Salt security advisory release - 2023-OCT-27
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH. Do not make the copy path on the target predictable and ensure we check return codes of the scp command if the copy fails.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Salt | SALT | 3005 to before 3005.4; 3004 to before 3006.4 | 3005.4, 3006.4 | Patch available | CNA |
| — | salt (PyPI) | before 3005.4 | 3005.4 | Patch available | GHSA-4277-m35q-7c9w |
| — | salt (PyPI) | 3006.0rc1 to before 3006.4 | 3006.4 | Patch available | GHSA-4277-m35q-7c9w |
- SALT VendorSalt Affected 3005 to before 3005.4; 3004 to before 3006.4 Fixed in 3005.4, 3006.4 Patch available CNA
- salt (PyPI) Vendor— Affected before 3005.4 Fixed in 3005.4 Patch available GHSA-4277-m35q-7c9w
- salt (PyPI) Vendor— Affected 3006.0rc1 to before 3006.4 Fixed in 3006.4 Patch available GHSA-4277-m35q-7c9w
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:salt_project:salt:*:*:*:*:*:*:*:* | — | — | Salt Project |
- cpe:2.3:a:salt_project:salt:*:*:*:*:*:*:*:* Versions — — ·Salt Project
Remediation
- Fix · CNA SALT (Salt) Fixed in 3005.4, 3006.4
- Fix · GHSA-4277-m35q-7c9w salt (PyPI) Fixed in 3005.4 Advisory →
- Fix · GHSA-4277-m35q-7c9w salt (PyPI) Fixed in 3006.4 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2023-34049
- 2026-10-03 Alias added: GHSA-4277-m35q-7c9w
References
Other 5
- https://saltproject.io/security-announcements/2023-10-27-advisory/
- https://github.com/saltstack/salt/commit/286d55eb5a6e6bf9428405bdf5632b419bdf8444
- https://github.com/saltstack/salt/commit/7a14112f2a16ce70e3c3e1862c92e37af5f2c7a4
- https://github.com/saltstack/salt
- https://saltproject.io/security-announcements/2023-10-27-advisory
Sources
- CVE-2023-34049 · CVE Program
- CVE-2023-34049 · NVD
- FIRST EPSS
- GHSA-4277-m35q-7c9w · GitHub Advisory Database · CC BY 4.0
- CVE-2023-34049 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences