python>> salt-security-backports>> 返回
项目作者： rossengeorgiev

项目描述 ：
Salt security backports for CVE-2020-11651 & CVE-2020-11652
高级语言： Python
项目地址: git://github.com/rossengeorgiev/salt-security-backports.git
创建时间： 2020-05-01T20:53:49Z
项目社区：https://github.com/rossengeorgiev/salt-security-backports
开源协议：
下载


Official patches for previous versions can be requested at: https://www.saltstack.com/lp/request-patch-april-2020/

⚠ Patches here are custom, and may differ from official ones ⚠

Backported security patches for unsupported salt versions

Build Status

Patches in this repo address the following CVEs:

Additionally include the following bugfixes:

Above fixed are included in latest release of SaltStack, specifically v2019.2.5 and v3000.3.

Check if your salt-master is vulnerable

Check script needs to be ran locally on your salt-master as root

  1. python salt-cve-check.py

Example output for Salt 2017.7.8:

  1. [+] Salt version: 2017.7.8
  2. [ ] This version of salt is vulnerable! Check results below
  3. [+] Checking salt-master (127.0.0.1:4506) status... ONLINE
  4. [+] Checking if vulnerable to CVE-2020-11651... YES
  5. [+] Checking if vulnerable to CVE-2020-11652 (read_token)... YES
  6. [+] Checking if vulnerable to CVE-2020-11652 (read)... YES
  7. [+] Checking if vulnerable to CVE-2020-11652 (write1)... YES
  8. [+] Checking if vulnerable to CVE-2020-11652 (write2)... YES

Applying the patches

  1. # locate the salt package directory (use python3 if necessary)
  3. python -c "import imp; print(imp.find_module('salt')[1])"
  5. # in my case: /usr/lib/python2.7/dist-packages/salt
  6. # apply patches
  7. # (adding -b flag will backup file before modifications at same path with .orig suffix)
  8. # (patch can be reversed running the same command with -R flag)
  10. patch -p2 -d /usr/lib/python2.7/dist-packages/salt < 2017.7.8_CVE-2020-11651.patch
  11. patch -p2 -d /usr/lib/python2.7/dist-packages/salt < 2017.7.8_CVE-2020-11652.patch
  13. # restart salt-master
  15. systemctl restart salt-master
  16. # or
  17. service salt-master restart

Rerun the check script:

  1. user@salt # python salt-cve-check.py
  2. [+] Salt version: 2017.7.8
  3. [ ] This version of salt is vulnerable! Check results below
  4. [+] Checking salt-master (127.0.0.1:4506) status... ONLINE
  5. [+] Checking if vulnerable to CVE-2020-11651... NO
  6. [+] Checking if vulnerable to CVE-2020-11652 (read_token)... NO
  7. [+] Checking if vulnerable to CVE-2020-11652 (read)... NO
  8. [+] Checking if vulnerable to CVE-2020-11652 (write1)... NO
  9. [+] Checking if vulnerable to CVE-2020-11652 (write2)... NO