In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the vmware.py files) does not always valida

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• debian debian linux10.0
• debian debian linux11.0
• debian debian linux9.0
• fedoraproject fedora32
• fedoraproject fedora33
• fedoraproject fedora34
• saltstack salt2016.11.4 and later · before 2016.11.5
• saltstack salt2016.11.7 and later · before 2016.11.10
• saltstack salt2017.5.0 and later · before 2017.7.8
• saltstack salt2018.2.0 and later · up to 2018.3.5 inclusive
• saltstack saltbefore 2015.8.10
• saltstack salt2019.2.6 and later · before 2019.2.8
• saltstack salt3000 and later · before 3000.6
• saltstack salt3001 and later · before 3001.4
• saltstack salt3002 and later · before 3002.5
• saltstack salt2019.2.0 and later · before 2019.2.5
• saltstack salt2015.8.11 and later · before 2015.8.13
• saltstack salt2016.3.0 and later · before 2016.3.4
• saltstack salt2016.3.5 and later · before 2016.3.6
• saltstack salt2016.3.7 and later · before 2016.3.8

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2020-16846An issue was discovered in SaltStack Salt through 3002.KEV
  99Now
• CVE-2020-11651An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2.KEV
  98Now
• CVE-2020-11652An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2.KEV
  82Now
• CVE-2021-25282An issue was discovered in through SaltStack Salt before 3002.5.
  64This week
• CVE-2021-3197An issue was discovered in SaltStack Salt before 3002.5.
  61This week
• CVE-2021-25281An issue was discovered in through SaltStack Salt before 3002.5.
  61This week

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A certificate validation error is silently swallowed instead of terminating the connection. Often, code added for a test environment makes its way into production.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1override fun checkServerTrusted(chain: Array<X509Certificate>, type: String) {2  // Left empty for the test environment3}

1val client = OkHttpClient.Builder()2  .certificatePinner(3    CertificatePinner.Builder()4      .add("api.sirius.example", "sha256/…")5      .build()6  ).build()

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.