An issue was discovered in SaltStack Salt through 3002.
Priority CRITICAL 100Exploited in the wildCWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-78.
Summary
An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.
Why it matters now
Exploitation Active In CISA KEV since 2021-11-03CISA due date 2022-05-03
EPSS 0.99585 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial salt (PyPI): 2015.8.13, 2016.3.8, 2016.11.10 +6Red Hat: 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | salt (PyPI) | before 2015.8.13 | 2015.8.13 | Patch available | GHSA-qr38-h96j-2j3w |
| — | salt (PyPI) | 2016.3.0 to before 2016.3.8 | 2016.3.8 | Patch available | GHSA-qr38-h96j-2j3w |
| — | salt (PyPI) | 2016.11.0 to before 2016.11.10 | 2016.11.10 | Patch available | GHSA-qr38-h96j-2j3w |
| — | salt (PyPI) | 2017.5.0 to before 2017.7.8 | 2017.7.8 | Patch available | GHSA-qr38-h96j-2j3w |
| — | salt (PyPI) | 2018.2.0 to before 2018.3.5 | 2018.3.5 | Patch available | GHSA-qr38-h96j-2j3w |
| — | salt (PyPI) | 2019.2.0 to before 2019.2.6 | 2019.2.6 | Patch available | GHSA-qr38-h96j-2j3w |
| — | salt (PyPI) | 3000.0 to before 3000.4 | 3000.4 | Patch available | GHSA-qr38-h96j-2j3w |
| — | salt (PyPI) | 3001 to before 3001.2 | 3001.2 | Patch available | GHSA-qr38-h96j-2j3w |
| — | salt (PyPI) | 3002 to before 3002.1 | 3002.1 | Patch available | GHSA-qr38-h96j-2j3w |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- salt (PyPI) Vendor— Affected before 2015.8.13 Fixed in 2015.8.13 Patch available GHSA-qr38-h96j-2j3w
- salt (PyPI) Vendor— Affected 2016.3.0 to before 2016.3.8 Fixed in 2016.3.8 Patch available GHSA-qr38-h96j-2j3w
- salt (PyPI) Vendor— Affected 2016.11.0 to before 2016.11.10 Fixed in 2016.11.10 Patch available GHSA-qr38-h96j-2j3w
- salt (PyPI) Vendor— Affected 2017.5.0 to before 2017.7.8 Fixed in 2017.7.8 Patch available GHSA-qr38-h96j-2j3w
- salt (PyPI) Vendor— Affected 2018.2.0 to before 2018.3.5 Fixed in 2018.3.5 Patch available GHSA-qr38-h96j-2j3w
- salt (PyPI) Vendor— Affected 2019.2.0 to before 2019.2.6 Fixed in 2019.2.6 Patch available GHSA-qr38-h96j-2j3w
- salt (PyPI) Vendor— Affected 3000.0 to before 3000.4 Fixed in 3000.4 Patch available GHSA-qr38-h96j-2j3w
- salt (PyPI) Vendor— Affected 3001 to before 3001.2 Fixed in 3001.2 Patch available GHSA-qr38-h96j-2j3w
- salt (PyPI) Vendor— Affected 3002 to before 3002.1 Fixed in 3002.1 Patch available GHSA-qr38-h96j-2j3w
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:* | before 2015.8.10; 2015.8.11 to before 2015.8.13; 2016.3.0 to before 2016.3.4; 2016.3.5 to before 2016.3.6; 2016.3.7 to before 2016.3.8; 2016.11.0 to before 2016.11.3; 2016.11.4 to before 2016.11.6; 2016.11.7 to before 2016.11.10; 2017.5.0 to before 2017.7.4; 2017.7.5 to before 2017.7.8; 2018.2.0 to before 2018.3.5; 2019.2.0 to before 2019.2.5; 3000.0 to before 3000.3 | Vulnerable | SaltStack |
| cpe:2.3:a:saltstack:salt:3001:*:*:*:*:*:*:* | 3001 | Vulnerable | SaltStack |
| cpe:2.3:a:saltstack:salt:3002:*:*:*:*:*:*:* | 3002 | Vulnerable | SaltStack |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* | 31 | Vulnerable | Fedoraproject |
| cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* | 15.1 | Vulnerable | openSUSE |
- cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:* Versions before 2015.8.10; 2015.8.11 to before 2015.8.13; 2016.3.0 to before 2016.3.4; 2016.3.5 to before 2016.3.6; 2016.3.7 to before 2016.3.8; 2016.11.0 to before 2016.11.3; 2016.11.4 to before 2016.11.6; 2016.11.7 to before 2016.11.10; 2017.5.0 to before 2017.7.4; 2017.7.5 to before 2017.7.8; 2018.2.0 to before 2018.3.5; 2019.2.0 to before 2019.2.5; 3000.0 to before 3000.3 Vulnerable ·SaltStack
- cpe:2.3:a:saltstack:salt:3001:*:*:*:*:*:*:* Versions 3001 Vulnerable ·SaltStack
- cpe:2.3:a:saltstack:salt:3002:*:*:*:*:*:*:* Versions 3002 Vulnerable ·SaltStack
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
Remediation
- Fix · GHSA-qr38-h96j-2j3w salt (PyPI) Fixed in 2015.8.13 Advisory →
- Fix · GHSA-qr38-h96j-2j3w salt (PyPI) Fixed in 2016.3.8 Advisory →
- Fix · GHSA-qr38-h96j-2j3w salt (PyPI) Fixed in 2016.11.10 Advisory →
- Fix · GHSA-qr38-h96j-2j3w salt (PyPI) Fixed in 2017.7.8 Advisory →
- Fix · GHSA-qr38-h96j-2j3w salt (PyPI) Fixed in 2018.3.5 Advisory →
- Fix · GHSA-qr38-h96j-2j3w salt (PyPI) Fixed in 2019.2.6 Advisory →
- Fix · GHSA-qr38-h96j-2j3w salt (PyPI) Fixed in 3000.4 Advisory →
- Fix · GHSA-qr38-h96j-2j3w salt (PyPI) Fixed in 3001.2 Advisory →
- Fix · GHSA-qr38-h96j-2j3w salt (PyPI) Fixed in 3002.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ceph Storage 2 | Affected | No fix planned: Will not fix |
Timeline
- 2021-11-03 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2020-16846
- 2026-10-03 Alias added: GHSA-qr38-h96j-2j3w
References
Exploit 1
Advisory 13
- https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/
- FEDORA-2020-9e040bd6dd
- openSUSE-SU-2020:1868
- GLSA-202011-13
- https://www.zerodayinitiative.com/advisories/ZDI-20-1381/
- https://www.zerodayinitiative.com/advisories/ZDI-20-1383/
- https://www.zerodayinitiative.com/advisories/ZDI-20-1380/
- https://www.zerodayinitiative.com/advisories/ZDI-20-1379/
- https://www.zerodayinitiative.com/advisories/ZDI-20-1382/
- [debian-lts-announce] 20201204 [SECURITY] [DLA 2480-1] salt security update
- DSA-4837
- [debian-lts-announce] 20220103 [SECURITY] [DLA 2480-2] salt regression update
- https://nvd.nist.gov/vuln/detail/CVE-2020-16846
Other 16
- https://github.com/saltstack/salt/releases
- https://www.zerodayinitiative.com/advisories/ZDI-20-1383
- https://www.zerodayinitiative.com/advisories/ZDI-20-1382
- https://www.zerodayinitiative.com/advisories/ZDI-20-1381
- https://www.zerodayinitiative.com/advisories/ZDI-20-1380
- https://www.zerodayinitiative.com/advisories/ZDI-20-1379
- https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-16846
- https://lists.fedoraproject.org/archives/list/[email protected]/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA
- https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3002.1.rst#L12
- https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3001.2.rst#L10
- https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3000.4.rst#L10
- https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/2019.2.6.rst#L10
- https://github.com/saltstack/salt
- https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2020-104.yaml
More SaltStack Salt vulnerabilities
- TI-2020-09349 An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. KEVCVSS 3.1CRITICAL 9.8
- TI-2021-07530 An issue was discovered in through SaltStack Salt before 3002.5. CVSS 3.1CRITICAL 9.8
- TI-2020-09350 An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. KEVCVSS 3.1MEDIUM 6.5
- TI-2021-07531 An issue was discovered in through SaltStack Salt before 3002.5. CVSS 3.1CRITICAL 9.1
- TI-2021-12769 Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute… CVSS 3.1CRITICAL 9.8
- TI-2021-02271 An issue was discovered in SaltStack Salt before 3002.5. CVSS 3.1CRITICAL 9.8
Sources
- CVE-2020-16846 · CVE Program
- CVE-2020-16846 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-qr38-h96j-2j3w · GitHub Advisory Database · CC BY 4.0
- CVE-2020-16846 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences