USN-7181-1: Salt vulnerability

It was discovered that Salt incorrectly handled web requests when the SSH client was enabled. An attacker could possibly use this issue to achieve remote code execution or obtain sensitive information...

USN-7181-1 salt vulnerability

It was discovered that Salt incorrectly handled web requests when the SSH client was enabled. An attacker could possibly use this issue to achieve remote code execution or obtain sensitive information...

Ubuntu 14.04 LTS : Salt vulnerability (USN-7181-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7181-1 advisory. It was discovered that Salt incorrectly handled web requests when the SSH client was enabled. An attacker could possibly use this issue to achieve remote code...

Salt 安全漏洞

Salt is an automation, infrastructure management, data-driven orchestration, and remote execution application from the Salt project. Salt has a security vulnerability that stems from the Salt-SSH preflight option copying scripts to predictable paths to the target, which allows an attacker to forc...

The vulnerability of the configuration management system and the remote execution of operations, known as Salt, is related to the possibility of bypassing the catalog. This allows attackers to execute arbitrary code.

The vulnerability of configuration management systems and remote execution of operations like Salt is related to the possibility of bypassing the catalog. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

PT-2024-4385

Name of the Vulnerable Software and Affected Versions Salt affected versions not specified Description The issue is related to the creation of specially crafted URLs, leading to directory traversal on the Salt file server. This can allow a malicious user to read arbitrary files from a Salt master...

WWBN AVideo salt generation insufficient entropy vulnerability

Talos Vulnerability Report TALOS-2023-1900 WWBN AVideo salt generation insufficient entropy vulnerability January 10, 2024 CVE Number CVE-2023-49599 SUMMARY An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially...

SUSE CVE-2013-4436

The default configuration for salt-ssh in Salt aka SaltStack 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle MITM attack...

SUSE CVE-2013-4437

Unspecified vulnerability in salt-ssh in Salt aka SaltStack 0.17.0 has unspecified impact and vectors related to "insecure Usage of /tmp."...

SUSE CVE-2016-1866

Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream...

SUSE CVE-2021-22004

An issue was discovered in SaltStack Salt before 3003.3. The salt minion installer will accept and use a minion config file at C:\salt\conf if that file is in place before the installer is run. This allows for a malicious actor to subvert the proper behaviour of the given minion software...

SUSE CVE-2021-25315

CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior t...

SUSE SLED15 / SLES15 Security Update : salt (SUSE-SU-2022:2304-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:2304-1 advisory. - An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked...

SUSE SLED15 / SLES15 Security Update : salt (SUSE-SU-2022:2178-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:2178-1 advisory. - An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked...

Malleability remedied in Salt

Salt Project has fixed a vulnerability in Salt. A malicious person who has a locked user account can still perform actions under privileges of this account. Systems are vulnerable only when PAM authentication is used. Salt Project has released updates to fix the vulnerability fix in Salt 3002.9,...

GHSA-HVMJ-356C-GPF4 Salt allows deleted minions to read or write to minions with the same id

Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching...

GHSA-8J9G-C9RP-JVG4 Salt vulnerable to Improper Certificate Validation

Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules...

Man-in-the-Middle (MitM)

salt is vulnerable to man in the middle attacks. The vulnerability exists because the salt masters don't sign pillar data with minion's public key which allows a malicious attacker to substitute pillar data and perform unauthorized actions...

Privilege Escalation

Salt is vulnerable to privilege escalation. A user who has control of the source, and sourcehash URLs can gain full file system access as root on a salt minion...

CVE-2021-22774

CVE-2021-22774 affects Schneider Electric EVlink City (EVC1S22P4/EVC1S7P4), EVlink Parking (EVW2/EVF2/EV.2), and EVlink Smart Wallbox (EVB1A) with all versions prior to R8 V3.4.0.1. The issue is CWE-759: Use of a One-Way Hash without a Salt, which could allow an attacker to recover charging-stati...