salt 3001 vulnerabilities

Known vulnerabilities in the salt package. This does not include vulnerabilities belonging to this package’s dependencies.

Vulnerability	Vulnerable Version
M Directory Traversal salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Directory Traversal via the `find_file` function in the GitFS class, where a path is constructed using unvalidated input from the `tgt_env` variable. An attacker can create arbitrary directories or delete files that the Master's process has permissions to by supplying crafted input. How to fix Directory Traversal? Upgrade `salt` to version 3006.12, 3007.4 or higher.	[,3006.12)[3007.0rc1,3007.4)
M Improper Certificate Validation salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Improper Certificate Validation via the `VirtKey` process when on-demand pillar data is requested and unvalidated input is used to construct paths to the pki directory. An attacker can overwrite file contents and potentially auto-accept Minion authentication keys by placing a crafted authorization file at a specific location. Note: This is only exploitable if the default configuration is used, which enables this functionality. How to fix Improper Certificate Validation? Upgrade `salt` to version 3006.12, 3007.4 or higher.	[,3006.12)[3007.0rc1,3007.4)
M Directory Traversal salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Directory Traversal via the `minion file cache creation` process. An attacker can write or overwrite files outside of the intended cache directory by supplying crafted input that exploits path traversal. How to fix Directory Traversal? Upgrade `salt` to version 3006.12, 3007.4 or higher.	[,3006.12)[3007.0rc1,3007.4)
M Incorrect Permission Assignment for Critical Resource salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource via the `_minion_event` method. An attacker can inject unauthorized events onto the master's event bus by sending crafted requests from an authorized minion. How to fix Incorrect Permission Assignment for Critical Resource? Upgrade `salt` to version 3006.12, 3007.4 or higher.	[,3006.12)[3007.0rc1,3007.4)
M Improper Certificate Validation salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Improper Certificate Validation due to improper authentication in the `salt.auth.pki` module. An attacker can gain unauthorized access by providing only a public certificate in the `password` field, which is accepted without requiring the corresponding private key. How to fix Improper Certificate Validation? A fix was pushed into the `master` branch but not yet published.	[0,)
M Improper Validation of Specified Type of Input salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via the `pub_ret` method due to unsanitized input in the `jid` parameter used to construct file paths. An attacker can cause the worker process to become unresponsive or crash by supplying a crafted value that targets a special file, such as a pipe node in the proc file system, resulting in a denial of service. How to fix Improper Validation of Specified Type of Input? Upgrade `salt` to version 3006.12, 3007.4 or higher.	[,3006.12)[3007.0rc1,3007.4)
M Replay Attack salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Replay Attack via the `request server` process when a TLS encrypted transport is not used. An attacker can replay previously captured requests by intercepting and resending them over an unencrypted channel. How to fix Replay Attack? Upgrade `salt` to version 3006.12, 3007.4 or higher.	[,3006.12)[3007.0rc1,3007.4)
M Improper Certificate Validation salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Improper Certificate Validation due to the skipping of minion token validation in multiple methods. An attacker can impersonate another minion by sending crafted requests to the master. How to fix Improper Certificate Validation? Upgrade `salt` to version 3006.12, 3007.4 or higher.	[,3006.12)[3007.0rc1,3007.4)
H Arbitrary Command Injection salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Arbitrary Command Injection via the `on demand` pillar process when a specially crafted git URL is provided. An attacker can execute arbitrary commands on the master with the same privileges as the master process by exploiting access to a minion key. How to fix Arbitrary Command Injection? Upgrade `salt` to version 3006.12, 3007.4 or higher.	[,3006.12)[3007.0rc1,3007.4)
M Directory Traversal salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Directory Traversal via the `recv_file` function. An attacker can write arbitrary files to the master cache directory by sending crafted requests. How to fix Directory Traversal? Upgrade `salt` to version 3006.12, 3007.4 or higher.	[,3006.12)[3007.0rc1,3007.4)
H Directory Traversal salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Directory Traversal via the `serve_file` method, due to insufficient checks in the `salt/fileserver/roots.py` file. How to fix Directory Traversal? Upgrade `salt` to version 3005.5 or higher.	[,3005.5)
H Directory Traversal salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Directory Traversal when establishing the syndic cache directory on the master. How to fix Directory Traversal? Upgrade `salt` to version 3005.5 or higher.	[,3005.5)
M Improper Access Control salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Improper Access Control. The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH. How to fix Improper Access Control? Upgrade `salt` to version 3005.4, 3006.4 or higher.	[,3005.4)[3006.0rc1,3006.4)
M Information Exposure salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Information Exposure and other possible impacts, due to a hash collision when using Git Providers reading from different environments. If Git Providers read from the wrong environment because they get the same cache directory base name, they could get bad data or unintended data. This could also lead to wrongful executions, data corruption or a crash. How to fix Information Exposure? Upgrade `salt` to version 3005.2, 3006.2 or higher.	[,3005.2)[3006.0rc1,3006.2)
H Denial of Service (DoS) salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Denial of Service (DoS) in the error message decoding mechanism in minion return. If the request server receives a number of requests equal to the number of worker threads, the master will become unresponsive to return requests until it is restarted. How to fix Denial of Service (DoS)? Upgrade `salt` to version 3005.2, 3006.2 or higher.	[,3005.2)[3006.0rc1,3006.2)
H Buffer Overflow salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Buffer Overflow via the `status` function. How to fix Buffer Overflow? There is no fixed version for `salt`.	[0,)
H Denial of Service (DoS) salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Denial of Service (DoS) in `junos ifconfig` output parsing. How to fix Denial of Service (DoS)? Upgrade `salt` to version 3004.1 or higher.	[,3004.1)
H Access Restriction Bypass salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Access Restriction Bypass where a previously authorized user whose account is locked can still run Salt commands. This affects both local shell accounts with an active session and `salt-api` users that authenticate via `PAM` `eauth`. Workaround: If the user can not upgrade to the fixed version, it is possible to: remove locked accounts rather than rely on Salt’s PAM `eauth` functionality. change to a different `eauth` module. How to fix Access Restriction Bypass? Upgrade `salt` to version 3002.9, 3003.5, 3004.2 or higher.	[,3002.9)[3003,3003.5)[3004,3004.2)
H Improper Access Control salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Improper Access Control which allows users specified in the `publisher_acl` to publish authorized commands to any configured minion. Note: This requires a syndic master combined with `publisher_acl` configured on the Master-of-Masters. How to fix Improper Access Control? Upgrade `salt` to version 3002.8, 3003.4, 3004.1 or higher.	[,3002.8)[3003,3003.4)[3004,3004.1)
M Denial of Service (DoS) salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Denial of Service (DoS). A MiTM attacker to force a minion process to stop by impersonating a master. How to fix Denial of Service (DoS)? Upgrade `salt` to version 3002.8, 3003.4, 3004.1 or higher.	[,3002.8)[3003,3003.4)[3004,3004.1)
H Access Restriction Bypass salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Access Restriction Bypass which can allow attackers to substitute arbitrary pillar data, because Salt Masters do not sign pillar data with the minion’s public key. How to fix Access Restriction Bypass? Upgrade `salt` to version 3002.8, 3003.4, 3004.1 or higher.	[,3002.8)[3003,3003.4)[3004,3004.1)
M Authentication Bypass salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Authentication Bypass which can result in an attacker replaying job publishes causing minions to run old jobs. File server replies can also be re-played. A sufficient craft attacker could gain root access to minion under certain scenarios. How to fix Authentication Bypass? Upgrade `salt` to version 3002.8, 3003.4, 3004.1 or higher.	[,3002.8)[3003,3003.4)[3004,3004.1)
H Privilege Escalation salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Privilege Escalation. A user who has control of the source and `source_hash` URLs, can gain full file system access as root on a salt minion. How to fix Privilege Escalation? Upgrade `salt` to version 3001.8, 3002.7, 3003.3 or higher.	[,3001.8)[3002rc1,3002.7)[3003rc1,3003.3)
M Privilege Escalation salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Privilege Escalation. The `salt` minion installer will accept and use a minion config file at `C:\salt\conf` if that file is in place before the installer is run. This allows for a malicious actor to subvert the proper behavior of the given minion software. The malicious actor must have access to a Windows system, permission to create directories and files on the root of the system drive, and create a malicious minion config at `C:\salt\conf`. How to fix Privilege Escalation? Upgrade `salt` to version 3001.8, 3002.7, 3003.3 or higher.	[,3001.8)[3002rc1,3002.7)[3003rc1,3003.3)
H Command Injection salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Command Injection via the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the `snapper.diff` function (which executes `popen` unsafely). How to fix Command Injection? Upgrade `salt` to version 3003rc1 or higher.	[2016.11.0rc1,3003rc1)
H Command Injection salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Command Injection. The Salt-API’s SSH client is vulnerable to a shell injection by including `ProxyCommand` in an argument, or via `ssh_options` provided in an API request. How to fix Command Injection? Upgrade `salt` to version 3002.5, 3001.6, 3000.8 or higher.	[3002rc1,3002.5)[3001rc1,3001.6)[,3000.8)
H Improper Authorization salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Improper Authorization. The SaltAPI does not honor eauth credentials for the `wheel_async` client. Thus, an attacker can remotely run any wheel modules on the master. How to fix Improper Authorization? Upgrade `salt` to version 3002.5, 3001.6, 3000.8 or higher.	[3002rc1,3002.5)[3001rc1,3001.6)[,3000.8)
M Directory Traversal salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Directory Traversal. The `salt.wheel.pillar_roots.write` method is vulnerable to directory traversal. Unauthorized access to `wheel_async` through salt-api can execute arbitrarily code/command. How to fix Directory Traversal? Upgrade `salt` to version 3002.5, 3001.6, 3000.8 or higher.	[3002rc1,3002.5)[3001rc1,3001.6)[,3000.8)
H Server-side Template Injection (SSTI) salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Server-side Template Injection (SSTI). The jinja renderer does not protect against server-side template injection attacks. This could be abused via the SaltAPI fix directory traversal in `wheel.pillar_roots.write`. How to fix Server-side Template Injection (SSTI)? Upgrade `salt` to version 3002.5, 3001.6, 3000.8 or higher.	[3002rc1,3002.5)[3001rc1,3001.6)[,3000.8)
M Command Injection salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Command Injection. A command injection in `salt.utils.thin.gen_thin()` exists How to fix Command Injection? Upgrade `salt` to version 3002.5, 3001.6, 3000.8 or higher.	[3002rc1,3002.5)[3001rc1,3001.6)[,3000.8)
M Sensitive Data Exposure salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Sensitive Data Exposure webutils write passwords in cleartext to `/var/log/salt/minion`. How to fix Sensitive Data Exposure? Upgrade `salt` to version 3002.5, 3001.6, 3000.8 or higher.	[3002rc1,3002.5)[3001rc1,3001.6)[,3000.8)
H Man-in-the-Middle (MitM) salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Man-in-the-Middle (MitM). The SaltStack Code base not validating SSL/TLS certificate of the server, which might allow attackers to obtain sensitive information via a man-in-the-middle attack How to fix Man-in-the-Middle (MitM)? Upgrade `salt` to version 3002.5, 3001.6, 3000.8 or higher.	[3002rc1,3002.5)[3001rc1,3001.6)[,3000.8)
M Sensitive Data Exposure salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Sensitive Data Exposure eauth tokens can be used once after expiration. How to fix Sensitive Data Exposure? Upgrade `salt` to version 3002.5, 3001.6, 3000.8 or higher.	[3002rc1,3002.5)[3001rc1,3001.6)[,3000.8)
M Local Privilege Escalation salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Local Privilege Escalation. A privilege escalation is possible on a SaltStack minion when an unprivileged user is able to create files in any non-blacklisted directory via a command injection in a process name. How to fix Local Privilege Escalation? Upgrade `salt` to version 3002.5, 3001.6, 3000.8 or higher.	[3002rc1,3002.5)[3001rc1,3001.6)[,3000.8)
H Improper Certificate Validation salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Improper Certificate Validation. Several places where Salt was not verifying the SSL cert by default. This has now been remediated. How to fix Improper Certificate Validation? Upgrade `salt` to version 3002.5, 3001.6, 3000.8 or higher.	[3002rc1,3002.5)[3001rc1,3001.6)[,3000.8)
H Remote Code Execution (RCE) salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Remote Code Execution (RCE). Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection. How to fix Remote Code Execution (RCE)? Upgrade `salt` to version 3000.4, 3001.2 or higher.	[,3000.4)[3001,3001.2)
M Improper Access Control salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Improper Access Control. When using the functions `create_ca`, `create_csr`, and `create_self_signed_cert` in the `tls` execution module, it does not ensure the key was created with the correct permissions, creating keys with world-readable permissions. How to fix Improper Access Control? Upgrade `salt` to version 3000.4, 3001.2, 3002.1 or higher.	[,3000.4)[3001,3001.2)[3002,3002.1)

Vulnerability

Vulnerable Version

Directory Traversal

salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more.

Affected versions of this package are vulnerable to Directory Traversal via the find_file function in the GitFS class, where a path is constructed using unvalidated input from the tgt_env variable. An attacker can create arbitrary directories or delete files that the Master's process has permissions to by supplying crafted input.

How to fix Directory Traversal?

Upgrade salt to version 3006.12, 3007.4 or higher.

[,3006.12)[3007.0rc1,3007.4)

Improper Certificate Validation

Affected versions of this package are vulnerable to Improper Certificate Validation via the VirtKey process when on-demand pillar data is requested and unvalidated input is used to construct paths to the pki directory. An attacker can overwrite file contents and potentially auto-accept Minion authentication keys by placing a crafted authorization file at a specific location.

Note:

This is only exploitable if the default configuration is used, which enables this functionality.

How to fix Improper Certificate Validation?

Upgrade salt to version 3006.12, 3007.4 or higher.

[,3006.12)[3007.0rc1,3007.4)

Directory Traversal

Affected versions of this package are vulnerable to Directory Traversal via the minion file cache creation process. An attacker can write or overwrite files outside of the intended cache directory by supplying crafted input that exploits path traversal.

How to fix Directory Traversal?

Upgrade salt to version 3006.12, 3007.4 or higher.

[,3006.12)[3007.0rc1,3007.4)

Incorrect Permission Assignment for Critical Resource

Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource via the _minion_event method. An attacker can inject unauthorized events onto the master's event bus by sending crafted requests from an authorized minion.

How to fix Incorrect Permission Assignment for Critical Resource?

Upgrade salt to version 3006.12, 3007.4 or higher.

[,3006.12)[3007.0rc1,3007.4)

Improper Certificate Validation

Affected versions of this package are vulnerable to Improper Certificate Validation due to improper authentication in the salt.auth.pki module. An attacker can gain unauthorized access by providing only a public certificate in the password field, which is accepted without requiring the corresponding private key.

How to fix Improper Certificate Validation?

A fix was pushed into the master branch but not yet published.

[0,)

Improper Validation of Specified Type of Input

Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via the pub_ret method due to unsanitized input in the jid parameter used to construct file paths. An attacker can cause the worker process to become unresponsive or crash by supplying a crafted value that targets a special file, such as a pipe node in the proc file system, resulting in a denial of service.

How to fix Improper Validation of Specified Type of Input?

Upgrade salt to version 3006.12, 3007.4 or higher.

[,3006.12)[3007.0rc1,3007.4)

Replay Attack

Affected versions of this package are vulnerable to Replay Attack via the request server process when a TLS encrypted transport is not used. An attacker can replay previously captured requests by intercepting and resending them over an unencrypted channel.

How to fix Replay Attack?

Upgrade salt to version 3006.12, 3007.4 or higher.

[,3006.12)[3007.0rc1,3007.4)

Improper Certificate Validation

Affected versions of this package are vulnerable to Improper Certificate Validation due to the skipping of minion token validation in multiple methods. An attacker can impersonate another minion by sending crafted requests to the master.

How to fix Improper Certificate Validation?

Upgrade salt to version 3006.12, 3007.4 or higher.

[,3006.12)[3007.0rc1,3007.4)

Arbitrary Command Injection

Affected versions of this package are vulnerable to Arbitrary Command Injection via the on demand pillar process when a specially crafted git URL is provided. An attacker can execute arbitrary commands on the master with the same privileges as the master process by exploiting access to a minion key.

How to fix Arbitrary Command Injection?

Upgrade salt to version 3006.12, 3007.4 or higher.

[,3006.12)[3007.0rc1,3007.4)

Directory Traversal

Affected versions of this package are vulnerable to Directory Traversal via the recv_file function. An attacker can write arbitrary files to the master cache directory by sending crafted requests.

How to fix Directory Traversal?

Upgrade salt to version 3006.12, 3007.4 or higher.

[,3006.12)[3007.0rc1,3007.4)

Directory Traversal

Affected versions of this package are vulnerable to Directory Traversal via the serve_file method, due to insufficient checks in the salt/fileserver/roots.py file.

How to fix Directory Traversal?

Upgrade salt to version 3005.5 or higher.

[,3005.5)

Directory Traversal

Affected versions of this package are vulnerable to Directory Traversal when establishing the syndic cache directory on the master.

How to fix Directory Traversal?

Upgrade salt to version 3005.5 or higher.

[,3005.5)

Improper Access Control

Affected versions of this package are vulnerable to Improper Access Control. The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH.

How to fix Improper Access Control?

Upgrade salt to version 3005.4, 3006.4 or higher.

[,3005.4)[3006.0rc1,3006.4)

Information Exposure

Affected versions of this package are vulnerable to Information Exposure and other possible impacts, due to a hash collision when using Git Providers reading from different environments. If Git Providers read from the wrong environment because they get the same cache directory base name, they could get bad data or unintended data. This could also lead to wrongful executions, data corruption or a crash.

How to fix Information Exposure?

Upgrade salt to version 3005.2, 3006.2 or higher.

[,3005.2)[3006.0rc1,3006.2)

Denial of Service (DoS)

Affected versions of this package are vulnerable to Denial of Service (DoS) in the error message decoding mechanism in minion return. If the request server receives a number of requests equal to the number of worker threads, the master will become unresponsive to return requests until it is restarted.

How to fix Denial of Service (DoS)?

Upgrade salt to version 3005.2, 3006.2 or higher.

[,3005.2)[3006.0rc1,3006.2)

Buffer Overflow

Affected versions of this package are vulnerable to Buffer Overflow via the status function.

How to fix Buffer Overflow?

There is no fixed version for salt.

[0,)

Denial of Service (DoS)

Affected versions of this package are vulnerable to Denial of Service (DoS) in junos ifconfig output parsing.

How to fix Denial of Service (DoS)?

Upgrade salt to version 3004.1 or higher.

[,3004.1)

Access Restriction Bypass

Affected versions of this package are vulnerable to Access Restriction Bypass where a previously authorized user whose account is locked can still run Salt commands. This affects both local shell accounts with an active session and salt-api users that authenticate via PAM eauth.

Workaround: If the user can not upgrade to the fixed version, it is possible to:

remove locked accounts rather than rely on Salt’s PAM eauth functionality.
change to a different eauth module.

How to fix Access Restriction Bypass?

Upgrade salt to version 3002.9, 3003.5, 3004.2 or higher.

[,3002.9)[3003,3003.5)[3004,3004.2)

Improper Access Control

Affected versions of this package are vulnerable to Improper Access Control which allows users specified in the publisher_acl to publish authorized commands to any configured minion. Note: This requires a syndic master combined with publisher_acl configured on the Master-of-Masters.

How to fix Improper Access Control?

Upgrade salt to version 3002.8, 3003.4, 3004.1 or higher.

[,3002.8)[3003,3003.4)[3004,3004.1)

Denial of Service (DoS)

Affected versions of this package are vulnerable to Denial of Service (DoS). A MiTM attacker to force a minion process to stop by impersonating a master.

How to fix Denial of Service (DoS)?

Upgrade salt to version 3002.8, 3003.4, 3004.1 or higher.

[,3002.8)[3003,3003.4)[3004,3004.1)

Access Restriction Bypass

Affected versions of this package are vulnerable to Access Restriction Bypass which can allow attackers to substitute arbitrary pillar data, because Salt Masters do not sign pillar data with the minion’s public key.

How to fix Access Restriction Bypass?

Upgrade salt to version 3002.8, 3003.4, 3004.1 or higher.

[,3002.8)[3003,3003.4)[3004,3004.1)

Authentication Bypass

Affected versions of this package are vulnerable to Authentication Bypass which can result in an attacker replaying job publishes causing minions to run old jobs. File server replies can also be re-played. A sufficient craft attacker could gain root access to minion under certain scenarios.

How to fix Authentication Bypass?

Upgrade salt to version 3002.8, 3003.4, 3004.1 or higher.

[,3002.8)[3003,3003.4)[3004,3004.1)

Privilege Escalation

Affected versions of this package are vulnerable to Privilege Escalation. A user who has control of the source and source_hash URLs, can gain full file system access as root on a salt minion.

How to fix Privilege Escalation?

Upgrade salt to version 3001.8, 3002.7, 3003.3 or higher.

[,3001.8)[3002rc1,3002.7)[3003rc1,3003.3)

Privilege Escalation

Affected versions of this package are vulnerable to Privilege Escalation. The salt minion installer will accept and use a minion config file at C:\salt\conf if that file is in place before the installer is run. This allows for a malicious actor to subvert the proper behavior of the given minion software.

The malicious actor must have access to a Windows system, permission to create directories and files on the root of the system drive, and create a malicious minion config at C:\salt\conf.

How to fix Privilege Escalation?

Upgrade salt to version 3001.8, 3002.7, 3003.3 or higher.

[,3001.8)[3002rc1,3002.7)[3003rc1,3003.3)

Command Injection

Affected versions of this package are vulnerable to Command Injection via the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely).

How to fix Command Injection?

Upgrade salt to version 3003rc1 or higher.

[2016.11.0rc1,3003rc1)

Command Injection

Affected versions of this package are vulnerable to Command Injection. The Salt-API’s SSH client is vulnerable to a shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request.

How to fix Command Injection?

Upgrade salt to version 3002.5, 3001.6, 3000.8 or higher.