Security Update for salt

Al Nikolov uploaded new package for salt which fixed the following security problem: CVE-2017-8109 The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on...

PYSEC-2017-82

The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions clients...

CVE-2017-8109

The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions clients...

CVE-2017-8109

The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions clients...

CVE-2017-8109

The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions clients...

CVE-2017-8109: Exposure of Sensitive Information to an Unauthorized Actor

The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions clients...

PT-2017-18121

Name of the Vulnerable Software and Affected Versions SaltStack Salt versions 2016.11 through 2016.11.3 Description The issue concerns the salt-ssh minion code, which copies configuration from the Salt Master without adjusting permissions. This might lead to credentials being leaked to local...

PT-2017-13633

Name of the Vulnerable Software and Affected Versions SaltStack Salt versions prior to 2016.3.8 SaltStack Salt versions 2016.11.x prior to 2016.11.8 SaltStack Salt versions 2017.7.x prior to 2017.7.2 Description A directory traversal vulnerability exists in the minion id validation of SaltStack...

PT-2017-13634

Name of the Vulnerable Software and Affected Versions SaltStack Salt versions prior to 2017.7.2 SaltStack Salt versions 2016.11.x prior to 2016.11.8 SaltStack Salt versions 2016.3.x prior to 2016.3.8 Description The issue allows remote attackers to cause a denial of service via a crafted...

PT-2017-12693

Name of the Vulnerable Software and Affected Versions SaltStack Salt versions prior to 2016.11.7 SaltStack Salt versions 2017.7.x prior to 2017.7.1 Description A directory traversal vulnerability exists in the minion id validation of SaltStack Salt. This issue allows remote minions with incorrect...

PT-2017-16377

Name of the Vulnerable Software and Affected Versions SaltStack Salt versions prior to 2015.8.13 SaltStack Salt versions 2016.3.x prior to 2016.3.5 SaltStack Salt versions 2016.11.x prior to 2016.11.2 Description The issue arises when using the local batch client from salt-api in SaltStack Salt,...

PT-2018-8428

Name of the Vulnerable Software and Affected Versions SaltStack Salt versions prior to 2016.3.6 Description The issue allows compromised salt-minions to impersonate the salt-master. Recommendations For versions prior to 2016.3.6, update to version 2016.3.6 or later to resolve the issue...

PT-2017-16385

Name of the Vulnerable Software and Affected Versions SaltStack Salt versions 2015.8.13 and earlier, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 Description The issue allows arbitrary command execution on a salt-master via Salt's ssh client. Users of Salt-API and salt-ssh could execu...

CVE-2017-5192

When using the localbatch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed. Mitigation Disable salt-api for mitigation...

PT-2020-3607

Name of the Vulnerable Software and Affected Versions SaltStack Salt versions prior to 2019.2.4 SaltStack Salt versions 3000 prior to 3000.2 Description An issue was discovered in SaltStack Salt where the salt-master process ClearFuncs class allows access to some methods that improperly sanitize...

PT-2020-5859 · Saltstack +3 · Saltstack Salt +3

Name of the Vulnerable Software and Affected Versions: SaltStack Salt versions through 3002 Description: The issue is related to a lack of measures to neutralize special elements in the Salt configuration management and remote execution system. Exploitation of this issue allows a remote attacker ...