93 matches found
PYSEC-2017-82
The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions clients...
CVE-2017-8109
The CVE-2017-8109 entry concerns SaltStack Salt 2016.11 before 2016.11.4, where the salt-ssh minion copied configuration from the Salt Master without adjusting permissions, potentially leaking credentials to local attackers on configured minions. Public writeups in the connected docs confirm the ...
CVE-2017-8109
Removed by vendor...
Remote Code Execution (RCE)
Salt is vulnerable to remote code execution RCE. Users of Salt-API and salt-ssh could execute a command on the salt master via a hole when both systems are enabled...
openSUSE Security Update : salt (openSUSE-2016-318)
This update for salt fixes the following issues : - CVE-2016-1866: Improper handling of clear messages on the minion remote code execution boo965403 The following bugs were fixed : - boo958350: Salt crashes on invalid UTF-8 in package data - boo959572: 'salt '' pkg.infoinstalled' causes exception...
PYSEC-2014-18
Multiple unspecified vulnerabilities in Salt aka SaltStack before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in 1 seed.py, 2 salt-ssh, or 3 salt-cloud...
UBUNTU-CVE-2014-3563
Multiple unspecified vulnerabilities in Salt aka SaltStack before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in 1 seed.py, 2 salt-ssh, or 3 salt-cloud...
CVE-2014-3563
Removed by vendor...
CVE-2013-4437
Unspecified vulnerability in salt-ssh in Salt aka SaltStack 0.17.0 has unspecified impact and vectors related to "insecure Usage of /tmp."...
CVE-2013-4437
Unspecified vulnerability in salt-ssh in Salt aka SaltStack 0.17.0 has unspecified impact and vectors related to "insecure Usage of /tmp."...
UBUNTU-CVE-2013-4436
The default configuration for salt-ssh in Salt aka SaltStack 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle MITM attack...