Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-17490

CVE-2020-17490: SaltStack Salt Allows creating certificates with weak file permissions

5.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-17490
GHSA ID
GHSA-3c56-vx6v-q5vh
EPSS Score
0.11221%
CWE
CWE-732
Published
5/24/2022
Updated
10/22/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
saltpip< 2015.8.132015.8.13
saltpip>= 2016.3.0, < 2016.3.82016.3.8
saltpip>= 2016.11.0, < 2016.11.102016.11.10
saltpip>= 2017.5.0, < 2017.7.82017.7.8
saltpip>= 2018.2.0, < 2018.3.52018.3.5
saltpip>= 2019.2.0, < 2019.2.62019.2.6
saltpip>= 3000, < 3000.43000.4
saltpip>= 3001, < 3001.23001.2
saltpip>= 3002, < 3002.13002.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability documentation explicitly references the TLS execution module's certificate creation functions (create_ca, create_csr, create_self_signed_cert) as failing to set proper permissions. Multiple security advisories (Debian DLA 2480-1, Gentoo GLSA 202011-13) and SaltStack's own release notes for patched versions directly link these functions to the weak file permission issue. The CWE-732 classification matches the pattern of improper permission assignment in certificate generation workflows.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

T** TLS mo*ul* wit*in S*ltSt**k S*lt t*rou** **** *r**t*s **rti*i**t*s wit* w**k *il* p*rmissions.

Reasoning

T** vuln*r**ility *o*um*nt*tion *xpli*itly r***r*n**s t** TLS *x**ution mo*ul*'s **rti*i**t* *r**tion *un*tions (*r**t*_**, *r**t*_*sr, *r**t*_s*l*_si*n**_**rt) *s **ilin* to s*t prop*r p*rmissions. Multipl* s**urity **visori*s (***i*n *L* ****-*, **