CVE-2016-1866

High

Published: 12/04/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, allowing man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream.

Risk Assessment

Attackers can gain control over the minion, potentially leading to data leakage or malicious actions within the organization's infrastructure.

Recommendation

It is recommended to upgrade Salt to version 2015.8.4 or later to mitigate this vulnerability.

Other vulnerabilities in Salt

See all

CVE-2015-4017High
Salt versions before 2014.7.6 do not verify certificates when connecting via the aliyun, proxmox, and splunk modules.
CVE-2016-9639Critical
Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching.

Original NVD description (English source)

Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream.