GHSA-h8xp-h3jf-wv4v

Suggest an improvement
Source
https://github.com/advisories/GHSA-h8xp-h3jf-wv4v
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-h8xp-h3jf-wv4v/GHSA-h8xp-h3jf-wv4v.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-h8xp-h3jf-wv4v
Aliases
Published
2022-05-24T16:50:39Z
Modified
2024-10-25T20:25:14Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
SaltStack Salt SQL Injection vulnerability in mysql.user_chpass function
Details

SaltStack Salt 2018.3 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.user_chpass function from the MySQL module for Salt (https://github.com/saltstack/salt/blob/develop/salt/modules/mysql.py#L1462). The attack vector is: specially crafted password string. The fixed version is: 2018.3.4.

Database specific 
{
    "cwe_ids":  [
        "CWE-89"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-04-22T22:33:06Z",
    "nvd_published_at":  "2019-07-18T17:15:00Z",
    "severity":  "CRITICAL"
}
References

Affected packages

PyPI / salt

Package

Name
salt
View open source insights on deps.dev
Purl
pkg:pypi/salt

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2018.3.0
Fixed
2018.3.4

Affected versions

2018.*
2018.3.0
2018.3.1
2018.3.2
2018.3.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-h8xp-h3jf-wv4v/GHSA-h8xp-h3jf-wv4v.json"