CVE-2023-20897: Medium severity SaltStack Salt vulnerability
DOS in minion return.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/saltto a version that resolves this vulnerability.Fixed in 3006.2 - Upgrade
Upgrade
pip/saltto a version that resolves this vulnerability.Fixed in 3005.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3005.2Fixed in 3006.2 - Upgrade
Upgrade
Saltto a version that resolves this vulnerability.Fixed in 3005.2 - Upgrade
Upgrade
Saltto a version that resolves this vulnerability.Fixed in 3006.2 - Compensating control
Firewall Salt master port 4506 to block access from untrusted sources and security scanning software.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2023-20897?
CVE-2023-20897 is a vulnerability in Salt masters prior to 3005.2 or 3006.2 that allows denial-of-service attacks through minion return.
How does CVE-2023-20897 affect Salt masters?
CVE-2023-20897 makes Salt masters unresponsive to return requests until restarted after receiving several bad packets on the request server.
What is the severity of CVE-2023-20897?
The severity of CVE-2023-20897 is medium, with a CVSS score of 5.3.
How can I fix CVE-2023-20897?
To fix CVE-2023-20897, upgrade your Salt master to version 3005.2 or 3006.2.
Where can I find more information about CVE-2023-20897?
You can find more information about CVE-2023-20897 [here](https://nvd.nist.gov/vuln/detail/CVE-2023-20897), [here](https://saltproject.io/security-announcements/2023-08-10-advisory/), and [here](https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2023-166.yaml).