PT-2013-5014 · Saltstack+1 · Salt+1

Publicado 2013-11-05 · Atualizado 2022-05-17 · CVE-2013-4435

Positive Technologies (AI Summary)

CVSS v4.0

7.7

Alta

Vetor base

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Salt (aka SaltStack) versions 0.15.0 through 0.17.0

Description The issue allows remote authenticated users who are using external authentication or client ACL to execute restricted routines. This is achieved by embedding the restricted routine in another routine.

Recommendations For Salt (aka SaltStack) versions 0.15.0 through 0.17.0, consider restricting access to routines to prevent unauthorized execution until a patch is available.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

ALT-PU-2013-1179

CVE-2013-4435

GHSA-V89F-4MC4-H6W9

PYSEC-2013-12

Produtos afetados

Alt Linux

Salt

Referências · 12

• https://github.com/saltstack/salt · Nota
• https://github.com/saltstack/salt/blob/master/doc/topics/releases/0.17.1.rst · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2013-12.yaml · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-4435 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-4435 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2013-4435 · Nota de Segurança
• https://osv.dev/vulnerability/PYSEC-2013-12 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-v89f-4mc4-h6w9 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2013-4435 · Aviso do Fabricante
• http://docs.saltstack.com/topics/releases/0.17.1.html · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2013/10/15 · Nota
• http://openwall.com/lists/oss-security/2013/10/18/3 · Nota