==========================================================================
Ubuntu Security Notice USN-4459-1
August 13, 2020

salt vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 18.04 LTS
– Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in Salt.

Software Description:
– salt: Infrastructure management built on a dynamic communication bus

Details:

It was discovered that Salt allows remote attackers to determine which files
exist on the server. An attacker could use that to extract sensitive
information. (CVE-2018-15750)

It was discovered that Salt has a vulnerability that allows an user to bypass
authentication. An attacker could use that to extract sensitive information,
execute abritrary code or crash the server. (CVE-2018-15751)

It was discovered that Salt is vulnerable to command injection. This allows
an unauthenticated attacker with network access to the API endpoint to
execute arbitrary code on the salt-api host. (CVE-2019-17361)

It was discovered that Salt incorrectly validated method calls and
sanitized paths. A remote attacker could possibly use this issue to access
some methods without authentication. (CVE-2020-11651, CVE-2020-11652)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS:
salt-api 2017.7.4+dfsg1-1ubuntu18.04.2
salt-common 2017.7.4+dfsg1-1ubuntu18.04.2
salt-master 2017.7.4+dfsg1-1ubuntu18.04.2
salt-minion 2017.7.4+dfsg1-1ubuntu18.04.2

Ubuntu 16.04 LTS:
salt-api 2015.8.8+ds-1ubuntu0.1
salt-common 2015.8.8+ds-1ubuntu0.1
salt-master 2015.8.8+ds-1ubuntu0.1
salt-minion 2015.8.8+ds-1ubuntu0.1

After a standard system update you need to restart salt to make all the
necessary changes.

References:
https://usn.ubuntu.com/4459-1
CVE-2018-15750, CVE-2018-15751, CVE-2019-17361, CVE-2020-11651,
CVE-2020-11652

Package Information:
https://launchpad.net/ubuntu/+source/salt/2017.7.4+dfsg1-1ubuntu18.04.2
https://launchpad.net/ubuntu/+source/salt/2015.8.8+ds-1ubuntu0.1
—–BEGIN PGP SIGNATURE—–

iQIzBAEBCgAdFiEEkCdEQ5T6DutSveCybUp5kL3izGYFAl82ue8ACgkQbUp5kL3i
zGZCoA/+Jl+8VdwWdJVPprTv5Bp5I35PnTmAPt0aO6J0XfcA9/no14LGs6q7iAtM
BNbSCMFswEh1IdA0x9PAiw1U9YNIw54cUWOsECjsSq7y8mTm9r4auioK0VYhqW5V
EpYoH/3i0YpOduaU1aBm92bFVKZcSfS1r8ckORB4f+dnXE3F0WSSBqqvt4jBkaWm
saPmqIBjKs0Gs+Kk/YcPzGoWWm3bj+AvF+rm2e2fLiltbBbsvoBpFLcAtzDwppsQ
Dhc4x62jH2yEKZ8nKVySNFibMxAJcycsa1/u4HDFaj55tA5vvJNsnsG5bTprGTa4
S4+pzSJLNet6kkTLssixqxg1zVh65tSOXt9UzdgO5hfDLlfaLK6fYN2hXJQSqlml
EnSRNnUuYOOM2SJRoqR9p7kMl1xCRdeoa8Dsyp3gcrWO5AaCa3+8djI6yb2TuinN
iNVQ5vvWwrm+vrV5ZyLI5bGDetXD+igd8an7XTL20dnrHVW4P5LnS0dMXntdevXP
bBmYW+B/qdFEY/Uv1+VtjcwK0hp7buWFDBmEJ+8HxCo/mdvgpsCgQionHJFhPR8a
u4y2UCvXCdRKLCVvARb83z/ZUBe//ss6N//vFRh8dFmJmudp9TYeq2SVzeinJKqP
s9spbvC/e4442qavyuXMzcMhhw4/hA1aEwX66TIbPV2WWqUyXFM=
=mqgs
—–END PGP SIGNATURE—–
—