Skip to content
OpenAdvisories
Medium · 5.3 CVE-2023-20897 EUVD-2023-0230GHSA-vpjg-wmf8-29h9PYSEC-2023-166

Salt vulnerable to denial of service

Published Sep 5, 2023 · Updated Feb 13, 2025 · Assigned by vmware

Package: salt Package: salt Ecosystem: PyPI Ecosystem: Ubuntu

Description

Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted.

Affected products

VendorProductAffectedFixed
— Salt Salt masters prior to 3005.2 or 3006.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS salt No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS salt No fix yet —
Ubuntu Pro 16.04 LTS salt No fix yet —
Ubuntu Pro 14.04 LTS salt No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP5 salt 3006.0-150500.4.19.1 SUSE-SU-2023:3862-1
SLES 15 SP4 salt 3006.0-150400.8.44.1 SUSE-SU-2023:3863-1
SLES 15 SP3 salt 3006.0-150300.53.60.1 SUSE-SU-2023:3864-1
SLES 15 SP2 salt 3006.0-150200.108.1 SUSE-SU-2023:3865-1
SLES 15 SP1 salt 3006.0-150100.107.1 SUSE-SU-2023:3866-1
Show 22 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP3 salt 3006.0-150300.53.60.1 SUSE-SU-2023:3864-1
SLES for SAP 15 SP2 salt 3006.0-150200.108.1 SUSE-SU-2023:3865-1
SLES for SAP 15 SP1 salt 3006.0-150100.107.1 SUSE-SU-2023:3866-1
SLE Micro 5.4 salt 3006.0-150400.8.44.1 SUSE-SU-2023:3863-1
SLE Micro 5.3 salt 3006.0-150400.8.44.1 SUSE-SU-2023:3863-1
SLE Micro 5.2 salt 3006.0-150300.53.60.1 SUSE-SU-2023:3864-1
SLE Micro 5.1 salt 3006.0-150300.53.60.1 SUSE-SU-2023:3864-1
SLE HPC 15 SP3 salt 3006.0-150300.53.60.1 SUSE-SU-2023:3864-1
SLE HPC 15 SP2 salt 3006.0-150200.108.1 SUSE-SU-2023:3865-1
SLE HPC 15 SP1 salt 3006.0-150100.107.1 SUSE-SU-2023:3866-1
SUSE Manager Server Module 4.3 venv-salt-minion 3006.0-150000.3.42.1 SUSE-SU-2023:3877-1
SUSE Manager Server 4.3 release-notes-susemanager 4.3.8-150400.3.77.1 SUSE-SU-2023:3885-1
SUSE Manager Server 4.2 salt 3006.0-150300.53.60.1 SUSE-SU-2023:3864-1
SUSE Manager Proxy Module 4.3 venv-salt-minion 3006.0-150000.3.42.1 SUSE-SU-2023:3877-1
SUSE Manager Proxy 4.3 release-notes-susemanager-proxy 4.3.8-150400.3.61.2 SUSE-SU-2023:3885-1
SUSE Manager Proxy 4.2 salt 3006.0-150300.53.60.1 SUSE-SU-2023:3864-1
SUSE Manager Client Tools for SLE Micro 5 venv-salt-minion 3006.0-150000.3.42.1 SUSE-SU-2023:3877-1
SUSE Manager Client Tools for RHEL, Liberty and Clones 9 venv-salt-minion 3006.0-1.24.1 SUSE-SU-2023:3884-1, SUSE-EL-9-CLIENT-TOOLS-2023-3884
SUSE Manager Client Tools 15 venv-salt-minion 3006.0-150000.3.42.1 SUSE-SU-2023:3877-1
SUSE Manager Client Tools 12 venv-salt-minion 3006.0-3.40.1 SUSE-SU-2023:3876-1
SUSE Enterprise Storage 7.1 salt 3006.0-150300.53.60.1 SUSE-SU-2023:3864-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundle-libsodium 1.0.18-1.9.1 SUSE-SU-2023:3884-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundle-zeromq 4.2.3-1.6.2 SUSE-SU-2023:3884-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy +1 3.10.10-1.9.1 SUSE-SU-2023:3884-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-cffi 1.15.1-1.6.1 SUSE-SU-2023:3884-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-cryptography 3.3.2-1.9.2 SUSE-SU-2023:3884-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-cryptography-vectors 3.3.2-1.6.1 SUSE-SU-2023:3884-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-cython 0.29.32-1.6.1 SUSE-SU-2023:3884-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-kiwi 9.24.43-1.9.1 SUSE-SU-2023:3884-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-lxml 4.9.2-1.9.1 SUSE-SU-2023:3884-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-pycparser 2.17-1.6.1 SUSE-SU-2023:3884-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-pytz 2022.1-1.9.1 SUSE-SU-2023:3884-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-pyxattr 0.7.2-1.6.2 SUSE-SU-2023:3884-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-pyzmq 24.0.1-1.9.2 SUSE-SU-2023:3884-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-rpm-macros 20211001.fc6c04e-1.6.1 SUSE-SU-2023:3884-1
SUSE EL-9:Update:Products:SaltBundle:Update venv-salt-minion 3006.0-1.24.1 SUSE-SU-2023:3884-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Leap 15.5 salt 3006.0-150500.4.19.1 SUSE-SU-2023:3862-1
openSUSE Leap 15.4 salt 3006.0-150400.8.44.1 SUSE-SU-2023:3863-1

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI salt < 3005.2 3005.2 GHSA-vpjg-wmf8-29h9
PyPI salt >= 3006.0rc1, < 3006.2 3006.2 GHSA-vpjg-wmf8-29h9
PyPI salt >= 3006.0, < 3006.2 · < 3005.2 3006.2, 3005.2 PYSEC-2023-166

Advisories 11

References