The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.
Priority LOW 25CWE-732Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.
Why it matters now
EPSS 0.00413 35th percentileScored 2026-11-07
Fix Partial salt (PyPI): 2015.8.13, 2016.3.8, 2016.11.10 +6Red Hat: 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | salt (PyPI) | before 2015.8.13 | 2015.8.13 | Patch available | GHSA-3c56-vx6v-q5vh |
| — | salt (PyPI) | 2016.3.0 to before 2016.3.8 | 2016.3.8 | Patch available | GHSA-3c56-vx6v-q5vh |
| — | salt (PyPI) | 2016.11.0 to before 2016.11.10 | 2016.11.10 | Patch available | GHSA-3c56-vx6v-q5vh |
| — | salt (PyPI) | 2017.5.0 to before 2017.7.8 | 2017.7.8 | Patch available | GHSA-3c56-vx6v-q5vh |
| — | salt (PyPI) | 2018.2.0 to before 2018.3.5 | 2018.3.5 | Patch available | GHSA-3c56-vx6v-q5vh |
| — | salt (PyPI) | 2019.2.0 to before 2019.2.6 | 2019.2.6 | Patch available | GHSA-3c56-vx6v-q5vh |
| — | salt (PyPI) | 3000 to before 3000.4 | 3000.4 | Patch available | GHSA-3c56-vx6v-q5vh |
| — | salt (PyPI) | 3001 to before 3001.2 | 3001.2 | Patch available | GHSA-3c56-vx6v-q5vh |
| — | salt (PyPI) | 3002 to before 3002.1 | 3002.1 | Patch available | GHSA-3c56-vx6v-q5vh |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- salt (PyPI) Vendor— Affected before 2015.8.13 Fixed in 2015.8.13 Patch available GHSA-3c56-vx6v-q5vh
- salt (PyPI) Vendor— Affected 2016.3.0 to before 2016.3.8 Fixed in 2016.3.8 Patch available GHSA-3c56-vx6v-q5vh
- salt (PyPI) Vendor— Affected 2016.11.0 to before 2016.11.10 Fixed in 2016.11.10 Patch available GHSA-3c56-vx6v-q5vh
- salt (PyPI) Vendor— Affected 2017.5.0 to before 2017.7.8 Fixed in 2017.7.8 Patch available GHSA-3c56-vx6v-q5vh
- salt (PyPI) Vendor— Affected 2018.2.0 to before 2018.3.5 Fixed in 2018.3.5 Patch available GHSA-3c56-vx6v-q5vh
- salt (PyPI) Vendor— Affected 2019.2.0 to before 2019.2.6 Fixed in 2019.2.6 Patch available GHSA-3c56-vx6v-q5vh
- salt (PyPI) Vendor— Affected 3000 to before 3000.4 Fixed in 3000.4 Patch available GHSA-3c56-vx6v-q5vh
- salt (PyPI) Vendor— Affected 3001 to before 3001.2 Fixed in 3001.2 Patch available GHSA-3c56-vx6v-q5vh
- salt (PyPI) Vendor— Affected 3002 to before 3002.1 Fixed in 3002.1 Patch available GHSA-3c56-vx6v-q5vh
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:* | before 2015.8.10; 2015.8.11 to before 2015.8.13; 2016.3.0 to before 2016.3.4; 2016.3.5 to before 2016.3.6; 2016.3.7 to before 2016.3.8; 2016.11.0 to before 2016.11.3; 2016.11.4 to before 2016.11.6; 2016.11.7 to before 2016.11.10; 2017.5.0 to before 2017.7.4; 2017.7.5 to before 2017.7.8; 2018.2.0 to before 2018.3.5; 2019.2.0 to before 2019.2.5; 3000.0 to before 3000.3 | Vulnerable | SaltStack |
| cpe:2.3:a:saltstack:salt:3001:*:*:*:*:*:*:* | 3001 | Vulnerable | SaltStack |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
- cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:* Versions before 2015.8.10; 2015.8.11 to before 2015.8.13; 2016.3.0 to before 2016.3.4; 2016.3.5 to before 2016.3.6; 2016.3.7 to before 2016.3.8; 2016.11.0 to before 2016.11.3; 2016.11.4 to before 2016.11.6; 2016.11.7 to before 2016.11.10; 2017.5.0 to before 2017.7.4; 2017.7.5 to before 2017.7.8; 2018.2.0 to before 2018.3.5; 2019.2.0 to before 2019.2.5; 3000.0 to before 3000.3 Vulnerable ·SaltStack
- cpe:2.3:a:saltstack:salt:3001:*:*:*:*:*:*:* Versions 3001 Vulnerable ·SaltStack
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
Remediation
- Fix · GHSA-3c56-vx6v-q5vh salt (PyPI) Fixed in 2015.8.13 Advisory →
- Fix · GHSA-3c56-vx6v-q5vh salt (PyPI) Fixed in 2016.3.8 Advisory →
- Fix · GHSA-3c56-vx6v-q5vh salt (PyPI) Fixed in 2016.11.10 Advisory →
- Fix · GHSA-3c56-vx6v-q5vh salt (PyPI) Fixed in 2017.7.8 Advisory →
- Fix · GHSA-3c56-vx6v-q5vh salt (PyPI) Fixed in 2018.3.5 Advisory →
- Fix · GHSA-3c56-vx6v-q5vh salt (PyPI) Fixed in 2019.2.6 Advisory →
- Fix · GHSA-3c56-vx6v-q5vh salt (PyPI) Fixed in 3000.4 Advisory →
- Fix · GHSA-3c56-vx6v-q5vh salt (PyPI) Fixed in 3001.2 Advisory →
- Fix · GHSA-3c56-vx6v-q5vh salt (PyPI) Fixed in 3002.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ceph Storage 2 | Affected | No fix planned: Will not fix |
Timeline
- 2026-10-02 Threatist record created from CVE-2020-17490
- 2026-10-03 Alias added: GHSA-3c56-vx6v-q5vh
References
Advisory 8
- https://docs.saltstack.com/en/latest/topics/releases/index.html#latest-branch-release
- https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/
- FEDORA-2020-9e040bd6dd
- openSUSE-SU-2020:1868
- GLSA-202011-13
- [debian-lts-announce] 20201204 [SECURITY] [DLA 2480-1] salt security update
- DSA-4837
- https://nvd.nist.gov/vuln/detail/CVE-2020-17490
Other 8
- https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2020-105.yaml
- https://github.com/saltstack/salt
- https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/2019.2.6.rst#L10
- https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3000.4.rst#L10
- https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3001.2.rst#L10
- https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3002.1.rst#L13
- https://lists.fedoraproject.org/archives/list/[email protected]/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA
- https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves
Sources
- CVE-2020-17490 · CVE Program
- CVE-2020-17490 · NVD
- FIRST EPSS
- GHSA-3c56-vx6v-q5vh · GitHub Advisory Database · CC BY 4.0
- CVE-2020-17490 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences