CVE-2013-4438

SaltStack (Salt) before 0.17.1 is vulnerable to remote code execution via YAML loading with unspecified vectors. The issue is evidenced by multiple feeds: CVE-2013-4438 states that an attacker can execute arbitrary YAML code, with the vendor noting the YAML may already be safe. Public references ...

CVE-2015-4017

CVE-2015-4017 describes a vulnerability in Salt prior to 2014.7.6 where certificate verification is not performed when Salt connects via the aliyun, proxmox, and splunk modules. According to the connected SUSE/OSV records, the issue centers on Salt’s failure to validate certificates, potentially ...