Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
69 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
PyPI salt >= 3006.12, < 3006.17; >= 3007.4, < 3007.9
Fixed in
3006.173007.9· Vendor fix available
Issue
Salt contains an authentication protocol version downgrade weakness that can allow a malicious minion to bypass newer authentication/security features by using an older request payload format, enabling minion impersonation and circumventing protections introduced in response to prior issues.
Recommended action: Upgrade to 3007.9 or 3006.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Salt's junos execution module contained an unsafe YAML decode/load usage. A specially crafted YAML payload processed by the junos module could lead to unintended code execution under the context of the Salt process.
Recommended action: Upgrade to 3006.17 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
PyPI salt >= 3007.0rc1, < 3007.4; >= 3006.0rc1, < 3006.12
Fixed in
3007.43006.12· Vendor fix available
Issue
Directory traversal vulnerability in recvfile method allows arbitrary files to be written to the master cache directory.
Recommended action: Upgrade to 3007.4 or 3006.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
PyPI salt >= 3007.0rc1, < 3007.4; >= 3006.0rc1, < 3006.12
Fixed in
3007.43006.12· Vendor fix available
Issue
Worker process denial of service through file read operation. .A vulnerability exists in the Master's “pubret” method which is exposed to all minions. The un-sanitized input value “jid” is used to construct a path which is then opened for reading. An attacker could exploit this vulnerabilities by attempting to read from a filename that will not return any data, e.g. by targeting a pipe node on the proc file system.
Recommended action: Upgrade to 3007.4 or 3006.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
PyPI salt >= 3006.0rc1, < 3006.12; >= 3007.0rc1, < 3007.4
Fixed in
3007.43006.12· Vendor fix available
Issue
An attacker with access to a minion key can exploit the 'on demand' pillar functionality with a specially crafted git url which could cause and arbitrary command to be run on the master with the same privileges as the master process.
Recommended action: Upgrade to 3007.4 or 3006.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
PyPI salt >= 3006.0rc1, < 3006.12; >= 3007.0rc1, < 3007.4
Fixed in
3007.43006.12· Vendor fix available
Issue
Arbitrary event injection on Salt Master. The master's "minionevent" method can be used by and authorized minion to send arbitrary events onto the master's event bus.
Recommended action: Upgrade to 3007.4 or 3006.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
PyPI salt >= 3006.0rc1, < 3006.12; >= 3007.0rc1, < 3007.4
Fixed in
3007.43006.12· Vendor fix available
Issue
The salt.auth.pki module does not properly authenticate callers. The "password" field contains a public certificate which is validated against a CA certificate by the module. This is not pki authentication, as the caller does not need access to the corresponding private key for the authentication attempt to be accepted.
Recommended action: Upgrade to 3007.4 or 3006.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
PyPI salt >= 3007.0rc1, < 3007.4; >= 3006.0rc1, < 3006.12
Fixed in
3007.43006.12· Vendor fix available
Issue
Arbitrary directory creation or file deletion. In the findfile method of the GitFS class, a path is created using os.path.join using unvalidated input from the “tgtenv” variable. This can be exploited by an attacker to delete any file on the Master's process has permissions to.
Recommended action: Upgrade to 3007.4 or 3006.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
PyPI salt >= 3007.0, < 3007.4; >= 3006.0, < 3006.12
Fixed in
3007.43006.12· Vendor fix available
Issue
Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions (= 3007.0).
Recommended action: Upgrade to 3007.4 or 3006.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
PyPI salt >= 3006.0rc1, < 3006.12; >= 3007.0rc1, < 3007.4
Fixed in
3007.43006.12· Vendor fix available
Issue
Directory traversal attack in minion file cache creation. The master's default cache is vulnerable to a directory traversal attack. Which could be leveraged to write or overwrite 'cache' files outside of the cache directory.
Recommended action: Upgrade to 3007.4 or 3006.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
PyPI salt >= 3007.0rc1, < 3007.4; >= 3006.0rc1, < 3006.12
Fixed in
3007.43006.12· Vendor fix available
Issue
File contents overwrite the VirtKey class is called when “on-demand pillar” data is requested and uses un-validated input to create paths to the “pki directory”. The functionality is used to auto-accept Minion authentication keys based on a pre-placed “authorization file” at a specific location and is present in the default configuration.
Recommended action: Upgrade to 3007.4 or 3006.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH. Do not make the copy path on the target predictable and ensure we check return codes of the scp command if the copy fails.
Recommended action: Upgrade to 3006.4 or 3005.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A specially crafted url can be created which leads to a directory traversal in the salt file server. A malicious user can read an arbitrary file from a Salt master’s filesystem.
Recommended action: Upgrade to 3006.6 or 3005.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Syndic cache directory creation is vulnerable to a directory traversal attack in salt project which can lead a malicious attacker to create an arbitrary directory on a Salt master.
Recommended action: Upgrade to 3006.6 or 3005.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted.
Recommended action: Upgrade to 3006.2 or 3005.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environments can get garbage data or the wrong data, which can lead to wrongful data disclosure, wrongful executions, data corruption and/or crash.
Recommended action: Upgrade to 3006.2 or 3005.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the func variable in salt/salt/modules/status.py file.
Recommended action: Upgrade to 3003.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously authorized user whose account is locked still run Salt commands when their account is locked. This affects both local shell accounts with an active session and salt-api users that authenticate via PAM eauth.
Recommended action: Upgrade to 3004.2, 3003.5 or 3002.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in SaltStack Salt before 3003.3. The salt minion installer will accept and use a minion config file at C:\salt\conf if that file is in place before the installer is run. This allows for a malicious actor to subvert the proper behaviour of the given minion software.
Recommended action: Upgrade to 3003.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely).
Recommended action: Upgrade to 3003rc1 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Incorrect Implementation of Authentication Algorithm vulnerability in of SUSE SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions.
Recommended action: Upgrade to 3002.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.genthin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py.
Recommended action: Upgrade to 3002.3, 3001.5, 3000.7 or 5 more by release line; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a shell injection by including ProxyCommand in an argument, or via sshoptions provided in an API request.
Recommended action: Upgrade to 3002.3, 3001.5, 3000.7 or 5 more by release line; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)
Recommended action: Upgrade to 3002.3, 3001.5, 3000.7 or 5 more by release line; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.
Recommended action: Upgrade to 3002.3, 3001.5, 3000.7 or 5 more by release line; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.