지원되지 않는 salt 버전을 위한 백포트 보안 패치

이 저장소의 패치는 다음 CVE를 해결합니다:

CVE-2020-11651 & CVE-2020-11652 - https://labs.f-secure.com/advisories/saltstack-authorization-bypass

또한 다음 버그 수정 사항을 포함합니다:

_minion_runner -> minion_runner 오타 수정. 참조: https://docs.saltstack.com/en/latest/topics/releases/3000.2.html#known-issue
_find_file_and_stat -> _find_hash_and_stat 타입 수정. 참조: https://github.com/rossengeorgiev/salt-security-backports/issues/1
허용 목록(whitelist)에서 run_func 제거
누락된 import salt.utils.verify 추가

위 수정 사항은 SaltStack 최신 릴리스, 특히 v2019.2.5 및 v3000.3에 포함되어 있습니다.

salt-master 취약 여부 확인

확인 스크립트는 salt-master에서 root로 로컬에서 실행해야 합니다.

python salt-cve-check.py

Salt 2017.7.8의 예시 출력:

[+] Salt version: 2017.7.8
[ ] This version of salt is vulnerable! Check results below
[+] Checking salt-master (127.0.0.1:4506) status... ONLINE
[+] Checking if vulnerable to CVE-2020-11651... YES
[+] Checking if vulnerable to CVE-2020-11652 (read_token)... YES
[+] Checking if vulnerable to CVE-2020-11652 (read)... YES
[+] Checking if vulnerable to CVE-2020-11652 (write1)... YES
[+] Checking if vulnerable to CVE-2020-11652 (write2)... YES

패치 적용

# locate the salt package directory (use python3 if necessary)

python -c "import imp; print(imp.find_module('salt')[1])"

# in my case: /usr/lib/python2.7/dist-packages/salt
# apply patches
# (adding -b flag will backup file before modifications at same path with .orig suffix)
# (patch can be reversed running the same command with -R flag)

patch -p2 -d /usr/lib/python2.7/dist-packages/salt < 2017.7.8_CVE-2020-11651.patch
patch -p2 -d /usr/lib/python2.7/dist-packages/salt < 2017.7.8_CVE-2020-11652.patch

# restart salt-master

systemctl restart salt-master
# or
service salt-master restart

확인 스크립트를 다시 실행합니다:

user@salt # python salt-cve-check.py
[+] Salt version: 2017.7.8
[ ] This version of salt is vulnerable! Check results below
[+] Checking salt-master (127.0.0.1:4506) status... ONLINE
[+] Checking if vulnerable to CVE-2020-11651... NO
[+] Checking if vulnerable to CVE-2020-11652 (read_token)... NO
[+] Checking if vulnerable to CVE-2020-11652 (read)... NO
[+] Checking if vulnerable to CVE-2020-11652 (write1)... NO
[+] Checking if vulnerable to CVE-2020-11652 (write2)... NO

salt-security-backports

인기

지원되지 않는 salt 버전을 위한 백포트 보안 패치

salt-master 취약 여부 확인

패치 적용