CVE-2017-8109 SaltStack Salt Information Exposure
HighCVSS 7.8
EPSS 0.43%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi salt(PyPI) | >= 2016.11, < 2016.11.4 | 2016.11.4 |
| pypi salt(PyPI) | = 2016.11.0 | No fix listed |
| pypi salt(PyPI) | = 2016.11.1 | No fix listed |
| pypi salt(PyPI) | = 2016.11.2 | No fix listed |
| pypi salt(PyPI) | = 2016.11.3 | No fix listed |
| saltstack salt | = 2016.11 | No fix listed |
| saltstack salt | = 2016.11.0 | No fix listed |
| saltstack salt | = 2016.11.0-rc1 | No fix listed |
| saltstack salt | = 2016.11.0-rc2 | No fix listed |
| saltstack salt | = 2016.11.1 | No fix listed |
| saltstack salt | = 2016.11.2 | No fix listed |
| saltstack salt | = 2016.11.3 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking patch third-party-advisory
- github.com issue-tracking patch third-party-advisory
- github.com issue-tracking patch third-party-advisory
- bugzilla.suse.com issue-tracking patch
- github.com
- github.com product
- docs.saltstack.com patch release-notes vendor-advisory
- 98095 third-party-advisory vdb-entry
- github.com vendor-advisory