Vulnerabilities

Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master cache directory.

Worker process denial of service through file read operation.

File contents overwrite the VirtKey class is called when “on-demand pillar” data is requested and uses un-validated input to create paths to the “pki directory”.

Arbitrary directory creation or file deletion.

Arbitrary event injection on Salt Master.

Directory traversal attack in minion file cache creation.

An attacker with access to a minion key can exploit the 'on demand' pillar functionality with a specially crafted git url which could cause and arbitrary command to be run on the master with the same privileges as the ma…

Minion event bus authorization bypass.

The salt.auth.pki module does not properly authenticate callers.

Salt's request server is vulnerable to replay attacks when not using a TLS encrypted transport.

Multiple methods in the salt master skip minion token validation.