{"id":"CVE-2020-17490","aliases":["ALPINE-CVE-2020-17490","DLA-2480-1","DSA-4837-1","EUVD-2020-0174","GHSA-3c56-vx6v-q5vh","PYSEC-2020-105","SUSE-SU-2020:14538-1","SUSE-SU-2020:3155-1","SUSE-SU-2020:3171-1","SUSE-SU-2020:3235-1","SUSE-SU-2020:3243-1","SUSE-SU-2020:3244-1","SUSE-SU-2020:3245-1","SUSE-SU-2020:3250-1","SUSE-SU-2020:3251-1","UBUNTU-CVE-2020-17490","USN-6948-1","openSUSE-SU-2020:1833-1","openSUSE-SU-2020:1868-1"],"status":"published","title":"SaltStack Salt Allows creating certificates with weak file permissions","description":"The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00413,"percentile":0.35904,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-732"],"published":"2020-11-04T13:44:16Z","modified":"2026-11-03T06:31:41Z","fixes":[{"ecosystem":"PyPI","package":"salt","fixed_in":["2015.8.13","2016.3.8","2016.11.10","2017.7.8","2018.3.5","2019.2.6","3000.4","3001.2","3002.1","2015.8.10","2016.3.4","2016.3.6","2016.11.3","2016.11.6","2017.7.4","2019.2.5","3000.3"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.13","package":"salt","fixed_in":["3002-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"salt","fixed_in":["3002-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"salt","fixed_in":["3002-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"salt","fixed_in":["3002-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"salt","fixed_in":["3002-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"salt","fixed_in":["3002-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"salt","fixed_in":["3002-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"salt","fixed_in":["3002-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"salt","fixed_in":["3002-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"salt","fixed_in":["3002-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"salt","fixed_in":["3002-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"salt","fixed_in":["3002-r1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"salt","fixed_in":["2015.8.8+ds-1ubuntu0.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"salt","fixed_in":["2017.7.4+dfsg1-1ubuntu18.04.2+esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2015.8.13"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2016.3.0"},{"fixed":"2016.3.8"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2016.11.0"},{"fixed":"2016.11.10"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2017.5.0"},{"fixed":"2017.7.8"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2018.2.0"},{"fixed":"2018.3.5"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2019.2.0"},{"fixed":"2019.2.6"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3000"},{"fixed":"3000.4"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3001"},{"fixed":"3001.2"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3002"},{"fixed":"3002.1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2015.8.11"},{"fixed":"3002-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2015.8.11"},{"fixed":"3002-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2015.8.11"},{"fixed":"3002-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2015.8.11"},{"fixed":"3002-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2015.8.11"},{"fixed":"3002-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2015.8.11"},{"fixed":"3002-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2015.8.11"},{"fixed":"3002-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2015.8.11"},{"fixed":"3002-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2015.8.11"},{"fixed":"3002-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2015.8.11"},{"fixed":"3002-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2015.8.11"},{"fixed":"3002-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2015.8.11"},{"fixed":"3002-r1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.2+ds-1+deb9u6"}]}],"versions":["2016.11.2+ds-1","2016.11.2+ds-1+deb9u1","2016.11.2+ds-1+deb9u2","2016.11.2+ds-1+deb9u3","2016.11.2+ds-1+deb9u4","2016.11.2+ds-1+deb9u5"],"bundled":3},{"source":"osv","ecosystem":"Debian:10","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2018.3.4+dfsg1-6+deb10u2"}]}],"versions":["2018.3.4+dfsg1-6","2018.3.4+dfsg1-6+deb10u1"],"bundled":3},{"source":"osv","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2015.8.13"}]}],"versions":["0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.5","0.11.0","0.11.1","0.12.0","0.12.1","0.13.0","0.13.1","0.13.2","0.13.3","0.14.0","0.14.1","0.15.0","0.15.1","0.15.2","0.15.3","0.15.90","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.17.0","0.17.0rc1","0.17.1","0.17.2","0.17.3","0.17.4","0.17.5","0.8.7","0.8.9","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","0.9.9.1","2014.1.0","2014.1.0rc1","2014.1.0rc2","2014.1.0rc3","2014.1.1","2014.1.10","2014.1.11","2014.1.12","2014.1.13","2014.1.2","2014.1.3","2014.1.4","2014.1.5","2014.1.6","2014.1.7","2014.1.8","2014.1.9","2014.7.0","2014.7.0rc1","2014.7.0rc2","2014.7.0rc3","2014.7.0rc4","2014.7.0rc5","2014.7.0rc6","2014.7.0rc7","2014.7.1","2014.7.2","2014.7.3","2014.7.4","2014.7.5","2014.7.6","2014.7.7","2015.2.0rc1","2015.2.0rc2","2015.5.0","2015.5.1","2015.5.10","2015.5.11","2015.5.2","2015.5.3","2015.5.4","2015.5.5","2015.5.6","2015.5.7","2015.5.8","2015.5.9","2015.8.0","2015.8.0rc1","2015.8.0rc2","2015.8.0rc3","2015.8.0rc4","2015.8.0rc5","2015.8.1","2015.8.10","2015.8.11","2015.8.12","2015.8.2","2015.8.3","2015.8.4","2015.8.5","2015.8.7","2015.8.8","2015.8.8.2","2015.8.9"]},{"source":"osv","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2016.3.0"},{"fixed":"2016.3.8"}]}],"versions":["2016.3.0","2016.3.1","2016.3.2","2016.3.3","2016.3.4","2016.3.5","2016.3.6","2016.3.7"]},{"source":"osv","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2016.11.0"},{"fixed":"2016.11.10"}]}],"versions":["2016.11.0","2016.11.1","2016.11.2","2016.11.3","2016.11.4","2016.11.5","2016.11.6","2016.11.7","2016.11.8","2016.11.9"]},{"source":"osv","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2017.5.0"},{"fixed":"2017.7.8"}]}],"versions":["2017.7.0","2017.7.0rc1","2017.7.1","2017.7.2","2017.7.3","2017.7.4","2017.7.5","2017.7.6","2017.7.7"]},{"source":"osv","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2018.2.0"},{"fixed":"2018.3.5"}]}],"versions":["2018.3.0","2018.3.0rc1","2018.3.1","2018.3.2","2018.3.3","2018.3.4"]},{"source":"osv","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2019.2.0"},{"fixed":"2019.2.6"}]}],"versions":["2019.2.0","2019.2.1","2019.2.2","2019.2.3","2019.2.4","2019.2.5"]},{"source":"osv","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3000"},{"fixed":"3000.4"}]}],"versions":["3000","3000.1","3000.2","3000.3"]},{"source":"osv","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3001"},{"fixed":"3001.2"}]}],"versions":["3001","3001.1"]},{"source":"osv","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3002"},{"fixed":"3002.1"}]}],"versions":["3002"]},{"source":"osv","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2015.8.10"},{"introduced":"2015.8.11"},{"fixed":"2015.8.13"},{"introduced":"2016.3.0"},{"fixed":"2016.3.4"},{"introduced":"2016.3.5"},{"fixed":"2016.3.6"},{"introduced":"2016.3.7"},{"fixed":"2016.3.8"},{"introduced":"2016.11.0"},{"fixed":"2016.11.3"},{"introduced":"2016.11.4"},{"fixed":"2016.11.6"},{"introduced":"2016.11.7"},{"fixed":"2016.11.10"},{"introduced":"2017.7.0"},{"fixed":"2017.7.4"},{"introduced":"2017.7.5"},{"fixed":"2017.7.8"},{"introduced":"2018.3.0rc1"},{"fixed":"2018.3.5"},{"introduced":"2019.2.0"},{"fixed":"2019.2.5"},{"introduced":"3000"},{"fixed":"3000.3"}]}],"versions":["0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.5","0.11.0","0.11.1","0.12.0","0.12.1","0.13.0","0.13.1","0.13.2","0.13.3","0.14.0","0.14.1","0.15.0","0.15.1","0.15.2","0.15.3","0.15.90","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.17.0","0.17.0rc1","0.17.1","0.17.2","0.17.3","0.17.4","0.17.5","0.8.7","0.8.9","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","0.9.9.1","2014.1.0","2014.1.0rc1","2014.1.0rc2","2014.1.0rc3","2014.1.1","2014.1.10","2014.1.11","2014.1.12","2014.1.13","2014.1.2","2014.1.3","2014.1.4","2014.1.5","2014.1.6","2014.1.7","2014.1.8","2014.1.9","2014.7.0","2014.7.0rc1","2014.7.0rc2","2014.7.0rc3","2014.7.0rc4","2014.7.0rc5","2014.7.0rc6","2014.7.0rc7","2014.7.1","2014.7.2","2014.7.3","2014.7.4","2014.7.5","2014.7.6","2014.7.7","2015.2.0rc1","2015.2.0rc2","2015.5.0","2015.5.1","2015.5.10","2015.5.11","2015.5.2","2015.5.3","2015.5.4","2015.5.5","2015.5.6","2015.5.7","2015.5.8","2015.5.9","2015.8.0","2015.8.0rc1","2015.8.0rc2","2015.8.0rc3","2015.8.0rc4","2015.8.0rc5","2015.8.1","2015.8.11","2015.8.12","2015.8.2","2015.8.3","2015.8.4","2015.8.5","2015.8.7","2015.8.8","2015.8.8.2","2015.8.9","2016.11.0","2016.11.1","2016.11.2","2016.11.4","2016.11.5","2016.11.7","2016.11.8","2016.11.9","2016.3.0","2016.3.1","2016.3.2","2016.3.3","2016.3.5","2016.3.7","2017.7.0","2017.7.1","2017.7.2","2017.7.3","2017.7.5","2017.7.6","2017.7.7","2018.3.0","2018.3.0rc1","2018.3.1","2018.3.2","2018.3.3","2018.3.4","2019.2.0","2019.2.1","2019.2.2","2019.2.3","2019.2.4","3000","3000.1","3000.2"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-0.68.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"mgr-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.3-5.20.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.10-43.63.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.8-18.72.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.7-27.38.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-0.68.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"mgr-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.3-5.20.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.10-43.63.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.8-18.72.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.7-27.38.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000-4.20.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 2 15 SP2","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000-4.20.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP2","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000-4.20.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.4-48.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.1","package":"mgr-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.3-2.6.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.1","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.8-4.9.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.1","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.16-4.11.5"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.1","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.7-4.6.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.1","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.19-3.9.5"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.1","package":"susemanager-build-keys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.2-3.6.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"bind-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1603299886.60e4bcf-3.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"grafana-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.0-3.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"image-sync-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1602150122.f08af0a-3.6.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"prometheus-exporters-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0-3.16.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"prometheus-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.0-3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"pxe-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1602490840.4f32148-3.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"py26-compat-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.10-6.3.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"python-susemanager-retail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1602150122.f08af0a-3.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"salt-netapi-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.0-15.7.5"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"saltboot-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1602150122.f08af0a-3.6.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.8-4.9.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.7-3.6.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.16-4.11.5"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-branding","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.11-3.9.6"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.7-4.6.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.22-3.16.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-search","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.3-3.3.7"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.19-3.9.5"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.21-3.11.6"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-build-keys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.2-3.6.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-doc-indexes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-11.17.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-11.17.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.15-3.11.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.17-3.13.6"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000-6.51.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 2 15 SP1","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000-6.51.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP1","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000-6.51.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000-5.91.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000-5.91.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000-5.91.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000-5.91.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000-46.114.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Advanced Systems Management 12","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000-46.114.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 12 SP2","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000-46.114.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.2","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000-46.114.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000-46.114.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"py26-compat-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.10-10.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.39-3.45.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"py26-compat-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.10-6.41.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.78.31-3.56.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.16.0-1","0.16.4-2","0.17.1+dfsg-1","0.17.2-1","0.17.2-2","0.17.2-3","0.17.4-1","0.17.4-2","0.17.5-1","0.17.5+ds-1","0.17.5+ds-1ubuntu0.1~esm1","0.17.5+ds-1ubuntu0.1~esm2","0.17.5+ds-1ubuntu0.1~esm4","0.17.5+ds-1ubuntu0.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2015.8.8+ds-1ubuntu0.1+esm2"}]}],"versions":["2015.5.3+ds-1","2015.8.1+ds-2","2015.8.3+ds-1","2015.8.3+ds-2","2015.8.3+ds-3","2015.8.5+ds-1","2015.8.7+ds-1","2015.8.8+ds-1","2015.8.8+ds-1ubuntu0.1~esm1","2015.8.8+ds-1ubuntu0.1","2015.8.8+ds-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017.7.4+dfsg1-1ubuntu18.04.2+esm1"}]}],"versions":["2016.11.5+ds-1","2016.11.8+dfsg1-1","2017.7.2+dfsg1-2ubuntu1","2017.7.3+dfsg1-1","2017.7.4+dfsg1-1","2017.7.4+dfsg1-1ubuntu18.04.1","2017.7.4+dfsg1-1ubuntu18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2015.8.8+ds-1ubuntu0.1+esm2"}]}],"versions":["2015.5.3+ds-1","2015.8.1+ds-2","2015.8.3+ds-1","2015.8.3+ds-2","2015.8.3+ds-3","2015.8.5+ds-1","2015.8.7+ds-1","2015.8.8+ds-1","2015.8.8+ds-1ubuntu0.1~esm1","2015.8.8+ds-1ubuntu0.1","2015.8.8+ds-1ubuntu0.1+esm1"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017.7.4+dfsg1-1ubuntu18.04.2+esm1"}]}],"versions":["2016.11.5+ds-1","2016.11.8+dfsg1-1","2017.7.2+dfsg1-2ubuntu1","2017.7.3+dfsg1-1","2017.7.4+dfsg1-1","2017.7.4+dfsg1-1ubuntu18.04.1","2017.7.4+dfsg1-1ubuntu18.04.2"],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000-lp152.3.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000-lp151.5.30.1"}]}],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"saltstack","product":"salt"}],"references":[{"url":"https://docs.saltstack.com/en/latest/topics/releases/index.html#latest-branch-release","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","advisory","web"]},{"url":"https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","article","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.gentoo.org/glsa/202011-13","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/12/msg00007.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://www.debian.org/security/2021/dsa-4837","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-17490","tags":["advisory"]},{"url":"https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/2019.2.6.rst#L10","tags":["web"]},{"url":"https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3000.4.rst#L10","tags":["web"]},{"url":"https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3001.2.rst#L10","tags":["web"]},{"url":"https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3002.1.rst#L13","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2020-105.yaml","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA","tags":["web"]},{"url":"https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3c56-vx6v-q5vh","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-17490","tags":["advisory"]},{"url":"https://github.com/saltstack/salt","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-202014538-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1167907","tags":["report"]},{"url":"https://bugzilla.suse.com/1169664","tags":["report"]},{"url":"https://bugzilla.suse.com/1176978","tags":["report"]},{"url":"https://bugzilla.suse.com/1178319","tags":["report"]},{"url":"https://bugzilla.suse.com/1178361","tags":["report"]},{"url":"https://bugzilla.suse.com/1178362","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-16846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17490","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25592","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203155-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1159670","tags":["report"]},{"url":"https://bugzilla.suse.com/1175987","tags":["report"]},{"url":"https://bugzilla.suse.com/1176024","tags":["report"]},{"url":"https://bugzilla.suse.com/1176294","tags":["report"]},{"url":"https://bugzilla.suse.com/1176397","tags":["report"]},{"url":"https://bugzilla.suse.com/1177867","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203171-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203235-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1144447","tags":["report"]},{"url":"https://bugzilla.suse.com/1173199","tags":["report"]},{"url":"https://bugzilla.suse.com/1175843","tags":["report"]},{"url":"https://bugzilla.suse.com/1175876","tags":["report"]},{"url":"https://bugzilla.suse.com/1176159","tags":["report"]},{"url":"https://bugzilla.suse.com/1176307","tags":["report"]},{"url":"https://bugzilla.suse.com/1176413","tags":["report"]},{"url":"https://bugzilla.suse.com/1176603","tags":["report"]},{"url":"https://bugzilla.suse.com/1176629","tags":["report"]},{"url":"https://bugzilla.suse.com/1176765","tags":["report"]},{"url":"https://bugzilla.suse.com/1177092","tags":["report"]},{"url":"https://bugzilla.suse.com/1177235","tags":["report"]},{"url":"https://bugzilla.suse.com/1177396","tags":["report"]},{"url":"https://bugzilla.suse.com/1177478","tags":["report"]},{"url":"https://bugzilla.suse.com/1177524","tags":["report"]},{"url":"https://bugzilla.suse.com/1177730","tags":["report"]},{"url":"https://bugzilla.suse.com/1177790","tags":["report"]},{"url":"https://bugzilla.suse.com/1177892","tags":["report"]},{"url":"https://bugzilla.suse.com/1178060","tags":["report"]},{"url":"https://bugzilla.suse.com/1178145","tags":["report"]},{"url":"https://bugzilla.suse.com/1178204","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15168","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203243-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1178485","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203244-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203245-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203250-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203251-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-17490","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-17490","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6948-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-16846","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-25592","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-28243","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-28972","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-35662","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3148","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3197","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-25281","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-25282","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-25283","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-25284","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2W22H3YLCTB3S3UBN7YRWYRBMUPL5V5B/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MB6DQ7QYY2NFKZFWBCHEOJR44RYJQMSN/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-17490","description":"The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.","status":"published","published":"2020-11-06T07:29:11Z","modified":"2024-08-04T14:00:47.533Z","updated_at":"2026-11-02T14:35:54.468882Z"}],"euvd":[{"id":"EUVD-2020-0174","description":"The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.","status":"published","published":"2020-11-06T07:29:11Z","modified":"2024-08-04T14:00:47Z","updated_at":"2026-11-03T03:07:26.951665Z"}],"ghsa":[{"id":"GHSA-3c56-vx6v-q5vh","title":"SaltStack Salt Allows creating certificates with weak file permissions","description":"The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.","status":"published","published":"2022-05-24T17:33:17Z","modified":"2024-10-22T14:54:10Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:38:12.325695Z"}],"nvd":[{"id":"CVE-2020-17490","description":"The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.","status":"published","published":"2020-11-06T08:15:13.347Z","modified":"2026-06-17T02:59:00.787Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:06:21.80969Z"}],"osv":[{"id":"ALPINE-CVE-2020-17490","description":"The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.","status":"published","published":"2020-11-06T08:15:13.347Z","modified":"2026-11-03T06:31:41.758665621Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T07:18:15.355745Z"},{"id":"CVE-2020-17490","description":"The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.","status":"published","published":"2020-11-06T08:15:13.347Z","modified":"2026-10-24T10:31:00.98818043Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:15.212689Z"},{"id":"GHSA-3c56-vx6v-q5vh","title":"SaltStack Salt Allows creating certificates with weak file permissions","description":"The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.","status":"published","published":"2022-05-24T17:33:17Z","modified":"2024-10-22T15:01:10.323086Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T15:46:35.406455Z"},{"id":"UBUNTU-CVE-2020-17490","description":"The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.","status":"published","published":"2020-11-06T08:15:00Z","modified":"2026-04-08T13:33:24.04665Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:23.344108Z"},{"id":"DLA-2480-1","title":"salt - security update","status":"published","published":"2020-12-04T00:00:00Z","modified":"2026-03-09T01:22:24.984186Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-4837-1","title":"salt - security update","status":"published","published":"2021-01-24T00:00:00Z","modified":"2026-03-09T02:10:40.342124Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"openSUSE-SU-2020:1833-1","title":"Security update for salt","description":"This update for salt fixes the following issues:\n\n- Properly validate eauth credentials and tokens on SSH calls made by Salt API \n  (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846)\n- Fix disk.blkid to avoid unexpected keyword argument '__pub_user'. (bsc#1177867)\n- Ensure virt.update stop_on_reboot is updated with its default value.\n- Do not break package building for systemd OSes.\n- Drop wrong mock from chroot unit test.\n- Support systemd versions with dot. (bsc#1176294)\n- Fix for grains.test_core unit test.\n- Fix file/directory user and group ownership containing UTF-8 characters. (bsc#1176024)\n- Several changes to virtualization:\n  * Fix virt update when cpu and memory are changed.\n  * Memory Tuning GSoC.\n  * Properly fix memory setting regression in virt.update.\n  * Expose libvirt on_reboot in virt states.\n- Support transactional systems (MicroOS).\n- zypperpkg module ignores retcode 104 for search(). (bsc#1159670)\n- Xen disk fixes. No longer generates volumes for Xen disks, but the corresponding\n  file or block disk. (bsc#1175987)\n- Invalidate file list cache when cache file modified time is in the future. (bsc#1176397)\n- Prevent import errors when running test_btrfs unit tests.\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2020-11-05T13:34:46Z","modified":"2025-05-07T18:11:45.297882Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:1868-1","title":"Security update for salt","description":"This update for salt fixes the following issues:\n\n- Avoid regression on 'salt-master': set passphrase for salt-ssh keys to empty string (bsc#1178485)\n- Properly validate eauth credentials and tokens on SSH calls made by Salt API \n  (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846)\n- Fix disk.blkid to avoid unexpected keyword argument '__pub_user'. (bsc#1177867)\n- Ensure virt.update stop_on_reboot is updated with its default value.\n- Do not break package building for systemd OSes.\n- Drop wrong mock from chroot unit test.\n- Support systemd versions with dot. (bsc#1176294)\n- Fix for grains.test_core unit test.\n- Fix file/directory user and group ownership containing UTF-8 characters. (bsc#1176024)\n- Several changes to virtualization:\n  * Fix virt update when cpu and memory are changed.\n  * Memory Tuning GSoC.\n  * Properly fix memory setting regression in virt.update.\n  * Expose libvirt on_reboot in virt states.\n- Support transactional systems (MicroOS).\n- zypperpkg module ignores retcode 104 for search(). (bsc#1159670)\n- Xen disk fixes. No longer generates volumes for Xen disks, but the corresponding file or block disk. (bsc#1175987)\n- Invalidate file list cache when cache file modified time is in the future. (bsc#1176397)\n- Prevent import errors when running test_btrfs unit tests\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2020-11-07T09:55:37Z","modified":"2026-02-04T03:06:16.508609Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"PYSEC-2020-105","description":"The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.","status":"published","published":"2020-11-06T08:15:00Z","modified":"2026-06-10T17:02:38.480617662Z","updated_at":"2026-11-02T15:52:52.192131Z"},{"id":"SUSE-SU-2020:14538-1","title":"Security update for SUSE Manager Client Tools","description":"\nThis update fixes the following issues:\n\ncobbler:\n\n- Fix parsing cobbler dictionary options with values containing '=', e.g. kernel params containing '=' (bsc#1176978)\n\nmgr-daemon:\n\n- Update translation strings\n\nsalt:\n\n- Properly validate eauth credentials and tokens on SSH calls made by Salt API \n  (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846)\n\nspacecmd:\n\n- Python3 fixes for errata in spacecmd (bsc#1169664)\n- Added support for i18n of user-facing strings\n- Python3 fix for sorted usage (bsc#1167907)\n\nspacewalk-client-tools:\n\n- Remove RH references in Python/Ruby localization and use the product name instead\n\n","status":"published","published":"2020-11-06T15:59:37Z","modified":"2026-02-04T03:55:51.620738Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:3155-1","title":"Security update for salt","description":"This update for salt fixes the following issues:\n\n- Properly validate eauth credentials and tokens on SSH calls made by Salt API \n  (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846)\n- Fix disk.blkid to avoid unexpected keyword argument '__pub_user'. (bsc#1177867)\n- Ensure virt.update stop_on_reboot is updated with its default value.\n- Do not break package building for systemd OSes.\n- Drop wrong mock from chroot unit test.\n- Support systemd versions with dot. (bsc#1176294)\n- Fix for grains.test_core unit test.\n- Fix file/directory user and group ownership containing UTF-8 characters. (bsc#1176024)\n- Several changes to virtualization:\n  * Fix virt update when cpu and memory are changed.\n  * Memory Tuning GSoC.\n  * Properly fix memory setting regression in virt.update.\n  * Expose libvirt on_reboot in virt states.\n- Support transactional systems (MicroOS).\n- zypperpkg module ignores retcode 104 for search(). (bsc#1159670)\n- Xen disk fixes. No longer generates volumes for Xen disks, but the corresponding\n  file or block disk. (bsc#1175987)\n- Invalidate file list cache when cache file modified time is in the future. (bsc#1176397)\n- Prevent import errors when running test_btrfs unit tests.\n","status":"published","published":"2020-11-04T13:44:16Z","modified":"2026-02-04T03:30:29.876748Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:3171-1","title":"Security update for salt","description":"This update for salt fixes the following issues:\n\n- Fix for CVE-2020-25592 (bsc#1178319), CVE-2020-16846, (bsc#1178361), and CVE-2020-17490 (bsc#1178362).\n","status":"published","published":"2020-11-05T13:43:04Z","modified":"2026-02-04T03:19:08.035251Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:3235-1","title":"Security update for SUSE Manager Server 4.1","description":"\nThis update fixes the following issues:\n\nbind-formula:\n\n- Temporarily disable dnssec-validation as hotfix for bsc#1177790\n\ngrafana-formula:\n\n- Use variable for product name\n- Add HA/SAP dashboards\n- Add support for system groups in Client Systems dashboard\n\nimage-sync-formula:\n\n- Do not use .gz suffix for default initrd symlink\n- Keep the old symlink 'initrd.gz' for compatibility\n\nprometheus-exporters-formula:\n\n- Fix empty directory values initialization\n- Add systemd collector as default for node_exporters\n  since otherwise some SAP/HA grafana dashboards will be empty\n- Disable reverse proxy on default\n\nprometheus-formula:\n\n- Disable Alertmanager clustering (bsc#1178145)\n- Use variable for product name\n\npxe-formula:\n\n- Change default to 'initrd' without .gz suffix\n\npy26-compat-salt:\n\n- Properly validate eauth credentials and tokens on SSH calls made by Salt API \n  (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846)\n\npython-susemanager-retail:\n\n- Use name 'initrd' without .gz suffix\n\nsalt-netapi-client:\n\n- Version 0.18.0\n  See: https://github.com/SUSE/salt-netapi-client/releases/tag/v0.18.0\n\nsaltboot-formula:\n\n- Allow setting terminal kernel parameters in saltboot formula\n\nspacecmd:\n\n- Python3 fixes for errata in spacecmd (bsc#1169664)\n- Added support for i18n of user-facing strings\n- Python3 fix for sorted usage (bsc#1167907)\n\nspacewalk-admin:\n\n- Show info message when applying schema upgrade\n\nspacewalk-backend:\n\n- Prevent IntegrityError during mgr-inter-sync execution (bsc#1177235)\n\nspacewalk-branding:\n\n- Enable to switch to multiple webUI theme\n\nspacewalk-client-tools:\n\n- Remove RH references in Python/Ruby localization and use the product name instead\n\nspacewalk-java:\n\n- Use correct eauth module and credentials for Salt SSH calls (bsc#1178319)\n- Remove expiration date from ics files (bsc#1177892)\n- Execute Salt SSH actions in parallel (bsc#1173199)\n- Enable to switch to multiple webUI theme\n- Fix action chain resuming when patches updating salt-minion don't cause service to be\n  restarted (bsc#1144447)\n- Renaming autoinstall distro didn't change the name of the Cobbler distro (bsc#1175876)\n- Fix the links for downloading the binaries in the package details UI (bsc#1176603)\n- Allow nightly ISS sync to also cover custom channels\n- Fix: reinspecting a container image (bsc#1177092)\n- Add power management xmlrpc api\n- Remove hostname from /var/lib/salt/.ssh/known_hosts when deleting system (bsc#1176159)\n- Log exception trace on fatal Taskomatic startup error\n- Fix max password length check at user creation (bsc#1176765)\n- Notify about missing libvirt or hypervisor on virtual host\n- Redesign maintenance schedule systems table to use paginated data from server\n- Fix SP migration after dry run for cloned channels (bsc#1176307)\n- Filter not available optional channels out\n\nspacewalk-search:\n\n- Change default maximum memory to 512 MB, preventing OutOfMemoryError\n\nspacewalk-web:\n\n- Enable to switch to multiple webUI theme\n- Only refresh the virtual storage list when pool events are received\n- Drop node-fetch to fix CVE-2020-15168\n- Notify about missing libvirt or hypervisor on virtual host\n- Redesign maintenance schedule systems table to use paginated data from server\n\nsusemanager:\n\n- Create bootstrap repo should not flush by default (bsc#1175843)\n- Improve detection of base channels for products (bsc#1177478)\n- Add LTSS PIDs for SLE12SP1, SLE12SP2, SLE12SP3 and SLE12SP4 to the bootstrap definitions as some packages from LTSS\n   are required (bsc#1177524)\n- Fix logrotate config\n- Add missing packages to ubuntu20.04 bootstrap data (bsc#1176629)\n\nsusemanager-build-keys:\n\n- Replace 'SuSE' user-facing references with 'SUSE'\n\nsusemanager-doc-indexes:\n\n- Documented zypper autorefresh feature in Upgrade Guide\n- Update SP Migration chapter in Client Configuration Guide \n- In Client Configuration and Upgrade Guide, add link to valid autoyast upgrade settings\n- Move client upgrade related sections from Reference and Upgrade Guide to Client Configuration Guide\n- Updated Requirements chapter in Installation Guide.  \n- Edits OpenSCAP section in Admin Guide (bsc#1176413)\n- Updated Terminology section in Salt Guide\n- Added on-demand images content to Install Guide\n- Adds webUI locale choice to Ref \u0026 Admin Guides\n- Adds new System Types section to Client Cfg\n- Updates supported client matrix in Install Guide\n- Add note about log file to Upgrade Guide \n- Removes outdated content from Activation Keys section (bsc#1177396)\n- Adds note about PAM Auth during migration (bsc#1177730)\n- Fixed broken table in admin guide\n\nsusemanager-docs_en:\n\n- Documented zypper autorefresh feature in Upgrade Guide\n- Update SP Migration chapter in Client Configuration Guide\n- In Client Configuration and Upgrade Guide, add link to valid autoyast upgrade settings\n- Move client upgrade related sections from Reference and Upgrade Guide to Client Configuration Guide\n- Updated Requirements chapter in Installation Guide.\n- Edits OpenSCAP section in Admin Guide (bsc#1176413)\n- Updated Terminology section in Salt Guide\n- Added on-demand images content to Install Guide\n- Adds webUI locale choice to Ref \u0026 Admin Guides\n- Adds new System Types section to Client Cfg\n- Updates supported client matrix in Install Guide\n- Add note about log file to Upgrade Guide\n- Removes outdated content from Activation Keys section (bsc#1177396)\n- Adds note about PAM Auth during migration (bsc#1177730)\n- Fixed broken table in admin guide \n\nsusemanager-schema:\n\n- Add web_theme user preferences column (bsc#1178204)\n- Execute Salt SSH actions in parallel (bsc#1173199)\n- Show info message when applying schema upgrade\n\nsusemanager-sls:\n\n- Fix action chain resuming when patches updating salt-minion don't cause service to be restarted (bsc#1144447)\n- Make grub2 autoinstall kernel path relative to the boot partition root (bsc#1175876)\n- Move channel token information from sources.list to auth.conf on Debian 10 and Ubuntu 18 and newer\n- Add support for activation keys on server configuration Salt modules\n- Ensure the yum/dnf plugins are enabled\n- Remove hostname from /var/lib/salt/.ssh/known_hosts when deleting system (bsc#1176159)\n- Fix grub2 autoinstall kernel path (bsc#1178060)\n\nHow to apply this update:\n1. Log in as root user to the SUSE Manager server.\n2. Stop the Spacewalk service:\nspacewalk-service stop\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Upgrade the database schema:\nspacewalk-schema-upgrade\n5. Start the Spacewalk service:\nspacewalk-service start\n","status":"published","published":"2020-11-06T15:55:37Z","modified":"2026-02-04T04:02:56.224665Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:3243-1","title":"Security update for salt","description":"This update for salt fixes the following issues:\n\n- Avoid regression on 'salt-master': set passphrase for salt-ssh keys to empty string (bsc#1178485)\n- Properly validate eauth credentials and tokens on SSH calls made by Salt API \n  (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846)\n- Fix disk.blkid to avoid unexpected keyword argument '__pub_user'. (bsc#1177867)\n- Ensure virt.update stop_on_reboot is updated with its default value.\n- Do not break package building for systemd OSes.\n- Drop wrong mock from chroot unit test.\n- Support systemd versions with dot. (bsc#1176294)\n- Fix for grains.test_core unit test.\n- Fix file/directory user and group ownership containing UTF-8 characters. (bsc#1176024)\n- Several changes to virtualization:\n  * Fix virt update when cpu and memory are changed.\n  * Memory Tuning GSoC.\n  * Properly fix memory setting regression in virt.update.\n  * Expose libvirt on_reboot in virt states.\n- Support transactional systems (MicroOS).\n- zypperpkg module ignores retcode 104 for search(). (bsc#1159670)\n- Xen disk fixes. No longer generates volumes for Xen disks, but the corresponding file or block disk. (bsc#1175987)\n- Invalidate file list cache when cache file modified time is in the future. (bsc#1176397)\n- Prevent import errors when running test_btrfs unit tests\n","status":"published","published":"2020-11-06T15:57:55Z","modified":"2026-02-04T03:45:17.599413Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:3244-1","title":"Security update for Salt","description":"\nThis update fixes the following issues:\n\nsalt:\n\n- Avoid regression on 'salt-master': set passphrase for salt-ssh keys to empty string (bsc#1178485)\n- Properly validate eauth credentials and tokens on SSH calls made by Salt API \n  (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846)\n- Fix disk.blkid to avoid unexpected keyword argument '__pub_user' (bsc#1177867)\n- Ensure virt.update stop_on_reboot is updated with its default value\n- Do not break package building for systemd OSes\n- Drop wrong mock from chroot unit test\n- Support systemd versions with dot (bsc#1176294)\n- Fix for grains.test_core unit test\n- Fix file/directory user and group ownership containing\n  UTF-8 characters (bsc#1176024)\n- Several changes to virtualization:\n  - Fix virt update when cpu and memory are changed\n  - Memory Tuning GSoC\n  - Properly fix memory setting regression in virt.update\n  - Expose libvirt on_reboot in virt states\n- Support transactional systems (MicroOS)\n- Zypperpkg module ignores retcode 104 for search() (bsc#1159670)\n- Xen disk fixes. No longer generates volumes for Xen disks, but the corresponding\n  file or block disk (bsc#1175987)\n- Invalidate file list cache when cache file modified time is in the future (bsc#1176397)\n- Prevent import errors when running test_btrfs unit tests\n\n","status":"published","published":"2020-11-06T15:58:23Z","modified":"2026-02-04T02:47:52.902213Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:3245-1","title":"Security update for Salt","description":"\nThis update fixes the following issues:\n\nsalt:\n\n- Fix disk.blkid to avoid unexpected keyword argument '__pub_user' (bsc#1177867)\n- Ensure virt.update stop_on_reboot is updated with its default value\n- Do not break package building for systemd OSes\n- Drop wrong mock from chroot unit test\n- Support systemd versions with dot (bsc#1176294)\n- Fix for grains.test_core unit test\n- Fix file/directory user and group ownership containing\n  UTF-8 characters (bsc#1176024)\n- Several changes to virtualization:\n  - Fix virt update when cpu and memory are changed\n  - Memory Tuning GSoC\n  - Properly fix memory setting regression in virt.update\n  - Expose libvirt on_reboot in virt states\n- Support transactional systems (MicroOS)\n- Zypperpkg module ignores retcode 104 for search() (bsc#1159670)\n- Xen disk fixes. No longer generates volumes for Xen disks, but the corresponding\n  file or block disk (bsc#1175987)\n- Invalidate file list cache when cache file modified time is in the future (bsc#1176397)\n- Prevent import errors when running test_btrfs unit tests\n- Properly validate eauth credentials and tokens on SSH calls made by Salt API \n  (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846)\n- Avoid regression on 'salt-master': set passphrase for salt-ssh keys to empty string (bsc#1178485)\n\n","status":"published","published":"2020-11-06T15:58:56Z","modified":"2026-02-04T03:54:06.600332Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:3250-1","title":"Security update for SUSE Manager 4.0","description":"This security update for SUSE Manager 4.0 provides the following fixes:\n\npy26-compat-salt:\n\n- Properly validate eauth credentials and tokens on SSH calls made by Salt API \n  (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846)\n\nspacewalk-java:\n\n- Use correct eauth module and credentials for Salt SSH calls. (bsc#1178319, CVE-2020-25592)\n","status":"published","published":"2020-11-06T16:03:24Z","modified":"2026-02-04T02:36:41.56586Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:3251-1","title":"Security update for SUSE Manager 3.2","description":"This security update for SUSE Manager 3.2 fixes the following issues:\n\npy26-compat-salt:\n\n- Properly validate eauth credentials and tokens on SSH calls made by Salt API \n  (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846)\n\nspacewalk-java:\n\n- Use correct eauth module and credentials for Salt SSH calls (bsc#1178319, CVE-2020-25592)\n","status":"published","published":"2020-11-06T16:03:37Z","modified":"2026-02-04T04:24:40.089914Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"USN-6948-1","title":"salt vulnerabilities","description":"It was discovered that Salt incorrectly handled crafted web requests.\nA remote attacker could possibly use this issue to run arbitrary\ncommands. (CVE-2020-16846)\n\nIt was discovered that Salt incorrectly created certificates with weak\nfile permissions. (CVE-2020-17490)\n\nIt was discovered that Salt incorrectly handled credential validation.\nA remote attacker could possibly use this issue to bypass authentication.\n(CVE-2020-25592)\n\nIt was discovered that Salt incorrectly handled crafted process names.\nAn attacker could possibly use this issue to run arbitrary commands.\nThis issue only affected Ubuntu 18.04 LTS. (CVE-2020-28243)\n\nIt was discovered that Salt incorrectly handled validation of SSL/TLS\ncertificates. A remote attacker could possibly use this issue to spoof\na trusted entity. (CVE-2020-28972, CVE-2020-35662)\n\nIt was discovered that Salt incorrectly handled credential validation.\nA remote attacker could possibly use this issue to run arbitrary code.\n(CVE-2021-25281)\n\nIt was discovered that Salt incorrectly handled crafted paths. A remote\nattacker could possibly use this issue to perform directory traversal.\n(CVE-2021-25282)\n\nIt was discovered that Salt incorrectly handled template rendering. A\nremote attacker could possibly this issue to run arbitrary code.\n(CVE-2021-25283)\n\nIt was discovered that Salt incorrectly handled logging. An attacker\ncould possibly use this issue to discover credentials. This issue only\naffected Ubuntu 18.04 LTS. (CVE-2021-25284)\n\nIt was discovered that Salt incorrectly handled crafted web requests.\nA remote attacker could possibly use this issue to run arbitrary\ncommands. This issue only affected Ubuntu 18.04 LTS. (CVE-2021-3148)\n\nIt was discovered that Salt incorrectly handled input sanitization.\nA remote attacker could possibly use this issue to run arbitrary\ncommands. (CVE-2021-3197)\n","status":"published","published":"2024-08-08T19:21:44Z","modified":"2026-06-25T13:32:28.878918772Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}