{"id":"CVE-2019-1010259","published":"2019-07-18T16:33:35Z","modified":"2024-08-05T03:07:18Z","title":"SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection","vendor":"SaltStack","product":"Salt","tier":"tail","description":{"text":"SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.user_chpass function from the MySQL module for Salt. The attack vector is: specially crafted password string. The fixed version is: 2018.3.4.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01898,"percentile":0.79573,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/saltstack/salt/blob/f22de0887cd7167887f113bf394244b74fb36b6b/salt/modules/mysql.py#L1534","tags":["x_refsource_MISC"]},{"url":"https://github.com/ShantonRU/salt/commit/a46c86a987c78e74e87969d8d3b27094e6544b7a","tags":["x_refsource_MISC"]},{"url":"https://github.com/saltstack/salt/pull/51462","tags":["x_refsource_MISC"]}],"priority":{"score":15.9,"factors":[{"name":"EPSS percentile","points":15.91}]},"vendorSlug":"saltstack","affectedVersions":[{"vendor":"SaltStack","product":"Salt","versions":["2018.3, 2019.2 [fixed: 2018.3.4]"]}],"affected":[{"ecosystem":"PyPI","package":"salt","vulnerableRanges":[">=2018.3.0, <2018.3.4","<2018.3.4"],"patched":["2018.3.4"],"from":["GHSA-h8xp-h3jf-wv4v","PYSEC-2019-119"],"provenance":"source"}],"euvd":{"id":"EUVD-2019-0127","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2017-14696","published":"2017-10-24","fixed":"2017.7.2","kev":false},{"cve":"CVE-2018-15750","published":"2018-10-24","fixed":"2018.3.3","kev":false,"link":{"from":"CVE-2018-15750","to":"CVE-2019-1010259","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:salt","fromFixed":"2018.3.3","toFixed":"2018.3.4","daysApart":267}]}},{"cve":"CVE-2018-15751","published":"2018-10-24","fixed":"2018.3.3","kev":false},{"cve":"CVE-2019-1010259","published":"2019-07-18","fixed":"2018.3.4","kev":false},{"cve":"CVE-2019-17361","published":"2020-01-17","fixed":"2019.2.3","kev":false},{"cve":"CVE-2020-11651","published":"2020-04-30","fixed":"3000.2","kev":true},{"cve":"CVE-2020-11652","published":"2020-04-30","fixed":"3000.2","kev":true}],"package":"PyPI:salt"}}