rpm package
suse/image-sync-formula&distro=SUSE Manager Server Module 4.1
pkg:rpm/suse/image-sync-formula&distro=SUSE%20Manager%20Server%20Module%204.1
Vulnerabilities (6)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2020-25592 | — | < 0.1.1602150122.f08af0a-3.6.2 | 0.1.1602150122.f08af0a-3.6.2 | Nov 6, 2020 | In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH. | ||
| CVE-2020-17490 | — | < 0.1.1602150122.f08af0a-3.6.2 | 0.1.1602150122.f08af0a-3.6.2 | Nov 6, 2020 | The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions. | ||
| CVE-2020-16846 | — | KEV | < 0.1.1602150122.f08af0a-3.6.2 | 0.1.1602150122.f08af0a-3.6.2 | Nov 6, 2020 | An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection. | |
| CVE-2020-15168 | — | < 0.1.1602150122.f08af0a-3.6.2 | 0.1.1602150122.f08af0a-3.6.2 | Sep 10, 2020 | node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have | ||
| CVE-2020-13692 | — | < 0.1.1605087464.65d1b51-3.9.5 | 0.1.1605087464.65d1b51-3.9.5 | Jun 4, 2020 | PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE. | ||
| CVE-2020-11022 | Med | 6.9 | < 0.1.1595937550.0285244-3.3.6 | 0.1.1595937550.0285244-3.3.6 | Apr 29, 2020 | In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. |
- CVE-2020-25592Nov 6, 2020affected < 0.1.1602150122.f08af0a-3.6.2fixed 0.1.1602150122.f08af0a-3.6.2
In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH.
- CVE-2020-17490Nov 6, 2020affected < 0.1.1602150122.f08af0a-3.6.2fixed 0.1.1602150122.f08af0a-3.6.2
The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.
- affected < 0.1.1602150122.f08af0a-3.6.2fixed 0.1.1602150122.f08af0a-3.6.2
An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.
- CVE-2020-15168Sep 10, 2020affected < 0.1.1602150122.f08af0a-3.6.2fixed 0.1.1602150122.f08af0a-3.6.2
node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have
- CVE-2020-13692Jun 4, 2020affected < 0.1.1605087464.65d1b51-3.9.5fixed 0.1.1605087464.65d1b51-3.9.5
PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.
- affected < 0.1.1595937550.0285244-3.3.6fixed 0.1.1595937550.0285244-3.3.6
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.