An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blacklisted directory.
{
"binaries": [
{
"binary_name": "salt-common",
"binary_version": "0.17.5+ds-1ubuntu0.1~esm4"
},
{
"binary_name": "salt-master",
"binary_version": "0.17.5+ds-1ubuntu0.1~esm4"
},
{
"binary_name": "salt-minion",
"binary_version": "0.17.5+ds-1ubuntu0.1~esm4"
},
{
"binary_name": "salt-ssh",
"binary_version": "0.17.5+ds-1ubuntu0.1~esm4"
},
{
"binary_name": "salt-syndic",
"binary_version": "0.17.5+ds-1ubuntu0.1~esm4"
}
]
}
{
"binaries": [
{
"binary_name": "salt-api",
"binary_version": "2017.7.4+dfsg1-1ubuntu18.04.2+esm1"
},
{
"binary_name": "salt-cloud",
"binary_version": "2017.7.4+dfsg1-1ubuntu18.04.2+esm1"
},
{
"binary_name": "salt-common",
"binary_version": "2017.7.4+dfsg1-1ubuntu18.04.2+esm1"
},
{
"binary_name": "salt-master",
"binary_version": "2017.7.4+dfsg1-1ubuntu18.04.2+esm1"
},
{
"binary_name": "salt-minion",
"binary_version": "2017.7.4+dfsg1-1ubuntu18.04.2+esm1"
},
{
"binary_name": "salt-proxy",
"binary_version": "2017.7.4+dfsg1-1ubuntu18.04.2+esm1"
},
{
"binary_name": "salt-ssh",
"binary_version": "2017.7.4+dfsg1-1ubuntu18.04.2+esm1"
},
{
"binary_name": "salt-syndic",
"binary_version": "2017.7.4+dfsg1-1ubuntu18.04.2+esm1"
}
],
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}
{
"binaries": [
{
"binary_name": "salt-api",
"binary_version": "3004.1+dfsg-2"
},
{
"binary_name": "salt-cloud",
"binary_version": "3004.1+dfsg-2"
},
{
"binary_name": "salt-common",
"binary_version": "3004.1+dfsg-2"
},
{
"binary_name": "salt-master",
"binary_version": "3004.1+dfsg-2"
},
{
"binary_name": "salt-minion",
"binary_version": "3004.1+dfsg-2"
},
{
"binary_name": "salt-proxy",
"binary_version": "3004.1+dfsg-2"
},
{
"binary_name": "salt-ssh",
"binary_version": "3004.1+dfsg-2"
},
{
"binary_name": "salt-syndic",
"binary_version": "3004.1+dfsg-2"
}
]
}