CVE-2013-6617: High severity SaltStack Salt vulnerability
Published Nov 5, 2013
·Updated
The salt master in Salt (aka SaltStack) 0.11.0 through 0.17.0 does not properly drop group privileges, which makes it easier for remote attackers to gain privileges.
Affected Software
12 affected componentsFixes available
pip/salt>=0.11.0<0.17.1
0.17.1
SaltStack Salt=0.11.0
SaltStack Salt=0.12.0
SaltStack Salt=0.13.0
SaltStack Salt=0.14.0
SaltStack Salt=0.15.0
SaltStack Salt=0.15.1
SaltStack Salt=0.16.0
SaltStack Salt=0.16.2
SaltStack Salt=0.16.3
SaltStack Salt=0.16.4
SaltStack Salt=0.17.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/saltto a version that resolves this vulnerability.Fixed in 0.17.1
Event History
Nov 5, 2013
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Data Sourced
via NVD·06:55 PM
DescriptionSeverityWeaknessAffected Software
May 17, 2022
Advisory Published
via GitHub·04:58 AM
Frequently Asked Questions
1
What is the severity of CVE-2013-6617?
CVE-2013-6617 is considered a moderate severity vulnerability due to improper privilege handling.
2
How do I fix CVE-2013-6617?
To fix CVE-2013-6617, upgrade to Salt version 0.17.1 or later.
3
What versions of Salt are affected by CVE-2013-6617?
CVE-2013-6617 affects Salt versions from 0.11.0 to 0.17.0.
4
What type of attacks can exploit CVE-2013-6617?
CVE-2013-6617 can be exploited by remote attackers to gain elevated privileges on the affected system.
5
Is CVE-2013-6617 specific to SaltStack?
Yes, CVE-2013-6617 specifically affects SaltStack software versions listed in the vulnerability details.