These release notes are for an old release of Salt. This release might contain known security and other issues that are fixed in the latest release.
Salt 3002.1 Release Notes¶
Version 3002.1 is a CVE fix release for 3002.
Fixed¶
Prevent shell injections in netapi ssh client (cve-2020-16846)
Prevent creating world readable private keys with the tls execution module. (cve-2020-17490)
Properly validate eauth credentials and tokens along with their ACLs. Prior to this change eauth was not properly validated when calling Salt ssh via the salt-api. Any value for 'eauth' or 'token' would allow a user to bypass authentication and make calls to Salt ssh. (CVE-2020-25592)
Generated on October 23, 2024 at 09:06:04 UTC.
You are viewing docs built from a recent snapshot of the master branch. Switch to docs for the latest stable release, 3007.1.
