CVE-2016-1866: High severity saltstack vulnerability
Published Apr 12, 2016
·Updated
Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream.
Affected Software
6 affected componentsFixes available
pip/salt>=2015.8.0rc1<2015.8.4
2015.8.4
SaltStack Salt=2015.8.0
SaltStack Salt=2015.8.1
SaltStack Salt=2015.8.2
SaltStack Salt=2015.8.3
openSUSE Leap=42.1
Event History
Apr 12, 2016
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Data Sourced
via NVD·02:59 PM
DescriptionSeverityWeaknessAffected Software
May 14, 2022
Advisory Published
02:11 AM
Frequently Asked Questions
1
What is the severity of CVE-2016-1866?
CVE-2016-1866 has a high severity rating due to its potential for arbitrary code execution.
2
How do I fix CVE-2016-1866?
To fix CVE-2016-1866, upgrade Salt to version 2015.8.4 or later.
3
Which versions of Salt are affected by CVE-2016-1866?
CVE-2016-1866 affects Salt versions 2015.8.0 through 2015.8.3.
4
Can CVE-2016-1866 allow remote code execution?
Yes, CVE-2016-1866 can allow man-in-the-middle attackers to execute arbitrary code.
5
What systems are affected by CVE-2016-1866?
CVE-2016-1866 impacts systems running Salt versions prior to 2015.8.4, including specific openSUSE versions.