CVE-2019-1010259: SaltStack Salt SQL Injection vulnerability in mysql.user_chpass function
(updated )
SaltStack Salt 2018.3 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.user_chpass function from the MySQL module for Salt (https://github.com/saltstack/salt/blob/develop/salt/modules/mysql.py#L1462). The attack vector is: specially crafted password string. The fixed version is: 2018.3.4.
References
- github.com/ShantonRU/salt/commit/a46c86a987c78e74e87969d8d3b27094e6544b7a
- github.com/advisories/GHSA-h8xp-h3jf-wv4v
- github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2019-119.yaml
- github.com/saltstack/salt
- github.com/saltstack/salt/blob/f22de0887cd7167887f113bf394244b74fb36b6b/salt/modules/mysql.py
- github.com/saltstack/salt/pull/51462
- nvd.nist.gov/vuln/detail/CVE-2019-1010259
Code Behaviors & Features
Detect and mitigate CVE-2019-1010259 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →