PT-2013-5014 · Saltstack+1 · Salt+1

Published 2013-11-05 · Updated 2022-05-17 · CVE-2013-4435

Positive Technologies (AI Summary)

CVSS v4.0

7.7

High

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Salt (aka SaltStack) versions 0.15.0 through 0.17.0

Description The issue allows remote authenticated users who are using external authentication or client ACL to execute restricted routines. This is achieved by embedding the restricted routine in another routine.

Recommendations For Salt (aka SaltStack) versions 0.15.0 through 0.17.0, consider restricting access to routines to prevent unauthorized execution until a patch is available.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

ALT-PU-2013-1179

CVE-2013-4435

GHSA-V89F-4MC4-H6W9

PYSEC-2013-12

Affected Products

Alt Linux

Salt

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2013-4435 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-4435 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2013-4435 · Security Note
• https://osv.dev/vulnerability/PYSEC-2013-12 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v89f-4mc4-h6w9 · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-4435 · Vendor Advisory
• http://docs.saltstack.com/topics/releases/0.17.1.html · Vendor Advisory
• https://github.com/saltstack/salt · Note
• https://github.com/saltstack/salt/blob/master/doc/topics/releases/0.17.1.rst · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2013-12.yaml · Note
• http://openwall.com/lists/oss-security/2013/10/15 · Note
• http://openwall.com/lists/oss-security/2013/10/18/3 · Note