CVE-2020-28972: 
Python vulnerability analysis and mitigation

CVE-2020-28972 affects SaltStack Salt versions before 3002.5, specifically impacting the authentication mechanism to VMware vcenter, vsphere, and esxi servers in the vmware.py files. The vulnerability was disclosed in February 2021 and affects multiple versions of the Salt software across various operating systems including Debian, Fedora, and Gentoo distributions (NVD, Debian LTS).

The vulnerability is characterized by improper certificate validation (CWE-295) where the authentication process to VMware services does not consistently validate SSL/TLS certificates. The National Vulnerability Database assigned it a CVSS v3.1 Base Score of 5.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating network accessibility with high attack complexity and potential for high confidentiality impact (NVD).

The failure to properly validate SSL/TLS certificates could allow a remote attacker to potentially spoof a trusted entity and intercept sensitive communications between Salt and VMware services. This could lead to unauthorized access to confidential information transmitted during these authentication sessions (Gentoo Security).

The vulnerability requires network access and has high attack complexity. While no specific exploits in the wild have been publicly documented, the nature of the vulnerability makes it exploitable by attackers who can position themselves in a man-in-the-middle position between Salt and VMware services (NVD).

The vulnerability has been patched in Salt version 3002.5 and corresponding distribution-specific versions. Users are advised to upgrade to the fixed versions: Debian users should upgrade to version 2016.11.2+ds-1+deb9u7 for Stretch, 2018.3.4+dfsg1-6+deb10u3 for Buster, and 3002.6+dfsg1-4+deb11u1 for Bullseye; Fedora users should upgrade to salt-3002.5-1 for Fedora 32, 33, and 34; and Gentoo users should upgrade to version 3000.8 or later (Debian Security, Fedora Update, Gentoo Security).