CVE-2017-8109
HighSummary
The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions.
Risk Assessment
Local attackers may gain access to sensitive data, posing a serious security threat to the system.
Recommendation
It is recommended to upgrade to version 2016.11.4 or later to fix the permissions issue.
Other vulnerabilities in SaltStack Salt
See all- CVE-2017-14696High
SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of service via a crafted authentication request.
- CVE-2017-5200High
Salt-api in SaltStack before version 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 allows arbitrary command execution on a salt-master via Salt's ssh_client.
- CVE-2017-5192High
In SaltStack Salt versions before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, the local_batch client from salt-api does not respect external authentication, allowing all authentication to be bypassed.
- CVE-2020-16846CriticalActively exploited
An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.
- CVE-2020-11652MediumActively exploited
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.
- CVE-2020-11651CriticalActively exploited
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls, allowing a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.
- CVE-2017-14695Critical
Directory traversal vulnerability in minion id validation in SaltStack Salt before version 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.
- CVE-2017-12791Critical
CVE-2017-12791 describes a vulnerability in minion ID validation in SaltStack Salt before version 2016.11.7 and 2017.7.x before 2017.7.1. This allows remote minions with incorrect credentials to authenticate to a master using a crafted minion ID.
Original NVD description (English source)
The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS