PT-2016-4907 · Saltstack · Salt

Publicado 2016-04-12 · Atualizado 2022-05-14 · CVE-2016-1866

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Salt versions 2015.8.x before 2015.8.4

Description The issue allows man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream due to improper handling of clear messages on the minion.

Recommendations For Salt versions 2015.8.x before 2015.8.4, update to version 2015.8.4 or later to resolve the issue.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2016-1866

GHSA-VQH4-CRJF-JJXX

OPENSUSE-SU-2024:10291-1

PYSEC-2016-23

Produtos afetados

Salt

Referências · 12

• https://github.com/saltstack/salt · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2016-23.yaml · Nota
• https://docs.saltstack.com/en/latest/topics/releases/2015.8.4.html · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-1866 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-updates/2016-03/msg00034.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-1866 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2016-1866 · Nota de Segurança
• https://ubuntu.com/security/CVE-2016-1866 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2016-23 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-1866 · Aviso do Fabricante
• https://docs.saltstack.com/en/latest/topics/releases/2015.8.5.html · Nota
• https://osv.dev/vulnerability/GHSA-vqh4-crjf-jjxx · Aviso do Fabricante