PT-2017-10230 · Saltstack+1 · Salt+1

Dario Leidi · Published 2016-09-07 · Updated 2022-05-17 · CVE-2016-9639

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Salt versions prior to 2015.8.11 Salt (affected versions not specified)

Description The issue allows deleted minions to read or write to minions with the same id due to caching.

Recommendations For versions prior to 2015.8.11, update to version 2015.8.11 or later to resolve the issue. At the moment, there is no information about additional mitigation measures for other affected versions.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

ALT-PU-2016-1939

CVE-2016-9639

GHSA-HVMJ-356C-GPF4

OPENSUSE-SU-2024:11364-1

PYSEC-2017-34

SUSE-RU-2017:0169-1

SUSE-RU-2017:0171-1

SUSE-RU-2017:0174-1

Affected Products

Alt Linux

Salt

References · 38

• https://osv.dev/vulnerability/SUSE-RU-2017:0169-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2017-34 · Vendor Advisory
• https://docs.saltstack.com/en/2015.8/ref/configuration/master.html#rotate-aes-key · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-9639 · Security Note
• https://cve.org/CVERecord?id=CVE-2016-9639 · Security Note
• https://osv.dev/vulnerability/SUSE-RU-2017:0171-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hvmj-356c-gpf4 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-RU-2017:0174-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-9639 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-9639 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-9639 · Vendor Advisory
• https://github.com/saltstack/salt · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2017-34.yaml · Note
• https://bugzilla.suse.com/1003449 · Note
• https://bugzilla.suse.com/1016475 · Note