{"id": "RH:CVE-2016-9639", "type": "redhatcve", "bulletinFamily": "info", "title": "CVE-2016-9639", "description": "Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching.\n", "published": "2016-11-28T15:18:59", "modified": "2020-12-03T11:27:10", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.2}, "href": "https://access.redhat.com/security/cve/cve-2016-9639", "reporter": "redhat.com", "references": ["https://bugzilla.redhat.com/show_bug.cgi?id=1399220"], "cvelist": ["CVE-2016-9639"], "immutableFields": [], "lastseen": "2021-09-02T22:52:20", "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-9639"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2016-9639"]}, {"type": "nessus", "idList": ["OPENSUSE-2018-388.NASL"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2016-9639"]}], "rev": 4}, "score": {"value": 5.6, "vector": "NONE"}, "backreferences": {"references": [{"type": "cve", "idList": ["CVE-2016-9639"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2016-9639"]}, {"type": "nessus", "idList": ["OPENSUSE-2018-388.NASL"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2016-9639"]}]}, "exploitation": null, "vulnersScore": 5.6}, "vendorCvss": {"score": "5.3", "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}, "_state": {"dependencies": 1645877923}}

{"ubuntucve": [{"lastseen": "2021-11-22T21:44:11", "description": "Salt before 2015.8.11 allows deleted minions to read or write to minions\nwith the same id, related to caching.\n\n#### Notes\n\nAuthor| Note \n---|--- \n[seth-arnold](<https://launchpad.net/~seth-arnold>) | The rotate_aes_key setting in 2015.8.11 and newer defeats this issue. If it is disabled in newer releases this issue is re-opened.\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "baseScore": 9.1, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 5.2}, "published": "2017-02-07T00:00:00", "type": "ubuntucve", "title": "CVE-2016-9639", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-9639"], "modified": "2017-02-07T00:00:00", "id": "UB:CVE-2016-9639", "href": "https://ubuntu.com/security/CVE-2016-9639", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "debiancve": [{"lastseen": "2022-04-18T07:34:32", "description": "Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.1, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.2}, "published": "2017-02-07T17:59:00", "type": "debiancve", "title": "CVE-2016-9639", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-9639"], "modified": "2017-02-07T17:59:00", "id": "DEBIANCVE:CVE-2016-9639", "href": "https://security-tracker.debian.org/tracker/CVE-2016-9639", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "cve": [{"lastseen": "2022-03-23T16:36:02", "description": "Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.1, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.2}, "published": "2017-02-07T17:59:00", "type": "cve", "title": "CVE-2016-9639", "cwe": ["CWE-284"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-9639"], "modified": "2017-02-09T22:08:00", "cpe": ["cpe:/a:saltstack:salt:2015.8.10"], "id": "CVE-2016-9639", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-9639", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:saltstack:salt:2015.8.10:*:*:*:*:*:*:*"]}], "osv": [{"lastseen": "2022-05-12T01:08:56", "description": "Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.1, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.2}, "published": "2017-02-07T17:59:00", "type": "osv", "title": "PYSEC-2017-34", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-9639"], "modified": "2021-07-05T00:01:26", "id": "OSV:PYSEC-2017-34", "href": "https://osv.dev/vulnerability/PYSEC-2017-34", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "nessus": [{"lastseen": "2021-08-19T12:32:53", "description": "This update for salt fixes the following issues :\n\n - [Regression] Permission problem: salt-ssh minion boostrap doesn't work anymore. (bsc#1027722)\n\n - wrong use of os_family string for Suse in the locale module and others (bsc#1038855)\n\n - Cannot bootstrap a host using 'Manage system completely via SSH (will not install an agent)' (bsc#1002529)\n\n - add user to or replace members of group not working with SLES11 SPx (bsc#978150)\n\n - SLES-12-GA client fail to start salt minion (SUSE MANAGER 3.0) (bsc#991048)\n\n - salt pkg.latest raises exception if package is not availible (bsc#1012999)\n\n - pkg.list_products on 'registerrelease' and 'productline' returns boolean.False if empty (bsc#989193)\n\n - SLES-12-SP1 salt-minion clients has no Base Channel added by default (bsc#986019)\n\n - 'The system requires a reboot' does not disappear from web-UI despite the reboot (bsc#1017078)\n\n - Remove option -f from startproc (bsc#975733)\n\n - [PYTHON2] package salt-minion requires /usr/bin/python (bsc#1081592)\n\n - Upgrading packages on RHEL6/7 client fails (bsc#1068566)\n\n - /var/log/salt has insecure permissions (bsc#1071322)\n\n - [Minion-bootstrapping] Invalid char cause server (salt-master ERROR) (bsc#1011304)\n\n - CVE-2016-9639: Possible information leak due to revoked keys still being used (bsc#1012398)\n\n - Bootstrapping SLES12 minion invalid (bsc#1053376)\n\n - Minions not correctly onboarded if Proxy has multiple FQDNs (bsc#1063419)\n\n - salt --summary '*' <function> reporting '# of minions that did not return' wrongly (bsc#972311)\n\n - RH-L3 SALT - Stacktrace if nscd package is not present when using nscd state (bsc#1027044)\n\n - Inspector broken: no module 'query' or 'inspector' while querying or inspecting (bsc#989798)\n\n - [ Regression ]Centos7 Minion remote command execution from gui or cli , minion not responding (bsc#1027240)\n\n - SALT, minion_id generation doesn't match the newhostname (bsc#967803)\n\n - Salt API server shuts down when SSH call with no matches is issued (bsc#1004723)\n\n - /var/log/salt/minion fails logrotate (bsc#1030009)\n\n - Salt proxy test.ping crashes (bsc#975303)\n\n - salt master flood log with useless messages (bsc#985661)\n\n - After bootstrap salt client has deprecation warnings (bsc#1041993)\n\n - Head: salt 2017.7.2 starts salt-master as user root (bsc#1064520)\n\n - CVE-2017-12791: Maliciously crafted minion IDs can cause unwanted directory traversals on the Salt-master (bsc#1053955)\n\n - salt-2017.7.2 - broken %post script for salt-master (bsc#1079048)\n\n - Tearing down deployment with SaltStack Kubernetes module always shows error (bsc#1059291)\n\n - lvm.vg_present does not recognize PV with certain LVM filter settings. (bsc#988506)\n\n - High state fails: No service execution module loaded:\n check support for service (bsc#1065792)\n\n - When multiple versions of a package are installed on a minion, patch status may vary (bsc#972490)\n\n - Salt cp.push does not work on SUMA 3.2 Builds because of python3.4 (bsc#1075950)\n\n - timezone modue does not update /etc/sysconfig/clock (bsc#1008933)\n\n - Add patches to salt to support SUSE Manager scalability features (bsc#1052264)\n\n - salt-minion failed to start on minimal RHEL6 because of DBus exception during load of snapper module (bsc#993039)\n\n - Permission denied: '/var/run/salt-master.pid' (bsc#1050003)\n\n - Jobs scheduled to run at a future time stay pending for Salt minions (bsc#1036125)\n\n - Backport kubernetes-modules to salt (bsc#1051948)\n\n - After highstate: The minion function caused an exception (bsc#1068446)\n\n - VUL-0: CVE-2017-14695: salt: directory traversal vulnerability in minion id validation (bsc#1062462)\n\n - unable to update salt-minion on RHEL (bsc#1022841)\n\n - Nodes run out of memory due to salt-minion process (bsc#983512)\n\n - [Proxy] 'Broken pipe' during bootstrap of salt minion (bsc#1039370)\n\n - incorrect return code from /etc/rc.d/salt-minion (bsc#999852)\n\n - CVE-2017-5200: Salt-ssh via api let's run arbitrary commands as user salt (bsc#1011800)\n\n - beacons.conf on salt-minion not processed (bsc#1060230)\n\n - SLES11 SP3 salt-minion Client Cannot Select Base Channel (bsc#975093)\n\n - salt-ssh sys.doc gives authentication failure without arguments (bsc#1019386)\n\n - minion bootstrapping: error when bootstrap SLE11 clients (bsc#990439)\n\n - Certificate Deployment Fails for SLES11 SP3 Clients (bsc#975757)\n\n - state.module run() does not translate varargs (bsc#1025896)", "cvss3": {"score": 9.8, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2018-04-24T00:00:00", "type": "nessus", "title": "openSUSE Security Update : salt (openSUSE-2018-388)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-9639", "CVE-2017-12791", "CVE-2017-14695", "CVE-2017-14696", "CVE-2017-5200"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:python2-salt", "p-cpe:/a:novell:opensuse:python3-salt", "p-cpe:/a:novell:opensuse:salt", "p-cpe:/a:novell:opensuse:salt-api", "p-cpe:/a:novell:opensuse:salt-bash-completion", "p-cpe:/a:novell:opensuse:salt-cloud", "p-cpe:/a:novell:opensuse:salt-fish-completion", "p-cpe:/a:novell:opensuse:salt-master", "p-cpe:/a:novell:opensuse:salt-minion", "p-cpe:/a:novell:opensuse:salt-proxy", "p-cpe:/a:novell:opensuse:salt-ssh", "p-cpe:/a:novell:opensuse:salt-syndic", "p-cpe:/a:novell:opensuse:salt-zsh-completion", "cpe:/o:novell:opensuse:42.3"], "id": "OPENSUSE-2018-388.NASL", "href": "https://www.tenable.com/plugins/nessus/109293", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2018-388.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(109293);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2016-9639\", \"CVE-2017-12791\", \"CVE-2017-14695\", \"CVE-2017-14696\", \"CVE-2017-5200\");\n script_xref(name:\"IAVB\", value:\"2017-B-0112-S\");\n\n script_name(english:\"openSUSE Security Update : salt (openSUSE-2018-388)\");\n script_summary(english:\"Check for the openSUSE-2018-388 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for salt fixes the following issues :\n\n - [Regression] Permission problem: salt-ssh minion\n boostrap doesn't work anymore. (bsc#1027722)\n\n - wrong use of os_family string for Suse in the locale\n module and others (bsc#1038855)\n\n - Cannot bootstrap a host using 'Manage system completely\n via SSH (will not install an agent)' (bsc#1002529)\n\n - add user to or replace members of group not working with\n SLES11 SPx (bsc#978150)\n\n - SLES-12-GA client fail to start salt minion (SUSE\n MANAGER 3.0) (bsc#991048)\n\n - salt pkg.latest raises exception if package is not\n availible (bsc#1012999)\n\n - pkg.list_products on 'registerrelease' and 'productline'\n returns boolean.False if empty (bsc#989193)\n\n - SLES-12-SP1 salt-minion clients has no Base Channel\n added by default (bsc#986019)\n\n - 'The system requires a reboot' does not disappear from\n web-UI despite the reboot (bsc#1017078)\n\n - Remove option -f from startproc (bsc#975733)\n\n - [PYTHON2] package salt-minion requires /usr/bin/python\n (bsc#1081592)\n\n - Upgrading packages on RHEL6/7 client fails (bsc#1068566)\n\n - /var/log/salt has insecure permissions (bsc#1071322)\n\n - [Minion-bootstrapping] Invalid char cause server\n (salt-master ERROR) (bsc#1011304)\n\n - CVE-2016-9639: Possible information leak due to revoked\n keys still being used (bsc#1012398)\n\n - Bootstrapping SLES12 minion invalid (bsc#1053376)\n\n - Minions not correctly onboarded if Proxy has multiple\n FQDNs (bsc#1063419)\n\n - salt --summary '*' <function> reporting '# of minions\n that did not return' wrongly (bsc#972311)\n\n - RH-L3 SALT - Stacktrace if nscd package is not present\n when using nscd state (bsc#1027044)\n\n - Inspector broken: no module 'query' or 'inspector' while\n querying or inspecting (bsc#989798)\n\n - [ Regression ]Centos7 Minion remote command execution\n from gui or cli , minion not responding (bsc#1027240)\n\n - SALT, minion_id generation doesn't match the newhostname\n (bsc#967803)\n\n - Salt API server shuts down when SSH call with no matches\n is issued (bsc#1004723)\n\n - /var/log/salt/minion fails logrotate (bsc#1030009)\n\n - Salt proxy test.ping crashes (bsc#975303)\n\n - salt master flood log with useless messages (bsc#985661)\n\n - After bootstrap salt client has deprecation warnings\n (bsc#1041993)\n\n - Head: salt 2017.7.2 starts salt-master as user root\n (bsc#1064520)\n\n - CVE-2017-12791: Maliciously crafted minion IDs can cause\n unwanted directory traversals on the Salt-master\n (bsc#1053955)\n\n - salt-2017.7.2 - broken %post script for salt-master\n (bsc#1079048)\n\n - Tearing down deployment with SaltStack Kubernetes module\n always shows error (bsc#1059291)\n\n - lvm.vg_present does not recognize PV with certain LVM\n filter settings. (bsc#988506)\n\n - High state fails: No service execution module loaded:\n check support for service (bsc#1065792)\n\n - When multiple versions of a package are installed on a\n minion, patch status may vary (bsc#972490)\n\n - Salt cp.push does not work on SUMA 3.2 Builds because of\n python3.4 (bsc#1075950)\n\n - timezone modue does not update /etc/sysconfig/clock\n (bsc#1008933)\n\n - Add patches to salt to support SUSE Manager scalability\n features (bsc#1052264)\n\n - salt-minion failed to start on minimal RHEL6 because of\n DBus exception during load of snapper module\n (bsc#993039)\n\n - Permission denied: '/var/run/salt-master.pid'\n (bsc#1050003)\n\n - Jobs scheduled to run at a future time stay pending for\n Salt minions (bsc#1036125)\n\n - Backport kubernetes-modules to salt (bsc#1051948)\n\n - After highstate: The minion function caused an exception\n (bsc#1068446)\n\n - VUL-0: CVE-2017-14695: salt: directory traversal\n vulnerability in minion id validation (bsc#1062462)\n\n - unable to update salt-minion on RHEL (bsc#1022841)\n\n - Nodes run out of memory due to salt-minion process\n (bsc#983512)\n\n - [Proxy] 'Broken pipe' during bootstrap of salt minion\n (bsc#1039370)\n\n - incorrect return code from /etc/rc.d/salt-minion\n (bsc#999852)\n\n - CVE-2017-5200: Salt-ssh via api let's run arbitrary\n commands as user salt (bsc#1011800)\n\n - beacons.conf on salt-minion not processed (bsc#1060230)\n\n - SLES11 SP3 salt-minion Client Cannot Select Base Channel\n (bsc#975093)\n\n - salt-ssh sys.doc gives authentication failure without\n arguments (bsc#1019386)\n\n - minion bootstrapping: error when bootstrap SLE11 clients\n (bsc#990439)\n\n - Certificate Deployment Fails for SLES11 SP3 Clients\n (bsc#975757)\n\n - state.module run() does not translate varargs\n (bsc#1025896)\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1002529\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1004723\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1008933\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1011304\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1011800\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1012398\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1012999\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1017078\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1019386\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1022841\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1025896\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1027044\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1027240\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1027722\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1030009\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1036125\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1038855\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1039370\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1041993\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1050003\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1051948\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1052264\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1053376\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1053955\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1059291\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1060230\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1062462\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1063419\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1064520\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1065792\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1068446\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1068566\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1071322\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1075950\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1079048\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1081592\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=967803\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=972311\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=972490\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=975093\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=975303\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=975733\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=975757\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=978150\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=983512\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=985661\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=986019\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=988506\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989193\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989798\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=990439\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=991048\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=993039\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=999852\"\n );\n # https://features.opensuse.org/320559\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://features.opensuse.org/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected salt packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:python2-salt\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:python3-salt\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:salt\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:salt-api\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:salt-bash-completion\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:salt-cloud\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:salt-fish-completion\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:salt-master\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:salt-minion\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:salt-proxy\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:salt-ssh\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:salt-syndic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:salt-zsh-completion\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:42.3\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/04/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/04/24\");\n script_set_attribute(attribute:\"stig_severity\", value:\"II\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE42\\.3)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"42.3\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(x86_64)$\") audit(AUDIT_ARCH_NOT, \"x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE42.3\", reference:\"python2-salt-2018.3.0-17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"python3-salt-2018.3.0-17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"salt-2018.3.0-17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"salt-api-2018.3.0-17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"salt-bash-completion-2018.3.0-17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"salt-cloud-2018.3.0-17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"salt-fish-completion-2018.3.0-17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"salt-master-2018.3.0-17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"salt-minion-2018.3.0-17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"salt-proxy-2018.3.0-17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"salt-ssh-2018.3.0-17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"salt-syndic-2018.3.0-17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"salt-zsh-completion-2018.3.0-17.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"python2-salt / python3-salt / salt / salt-api / etc\");\n}\n", "cvss": {"score": 9, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}]}