CVE-2020-35662: 
Python vulnerability analysis and mitigation

In SaltStack Salt before version 3002.5, a security vulnerability was identified where SSL certificates were not consistently validated when authenticating to services using certain modules. This vulnerability was assigned CVE-2020-35662 and was publicly disclosed in February 2021 (Salt Project).

The vulnerability stems from insufficient SSL certificate validation mechanisms in certain SaltStack Salt modules when authenticating to services. The issue received a CVSS v3.1 Base Score of 7.4 (High), with attack vector being Network-based, high attack complexity, requiring no privileges or user interaction, and potentially impacting both confidentiality and integrity (Ubuntu CVE).

The vulnerability could allow an attacker to potentially intercept or manipulate communication between Salt components and external services due to improper SSL certificate validation. This could lead to unauthorized access to sensitive information or potential manipulation of data in transit (Red Hat CVE).

The vulnerability requires network access and high attack complexity to exploit. While the attack requires no privileges or user interaction, the complexity of the attack somewhat mitigates the risk (Ubuntu CVE).

The vulnerability was addressed in SaltStack Salt version 3002.5. Users are advised to upgrade to this version or later to resolve the issue. Multiple distributions have released security updates, including Debian (2016.11.2+ds-1+deb9u7), Fedora (3002.5-1), and Ubuntu (various versions) (Debian LTS, Fedora Update).