rossengeorgiev/salt-security-backportsBackports de seguridad de Salt para CVE-2020-11651 y CVE-2020-11652
Se pueden solicitar parches oficiales para versiones anteriores en: https://www.saltstack.com/lp/request-patch-april-2020/
⚠ Los parches aquí son personalizados y pueden diferir de los oficiales ⚠
Los parches en este repositorio abordan los siguientes CVEs:
Además, incluyen las siguientes correcciones de errores:
_minion_runner -> minion_runner. Ver: https://docs.saltstack.com/en/latest/topics/releases/3000.2.html#known-issue_find_file_and_stat -> _find_hash_and_stat. Ver run_func de la lista blancaimport salt.utils.verifyLas correcciones anteriores están incluidas en la última versión de SaltStack, específicamente v2019.2.5 y v3000.3.
El script de verificación debe ejecutarse localmente en tu salt-master como root
python salt-cve-check.py
Ejemplo de salida para Salt 2017.7.8:
[+] Salt version: 2017.7.8
[ ] This version of salt is vulnerable! Check results below
[+] Checking salt-master (127.0.0.1:4506) status... ONLINE
[+] Checking if vulnerable to CVE-2020-11651... YES
[+] Checking if vulnerable to CVE-2020-11652 (read_token)... YES
[+] Checking if vulnerable to CVE-2020-11652 (read)... YES
[+] Checking if vulnerable to CVE-2020-11652 (write1)... YES
[+] Checking if vulnerable to CVE-2020-11652 (write2)... YES
# locate the salt package directory (use python3 if necessary)
python -c "import imp; print(imp.find_module('salt')[1])"
# in my case: /usr/lib/python2.7/dist-packages/salt
# apply patches
# (adding -b flag will backup file before modifications at same path with .orig suffix)
# (patch can be reversed running the same command with -R flag)
patch -p2 -d /usr/lib/python2.7/dist-packages/salt < 2017.7.8_CVE-2020-11651.patch
patch -p2 -d /usr/lib/python2.7/dist-packages/salt < 2017.7.8_CVE-2020-11652.patch
# restart salt-master
systemctl restart salt-master
# or
service salt-master restart
Vuelve a ejecutar el script de verificación:
user@salt # python salt-cve-check.py
[+] Salt version: 2017.7.8
[ ] This version of salt is vulnerable! Check results below
[+] Checking salt-master (127.0.0.1:4506) status... ONLINE
[+] Checking if vulnerable to CVE-2020-11651... NO
[+] Checking if vulnerable to CVE-2020-11652 (read_token)... NO
[+] Checking if vulnerable to CVE-2020-11652 (read)... NO
[+] Checking if vulnerable to CVE-2020-11652 (write1)... NO
[+] Checking if vulnerable to CVE-2020-11652 (write2)... NO