SQL Injection Vulnerability in SaltStack Salt for MySQL Module

CVE-2019-1010259

What is CVE-2019-1010259?

A vulnerability exists in SaltStack Salt's MySQL module, specifically within the mysql.user_chpass function. This security flaw allows attackers to perform SQL injection attacks by using a specially crafted password string. Successful exploitation of this vulnerability can enable an attacker to escalate privileges on MySQL servers deployed by cloud providers, potentially leading to Remote Code Execution (RCE). It is crucial for users of SaltStack Salt to update to version 2018.3.4 or later to mitigate this risk.

References