CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-20898
https://notcve.org/view.php?id=CVE-2023-20898
Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environments can get garbage data or the wrong data, which can lead to wrongful data disclosure, wrongful executions, data corruption and/or crash. Git Providers pueden leer desde el entorno incorrecto porque obtienen el mismo nombre base de directorio de caché en los Salt Masters anteriores a 3005.2 o 3006.2. Cualquier cosa que use proveedores de Git con diferentes entornos puede obtener datos basura o datos incorrectos, lo que puede conducir a la divulgación de datos incorrecta, ejecuciones incorrectas, corrupción de datos y / o bloqueo. • https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OMWJIHQZXHK6FH2E3IWAZCYIRI7FLVOL https://saltproject.io/security-announcements/2023-08-10-advisory •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2023-20897
https://notcve.org/view.php?id=CVE-2023-20897
Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted. Salt masters anteriores a 3005.2 o 3006.2 contienen un DOS en retorno minion. Después de recibir varios paquetes incorrectos en el servidor de solicitudes igual al número de subprocesos de trabajo, el master dejará de responder a las solicitudes de devolución hasta que se reinicie. • https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OMWJIHQZXHK6FH2E3IWAZCYIRI7FLVOL https://saltproject.io/security-announcements/2023-08-10-advisory • CWE-404: Improper Resource Shutdown or Release •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-33226
https://notcve.org/view.php?id=CVE-2021-33226
Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the func variable in salt/salt/modules/status.py file. NOTE: this is disputed by third parties because an attacker cannot influence the eval input • https://bugzilla.suse.com/show_bug.cgi?id=1208473 https://github.com/saltstack/salt/blob/master/salt/modules/status.py • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-22967
https://notcve.org/view.php?id=CVE-2022-22967
An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously authorized user whose account is locked still run Salt commands when their account is locked. This affects both local shell accounts with an active session and salt-api users that authenticate via PAM eauth. Se ha detectado un problema en SaltStack Salt en versiones anteriores a 3002.9, 3003.5, 3004.2. PAM auth falla al rechazar cuentas bloqueadas, lo que permite que un usuario previamente autorizado cuya cuenta está bloqueada siga ejecutando comandos de Salt cuando su cuenta está bloqueada. • https://repo.saltproject.io https://saltproject.io/security_announcements/salt-security-advisory-release-june-21st-2022/%2C https://security.gentoo.org/glsa/202310-22 • CWE-863: Incorrect Authorization •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 1CVE-2021-31607
https://notcve.org/view.php?id=CVE-2021-31607
In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely). En SaltStack Salt versiones 2016.9 hasta 3002.6, se presenta una vulnerabilidad de inyección de comando en el módulo snapper que permite una escalada local de privilegios en un minion. El ataque requiere que sea creado un archivo con un nombre de ruta respaldado por snapper, y que el maestro llame a la función snapper.diff (que ejecuta popen de manera no segura) • https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BUWUF5VTENNP2ZYZBVFKPSUHLKLUBD5 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ACVT7M4YLZRLWWQ6SGRK3C6TOF4FXOXT https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LDKMAJXYFHM4USVX3H5V2GCCBGASWUSM https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MBAHHSGZLEJRCG4DX6J4RBWJ • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •