8.7
- 2015.8.8
- 2015.8.8.2
- 2015.8.9
- 2016.11.0
- 2016.11.1
- 2016.11.2
- 2016.11.4
- 2016.11.5
- 2016.11.7
- 2016.11.8
- 2016.11.9
- 2016.3.0
- 2016.3.1
- 2016.3.2
- 2016.3.3
- 2016.3.5
- 2016.3.7
- 2017.7.0
- 2017.7.1
- 2017.7.2
- 2017.7.3
- 2017.7.5
- 2017.7.6
- 2017.7.7
- 2018.3.0
- 2018.3.0rc1
- 2018.3.1
- 2018.3.2
- 2018.3.3
- 2018.3.4
- 2019.2.0
- 2019.2.1
- 2019.2.2
- 2019.2.3
- 2019.2.4
- 3000
- 3000.1
- 3000.2
- Affected ranges
- ECOSYSTEM: < 2015.8.10 ∪ ≥ 2015.8.11, < 2015.8.13 ∪ ≥ 2016.3.0, < 2016.3.4 ∪ ≥ 2016.3.5, < 2016.3.6 ∪ ≥ 2016.3.7, < 2016.3.8 ∪ ≥ 2016.11.0, < 2016.11.3 ∪ ≥ 2016.11.4, < 2016.11.6 ∪ ≥ 2016.11.7, < 2016.11.10 ∪ ≥ 2017.7.0, < 2017.7.4 ∪ ≥ 2017.7.5, < 2017.7.8 ∪ ≥ 2018.3.0rc1, < 2018.3.5 ∪ ≥ 2019.2.0, < 2019.2.5 ∪ ≥ 3000, < 3000.3
Update to 2015.8.10; Update to 2015.8.13; Update to 2016.3.4; Update to 2016.3.6; Update to 2016.3.8; Update to 2016.11.3; Update to 2016.11.6; Update to 2016.11.10; Update to 2017.7.4; Update to 2017.7.8; Update to 2018.3.5; Update to 2019.2.5; Update to 3000.3
salt Ubuntu:Pro:14.04:LTS
- Versions
- 0.16.0-1
- 0.16.4-2
- 0.17.1+dfsg-1
- 0.17.2-1
- 0.17.2-2
- 0.17.2-3
- 0.17.4-1
- 0.17.4-2
- 0.17.5-1
- 0.17.5+ds-1
- 0.17.5+ds-1ubuntu0.1~esm1
- 0.17.5+ds-1ubuntu0.1~esm2
- Affected ranges
- ECOSYSTEM: < 0.17.5+ds-1ubuntu0.1~esm4
Update to 0.17.5+ds-1ubuntu0.1~esm4
salt Ubuntu:Pro:16.04:LTS
- Versions
- 2015.5.3+ds-1
- 2015.8.1+ds-2
- 2015.8.3+ds-1
- 2015.8.3+ds-2
- 2015.8.3+ds-3
- 2015.8.5+ds-1
- 2015.8.7+ds-1
- 2015.8.8+ds-1
- 2015.8.8+ds-1ubuntu0.1~esm1
- 2015.8.8+ds-1ubuntu0.1
- 2015.8.8+ds-1ubuntu0.1+esm1
- Affected ranges
- ECOSYSTEM: < 2015.8.8+ds-1ubuntu0.1+esm2
Update to 2015.8.8+ds-1ubuntu0.1+esm2
salt Ubuntu:Pro:18.04:LTS
- Versions
- 2016.11.5+ds-1
- 2016.11.8+dfsg1-1
- 2017.7.2+dfsg1-2ubuntu1
- 2017.7.3+dfsg1-1
- 2017.7.4+dfsg1-1
- 2017.7.4+dfsg1-1ubuntu18.04.1
- 2017.7.4+dfsg1-1ubuntu18.04.2
- Affected ranges
- ECOSYSTEM: < 2017.7.4+dfsg1-1ubuntu18.04.2+esm1
Update to 2017.7.4+dfsg1-1ubuntu18.04.2+esm1
Original sources
- https://github.com/saltstack/salt/releases
- https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA/
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.html
- https://security.gentoo.org/glsa/202011-13
- http://packetstormsecurity.com/files/160039/SaltStack-Salt-REST-API-Arbitrary-Command-Execution.html
- https://www.zerodayinitiative.com/advisories/ZDI-20-1381/
- https://www.zerodayinitiative.com/advisories/ZDI-20-1383/
- https://www.zerodayinitiative.com/advisories/ZDI-20-1380/
- https://www.zerodayinitiative.com/advisories/ZDI-20-1379/
- https://www.zerodayinitiative.com/advisories/ZDI-20-1382/
- https://lists.debian.org/debian-lts-announce/2020/12/msg00007.html
- https://www.debian.org/security/2021/dsa-4837
- https://lists.debian.org/debian-lts-announce/2022/01/msg00000.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-16846
- https://nvd.nist.gov/vuln/detail/CVE-2020-16846