CVE-2019-18897

CWE-597 documents5 sources
Severity
7.8HIGH
EPSS
0.1%
top 73.70%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Opensuse FactorySuse Suse Linux Enterprise Server 12Suse Suse Linux Enterprise Server 15+2 more
Timeline
PublishedMar 2
Latest updateMay 24

Description

A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of salt of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Factory allows local attackers to escalate privileges from user salt to root. This issue affects: SUSE Linux Enterprise Server 12 salt-master version 2019.2.0-46.83.1 and prior versions. SUSE Linux Enterprise Server 15 salt-master version 2019.2.0-6.21.1 and prior versions. openSUSE Factory salt-master version 2019.2.2-3.1 and prior version…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.5 | Impact: 5.9

Affected Packages5 packages

▶CVEListV5suse/suse_linux_enterprise_server_12salt-master — 2019.2.0-46.83.1
▶CVEListV5suse/suse_linux_enterprise_server_15salt-master — 2019.2.0-6.21.1
▶CVEListV5opensuse/factorysalt-master — 2019.2.2-3.1
▶NVDopensuse/leap15.1

🔴Vulnerability Details

2
GHSA
GHSA-p48p-8wh6-cj6f: A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of salt of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; o↗2022-05-24
▶
CVEList
Local privilege escalation from user salt to root↗2020-03-02
▶

📋Vendor Advisories

1
Red Hat
salt: symlink following in salt allows for privilege escalalation↗2019-11-21
▶

💬Community

3
Bugzilla
CVE-2019-18897 salt: symlink following in salt allows for privilege escalalation [fedora-all]↗2020-03-06
▶
Bugzilla
CVE-2019-18897 salt: symlink following in salt allows for privilege escalalation [epel-all]↗2020-03-06
▶
Bugzilla
CVE-2019-18897 salt: symlink following in salt allows for privilege escalalation↗2020-03-06
▶