CVE-2016-9639: Critical severity SaltStack Salt vulnerability
Published Feb 7, 2017
·Updated
Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching.
Affected Software
2 affected componentsFixes available
pip/salt<2015.8.11
2015.8.11
SaltStack Salt<=2015.8.10
Event History
Feb 7, 2017
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Data Sourced
via NVD·05:59 PM
DescriptionSeverityWeaknessAffected Software
May 17, 2022
Advisory Published
via GitHub·03:00 AM
Frequently Asked Questions
1
What is the severity of CVE-2016-9639?
CVE-2016-9639 has a medium severity rating due to its potential for unauthorized access.
2
How do I fix CVE-2016-9639?
To resolve CVE-2016-9639, upgrade Salt to version 2015.8.11 or later.
3
What is CVE-2016-9639 about?
CVE-2016-9639 allows deleted minions to interact with other minions sharing the same ID due to caching issues.
4
Which versions of Salt are affected by CVE-2016-9639?
Versions of Salt prior to 2015.8.11 are affected by CVE-2016-9639.
5
What should I do if I cannot upgrade to patch CVE-2016-9639?
If upgrading is not possible, consider implementing strict access controls to mitigate the risks associated with CVE-2016-9639.