Description
Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | salt | >= 2015.8.0rc1, < 2015.8.4 | 2015.8.4 | GHSA-vqh4-crjf-jjxx |
| PyPI | salt | >= 2015.8, < 2015.8.4 | 2015.8.4 | PYSEC-2016-23 |