GitHub Advisoryadvisory · PyPI

GHSA-7wx3-vr2f-6p29 SaltStack Privilege Escalation vulnerability

HIGH Published 2022-05-17 Modified 2024-11-06 Official page ↗
Aliases
CVE-2013-6617
Ecosystem
PyPI
Packages
salt
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Reviewed
2024-04-30

Affected packages

• PyPI salt: >= 0.11.0, < 0.17.1 → fixed in 0.17.1

Description

The salt master in Salt (aka SaltStack) 0.11.0 through 0.17.0 does not properly drop group privileges, which makes it easier for remote attackers to gain privileges.

Related

Alias · CVE (1)

  • CVE-2013-6617 The salt master in Salt (aka SaltStack) 0.11.0 through 0.17.0 does not properly drop group privileges, which makes it easier for remote… vulnerability

References