Description
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- https://github.com/saltstack/salt/releases ↗
- https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/ ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/ ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/ ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/ ↗
- https://security.gentoo.org/glsa/202103-01 ↗
- https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html ↗
- https://www.debian.org/security/2021/dsa-5011 ↗
- https://security.gentoo.org/glsa/202310-22 ↗