Skip to content
OpenAdvisories
Medium · 6.7 CVE-2023-34049 EUVD-2024-3190GHSA-4277-m35q-7c9wPYSEC-2026-1892

Salt security advisory release - 2023-OCT-27

Published Nov 14, 2024 · Updated Nov 14, 2024 · Assigned by vmware

Vendor: Salt Project Product: Salt Package: salt Package: salt Ecosystem: PyPI Ecosystem: Ubuntu

Description

The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH. Do not make the copy path on the target predictable and ensure we check return codes of the scp command if the copy fails.

Affected products

VendorProductAffectedFixed
Salt SALT 3005 – < 3005.4, 3004 – < 3006.4 3005.4

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS salt No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS salt No fix yet —
Ubuntu Pro 16.04 LTS salt No fix yet —
Ubuntu Pro 14.04 LTS salt No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP5 python-simplejson 3.17.2-150300.3.4.1 SUSE-SU-2023:4388-1
SLES 15 SP5 salt 3006.0-150500.4.24.2 SUSE-SU-2023:4386-1
SLES 15 SP4 python-simplejson 3.17.2-150300.3.4.1 SUSE-SU-2023:4388-1
SLES 15 SP4 salt 3006.0-150400.8.49.2 SUSE-SU-2023:4387-1
SLES 15 SP3 python-simplejson 3.17.2-150300.3.4.1 SUSE-SU-2023:4388-1
SLES 15 SP3 salt 3006.0-150300.53.65.2 SUSE-SU-2023:4388-1
SLES 15 SP2 salt 3006.0-150200.113.1 SUSE-SU-2023:4389-1
SLES 15 SP1 salt 3006.0-150100.112.1 SUSE-SU-2023:4390-1
Show 21 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP3 python-simplejson 3.17.2-150300.3.4.1 SUSE-SU-2023:4388-1
SLES for SAP 15 SP3 salt 3006.0-150300.53.65.2 SUSE-SU-2023:4388-1
SLES for SAP 15 SP2 salt 3006.0-150200.113.1 SUSE-SU-2023:4389-1
SLES for SAP 15 SP1 salt 3006.0-150100.112.1 SUSE-SU-2023:4390-1
SLE Micro 5.5 python-simplejson 3.17.2-150300.3.4.1 SUSE-SU-2023:4388-1
SLE Micro 5.5 salt 3006.0-150500.4.24.2 SUSE-SU-2023:4386-1
SLE Micro 5.4 python-simplejson 3.17.2-150300.3.4.1 SUSE-SU-2023:4388-1
SLE Micro 5.4 salt 3006.0-150400.8.49.2 SUSE-SU-2023:4387-1
SLE Micro 5.3 python-simplejson 3.17.2-150300.3.4.1 SUSE-SU-2023:4388-1
SLE Micro 5.3 salt 3006.0-150400.8.49.2 SUSE-SU-2023:4387-1
SLE Micro 5.2 python-simplejson 3.17.2-150300.3.4.1 SUSE-SU-2023:4388-1
SLE Micro 5.2 salt 3006.0-150300.53.65.2 SUSE-SU-2023:4388-1
SLE Micro 5.1 python-simplejson 3.17.2-150300.3.4.1 SUSE-SU-2023:4388-1
SLE Micro 5.1 salt 3006.0-150300.53.65.2 SUSE-SU-2023:4388-1
SLE HPC 15 SP3 python-simplejson 3.17.2-150300.3.4.1 SUSE-SU-2023:4388-1
SLE HPC 15 SP3 salt 3006.0-150300.53.65.2 SUSE-SU-2023:4388-1
SLE HPC 15 SP2 salt 3006.0-150200.113.1 SUSE-SU-2023:4389-1
SLE HPC 15 SP1 salt 3006.0-150100.112.1 SUSE-SU-2023:4390-1
SUSE Manager Server Module 4.3 venv-salt-minion 3006.0-150000.3.48.2 SUSE-SU-2023:4749-1
SUSE Manager Server 4.3 release-notes-susemanager 4.3.9-150400.3.90.1 SUSE-SU-2023:4412-1
SUSE Manager Proxy Module 4.3 venv-salt-minion 3006.0-150000.3.48.2 SUSE-SU-2023:4749-1
SUSE Manager Proxy 4.3 release-notes-susemanager-proxy 4.3.9-150400.3.69.1 SUSE-SU-2023:4412-1
SUSE Manager Client Tools for SLE Micro 5 venv-salt-minion 3006.0-150000.3.48.2 SUSE-SU-2023:4749-1
SUSE Manager Client Tools for RHEL, Liberty and Clones 9 venv-salt-minion 3006.0-1.30.3 SUSE-SU-2023:4757-1, SUSE-EL-9-CLIENT-TOOLS-2023-4757
SUSE Manager Client Tools 15 venv-salt-minion 3006.0-150000.3.48.2 SUSE-SU-2023:4749-1
SUSE Manager Client Tools 12 venv-salt-minion 3006.0-3.46.2 SUSE-SU-2023:4748-1
SUSE Enterprise Storage 7.1 python-simplejson 3.17.2-150300.3.4.1 SUSE-SU-2023:4388-1
SUSE Enterprise Storage 7.1 salt 3006.0-150300.53.65.2 SUSE-SU-2023:4388-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundle-swig 4.1.1-1.9.1 SUSE-SU-2023:4757-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-appdirs 1.4.4-1.6.1 SUSE-SU-2023:4757-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-certifi 2018.1.18-1.9.1 SUSE-SU-2023:4757-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-cffi 1.15.1-1.9.1 SUSE-SU-2023:4757-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-dateutil 2.8.1-1.3.4 SUSE-SU-2023:4757-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-editables 0.3-1.3.1 SUSE-SU-2023:4757-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-exceptiongroup +1 1.1.0-1.3.1 SUSE-SU-2023:4757-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-flit-core 3.8.0-1.3.1 SUSE-SU-2023:4757-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-flit-scm 1.7.0-1.3.1 SUSE-SU-2023:4757-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-hatch-vcs +1 0.3.0-1.3.1 SUSE-SU-2023:4757-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-hatchling 1.13.0-1.3.1 SUSE-SU-2023:4757-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-iniconfig +1 2.0.0-1.3.1 SUSE-SU-2023:4757-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-lxml 4.9.3-1.12.1 SUSE-SU-2023:4757-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-more-itertools 8.10.0-1.6.1 SUSE-SU-2023:4757-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-packaging 23.1-1.6.1 SUSE-SU-2023:4757-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-pathspec 0.11.1-1.3.1 SUSE-SU-2023:4757-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-pip 20.2.4-1.6.1 SUSE-SU-2023:4757-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-pluggy 1.0.0-1.6.4 SUSE-SU-2023:4757-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-pluggy-test 1.0.0-1.6.1 SUSE-SU-2023:4757-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-py 1.10.0-1.9.4 SUSE-SU-2023:4757-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-pytest 7.3.2-1.6.1 SUSE-SU-2023:4757-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-setuptools-scm 7.1.0-1.6.1 SUSE-SU-2023:4757-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-tomli 1.2.3-1.3.1 SUSE-SU-2023:4757-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-typing-extensions +1 4.5.0-1.3.1 SUSE-SU-2023:4757-1
SUSE EL-9:Update:Products:SaltBundle:Update saltbundlepy-wheel +1 0.40.0-1.3.1 SUSE-SU-2023:4757-1
SUSE EL-9:Update:Products:SaltBundle:Update venv-salt-minion 3006.0-1.30.3 SUSE-SU-2023:4757-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Leap 15.5 python-simplejson 3.17.2-150300.3.4.1 SUSE-SU-2023:4388-1
openSUSE Leap 15.5 salt 3006.0-150500.4.24.2 SUSE-SU-2023:4386-1
openSUSE Leap 15.4 python-simplejson 3.17.2-150300.3.4.1 SUSE-SU-2023:4388-1
openSUSE Leap 15.4 salt 3006.0-150400.8.49.2 SUSE-SU-2023:4387-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
openSUSE Leap Micro 5.4 python-simplejson 3.17.2-150300.3.4.1 SUSE-SU-2023:4388-1
openSUSE Leap Micro 5.4 salt 3006.0-150400.8.49.2 SUSE-SU-2023:4387-1
openSUSE Leap Micro 5.3 python-simplejson 3.17.2-150300.3.4.1 SUSE-SU-2023:4388-1
openSUSE Leap Micro 5.3 salt 3006.0-150400.8.49.2 SUSE-SU-2023:4387-1

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI salt < 3005.4 3005.4 GHSA-4277-m35q-7c9w
PyPI salt >= 3006.0rc1, < 3006.4 3006.4 GHSA-4277-m35q-7c9w
PyPI salt < 3005.4 · >= 3006.0rc1, < 3006.4 3005.4, 3006.4 PYSEC-2026-1892

Advisories 11

References