Skip to content
OpenAdvisories
Medium · 4.2 CVE-2023-20898 EUVD-2023-0231GHSA-qvh6-3j7x-3hq7PYSEC-2023-169

Salt can cause Git Providers to get wrong data

Published Sep 5, 2023 · Updated Feb 13, 2025 · Assigned by vmware

Package: salt Package: salt Ecosystem: PyPI Ecosystem: Ubuntu

Description

Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environments can get garbage data or the wrong data, which can lead to wrongful data disclosure, wrongful executions, data corruption and/or crash.

Affected products

VendorProductAffectedFixed
— Salt Salt masters prior to 3005.2 or 3006.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS salt No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS salt No fix yet —
Ubuntu Pro 16.04 LTS salt No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP5 salt 3006.0-150500.4.19.1 SUSE-SU-2023:3862-1
SLES 15 SP4 salt 3006.0-150400.8.44.1 SUSE-SU-2023:3863-1
SLES 15 SP3 salt 3006.0-150300.53.60.1 SUSE-SU-2023:3864-1
SLES 15 SP2 salt 3006.0-150200.108.1 SUSE-SU-2023:3865-1
SLES 15 SP1 salt 3006.0-150100.107.1 SUSE-SU-2023:3866-1
Show 22 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP3 salt 3006.0-150300.53.60.1 SUSE-SU-2023:3864-1
SLES for SAP 15 SP2 salt 3006.0-150200.108.1 SUSE-SU-2023:3865-1
SLES for SAP 15 SP1 salt 3006.0-150100.107.1 SUSE-SU-2023:3866-1
SLE Micro 5.4 salt 3006.0-150400.8.44.1 SUSE-SU-2023:3863-1
SLE Micro 5.3 salt 3006.0-150400.8.44.1 SUSE-SU-2023:3863-1
SLE Micro 5.2 salt 3006.0-150300.53.60.1 SUSE-SU-2023:3864-1
SLE Micro 5.1 salt 3006.0-150300.53.60.1 SUSE-SU-2023:3864-1
SLE HPC 15 SP3 salt 3006.0-150300.53.60.1 SUSE-SU-2023:3864-1
SLE HPC 15 SP2 salt 3006.0-150200.108.1 SUSE-SU-2023:3865-1
SLE HPC 15 SP1 salt 3006.0-150100.107.1 SUSE-SU-2023:3866-1
SUSE Manager Server Module 4.3 venv-salt-minion 3006.0-150000.3.42.1 SUSE-SU-2023:3877-1
SUSE Manager Server 4.3 release-notes-susemanager 4.3.8-150400.3.77.1 SUSE-SU-2023:3885-1
SUSE Manager Server 4.2 salt 3006.0-150300.53.60.1 SUSE-SU-2023:3864-1
SUSE Manager Proxy Module 4.3 venv-salt-minion 3006.0-150000.3.42.1 SUSE-SU-2023:3877-1
SUSE Manager Proxy 4.3 release-notes-susemanager-proxy 4.3.8-150400.3.61.2 SUSE-SU-2023:3885-1
SUSE Manager Proxy 4.2 salt 3006.0-150300.53.60.1 SUSE-SU-2023:3864-1
SUSE Manager Client Tools for SLE Micro 5 venv-salt-minion 3006.0-150000.3.42.1 SUSE-SU-2023:3877-1
SUSE Manager Client Tools for RHEL, Liberty and Clones 9 venv-salt-minion 3006.0-1.24.1 SUSE-SU-2023:3884-1, SUSE-EL-9-CLIENT-TOOLS-2023-3884
SUSE Manager Client Tools 15 venv-salt-minion 3006.0-150000.3.42.1 SUSE-SU-2023:3877-1
SUSE Manager Client Tools 12 venv-salt-minion 3006.0-3.40.1 SUSE-SU-2023:3876-1
SUSE Enterprise Storage 7.1 salt 3006.0-150300.53.60.1 SUSE-SU-2023:3864-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundle-libsodium 1.0.18-1.9.1 SUSE-SU-2023:3884-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundle-zeromq 4.2.3-1.6.2 SUSE-SU-2023:3884-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy +1 3.10.10-1.9.1 SUSE-SU-2023:3884-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-cffi 1.15.1-1.6.1 SUSE-SU-2023:3884-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-cryptography 3.3.2-1.9.2 SUSE-SU-2023:3884-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-cryptography-vectors 3.3.2-1.6.1 SUSE-SU-2023:3884-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-cython 0.29.32-1.6.1 SUSE-SU-2023:3884-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-kiwi 9.24.43-1.9.1 SUSE-SU-2023:3884-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-lxml 4.9.2-1.9.1 SUSE-SU-2023:3884-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-pycparser 2.17-1.6.1 SUSE-SU-2023:3884-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-pytz 2022.1-1.9.1 SUSE-SU-2023:3884-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-pyxattr 0.7.2-1.6.2 SUSE-SU-2023:3884-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-pyzmq 24.0.1-1.9.2 SUSE-SU-2023:3884-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-rpm-macros 20211001.fc6c04e-1.6.1 SUSE-SU-2023:3884-1
SUSE EL-9:Update:Products:SaltBundle:Update venv-salt-minion 3006.0-1.24.1 SUSE-SU-2023:3884-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Leap 15.5 salt 3006.0-150500.4.19.1 SUSE-SU-2023:3862-1
openSUSE Leap 15.4 salt 3006.0-150400.8.44.1 SUSE-SU-2023:3863-1

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI salt < 3005.2 3005.2 GHSA-qvh6-3j7x-3hq7
PyPI salt >= 3006.0rc1, < 3006.2 3006.2 GHSA-qvh6-3j7x-3hq7
PyPI salt >= 3006.0, < 3006.2 · < 3005.2 3006.2, 3005.2 PYSEC-2023-169

Advisories 11

References