CVE:CVE-2019-17361
CNNVD:CNNVD-202001-847
SaltStack Salt是SaltStack公司的一套开源的用于管理基础架构的工具。该工具提供配置管理、远程执行等功能。
SaltStack Salt 2019.2.0及之前版本中的salt-api NEST API（ssh客户端被启用）存在注入漏洞。攻击者可通过网络访问API端点利用该漏洞执行任意代码。
solution:Upgrade saltstack salt to a higher version than 2019.2.0,and avoid the version (,2019.2.0]; Upgrade debian debian_linux to a higher version than 9.0,10.0,and avoid the version 9.0,10.0; Upgrade opensuse leap to a higher version than 15.1,and avoid the version 15.1; Upgrade canonical ubuntu_linux to a higher version than 16.04,18.04,and avoid the version 16.04,18.04