PT-2013-6050 · Saltstack+1 · Salt+1

Published 2013-11-05 · Updated 2022-05-17 · CVE-2013-6617

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Salt (aka SaltStack) versions 0.11.0 through 0.17.0

Description The issue is related to the salt master in Salt not properly dropping group privileges. This makes it easier for remote attackers to gain privileges.

Recommendations For Salt (aka SaltStack) versions 0.11.0 through 0.17.0, update to a version where this issue is fixed to prevent remote attackers from gaining privileges.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

ALT-PU-2013-1179

CVE-2013-6617

GHSA-7WX3-VR2F-6P29

PYSEC-2013-15

Affected Products

Alt Linux

Salt

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2013-6617 · Security Note
• https://cve.org/CVERecord?id=CVE-2013-6617 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-6617 · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-6617 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7wx3-vr2f-6p29 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2013-15 · Vendor Advisory
• https://github.com/saltstack/salt · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2013-15.yaml · Note
• http://docs.saltstack.com/topics/releases/0.17.1.html · Note