CVE-2017-8109

The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions clients...

PYSEC-2017-82

The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions clients...

PYSEC-2017-82

The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions clients...

CVE-2017-8109

The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions clients...

CVE-2017-8109

Removed by vendor...

CVE-2017-8109

The CVE-2017-8109 entry concerns SaltStack Salt 2016.11 before 2016.11.4, where the salt-ssh minion copied configuration from the Salt Master without adjusting permissions, potentially leaking credentials to local attackers on configured minions. Public writeups in the connected docs confirm the ...

CVE-2017-8109: Exposure of Sensitive Information to an Unauthorized Actor

The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions clients...

PT-2017-12693

Name of the Vulnerable Software and Affected Versions SaltStack Salt versions prior to 2016.11.7 SaltStack Salt versions 2017.7.x prior to 2017.7.1 Description A directory traversal vulnerability exists in the minion id validation of SaltStack Salt. This issue allows remote minions with incorrect...

PT-2017-13633

Name of the Vulnerable Software and Affected Versions SaltStack Salt versions prior to 2016.3.8 SaltStack Salt versions 2016.11.x prior to 2016.11.8 SaltStack Salt versions 2017.7.x prior to 2017.7.2 Description A directory traversal vulnerability exists in the minion id validation of SaltStack...

PT-2017-18121

Name of the Vulnerable Software and Affected Versions SaltStack Salt versions 2016.11 through 2016.11.3 Description The issue concerns the salt-ssh minion code, which copies configuration from the Salt Master without adjusting permissions. This might lead to credentials being leaked to local...

PT-2018-8428

Name of the Vulnerable Software and Affected Versions SaltStack Salt versions prior to 2016.3.6 Description The issue allows compromised salt-minions to impersonate the salt-master. Recommendations For versions prior to 2016.3.6, update to version 2016.3.6 or later to resolve the issue...

Information Disclosure

salt is vulnerable to information disclosure. The system allows a minion to access any file in the master system, meaning a malicious user can manipulate a minion to access sensitive data...

Man In The Middle (MitM)

Salt is vulnerable to man in the middle MitM attack in minion authentication. It does not check the integrity of the message sent back by the master. It is possible to intercept the communication between the minion and master and alter certain information...

Path Injection Via Minion Ids

Salt is vulnerable to path injection attacks via minion ids. Salt masters do not properly validate the id of a connecting minion. This can lead to an attacker uploading files to the master in arbitrary locations. In particular, this can be used to bypass the manual validation of new unknown...

CVE-2016-9639

Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching...

PYSEC-2017-34

Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching...

CVE-2016-9639

Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching...

PT-2017-10230

Name of the Vulnerable Software and Affected Versions Salt versions prior to 2015.8.11 Salt affected versions not specified Description The issue allows deleted minions to read or write to minions with the same id due to caching. Recommendations For versions prior to 2015.8.11, update to version...

Code injection

Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream...

PYSEC-2016-23

Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream...