Weak File Permissions in TLS Module of SaltStack Salt Affects Security
CVE-2020-17490

5.5MEDIUM

Key Information:

Vendor

Saltstack

Status
Salt
Vendor
CVE Published:
6 November 2020

What is CVE-2020-17490?

The TLS module in SaltStack Salt up to version 3002 allows the creation of certificates with inadequate file permissions. This misconfiguration could lead to unauthorized access, as the generated certificates may be exposed or manipulated by unauthorized users. It is crucial for users of SaltStack Salt to review their configurations and implement proper file permission settings to safeguard their systems and data.

References

https://docs.saltstack.com/en/latest/topics/releases/inde...
x_refsource_MISC
https://www.saltstack.com/blog/on-november-3-2020-saltsta...
x_refsource_CONFIRM
https://lists.fedoraproject.org/archives/list/package-ann...
vendor-advisoryx_refsource_FEDORA

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.