VYPR
← All advisories
Moderate severityNVD Advisory· Published Sep 5, 2023· Updated Feb 13, 2025

CVE-2023-20898

CVE-2023-20898

Description

Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environments can get garbage data or the wrong data, which can lead to wrongful data disclosure, wrongful executions, data corruption and/or crash.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In Salt masters prior to 3005.2 and 3006.2, Git Providers cache directory base name collision across environments can cause data disclosure, corruption, or code execution.

Vulnerability

CVE-2023-20898 affects Salt masters running versions prior to 3005.2 or 3006.2. The root cause is that Git Providers use a cache directory base name that does not incorporate environment information. When the same repository is accessed in different environments, they all share the same cache directory, leading to potential data cross-contamination [4].

Exploitation

Exploitation requires local access to the Salt master (CVSS 4.2, AV:L/AC:H/PR:L/UI:N/S:C). An attacker with low privileges can cause Git Providers to read from the wrong environment by leveraging the cache collision. This can result in garbage data or the wrong data being used in operations such as state execution [2][4].

Impact

Successful exploitation can lead to wrongful data disclosure, wrongful executions, data corruption, or a crash of the master. The information disclosure is limited (C:L), and integrity impact is low (I:L), but the consequences may be severe in sensitive environments [2][4].

Mitigation

The Salt Project advises upgrading to Salt 3005.2 or 3006.2, which fix the issue by including environment information in the cache directory hash and adding a multiprocessing lock to prevent race conditions [4].

References
  1. NVD - CVE-2023-20898
  2. Saltproject.io - Salt security advisory release

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
saltPyPI
< 3005.23005.2
saltPyPI
>= 3006.0rc1, < 3006.23006.2

Affected products

51

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

7

News mentions

0

No linked articles in our index yet.