Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
69 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.
Recommended action: Upgrade to 2014.1.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.
Recommended action: Upgrade to 2017.7.1 or 2016.11.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When using the localbatch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed.
Recommended action: Upgrade to 2016.11.2, 2016.3.5 or 2015.8.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
salt before 2015.5.5 leaks git usernames and passwords to the log.
Recommended action: Upgrade to 2015.5.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12791.
Recommended action: Upgrade to 2017.7.2, 2016.11.8 or 2016.3.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of service via a crafted authentication request.
Recommended action: Upgrade to 2017.7.2, 2016.11.8 or 2016.3.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules.
Recommended action: Upgrade to 2014.7.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream.
Recommended action: Upgrade to 2015.8.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master.
Recommended action: Upgrade to 2016.3.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 allows arbitrary command execution on a salt-master via Salt's sshclient.
Recommended action: Upgrade to 2016.11.2, 2016.3.5 or 2015.8.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Directory Traversal vulnerability in salt-api in SaltStack Salt 2016.11.x before 2016.11.10, 2017.7.x before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to determine which files exist on the server.
Recommended action: Upgrade to 2018.3.3, 2017.7.8 or 2016.11.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
SaltStack Salt 2016.11.x before 2016.11.10, 2017.7.x before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands via salt-api(netapi).
Recommended action: Upgrade to 2018.3.3, 2017.7.8 or 2016.11.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
SaltStack RSA Key Generation allows remote users to decrypt communications
Recommended action: Upgrade to 0.15.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to force a minion process to stop by impersonating a master.
Recommended action: Upgrade to 3004.1, 3003.4 or 3002.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Job publishes and file server replies are susceptible to replay attacks, which can result in an attacker replaying job publishes causing minions to run old jobs. File server replies can also be re-played. A sufficient craft attacker could gain root access on minion under certain scenarios.
Recommended action: Upgrade to 3004.1, 3003.4 or 3002.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisheracl, if a user configured in the publisheracl targets any minion connected to the Syndic, the Salt Master incorrectly interpreted no valid targets as valid, allowing configured users to target any of the minions connected to the syndic with their configured commands. This requires a syndic master combined with publisheracl configured on the Master-of-Masters, allowing users specified in the publisheracl to bypass permissions, publishing authorized commands to any configured minion.
Recommended action: Upgrade to 3004.1, 3003.4 or 3002.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data.
Recommended action: Upgrade to 3004.1, 3003.4 or 3002.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and sourcehash URLs can gain full file system access as root on a salt minion.
Recommended action: Upgrade to 3003.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Salt (aka SaltStack) before 0.17.1 allows remote attackers to execute arbitrary YAML code via unspecified vectors. NOTE: the vendor states that this might not be a vulnerability because the YAML to be loaded has already been determined to be safe.
Recommended action: Upgrade to 0.17.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.