CVE-2016-9639
CriticalSummary
Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching.
Risk Assessment
Deleted minions may gain access to other minions' data, posing a risk of unauthorized access and potential data loss.
Recommendation
It is recommended to upgrade to Salt version 2015.8.11 or later to mitigate this vulnerability.
Other vulnerabilities in Salt
See all- CVE-2015-4017High
Salt versions before 2014.7.6 do not verify certificates when connecting via the aliyun, proxmox, and splunk modules.
- CVE-2016-1866High
Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, allowing man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream.
Original NVD description (English source)
Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching.