CVE-2023-20898: High severity SaltStack Salt vulnerability
Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environments can get garbage data or the wrong data, which can lead to wrongful data disclosure, wrongful executions, data corruption and/or crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/saltto a version that resolves this vulnerability.Fixed in 3006.2 - Upgrade
Upgrade
pip/saltto a version that resolves this vulnerability.Fixed in 3005.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3005.2Fixed in 3006.2 - Upgrade
Upgrade
Salt masterto a version that resolves this vulnerability.Fixed in 3005.2 - Upgrade
Upgrade
Salt masterto a version that resolves this vulnerability.Fixed in 3006.2
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2023-20898?
CVE-2023-20898 is a vulnerability in Salt masters prior to version 3005.2 or 3006.2 that allows Git Providers to read from the wrong environment, potentially leading to data disclosure and other issues.
How severe is CVE-2023-20898?
CVE-2023-20898 has a severity rating of 7.8 (high).
Which software versions are affected by CVE-2023-20898?
Salt masters prior to version 3005.2 or 3006.2 are affected by CVE-2023-20898.
How can the vulnerability in CVE-2023-20898 be fixed?
To fix the vulnerability in CVE-2023-20898, upgrade Salt masters to version 3005.2 or 3006.2.
Where can I find more information about CVE-2023-20898?
You can find more information about CVE-2023-20898 in the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-20898), [SaltStack Security Advisory](https://saltproject.io/security-announcements/2023-08-10-advisory/), [GitHub Advisory Database](https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2023-169.yaml).