Salt allows deleted minions to read or write to minions with the same id
Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2016-9639US | critical9.1 | — | ||
Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching. | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2016/11/25/2WEB
- http://www.openwall.com/lists/oss-security/2016/11/25/3WEB
- https://docs.saltproject.io/en/latest/topics/releases/2015.8.11.html#new-master-configuration-parameterWEB
- https://docs.saltstack.com/en/2015.8/ref/configuration/master.html#rotate-aes-keyWEB
- https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2017-34.yamlWEB
- https://github.com/saltstack/saltPACKAGE
- https://nvd.nist.gov/vuln/detail/CVE-2016-9639ADVISORY
- https://web.archive.org/web/20200227212146/http://www.securityfocus.com/bid/94553WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan