CVE-2015-4017
HighSummary
Salt versions before 2014.7.6 do not verify certificates when connecting via the aliyun, proxmox, and splunk modules.
Risk Assessment
The lack of certificate verification may lead to man-in-the-middle attacks, jeopardizing the integrity and confidentiality of data transmitted through these modules.
Recommendation
It is recommended to upgrade Salt to version 2014.7.6 or later to ensure certificate verification.
Other vulnerabilities in Salt
See all- CVE-2016-1866High
Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, allowing man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream.
- CVE-2016-9639Critical
Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching.
Original NVD description (English source)
Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules.