{"id":"CVE-2019-1010259","aliases":["EUVD-2019-0127","GHSA-h8xp-h3jf-wv4v","PYSEC-2019-119","UBUNTU-CVE-2019-1010259"],"status":"published","title":"SaltStack Salt SQL Injection vulnerability in mysql.user_chpass function","description":"SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.user_chpass function from the MySQL module for Salt. The attack vector is: specially crafted password string. The fixed version is: 2018.3.4.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01935,"percentile":0.80208,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2019-07-18T16:33:35Z","modified":"2026-06-17T02:09:55Z","fixes":[{"ecosystem":"PyPI","package":"salt","fixed_in":["2018.3.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2018.3.0"},{"fixed":"2018.3.4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2018.3.0"},{"fixed":"2018.3.4"}]}],"versions":["2018.3.0","2018.3.1","2018.3.2","2018.3.3"]},{"source":"osv","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2018.3.4"}]}],"versions":["0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.5","0.11.0","0.11.1","0.12.0","0.12.1","0.13.0","0.13.1","0.13.2","0.13.3","0.14.0","0.14.1","0.15.0","0.15.1","0.15.2","0.15.3","0.15.90","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.17.0","0.17.0rc1","0.17.1","0.17.2","0.17.3","0.17.4","0.17.5","0.8.7","0.8.9","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","0.9.9.1","2014.1.0","2014.1.0rc1","2014.1.0rc2","2014.1.0rc3","2014.1.1","2014.1.10","2014.1.11","2014.1.12","2014.1.13","2014.1.2","2014.1.3","2014.1.4","2014.1.5","2014.1.6","2014.1.7","2014.1.8","2014.1.9","2014.7.0","2014.7.0rc1","2014.7.0rc2","2014.7.0rc3","2014.7.0rc4","2014.7.0rc5","2014.7.0rc6","2014.7.0rc7","2014.7.1","2014.7.2","2014.7.3","2014.7.4","2014.7.5","2014.7.6","2014.7.7","2015.2.0rc1","2015.2.0rc2","2015.5.0","2015.5.1","2015.5.10","2015.5.11","2015.5.2","2015.5.3","2015.5.4","2015.5.5","2015.5.6","2015.5.7","2015.5.8","2015.5.9","2015.8.0","2015.8.0rc1","2015.8.0rc2","2015.8.0rc3","2015.8.0rc4","2015.8.0rc5","2015.8.1","2015.8.10","2015.8.11","2015.8.12","2015.8.13","2015.8.2","2015.8.3","2015.8.4","2015.8.5","2015.8.7","2015.8.8","2015.8.8.2","2015.8.9","2016.11.0","2016.11.0rc1","2016.11.0rc2","2016.11.1","2016.11.10","2016.11.2","2016.11.3","2016.11.4","2016.11.5","2016.11.6","2016.11.7","2016.11.8","2016.11.9","2016.3.0","2016.3.0rc2","2016.3.0rc3","2016.3.1","2016.3.2","2016.3.3","2016.3.4","2016.3.5","2016.3.6","2016.3.7","2016.3.8","2017.7.0","2017.7.0rc1","2017.7.1","2017.7.2","2017.7.3","2017.7.4","2017.7.5","2017.7.6","2017.7.7","2017.7.8","2018.3.0","2018.3.0rc1","2018.3.1","2018.3.2","2018.3.3"]}],"products":[{"vendor":"salt project","product":"salt"},{"vendor":"saltstack","product":"salt"},{"vendor":"saltstack","product":"salt_2018"},{"vendor":"saltstack","product":"salt_2019"}],"references":[{"url":"https://github.com/saltstack/salt/blob/f22de0887cd7167887f113bf394244b74fb36b6b/salt/modules/mysql.py#L1534","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://github.com/ShantonRU/salt/commit/a46c86a987c78e74e87969d8d3b27094e6544b7a","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","web","fix"]},{"url":"https://github.com/saltstack/salt/pull/51462","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010259","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2019-119.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-h8xp-h3jf-wv4v","tags":["advisory"]},{"url":"https://github.com/saltstack/salt","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2019-1010259","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1010259","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-1010259","description":"SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.user_chpass function from the MySQL module for Salt. The attack vector is: specially crafted password string. The fixed version is: 2018.3.4.","status":"published","published":"2019-07-18T16:33:35Z","modified":"2024-08-05T03:07:18.507Z","updated_at":"2026-11-02T14:20:24.989116Z"}],"euvd":[{"id":"EUVD-2019-0127","description":"SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.user_chpass function from the MySQL module for Salt. The attack vector is: specially crafted password string. The fixed version is: 2018.3.4.","status":"published","published":"2019-07-18T16:33:35Z","modified":"2024-08-05T03:07:18Z","updated_at":"2026-11-03T02:40:19.294113Z"}],"ghsa":[{"id":"GHSA-h8xp-h3jf-wv4v","title":"SaltStack Salt SQL Injection vulnerability in mysql.user_chpass function","description":"SaltStack Salt 2018.3 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The `mysql.user_chpass` function from the MySQL module for Salt (https://github.com/saltstack/salt/blob/develop/salt/modules/mysql.py#L1462). The attack vector is: specially crafted password string. The fixed version is: 2018.3.4.","status":"published","published":"2022-05-24T16:50:39Z","modified":"2024-10-25T20:20:14Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:38:13.09489Z"}],"nvd":[{"id":"CVE-2019-1010259","description":"SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.user_chpass function from the MySQL module for Salt. The attack vector is: specially crafted password string. The fixed version is: 2018.3.4.","status":"published","published":"2019-07-18T17:15:11.567Z","modified":"2026-06-17T02:09:55.26Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:05:20.616405Z"}],"osv":[{"id":"GHSA-h8xp-h3jf-wv4v","title":"SaltStack Salt SQL Injection vulnerability in mysql.user_chpass function","description":"SaltStack Salt 2018.3 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The `mysql.user_chpass` function from the MySQL module for Salt (https://github.com/saltstack/salt/blob/develop/salt/modules/mysql.py#L1462). The attack vector is: specially crafted password string. The fixed version is: 2018.3.4.","status":"published","published":"2022-05-24T16:50:39Z","modified":"2024-10-25T20:25:14.913483Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:48.920784Z"},{"id":"UBUNTU-CVE-2019-1010259","description":"SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.user_chpass function from the MySQL module for Salt. The attack vector is: specially crafted password string. The fixed version is: 2018.3.4.","status":"withdrawn","published":"2019-07-18T17:15:00Z","modified":"2026-04-02T18:11:51.26742Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:18.772093Z"},{"id":"PYSEC-2019-119","description":"SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.user_chpass function from the MySQL module for Salt. The attack vector is: specially crafted password string. The fixed version is: 2018.3.4.","status":"published","published":"2019-07-18T17:15:00Z","modified":"2026-06-10T17:02:38.032434832Z","updated_at":"2026-11-02T15:52:52.192131Z"}]}}