TI-2024-26051 CVE-2024-38824 · GHSA-8pcp-r83j-fc92
CVE-2024-38824 salt advisory
Priority MEDIUM 45
Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master cache directory.
Vulnerabilities
56 records
TI-2023-07314 CVE-2023-20898 · GHSA-qvh6-3j7x-3hq7
Git Providers can read from the wrong environment because they get the same cache…
Priority LOW 34
Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2.
TI-2023-07313 CVE-2023-20897 · GHSA-vpjg-wmf8-29h9
Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return.
Priority LOW 33
Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return.
TI-2021-12769 CVE-2021-33226 · GHSA-3cjm-9wq5-p7gj
Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute…
Priority HIGH 82
Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the func variable in salt/salt/modules/status.py file.
TI-2022-07144 CVE-2022-22967 · GHSA-fpxm-fprw-6hxj
Incorrect authorization in SaltStack Salt
Priority MEDIUM 44
An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2.
TI-2022-07119 CVE-2022-22941 · GHSA-qcr3-hr2f-6557
Incorrect permission assignment in SaltStack Salt
Priority MEDIUM 43
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1.
TI-2022-07116 CVE-2022-22936 · GHSA-5r3f-3m3j-wcj2
Authentication bypass by capture-replay in SaltStack Salt
Priority MEDIUM 42
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1.
TI-2022-07115 CVE-2022-22935 · GHSA-cvcc-5x92-gmhc
Improper authentication in SaltStack Salt
Priority LOW 21
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1.
TI-2022-07114 CVE-2022-22934 · GHSA-2q4g-wfm6-5fpm
Improper signature verification in SaltStack Salt
Priority MEDIUM 40
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1.
TI-2021-05048 CVE-2021-22004 · GHSA-xf37-qcvf-7m57
Race condition in Saltstack Salt
Priority LOW 28
An issue was discovered in SaltStack Salt before 3003.3.
TI-2021-05040 CVE-2021-21996 · GHSA-pf7h-h2wq-m7pg
Exposure of resource to wrong sphere in Saltstack Salt
Priority LOW 39
An issue was discovered in SaltStack Salt before 3003.3.
TI-2021-11706 CVE-2021-31607 · GHSA-hcjf-rp5h-g5h3
In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the…
Priority MEDIUM 43
In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion.
TI-2021-07554 CVE-2021-25315 · GHSA-pmj6-9f8c-8g2m
salt-api unauthenticated remote code execution
Priority MEDIUM 46
CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials.
TI-2021-07533 CVE-2021-25284 · GHSA-r55w-xph5-xvx2
An issue was discovered in through SaltStack Salt before 3002.5.
Priority LOW 21
An issue was discovered in through SaltStack Salt before 3002.5.
TI-2021-07532 CVE-2021-25283 · GHSA-xgmh-gfxw-2hvv
An issue was discovered in through SaltStack Salt before 3002.5.
Priority MEDIUM 55
An issue was discovered in through SaltStack Salt before 3002.5.
TI-2021-07531 CVE-2021-25282 · GHSA-76x4-x3p6-rpr9
An issue was discovered in through SaltStack Salt before 3002.5.
Priority HIGH 83
An issue was discovered in through SaltStack Salt before 3002.5.
TI-2021-07530 CVE-2021-25281 · GHSA-xxw3-765m-f37p
An issue was discovered in through SaltStack Salt before 3002.5.
Priority CRITICAL 87
An issue was discovered in through SaltStack Salt before 3002.5.
TI-2021-02271 CVE-2021-3197 · GHSA-8rp6-x3r7-5qw3
An issue was discovered in SaltStack Salt before 3002.5.
Priority HIGH 80
An issue was discovered in SaltStack Salt before 3002.5.
TI-2021-02234 CVE-2021-3148 · GHSA-ghc2-hx3w-jqmp
An issue was discovered in SaltStack Salt before 3002.5.
Priority MEDIUM 53
An issue was discovered in SaltStack Salt before 3002.5.
TI-2021-02231 CVE-2021-3144 · GHSA-w2hr-3mc8-46gh
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration.
Priority MEDIUM 47
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration.
TI-2020-18138 CVE-2020-35662 · GHSA-qx72-q6w3-qgc7
In SaltStack Salt before 3002.5, when authenticating to services using certain modules…
Priority MEDIUM 40
In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated.
TI-2020-17495 CVE-2020-28972 · GHSA-w589-r335-4f55
In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi…
Priority LOW 32
In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the vmware.py files) does not always validate the SSL/TLS certificate.
TI-2020-17154 CVE-2020-28243 · GHSA-phhw-3wc9-8q75
An issue was discovered in SaltStack Salt before 3002.5.
Priority MEDIUM 41
An issue was discovered in SaltStack Salt before 3002.5.
TI-2020-15613 CVE-2020-25592 · GHSA-29j3-2446-5j4w
In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and…
Priority HIGH 76
In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens.
TI-2020-13245 CVE-2020-17490 · GHSA-3c56-vx6v-q5vh
The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.
Priority LOW 25
The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.