CVE:CVE-2020-11652
CNNVD:CNNVD-202004-2446
SaltStack Salt是SaltStack公司的一套开源的用于管理基础架构的工具。该工具提供配置管理、远程执行等功能。
SaltStack Salt 3000.2之前的3000.x版本中的salt-master进程的ClearFuncs类存在路径遍历漏洞，该漏洞源于不正确的访问控制。远程攻击者可利用该漏洞访问任意目录。
solution:Upgrade saltstack salt to a higher version than 2019.2.4,3000.2,and avoid the version (,2019.2.4),[3000,3000.2); Upgrade opensuse leap to a higher version than 15.1,and avoid the version 15.1; Upgrade debian debian_linux to a higher version than 8.0,9.0,10.0,and avoid the version 8.0,9.0,10.0; Upgrade canonical ubuntu_linux to a higher version than 16.04,18.04,and avoid the version 16.04,18.04; Upgrade blackberry workspaces_server to a higher version than 7.1.3,8.2.6,9.1.0,and avoid the version (,7.1.3],[8.0.0,8.2.6],9.1.0; Upgrade vmware application_remote_collector to a higher version than 7.5.0,8.0.0,and avoid the version 7.5.0,8.0.0