Incorrect default permissions in Salt - CVE-2020-17490

Vulnerability identifier: #VU48205

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-17490

CWE-ID: CWE-276

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions for files and folders that are set by the application within the TLS module. A local user with access to the system can view contents of files and directories or modify them.

Salt
Arch Linux
Gentoo Linux
Opensuse
Ubuntu
Fedora
salt (Alpine package)
salt (Debian package)
salt-common (Ubuntu package)
salt

Install updates from vendor's website.

Salt - addressed in versions 2019.2.6, 2019.2.7, 3000.4, 3000.5, 3001.2, 3001.3, 3002.1
salt (Alpine package) - update to 3002-r1
salt (Debian package) - update to 2018.3.4+dfsg1-6+deb10u2
salt-common (Ubuntu package) - update to Ubuntu Pro
salt - addressed in versions 3001.3-1.fc31, 3001.3-1.fc32, 3002.1-1.fc33

• http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.html
• https://docs.saltstack.com/en/latest/topics/releases/index.html#latest-branch-release
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA/
• https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/

• Multiple vulnerabilities in SaltStack Salt
• OpenSUSE Linux update for salt
• OpenSUSE Linux update for salt
• Arch Linux update for salt
• Incorrect default permissions in salt (Alpine package)
• Gentoo update for Salt
• Debian update for salt
• Ubuntu update for salt
• Fedora 31 update for salt
• Fedora 32 update for salt
• Fedora 33 update for salt