CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-20898
https://notcve.org/view.php?id=CVE-2023-20898
Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environments can get garbage data or the wrong data, which can lead to wrongful data disclosure, wrongful executions, data corruption and/or crash. Git Providers pueden leer desde el entorno incorrecto porque obtienen el mismo nombre base de directorio de caché en los Salt Masters anteriores a 3005.2 o 3006.2. Cualquier cosa que use proveedores de Git con diferentes entornos puede obtener datos basura o datos incorrectos, lo que puede conducir a la divulgación de datos incorrecta, ejecuciones incorrectas, corrupción de datos y / o bloqueo. • https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OMWJIHQZXHK6FH2E3IWAZCYIRI7FLVOL https://saltproject.io/security-announcements/2023-08-10-advisory •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2023-20897
https://notcve.org/view.php?id=CVE-2023-20897
Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted. Salt masters anteriores a 3005.2 o 3006.2 contienen un DOS en retorno minion. Después de recibir varios paquetes incorrectos en el servidor de solicitudes igual al número de subprocesos de trabajo, el master dejará de responder a las solicitudes de devolución hasta que se reinicie. • https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OMWJIHQZXHK6FH2E3IWAZCYIRI7FLVOL https://saltproject.io/security-announcements/2023-08-10-advisory • CWE-404: Improper Resource Shutdown or Release •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-33226
https://notcve.org/view.php?id=CVE-2021-33226
Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the func variable in salt/salt/modules/status.py file. NOTE: this is disputed by third parties because an attacker cannot influence the eval input • https://bugzilla.suse.com/show_bug.cgi?id=1208473 https://github.com/saltstack/salt/blob/master/salt/modules/status.py • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-22967
https://notcve.org/view.php?id=CVE-2022-22967
An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously authorized user whose account is locked still run Salt commands when their account is locked. This affects both local shell accounts with an active session and salt-api users that authenticate via PAM eauth. Se ha detectado un problema en SaltStack Salt en versiones anteriores a 3002.9, 3003.5, 3004.2. PAM auth falla al rechazar cuentas bloqueadas, lo que permite que un usuario previamente autorizado cuya cuenta está bloqueada siga ejecutando comandos de Salt cuando su cuenta está bloqueada. • https://repo.saltproject.io https://saltproject.io/security_announcements/salt-security-advisory-release-june-21st-2022/%2C https://security.gentoo.org/glsa/202310-22 • CWE-863: Incorrect Authorization •
CVSS: 6.4EPSS: 0%CPEs: 5EXPL: 0CVE-2021-22004
https://notcve.org/view.php?id=CVE-2021-22004
An issue was discovered in SaltStack Salt before 3003.3. The salt minion installer will accept and use a minion config file at C:\salt\conf if that file is in place before the installer is run. This allows for a malicious actor to subvert the proper behaviour of the given minion software. Se detectó un problema en SaltStack Salt versiones anteriores a 3003.3. El instalador de minions de Salt aceptará y usará un archivo de configuración de minions en C:\salt\conf si ese archivo está en su lugar antes de que se ejecute el instalador. • https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BUWUF5VTENNP2ZYZBVFKPSUHLKLUBD5 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ACVT7M4YLZRLWWQ6SGRK3C6TOF4FXOXT https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MBAHHSGZLEJRCG4DX6J4RBWJAAWH55RQ https://saltproject.io/security_announcements/salt-security-advisory-2021-sep-02 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •