[IT-SecNots] [SECURITY] [DSA 4837-1] salt security update

[Salvatore Bonaccorso <carnil AT debian.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4837-1                   security AT debian.org
https://www.debian.org/security/                     Salvatore Bonaccorso
January 24, 2021                      https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : salt
CVE ID         : CVE-2020-16846 CVE-2020-17490 CVE-2020-25592

Several vulnerabilities were discovered in salt, a powerful remote
execution manager. The flaws could result in authentication bypass and
invocation of Salt SSH, creation of certificates with weak file
permissions via the TLS execution module or shell injections with the
Salt API using the SSH client.

For the stable distribution (buster), these problems have been fixed in
version 2018.3.4+dfsg1-6+deb10u2.

We recommend that you upgrade your salt packages.

For the detailed security status of salt please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/salt

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce AT lists.debian.org
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmANkXVfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0SBWRAAoHGD+OhrOH0ceSVeirl6qrIQua7L+70a4s2wh251K4pnE72fZl9Dt+IT
Idhc6YZhQ+Y0j3Bu+J2YE9NWUXsgaAN99tRUDe8vnbgjtPc3VHMk7LyfPc6PEaIl
jMWT2BeN6FbusuLk4Kwwqa+oZ8qxEKqnU7L+eHI/sX2UjUZt5hvMfTFESHayivUM
OXNH7/SdEL3V2nC/I8Vr0NwhrVE2sv/yKSyp5faawC+tBPhhzyM1Gnaka9yGxjq4
k/x5Vi2zoyTZziRss9WZ3st0Mbh+O/qKzIIQP+1SIqnIJXx/tXXgLIt95WiXu/lr
6+DsrndVrHfRgGUVELZnp3s00/ddEXanTJtJKwf9BnlPrLKp+kiQU3wPNrR4EGHa
yDjxf2e4vWJWqaC1H3u6MvfUpkG4WdTxXOi9Q5y3xEZfgKrs5AjIAXSGRILIV1Q9
UoPELoFzkLG1tTJ5LjMNl5N3CnsK8xeuuQ5Ljb1rH9c7EWXPma1XXg6SdorTz21h
eUs3X3teSagepPknitSAErYsEXCE/r7rgg1aqeWlleH/r8jYid4eEWGJP+8lrv7b
Scl1oEMg6rqLfLC7VKqGJdrFRKNWpRdlw4YRe1qed/lyAL/mrMq60r61FWA5NhFs
lmxgdTLSK5vSROCxXLYhg6WmkFtLO4IcufQbzTIaaGnQqbG3xI8=
=1Rmw
-----END PGP SIGNATURE-----