Skip to content
OpenAdvisories
Medium WID-SEC-2023-2274 2 CVEs

SaltStack Salt: Mehrere Schwachstellen

Published Sep 5, 2023 · Updated Dec 8, 2024 · Revision 3 · de-DE

Vendor: gentoo Vendor: SaltStack Vendor: SUSE Product: Linux Product: Linux Product: Manager Product: Salt Platform: Linux Platform: macOS Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in SaltStack Salt ausnutzen, um einen Denial of Service Angriff durchzuführen.

Product

Salt bietet Infrastrukturverwaltung auf der Grundlage eines dynamischen Kommunikationsbusses.

Vulnerabilities 2

  • Medium 5.3
    CVE-2023-20897

    Salt vulnerable to denial of service

    Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted.

    salt salt Ubuntu PyPI
  • Medium 4.2
    CVE-2023-20898

    Salt can cause Git Providers to get wrong data

    Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environments can get garbage data or the wrong data, which can lea…

    salt salt Ubuntu PyPI

Revision history

  1. #3

    Neue Updates von Gentoo aufgenommen

  2. #2

    Neue Updates von SUSE aufgenommen

  3. #1

    Initiale Fassung

References