PyPI package
salt
pkg:pypi/salt
Vulnerabilities (66)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2014-3563 | — | < 2014.1.10 | 2014.1.10 | Aug 22, 2014 | Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud. | ||
| CVE-2013-6617 | — | >= 0.11.0, < 0.17.1 | 0.17.1 | Nov 5, 2013 | The salt master in Salt (aka SaltStack) 0.11.0 through 0.17.0 does not properly drop group privileges, which makes it easier for remote attackers to gain privileges. | ||
| CVE-2013-4439 | — | >= 0.15.0, < 0.17.1 | 0.17.1 | Nov 5, 2013 | Salt (aka SaltStack) before 0.15.0 through 0.17.0 allows remote authenticated minions to impersonate arbitrary minions via a crafted minion with a valid key. | ||
| CVE-2013-4437 | — | >= 0.17.0, < 0.17.1 | 0.17.1 | Nov 5, 2013 | Unspecified vulnerability in salt-ssh in Salt (aka SaltStack) 0.17.0 has unspecified impact and vectors related to "insecure Usage of /tmp." | ||
| CVE-2013-4436 | — | >= 0.17.0, < 0.17.1 | 0.17.1 | Nov 5, 2013 | The default configuration for salt-ssh in Salt (aka SaltStack) 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle (MITM) attack. | ||
| CVE-2013-4435 | — | >= 0.15.0, < 0.17.1 | 0.17.1 | Nov 5, 2013 | Salt (aka SaltStack) 0.15.0 through 0.17.0 allows remote authenticated users who are using external authentication or client ACL to execute restricted routines by embedding the routine in another routine. |
- CVE-2014-3563Aug 22, 2014affected < 2014.1.10fixed 2014.1.10
Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.
- CVE-2013-6617Nov 5, 2013affected >= 0.11.0, < 0.17.1fixed 0.17.1
The salt master in Salt (aka SaltStack) 0.11.0 through 0.17.0 does not properly drop group privileges, which makes it easier for remote attackers to gain privileges.
- CVE-2013-4439Nov 5, 2013affected >= 0.15.0, < 0.17.1fixed 0.17.1
Salt (aka SaltStack) before 0.15.0 through 0.17.0 allows remote authenticated minions to impersonate arbitrary minions via a crafted minion with a valid key.
- CVE-2013-4437Nov 5, 2013affected >= 0.17.0, < 0.17.1fixed 0.17.1
Unspecified vulnerability in salt-ssh in Salt (aka SaltStack) 0.17.0 has unspecified impact and vectors related to "insecure Usage of /tmp."
- CVE-2013-4436Nov 5, 2013affected >= 0.17.0, < 0.17.1fixed 0.17.1
The default configuration for salt-ssh in Salt (aka SaltStack) 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle (MITM) attack.
- CVE-2013-4435Nov 5, 2013affected >= 0.15.0, < 0.17.1fixed 0.17.1
Salt (aka SaltStack) 0.15.0 through 0.17.0 allows remote authenticated users who are using external authentication or client ACL to execute restricted routines by embedding the routine in another routine.
Page 4 of 4