Product:

Salt

(Saltstack)
Repositories https://github.com/saltstack/salt
#Vulnerabilities 51
Date Id Summary Products Score Patch Annotated
2017-01-30 CVE-2015-8034 The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive information by reading the file. Salt 3.3
2017-04-13 CVE-2015-1839 modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp. Fedora, Salt 5.3
2017-04-13 CVE-2015-1838 modules/serverdensity_device.py in SaltStack before 2014.7.4 does not properly handle files in /tmp. Fedora, Salt 5.3
2014-08-22 CVE-2014-3563 Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud. Salt N/A
2013-11-05 CVE-2013-6617 The salt master in Salt (aka SaltStack) 0.11.0 through 0.17.0 does not properly drop group privileges, which makes it easier for remote attackers to gain privileges. Salt N/A
2013-11-05 CVE-2013-4439 Salt (aka SaltStack) before 0.15.0 through 0.17.0 allows remote authenticated minions to impersonate arbitrary minions via a crafted minion with a valid key. Salt N/A
2013-11-05 CVE-2013-4438 Salt (aka SaltStack) before 0.17.1 allows remote attackers to execute arbitrary YAML code via unspecified vectors. NOTE: the vendor states that this might not be a vulnerability because the YAML to be loaded has already been determined to be safe. Salt N/A
2013-11-05 CVE-2013-4437 Unspecified vulnerability in salt-ssh in Salt (aka SaltStack) 0.17.0 has unspecified impact and vectors related to "insecure Usage of /tmp." Salt N/A
2013-11-05 CVE-2013-4436 The default configuration for salt-ssh in Salt (aka SaltStack) 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle (MITM) attack. Salt N/A
2013-11-05 CVE-2013-4435 Salt (aka SaltStack) 0.15.0 through 0.17.0 allows remote authenticated users who are using external authentication or client ACL to execute restricted routines by embedding the routine in another routine. Salt N/A