PT-2013-6050 · Saltstack+1 · Salt+1

Publicado 2013-11-05 · Atualizado 2022-05-17 · CVE-2013-6617

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Salt (aka SaltStack) versions 0.11.0 through 0.17.0

Description The issue is related to the salt master in Salt not properly dropping group privileges. This makes it easier for remote attackers to gain privileges.

Recommendations For Salt (aka SaltStack) versions 0.11.0 through 0.17.0, update to a version where this issue is fixed to prevent remote attackers from gaining privileges.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

ALT-PU-2013-1179

CVE-2013-6617

GHSA-7WX3-VR2F-6P29

PYSEC-2013-15

Produtos afetados

Alt Linux

Salt

Referências · 9

• https://github.com/saltstack/salt · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2013-15.yaml · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-6617 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2013-6617 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-6617 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2013-6617 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-7wx3-vr2f-6p29 · Aviso do Fabricante
• http://docs.saltstack.com/topics/releases/0.17.1.html · Nota
• https://osv.dev/vulnerability/PYSEC-2013-15 · Aviso do Fabricante