The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH. Do not make the copy path on the target predictable and ensure we check return codes of the scp command if the copy fails.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an     attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the     path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the     privileges of the user running Salt-SSH. Do not make the copy path on the target predictable and ensure we     check return codes of the scp command if the copy fails. (CVE-2023-34049)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an
    attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the
    path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the
    privileges of the user running Salt-SSH. Do not make the copy path on the target predictable and ensure we
    check return codes of the scp command if the copy fails. (CVE-2023-34049)

The remote host is affected by the vulnerability described in GLSA-202412-09 (Salt: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Salt. Please review the CVE identifiers referenced below     for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2023:4749-1 advisory.

    venv-salt-minion:

      * Security fixes:
        * CVE-2023-34049: Arbitrary code execution via symlink attack (bsc#1215157)
      * Non security fixes:
        * Add python dateutil module to the bundle
        * Allow all primitive grain types for autosign_grains (bsc#1214477)
        * Remove non-free RNG schema file (bsc#1213351)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of SaltStack hosted on the remote server is affected by a security bypass vulnerability. The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4386-1 advisory.

    Security issues fixed:

    - CVE-2023-34049: arbitrary code execution via symlink attack (bsc#1215157)

    Bugs fixed:

    - Fix optimization_order opt to prevent testsuite fails
    - Improve salt.utils.json.find_json to avoid fails (bsc#1213293)
    - Use salt-call from salt bundle with transactional_update
    - Only call native_str on curl_debug message in tornado when needed
    - Implement the calling for batch async from the salt CLI
    - Fix calculation of SLS context vars when trailing dots       on targetted sls/state (bsc#1213518)
    - Rename salt-tests to python3-salt-testsuite
    - Allow all primitive grain types for autosign_grains (bsc#1214477)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4388-1 advisory.

  - allows an attacker to force Salt-SSH to run their script [fedora-all] (CVE-2023-34049)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4389-1 advisory.

    Security issues fixed:

    - CVE-2023-34049: arbitrary code execution via symlink attack (bsc#1215157)

    Bugs fixed:

    - Fix optimization_order opt to prevent testsuite fails
    - Improve salt.utils.json.find_json to avoid fails (bsc#1213293)
    - Use salt-call from salt bundle with transactional_update
    - Only call native_str on curl_debug message in tornado when needed
    - Implement the calling for batch async from the salt CLI
    - Fix calculation of SLS context vars when trailing dots       on targetted sls/state (bsc#1213518)
    - Rename salt-tests to python3-salt-testsuite
    - Allow all primitive grain types for autosign_grains (bsc#1214477)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2023:4412-1 advisory.

    - Update to SUSE Manager 4.3.9
      * Debian 12 support as client
      * New Update Notification (jsc#SUMA-111)
      * Monitoring: Grafana upgraded to 9.5.8
      * Update 'saltkey' endpoints to accept GET instead of POST
      * CVEs fixed:
        CVE-2023-34049
      * Bugs mentioned:
        bsc#1204270, bsc#1211047, bsc#1211145, bsc#1211270, bsc#1211912         bsc#1212168, bsc#1212507, bsc#1213132, bsc#1213376, bsc#1213469         bsc#1213680, bsc#1213689, bsc#1214041, bsc#1214121, bsc#1214463         bsc#1214553, bsc#1214746, bsc#1215027, bsc#1215120, bsc#1215412         bsc#1215514, bsc#1216661, bsc#1215157

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4387-1 advisory.

  - allows an attacker to force Salt-SSH to run their script [fedora-all] (CVE-2023-34049)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4390-1 advisory.

    Security issues fixed:

    - CVE-2023-34049: arbitrary code execution via symlink attack (bsc#1215157)

    Bugs fixed:

    - Fix optimization_order opt to prevent testsuite fails
    - Improve salt.utils.json.find_json to avoid fails (bsc#1213293)
    - Use salt-call from salt bundle with transactional_update
    - Only call native_str on curl_debug message in tornado when needed
    - Implement the calling for batch async from the salt CLI
    - Fix calculation of SLS context vars when trailing dots       on targetted sls/state (bsc#1213518)
    - Rename salt-tests to python3-salt-testsuite
    - CVE-2023-34049: arbitrary code execution via symlink attack (bsc#1215157)
    - Allow all primitive grain types for autosign_grains (bsc#1214477)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-3eda7b85f5 advisory.

    Fix for CVE-2023-34049

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-a6699df922 advisory.

    Fix for CVE-2023-34049

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-89e8f3efc5 advisory.

    Fix for CVE-2023-34049

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
260991	Linux Distros Unpatched Vulnerability : CVE-2023-34049	Nessus	Misc.	medium
409806	SCA: security update for salt (GHSA-4277-m35q-7c9w)	Tenable Cloud Security	SCA Checks	medium
409806	SCA: security update for salt (GHSA-4277-m35q-7c9w)	Tenable Self-Hosted Container Security	SCA Checks	medium
212187	GLSA-202412-09 : Salt: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
186881	SUSE SLES15 Security Update : SUSE Manager Salt Bundle (SUSE-SU-2023:4749-1)	Nessus	SuSE Local Security Checks	medium
185733	SaltStack 3000 < 3005.4 / 3006 < 3006.4 Security Bypass	Nessus	Misc.	medium
185450	SUSE SLED15: python3-salt / salt / salt-api / salt-bash-completion / salt-cloud / etc (SUSE-SU-2023:4386-1)	Nessus	SuSE Local Security Checks	medium
185449	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : salt (SUSE-SU-2023:4388-1)	Nessus	SuSE Local Security Checks	medium
185448	SUSE SLES15: python3-salt / salt / salt-api / salt-bash-completion / salt-cloud / etc (SUSE-SU-2023:4389-1)	Nessus	SuSE Local Security Checks	medium
185447	SUSE SLES15 Security Update : SUSE Manager Server 4.3 (SUSE-SU-2023:4412-1)	Nessus	SuSE Local Security Checks	medium
185446	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : salt (SUSE-SU-2023:4387-1)	Nessus	SuSE Local Security Checks	medium
185445	SUSE SLES15: python3-salt / salt / salt-api / salt-bash-completion / salt-cloud / etc (SUSE-SU-2023:4390-1)	Nessus	SuSE Local Security Checks	medium
185374	Fedora 39 : salt (2023-3eda7b85f5)	Nessus	Fedora Local Security Checks	medium
185365	Fedora 38 : salt (2023-a6699df922)	Nessus	Fedora Local Security Checks	medium
185348	Fedora 37 : salt (2023-89e8f3efc5)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2023-34049

medium

Tenable Plugins

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium