GitHub Advisoryadvisory · PyPI

GHSA-qvh6-3j7x-3hq7 Salt can cause Git Providers to get wrong data

MEDIUM Published 2023-09-05 Modified 2025-02-13 Official page ↗
Aliases
CVE-2023-20898
Ecosystem
PyPI
Packages
salt
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Reviewed
2023-09-06

Affected packages

• PyPI salt: < 3005.2 → fixed in 3005.2 • PyPI salt: >= 3006.0rc1, < 3006.2 → fixed in 3006.2

Description

Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environments can get garbage data or the wrong data, which can lead to wrongful data disclosure, wrongful executions, data corruption and/or crash.

Related

Alias · CVE (1)

  • CVE-2023-20898 Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or… vulnerability

References