CVE-2020-28243

An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blacklisted directory.
Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 80%
Affected Products (NVD)
VendorProductVersion
saltstacksalt
𝑥
< 2015.8.10
saltstacksalt
2015.8.11 ≤
𝑥
< 2015.8.13
saltstacksalt
2016.3.0 ≤
𝑥
< 2016.3.4
saltstacksalt
2016.3.5 ≤
𝑥
< 2016.3.6
saltstacksalt
2016.3.7 ≤
𝑥
< 2016.3.8
saltstacksalt
2016.3.9 ≤
𝑥
< 2016.11.3
saltstacksalt
2016.11.4 ≤
𝑥
< 2016.11.5
saltstacksalt
2016.11.7 ≤
𝑥
< 2016.11.10
saltstacksalt
2017.5.0 ≤
𝑥
< 2017.7.8
saltstacksalt
2018.2.0 ≤
𝑥
≤ 2018.3.5
saltstacksalt
2019.2.0 ≤
𝑥
< 2019.2.5
saltstacksalt
2019.2.6 ≤
𝑥
< 2019.2.8
saltstacksalt
3000 ≤
𝑥
< 3000.6
saltstacksalt
3001 ≤
𝑥
< 3001.4
saltstacksalt
3002 ≤
𝑥
< 3002.5
debiandebian_linux
9.0
debiandebian_linux
10.0
debiandebian_linux
11.0
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
salt
bionic
Fixed 2017.7.4+dfsg1-1ubuntu18.04.2+esm1
released
focal
dne
groovy
ignored
hirsute
ignored
impish
ignored
jammy
needs-triage
kinetic
ignored
lunar
dne
mantic
dne
noble
dne
trusty
needs-triage
xenial
not-affected
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
python2-salt-3000
suse enterprise server 15
5.106.1
fixed
suse enterprise server 15 SP1
24.1
fixed
python3-salt
suse enterprise desktop 15 SP3
3002.2-6.1
fixed
suse enterprise desktop 15 SP5
3005.1-150500.2.13
fixed
suse enterprise desktop 15 SP6
3006.0-150500.4.29.1
fixed
suse enterprise sap 15 SP3
3002.2-6.1
fixed
suse enterprise sap 15 SP5
3005.1-150500.2.13
fixed
suse enterprise sap 15 SP6
3006.0-150500.4.29.1
fixed
suse enterprise server 15 SP3
3002.2-6.1
fixed
suse enterprise server 15 SP5
3005.1-150500.2.13
fixed
suse enterprise server 15 SP6
3006.0-150500.4.29.1
fixed
python3-salt-3000
suse enterprise desktop 15 SP2
24.1
fixed
suse enterprise sap 15 SP2
24.1
fixed
suse enterprise server 15
5.106.1
fixed
suse enterprise server 15 SP1
24.1
fixed
suse enterprise server 15 SP2
24.1
fixed
python3-salt-3004
suse enterprise desktop 15 SP4
150400.6.16
fixed
suse enterprise sap 15 SP4
150400.6.16
fixed
suse enterprise server 15 SP4
150400.6.16
fixed
salt
suse enterprise desktop 15 SP3
3002.2-6.1
fixed
suse enterprise desktop 15 SP5
3005.1-150500.2.13
fixed
suse enterprise desktop 15 SP6
3006.0-150500.4.29.1
fixed
suse enterprise sap 15 SP3
3002.2-6.1
fixed
suse enterprise sap 15 SP5
3005.1-150500.2.13
fixed
suse enterprise sap 15 SP6
3006.0-150500.4.29.1
fixed
suse enterprise server 15 SP3
3002.2-6.1
fixed
suse enterprise server 15 SP5
3005.1-150500.2.13
fixed
suse enterprise server 15 SP6
3006.0-150500.4.29.1
fixed
salt-3000
suse enterprise desktop 15 SP2
24.1
fixed
suse enterprise sap 15 SP2
24.1
fixed
suse enterprise server 15
5.106.1
fixed
suse enterprise server 15 SP1
24.1
fixed
suse enterprise server 15 SP2
24.1
fixed
salt-3004
suse enterprise desktop 15 SP4
150400.6.16
fixed
suse enterprise sap 15 SP4
150400.6.16
fixed
suse enterprise server 15 SP4
150400.6.16
fixed
salt-api
suse enterprise sap 15 SP3
3002.2-6.1
fixed
suse enterprise server 15 SP3
3002.2-6.1
fixed
salt-api-3000
suse enterprise sap 15 SP2
24.1
fixed
suse enterprise server 15
5.106.1
fixed
suse enterprise server 15 SP1
24.1
fixed
suse enterprise server 15 SP2
24.1
fixed
salt-api-3004
suse enterprise sap 15 SP4
150400.6.16
fixed
suse enterprise server 15 SP4
150400.6.16
fixed
salt-bash-completion
suse enterprise desktop 15 SP3
3002.2-6.1
fixed
suse enterprise desktop 15 SP5
3005.1-150500.2.13
fixed
suse enterprise desktop 15 SP6
3006.0-150500.4.29.1
fixed
suse enterprise sap 15 SP3
3002.2-6.1
fixed
suse enterprise sap 15 SP5
3005.1-150500.2.13
fixed
suse enterprise sap 15 SP6
3006.0-150500.4.29.1
fixed
suse enterprise server 15 SP3
3002.2-6.1
fixed
suse enterprise server 15 SP5
3005.1-150500.2.13
fixed
suse enterprise server 15 SP6
3006.0-150500.4.29.1
fixed
salt-bash-completion-3000
suse enterprise desktop 15 SP2
24.1
fixed
suse enterprise sap 15 SP2
24.1
fixed
suse enterprise server 15
5.106.1
fixed
suse enterprise server 15 SP1
24.1
fixed
suse enterprise server 15 SP2
24.1
fixed
salt-bash-completion-3004
suse enterprise desktop 15 SP4
150400.6.16
fixed
suse enterprise sap 15 SP4
150400.6.16
fixed
suse enterprise server 15 SP4
150400.6.16
fixed
salt-cloud
suse enterprise sap 15 SP3
3002.2-6.1
fixed
suse enterprise server 15 SP3
3002.2-6.1
fixed
salt-cloud-3000
suse enterprise sap 15 SP2
24.1
fixed
suse enterprise server 15
5.106.1
fixed
suse enterprise server 15 SP1
24.1
fixed
suse enterprise server 15 SP2
24.1
fixed
salt-cloud-3004
suse enterprise sap 15 SP4
150400.6.16
fixed
suse enterprise server 15 SP4
150400.6.16
fixed
salt-doc
suse enterprise desktop 15 SP3
3002.2-6.1
fixed
suse enterprise desktop 15 SP5
3005.1-150500.2.13
fixed
suse enterprise desktop 15 SP6
3006.0-150500.4.29.1
fixed
suse enterprise sap 15 SP3
3002.2-6.1
fixed
suse enterprise sap 15 SP5
3005.1-150500.2.13
fixed
suse enterprise sap 15 SP6
3006.0-150500.4.29.1
fixed
suse enterprise server 15 SP3
3002.2-6.1
fixed
suse enterprise server 15 SP5
3005.1-150500.2.13
fixed
suse enterprise server 15 SP6
3006.0-150500.4.29.1
fixed
salt-doc-3000
suse enterprise desktop 15 SP2
24.1
fixed
suse enterprise sap 15 SP2
24.1
fixed
suse enterprise server 15
5.106.1
fixed
suse enterprise server 15 SP1
24.1
fixed
suse enterprise server 15 SP2
24.1
fixed
salt-doc-3004
suse enterprise desktop 15 SP4
150400.6.16
fixed
suse enterprise sap 15 SP4
150400.6.16
fixed
suse enterprise server 15 SP4
150400.6.16
fixed
salt-fish-completion
suse enterprise sap 15 SP3
3002.2-6.1
fixed
suse enterprise server 15 SP3
3002.2-6.1
fixed
salt-fish-completion-3000
suse enterprise sap 15 SP2
24.1
fixed
suse enterprise server 15
5.106.1
fixed
suse enterprise server 15 SP1
24.1
fixed
suse enterprise server 15 SP2
24.1
fixed
salt-fish-completion-3004
suse enterprise sap 15 SP4
150400.6.16
fixed
suse enterprise server 15 SP4
150400.6.16
fixed
salt-master
suse enterprise sap 15 SP3
3002.2-6.1
fixed
suse enterprise server 15 SP3
3002.2-6.1
fixed
salt-master-3000
suse enterprise sap 15 SP2
24.1
fixed
suse enterprise server 15
5.106.1
fixed
suse enterprise server 15 SP1
24.1
fixed
suse enterprise server 15 SP2
24.1
fixed
salt-master-3004
suse enterprise sap 15 SP4
150400.6.16
fixed
suse enterprise server 15 SP4
150400.6.16
fixed
salt-minion
suse enterprise desktop 15 SP3
3002.2-6.1
fixed
suse enterprise desktop 15 SP5
3005.1-150500.2.13
fixed
suse enterprise desktop 15 SP6
3006.0-150500.4.29.1
fixed
suse enterprise sap 15 SP3
3002.2-6.1
fixed
suse enterprise sap 15 SP5
3005.1-150500.2.13
fixed
suse enterprise sap 15 SP6
3006.0-150500.4.29.1
fixed
suse enterprise server 15 SP3
3002.2-6.1
fixed
suse enterprise server 15 SP5
3005.1-150500.2.13
fixed
suse enterprise server 15 SP6
3006.0-150500.4.29.1
fixed
salt-minion-3000
suse enterprise desktop 15 SP2
24.1
fixed
suse enterprise sap 15 SP2
24.1
fixed
suse enterprise server 15
5.106.1
fixed
suse enterprise server 15 SP1
24.1
fixed
suse enterprise server 15 SP2
24.1
fixed
salt-minion-3004
suse enterprise desktop 15 SP4
150400.6.16
fixed
suse enterprise sap 15 SP4
150400.6.16
fixed
suse enterprise server 15 SP4
150400.6.16
fixed
salt-proxy
suse enterprise sap 15 SP3
3002.2-6.1
fixed
suse enterprise server 15 SP3
3002.2-6.1
fixed
salt-proxy-3000
suse enterprise sap 15 SP2
24.1
fixed
suse enterprise server 15
5.106.1
fixed
suse enterprise server 15 SP1
24.1
fixed
suse enterprise server 15 SP2
24.1
fixed
salt-proxy-3004
suse enterprise sap 15 SP4
150400.6.16
fixed
suse enterprise server 15 SP4
150400.6.16
fixed
salt-ssh
suse enterprise sap 15 SP3
3002.2-6.1
fixed
suse enterprise server 15 SP3
3002.2-6.1
fixed
salt-ssh-3000
suse enterprise sap 15 SP2
24.1
fixed
suse enterprise server 15
5.106.1
fixed
suse enterprise server 15 SP1
24.1
fixed
suse enterprise server 15 SP2
24.1
fixed
salt-ssh-3004
suse enterprise sap 15 SP4
150400.6.16
fixed
suse enterprise server 15 SP4
150400.6.16
fixed
salt-standalone-formulas-configuration
suse enterprise sap 15 SP3
3002.2-6.1
fixed
suse enterprise server 15 SP3
3002.2-6.1
fixed
salt-standalone-formulas-configuration-3000
suse enterprise sap 15 SP2
24.1
fixed
suse enterprise server 15
5.106.1
fixed
suse enterprise server 15 SP1
24.1
fixed
suse enterprise server 15 SP2
24.1
fixed
salt-standalone-formulas-configuration-3004
suse enterprise sap 15 SP4
150400.6.16
fixed
suse enterprise server 15 SP4
150400.6.16
fixed
salt-syndic
suse enterprise sap 15 SP3
3002.2-6.1
fixed
suse enterprise server 15 SP3
3002.2-6.1
fixed
salt-syndic-3000
suse enterprise sap 15 SP2
24.1
fixed
suse enterprise server 15
5.106.1
fixed
suse enterprise server 15 SP1
24.1
fixed
suse enterprise server 15 SP2
24.1
fixed
salt-syndic-3004
suse enterprise sap 15 SP4
150400.6.16
fixed
suse enterprise server 15 SP4
150400.6.16
fixed
salt-zsh-completion
suse enterprise desktop 15 SP3
3002.2-6.1
fixed
suse enterprise desktop 15 SP5
3005.1-150500.2.13
fixed
suse enterprise desktop 15 SP6
3006.0-150500.4.29.1
fixed
suse enterprise sap 15 SP3
3002.2-6.1
fixed
suse enterprise sap 15 SP5
3005.1-150500.2.13
fixed
suse enterprise sap 15 SP6
3006.0-150500.4.29.1
fixed
suse enterprise server 15 SP3
3002.2-6.1
fixed
suse enterprise server 15 SP5
3005.1-150500.2.13
fixed
suse enterprise server 15 SP6
3006.0-150500.4.29.1
fixed
salt-zsh-completion-3000
suse enterprise desktop 15 SP2
24.1
fixed
suse enterprise sap 15 SP2
24.1
fixed
suse enterprise server 15
5.106.1
fixed
suse enterprise server 15 SP1
24.1
fixed
suse enterprise server 15 SP2
24.1
fixed
salt-zsh-completion-3004
suse enterprise desktop 15 SP4
150400.6.16
fixed
suse enterprise sap 15 SP4
150400.6.16
fixed
suse enterprise server 15 SP4
150400.6.16
fixed
Common Weakness Enumeration
References
https://github.com/stealthcopter/CVE-2020-28243
https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html
https://lists.debian.org/debian-lts-announce/2022/01/msg00000.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/
https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/
https://sec.stealthcopter.com/cve-2020-28243/
https://security.gentoo.org/glsa/202103-01
https://security.gentoo.org/glsa/202310-22
https://www.debian.org/security/2021/dsa-5011
https://github.com/stealthcopter/CVE-2020-28243
https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html
https://lists.debian.org/debian-lts-announce/2022/01/msg00000.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/
https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/
https://sec.stealthcopter.com/cve-2020-28243/
https://security.gentoo.org/glsa/202103-01
https://security.gentoo.org/glsa/202310-22
https://www.debian.org/security/2021/dsa-5011