Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
69 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillarroots.write method is vulnerable to directory traversal.
Recommended action: Upgrade to 3002.3, 3001.5, 3000.7 or 5 more by release line; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks.
Recommended action: Upgrade to 3002.5, 3001.5, 3000.7 or 5 more by release line; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheelasync client. Thus, an attacker can remotely run any wheel modules on the master.
Recommended action: Upgrade to 3002.3, 3001.5, 3000.7 or 5 more by release line; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blacklisted directory.
Recommended action: Upgrade to 3002.3, 3001.5, 3000.7 or 5 more by release line; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated.
Recommended action: Upgrade to 3002.3, 3001.5, 3000.7 or 5 more by release line; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the vmware.py files) does not always validate the SSL/TLS certificate.
Recommended action: Upgrade to 3002.3, 3001.5, 3000.7 or 5 more by release line; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
3000.42015.8.132016.3.82018.3.52019.2.62017.7.83002.13001.22016.11.10· Vendor fix available
Issue
An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.
Recommended action: Upgrade to 3002.1, 3001.2, 3000.4 or 6 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
2015.8.132016.3.82018.3.52017.7.83000.53002.13001.32016.11.102019.2.7· Vendor fix available
Issue
In SaltStack the salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH.
Recommended action: Upgrade to 3002.1, 3001.3, 3000.5 or 6 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
3000.42015.8.132016.3.82018.3.52019.2.62017.7.83002.13001.22016.11.10· Vendor fix available
Issue
The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.
Recommended action: Upgrade to 3002.1, 3001.2, 3000.4 or 6 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.
Recommended action: Upgrade to 3000.2 or 2019.2.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.
Recommended action: Upgrade to 3000.2 or 2019.2.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In SaltStack Salt before 2019.2.3, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.
Recommended action: Upgrade to 2019.2.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
SaltStack Salt 2018.3 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.userchpass function from the MySQL module for Salt (https://github.com/saltstack/salt/blob/develop/salt/modules/mysql.py#L1462). The attack vector is: specially crafted password string. The fixed version is: 2018.3.4.
Recommended action: Upgrade to 2018.3.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The salt master in Salt (aka SaltStack) 0.11.0 through 0.17.0 does not properly drop group privileges, which makes it easier for remote attackers to gain privileges.
Recommended action: Upgrade to 0.17.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Salt (aka SaltStack) before 0.15.0 through 0.17.0 allows remote authenticated minions to impersonate arbitrary minions via a crafted minion with a valid key.
Recommended action: Upgrade to 0.17.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Unspecified vulnerability in salt-ssh in Salt (aka SaltStack) 0.17.0 has unspecified impact and vectors related to "insecure Usage of /tmp."
Recommended action: Upgrade to 0.17.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The default configuration for salt-ssh in Salt (aka SaltStack) 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle (MITM) attack.
Recommended action: Upgrade to 0.17.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Salt (aka SaltStack) 0.15.0 through 0.17.0 allows remote authenticated users who are using external authentication or client ACL to execute restricted routines by embedding the routine in another routine.
Recommended action: Upgrade to 0.17.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient.
Recommended action: Upgrade to 2015.8.8 or 2015.5.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching.
Recommended action: Upgrade to 2015.8.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive information by reading the file.
Recommended action: Upgrade to 2015.8.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.
Recommended action: Upgrade to 2014.7.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
modules/serverdensitydevice.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.
Recommended action: Upgrade to 2014.7.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients).
Recommended action: Upgrade to 2016.11.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
PyPI salt >= 2015.5, < 2015.5.6; >= 2015.8, < 2015.8.1
Fixed in
2015.5.62015.8.1· Vendor fix available
Issue
winuseradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in debug logs.
Recommended action: Upgrade to 2015.8.1 or 2015.5.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.