Vulnerability · Published Feb 27, 2021 · Assigned by mitre
CVE-2020-35662
High 7.4
In plain English
A high-severity improper certificate validation in the salt package (PyPI). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.0% (higher than 87% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.4High
Exploit odds (30 days)3.0%top 12.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | salt | 2015.8.13 | GHSA-qx72-q6w3-qgc7 |
| PyPI | salt | 2016.11.5 | GHSA-qx72-q6w3-qgc7 |
| PyPI | salt | 2016.11.10 | GHSA-qx72-q6w3-qgc7 |
| PyPI | salt | 2017.7.8 | GHSA-qx72-q6w3-qgc7 |
| PyPI | salt | no fix listed | GHSA-qx72-q6w3-qgc7 |
| PyPI | salt | 2019.2.8 | GHSA-qx72-q6w3-qgc7 |
| PyPI | salt | 3000.7 | GHSA-qx72-q6w3-qgc7 |
| PyPI | salt | 3001.5 | GHSA-qx72-q6w3-qgc7 |
| PyPI | salt | 3002.3 | GHSA-qx72-q6w3-qgc7 |
| PyPI | salt | 2015.8.10, 2015.8.13, 2016.11.10, 2016.11.3, 2016.11.5, 2016.3.4, 2016.3.6, 2016.3.8, 2017.7.8, 2019.2.0rc1, 2019.2.5, 2019.2.8, 3000.6, 3001.4, 3002.5 | PYSEC-2021-75 |
Affected products (as reported)
Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/
- FEDORA-2021-904a2dbc0c vendor-advisory
- FEDORA-2021-5756fbf8a6 vendor-advisory
- FEDORA-2021-43eb5584ad vendor-advisory
- GLSA-202103-01 vendor-advisory
- [debian-lts-announce] 20211110 [SECURITY] [DLA 2815-1] salt security update mailing-list
- DSA-5011 vendor-advisory
- GLSA-202310-22 vendor-advisory