Vulnerabilities (CVE)

Filtered by vendor Saltstack Subscribe
Total 17 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2021-25282 3 Debian, Fedoraproject, Saltstack 3 Debian Linux, Fedora, Salt 2022-01-03 6.4 MEDIUM 9.1 CRITICAL
An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal.
CVE-2020-16846 2 Debian, Saltstack 2 Debian Linux, Salt 2022-01-03 7.5 HIGH 9.8 CRITICAL
An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.
CVE-2021-3197 3 Debian, Fedoraproject, Saltstack 3 Debian Linux, Fedora, Salt 2022-01-03 7.5 HIGH 9.8 CRITICAL
An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request.
CVE-2021-25281 3 Debian, Fedoraproject, Saltstack 3 Debian Linux, Fedora, Salt 2021-11-23 7.5 HIGH 9.8 CRITICAL
An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master.
CVE-2021-25283 3 Debian, Fedoraproject, Saltstack 3 Debian Linux, Fedora, Salt 2021-11-23 7.5 HIGH 9.8 CRITICAL
An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks.
CVE-2021-3148 3 Debian, Fedoraproject, Saltstack 3 Debian Linux, Fedora, Salt 2021-11-23 7.5 HIGH 9.8 CRITICAL
An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py.
CVE-2021-3144 3 Debian, Fedoraproject, Saltstack 3 Debian Linux, Fedora, Salt 2021-11-23 7.5 HIGH 9.1 CRITICAL
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)
CVE-2020-11651 3 Debian, Opensuse, Saltstack 3 Debian Linux, Leap, Salt 2021-07-21 7.5 HIGH 9.8 CRITICAL
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.
CVE-2020-25592 2 Debian, Saltstack 2 Debian Linux, Salt 2021-07-21 7.5 HIGH 9.8 CRITICAL
In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH.
CVE-2019-17361 3 Debian, Opensuse, Saltstack 3 Debian Linux, Leap, Salt 2020-08-24 6.8 MEDIUM 9.8 CRITICAL
In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.
CVE-2018-15751 1 Saltstack 1 Salt 2020-08-20 7.5 HIGH 9.8 CRITICAL
SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands via salt-api(netapi).
CVE-2017-7893 1 Saltstack 1 Salt 2019-10-03 7.5 HIGH 9.8 CRITICAL
In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master.
CVE-2019-1010259 1 Saltstack 2 Salt 2018, Salt 2019 2019-08-13 7.5 HIGH 9.8 CRITICAL
SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.user_chpass function from the MySQL module for Salt. The attack vector is: specially crafted password string. The fixed version is: 2018.3.4.
CVE-2017-14695 1 Saltstack 1 Salt 2017-11-14 7.5 HIGH 9.8 CRITICAL
Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12791.
CVE-2017-12791 1 Saltstack 1 Salt 2017-08-29 7.5 HIGH 9.8 CRITICAL
Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.
CVE-2015-6941 1 Saltstack 1 Salt 2015 2017-08-21 5.0 MEDIUM 9.8 CRITICAL
win_useradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in debug logs.
CVE-2016-9639 1 Saltstack 1 Salt 2017-02-09 7.5 HIGH 9.1 CRITICAL
Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching.