Salt (aka SaltStack) before 0.15.0 through 0.17.0 allows remote authenticated minions to impersonate arbitrary minions via a crafted minion with a valid key.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Salt (aka SaltStack) before 0.15.0 through 0.17.0 allows remote authenticated minions to impersonate
    arbitrary minions via a crafted minion with a valid key. (CVE-2013-4439)

Update to bugfix release 0.17.1.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated to bugfix release 0.17.1.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
416471	SCA: security update for salt (GHSA-jmv9-5gx8-7xpf)	Tenable Cloud Security	SCA Checks	high
416471	SCA: security update for salt (GHSA-jmv9-5gx8-7xpf)	Tenable Self-Hosted Container Security	SCA Checks	high
70809	Fedora 20 : salt-0.17.1-1.fc20 (2013-19438)	Nessus	Fedora Local Security Checks	critical
70655	Fedora 18 : salt-0.17.1-1.fc18 (2013-19354)	Nessus	Fedora Local Security Checks	medium
70640	Fedora 19 : salt-0.17.1-1.fc19 (2013-19356)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-4439

high

Tenable Plugins

high

high

critical

medium

medium