GitHub Advisoryadvisory · PyPI

GHSA-vpjg-wmf8-29h9 Salt vulnerable to denial of service

MEDIUM Published 2023-09-05 Modified 2025-02-13 Official page ↗
Aliases
CVE-2023-20897
Ecosystem
PyPI
Packages
salt
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-404
Reviewed
2023-09-06

Affected packages

• PyPI salt: < 3005.2 → fixed in 3005.2 • PyPI salt: >= 3006.0rc1, < 3006.2 → fixed in 3006.2

Description

Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted.

Related

Alias · CVE (1)

  • CVE-2023-20897 Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. vulnerability

Weakness · CWE (1)

  • CWE-404 Improper Resource Shutdown or Release weakness

References