GitHub Advisoryadvisory · PyPI

GHSA-xcx4-5wq7-g5g7 SaltStack Salt Information Exposure

HIGH Published 2022-05-17 Modified 2024-10-26 Official page ↗
Aliases
CVE-2017-8109
Ecosystem
PyPI
Packages
salt
Severity
High
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-200
Reviewed
2024-04-22

Affected packages

• PyPI salt: >= 2016.11, < 2016.11.4 → fixed in 2016.11.4

Description

The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients).

Related

Alias · CVE (1)

  • CVE-2017-8109 The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References