CVEvulnerability
CVE-2017-8109
7.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2017-04-25
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.8 HIGH — CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 2.1 LOW — AV:L/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients).
Affected configurations
• saltstack salt 2016.11
• saltstack salt 2016.11.0
• saltstack salt 2016.11.1
• saltstack salt 2016.11.2
• saltstack salt 2016.11.3
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://www.securityfocus.com/bid/98095 Third Party Advisory, VDB Entry
- https://bugzilla.suse.com/show_bug.cgi?id=1035912 Issue Tracking, Patch
- https://docs.saltstack.com/en/latest/topics/releases/2016.11.4.html Patch, Release Notes, Vendor Advisory
- https://github.com/saltstack/salt/issues/40075 Issue Tracking, Patch, Third Party Advisory
- https://github.com/saltstack/salt/pull/40609 Issue Tracking, Patch, Third Party Advisory
- https://github.com/saltstack/salt/pull/40609/commits/6e34c2b5e5e849302af7ccd00509929c3809c658 Issue Tracking, Patch, Third Party Advisory
- http://www.securityfocus.com/bid/98095 Third Party Advisory, VDB Entry
- https://bugzilla.suse.com/show_bug.cgi?id=1035912 Issue Tracking, Patch
- https://docs.saltstack.com/en/latest/topics/releases/2016.11.4.html Patch, Release Notes, Vendor Advisory
- https://github.com/saltstack/salt/issues/40075 Issue Tracking, Patch, Third Party Advisory
- https://github.com/saltstack/salt/pull/40609 Issue Tracking, Patch, Third Party Advisory
- https://github.com/saltstack/salt/pull/40609/commits/6e34c2b5e5e849302af7ccd00509929c3809c658 Issue Tracking, Patch, Third Party Advisory