GitHub Advisoryadvisory · PyPI

GHSA-vqh4-crjf-jjxx Salt Improper Access Control

HIGH Published 2022-05-14 Modified 2024-10-21 Official page ↗
Aliases
CVE-2016-1866
Ecosystem
PyPI
Packages
salt
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-284
Reviewed
2023-07-28

Affected packages

• PyPI salt: >= 2015.8.0rc1, < 2015.8.4 → fixed in 2015.8.4

Description

Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream.

Related

Alias · CVE (1)

  • CVE-2016-1866 Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References