salt@3005rc1 vulnerabilities

salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more.

Affected versions of this package are vulnerable to Improper Certificate Validation via the VirtKey process when on-demand pillar data is requested and unvalidated input is used to construct paths to the pki directory. An attacker can overwrite file contents and potentially auto-accept Minion authentication keys by placing a crafted authorization file at a specific location.

Note:

This is only exploitable if the default configuration is used, which enables this functionality.

Upgrade salt to version 3006.12, 3007.4 or higher.

salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more.

Affected versions of this package are vulnerable to Directory Traversal via the minion file cache creation process. An attacker can write or overwrite files outside of the intended cache directory by supplying crafted input that exploits path traversal.

Upgrade salt to version 3006.12, 3007.4 or higher.

salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more.

Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource via the _minion_event method. An attacker can inject unauthorized events onto the master's event bus by sending crafted requests from an authorized minion.

Upgrade salt to version 3006.12, 3007.4 or higher.

salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more.

Affected versions of this package are vulnerable to Improper Certificate Validation due to improper authentication in the salt.auth.pki module. An attacker can gain unauthorized access by providing only a public certificate in the password field, which is accepted without requiring the corresponding private key.

A fix was pushed into the master branch but not yet published.

salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more.

Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via the pub_ret method due to unsanitized input in the jid parameter used to construct file paths. An attacker can cause the worker process to become unresponsive or crash by supplying a crafted value that targets a special file, such as a pipe node in the proc file system, resulting in a denial of service.

Upgrade salt to version 3006.12, 3007.4 or higher.

salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more.

Affected versions of this package are vulnerable to Replay Attack via the request server process when a TLS encrypted transport is not used. An attacker can replay previously captured requests by intercepting and resending them over an unencrypted channel.

Upgrade salt to version 3006.12, 3007.4 or higher.

salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more.

Affected versions of this package are vulnerable to Improper Certificate Validation due to the skipping of minion token validation in multiple methods. An attacker can impersonate another minion by sending crafted requests to the master.

Upgrade salt to version 3006.12, 3007.4 or higher.

salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more.

Affected versions of this package are vulnerable to Arbitrary Command Injection via the on demand pillar process when a specially crafted git URL is provided. An attacker can execute arbitrary commands on the master with the same privileges as the master process by exploiting access to a minion key.

Upgrade salt to version 3006.12, 3007.4 or higher.

salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more.

Affected versions of this package are vulnerable to Directory Traversal via the recv_file function. An attacker can write arbitrary files to the master cache directory by sending crafted requests.

Upgrade salt to version 3006.12, 3007.4 or higher.

salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more.

Affected versions of this package are vulnerable to Directory Traversal via the serve_file method, due to insufficient checks in the salt/fileserver/roots.py file.

Upgrade salt to version 3005.5 or higher.

salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more.

Affected versions of this package are vulnerable to Directory Traversal when establishing the syndic cache directory on the master.

Upgrade salt to version 3005.5 or higher.

salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more.

Affected versions of this package are vulnerable to Improper Access Control. The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH.

Upgrade salt to version 3005.4, 3006.4 or higher.

salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more.

Affected versions of this package are vulnerable to Information Exposure and other possible impacts, due to a hash collision when using Git Providers reading from different environments. If Git Providers read from the wrong environment because they get the same cache directory base name, they could get bad data or unintended data. This could also lead to wrongful executions, data corruption or a crash.

Upgrade salt to version 3005.2, 3006.2 or higher.

salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more.

Affected versions of this package are vulnerable to Denial of Service (DoS) in the error message decoding mechanism in minion return. If the request server receives a number of requests equal to the number of worker threads, the master will become unresponsive to return requests until it is restarted.

Upgrade salt to version 3005.2, 3006.2 or higher.