UBUNTU-CVE-2017-5200

Salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 allows arbitrary command execution on a salt-master via Salt's sshclient. Users of Salt-API and salt-ssh could execute a command on the salt master via a hole when both systems were enabled...

Security Update for salt

Al Nikolov uploaded new package for salt which fixed the following security problem: CVE-2017-8109 The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on...

Unspecified Vulnerability in SaltStack Salt

SaltStack Salt aka SaltStack is a set of open source tools for managing infrastructure from SaltStack, Inc. in the United States. The tool provides configuration management, remote execution and other functions , able to manage tens of thousands of servers , with the ability to quickly complete t...

CVE-2017-8109

The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions clients...

PYSEC-2017-82

The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions clients...

CVE-2017-8109

Removed by vendor...

CVE-2017-8109

The CVE-2017-8109 entry concerns SaltStack Salt 2016.11 before 2016.11.4, where the salt-ssh minion copied configuration from the Salt Master without adjusting permissions, potentially leaking credentials to local attackers on configured minions. Public writeups in the connected docs confirm the ...

CVE-2017-8109: Exposure of Sensitive Information to an Unauthorized Actor

The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions clients...

Remote Code Execution (RCE)

Salt is vulnerable to remote code execution RCE. Users of Salt-API and salt-ssh could execute a command on the salt master via a hole when both systems are enabled...

openSUSE Security Update : salt (openSUSE-2016-318)

This update for salt fixes the following issues : - CVE-2016-1866: Improper handling of clear messages on the minion remote code execution boo965403 The following bugs were fixed : - boo958350: Salt crashes on invalid UTF-8 in package data - boo959572: 'salt '' pkg.infoinstalled' causes exception...

PYSEC-2014-18

Multiple unspecified vulnerabilities in Salt aka SaltStack before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in 1 seed.py, 2 salt-ssh, or 3 salt-cloud...

UBUNTU-CVE-2014-3563

Multiple unspecified vulnerabilities in Salt aka SaltStack before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in 1 seed.py, 2 salt-ssh, or 3 salt-cloud...

CVE-2014-3563

Removed by vendor...

CVE-2014-3563: Improper Link Resolution Before File Access

Multiple unspecified vulnerabilities in Salt aka SaltStack before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in 1 seed.py, 2 salt-ssh, or 3 salt-cloud...

CVE-2013-4437

Unspecified vulnerability in salt-ssh in Salt aka SaltStack 0.17.0 has unspecified impact and vectors related to "insecure Usage of /tmp."...

CVE-2013-4437

Unspecified vulnerability in salt-ssh in Salt aka SaltStack 0.17.0 has unspecified impact and vectors related to "insecure Usage of /tmp."...

PYSEC-2013-27

Unspecified vulnerability in salt-ssh in Salt aka SaltStack 0.17.0 has unspecified impact and vectors related to "insecure Usage of /tmp."...

UBUNTU-CVE-2013-4436

The default configuration for salt-ssh in Salt aka SaltStack 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle MITM attack...

CVE-2013-4437

Technical details for CVE-2013-4437 are not publicly provided in the supplied documents. Monitor for updates and new disclosures.

CVE-2013-4436: Improper Input Validation

The default configuration for salt-ssh in Salt aka SaltStack 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle MITM attack...