PT-2018-8428 · Saltstack+1 · Saltstack Salt+1

Publicado 2017-04-02 · Atualizado 2022-05-13 · CVE-2017-7893

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SaltStack Salt versions prior to 2016.3.6

Description The issue allows compromised salt-minions to impersonate the salt-master.

Recommendations For versions prior to 2016.3.6, update to version 2016.3.6 or later to resolve the issue.

Correção

Identificadores relacionados

ALT-PU-2017-1403

CVE-2017-7893

GHSA-G283-88V5-RMQ2

PYSEC-2018-50

Produtos afetados

Alt Linux

Saltstack Salt

Referências · 14

• https://github.com/saltstack/salt · Nota
• https://github.com/saltstack/salt/issues/48939 · Nota
• https://github.com/saltstack/salt/issues/48939#issuecomment-410777638 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2018-50.yaml · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-7893 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-7893 · Nota de Segurança
• https://docs.saltstack.com/en/2017.7/topics/releases/2016.3.6.html · Aviso do Fabricante
• https://patch-diff.githubusercontent.com/raw/saltstack/salt/pull/40206.patch · Nota
• https://osv.dev/vulnerability/GHSA-g283-88v5-rmq2 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-7893 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2018-50 · Aviso do Fabricante
• https://patch-diff.githubusercontent.com/raw/saltstack/salt/pull/40159.patch · Nota
• https://cve.org/CVERecord?id=CVE-2017-7893 · Nota de Segurança
• https://ubuntu.com/security/CVE-2017-7893 · Aviso do Fabricante