DISPUTED Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the func variable in salt/salt/modules/status.py file. NOTE: this is disputed by third parties because an attacker cannot influence the eval input
A Incorrect Implementation of Authentication Algorithm vulnerability in of SUSE SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions.
In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master.
Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12791.
An input validation vulnerability with a specially crafted authentication request was discover in salt. A remote attacker can use this for a Denial of Service attack.
A flaw in minion id validation was found which could allow certain minions to authenticate to a master despite not having the correct credentials. To exploit the vulnerability, an attacker must create a salt-minion with an ID containing characters that will cause a directory traversal.
External References:
https://docs.saltstack.com/en/2016.11/topics/releases/2016.11.7.html
Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream.
A vulnerability in winuseradd, salt-cloud and Linode driver were found:
winuseradd returned data including the password of the newly created user salt-cloud debug output contained winpassword and sudopassword authentication credentials Linode driver displayed authentication credentials in debug logs
Upstream patch:
https://github.com/twangboy/salt/commit/c0689e32154c41f59840ae10ffc5fbfa30618710
External reference:
https://docs.saltstack.com/en/latest/topics/releases/2015.8.1.html https://docs.saltstack.com/en/latest/topics/releases/2015.5.6.html
It was found that calling git.clone with https user/pass will leak the authentication details to the log.
Upstream patch:
https://github.com/saltstack/salt/commit/28aa9b105804ff433d8f663b2f9b804f2b75495a
It was found that Salt does not verify the certificate when connecting via the aliyun, proxmox, and splunk modules.
This flaw has been fixed in version 2014.7.6:
https://groups.google.com/forum/#!topic/salt-users/8Kv1bytGD6c
Last updated 24 July 2024
Salt (aka SaltStack) before 0.15.0 through 0.17.0 allows remote authenticated minions to impersonate arbitrary minions via a crafted minion with a valid key.
Salt (aka SaltStack) before 0.17.1 allows remote attackers to execute arbitrary YAML code via unspecified vectors. NOTE: the vendor states that this might not be a vulnerability because the YAML to be loaded has already been determined to be safe.
Unspecified vulnerability in salt-ssh in Salt (aka SaltStack) 0.17.0 has unspecified impact and vectors related to "insecure Usage of /tmp."
Salt (aka SaltStack) 0.15.0 through 0.17.0 allows remote authenticated users who are using external authentication or client ACL to execute restricted routines by embedding the routine in another routine.