CVE-2016-1866 Salt Improper Access Control
HighCVSS 8.1
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi salt(PyPI) | >= 2015.8.0rc1, < 2015.8.4 | 2015.8.4 |
| pypi salt(PyPI) | = 2015.8.0 | No fix listed |
| pypi salt(PyPI) | = 2015.8.0rc1 | No fix listed |
| pypi salt(PyPI) | = 2015.8.0rc2 | No fix listed |
| pypi salt(PyPI) | = 2015.8.0rc3 | No fix listed |
| pypi salt(PyPI) | = 2015.8.0rc4 | No fix listed |
| pypi salt(PyPI) | = 2015.8.0rc5 | No fix listed |
| pypi salt(PyPI) | = 2015.8.1 | No fix listed |
| pypi salt(PyPI) | = 2015.8.2 | No fix listed |
| pypi salt(PyPI) | = 2015.8.3 | No fix listed |
| pypi salt(PyPI) | >= 2015.8, < 2015.8.4 | 2015.8.4 |
| saltstack salt | = 2015.8.0 | No fix listed |
| saltstack salt | = 2015.8.1 | No fix listed |
| saltstack salt | = 2015.8.2 | No fix listed |
| saltstack salt | = 2015.8.3 | No fix listed |
| openSUSE leap | = 42.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- docs.saltstack.com vendor-advisory
- github.com
- github.com product
- openSUSE-SU-2016:0694 vendor-advisory
- github.com vendor-advisory