Ubuntu.comUB:CVE-2013-4435CVE-2013-4435
10 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.002 Low
EPSS
Percentile
60.6%
Salt (aka SaltStack) 0.15.0 through 0.17.0 allows remote authenticated
users who are using external authentication or client ACL to execute
restricted routines by embedding the routine in another routine.
Bugs
Notes
| Author | Note |
|---|---|
| seth-arnold | The announce notes are too difficult to decipher to discover which patches go with which vulnerabilities; there are also some duplicated CVEs and CVE-2013-4437 isn’t even mentioned at all, which makes me think the whole annoucement needs a salt expert to revisit and revise. |
References
docs.saltstack.com/topics/releases/0.17.1.html
www.openwall.com/lists/oss-security/2013/10/15
www.openwall.com/lists/oss-security/2013/10/18/3
launchpad.net/bugs/cve/CVE-2013-4435
nvd.nist.gov/vuln/detail/CVE-2013-4435
security-tracker.debian.org/tracker/CVE-2013-4435
www.cve.org/CVERecord?id=CVE-2013-4435
Related
10 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.002 Low
EPSS
Percentile
60.6%