Salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 allows arbitrary command execution on a salt-master via Salt’s ssh_client.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 11 | all | salt | < 2016.11.2+ds-1 | salt_2016.11.2+ds-1_all.deb |
Debian | 10 | all | salt | < 2016.11.2+ds-1 | salt_2016.11.2+ds-1_all.deb |