Syndic cache directory creation is vulnerable to a directory traversal attack in salt project which can lead a malicious attacker to create an arbitrary directory on a Salt master.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Syndic cache directory creation is vulnerable to a directory traversal attack in salt project which can     lead a malicious attacker to create an arbitrary directory on a Salt master. (CVE-2024-22231)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Syndic cache directory creation is vulnerable to a directory traversal attack in salt project which can
    lead a malicious attacker to create an arbitrary directory on a Salt master. (CVE-2024-22231)

The remote host is affected by the vulnerability described in GLSA-202412-09 (Salt: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Salt. Please review the CVE identifiers referenced below     for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1518-1 advisory.

    venv-salt-minion:

    - Security issues fixed:

      * CVE-2024-22231: Prevent directory traversal when creating syndic cache directory on the master     (bsc#1219430)
      * CVE-2024-22232: Prevent directory traversal attacks in the master's serve_file method (bsc#1219431)

    - Bugs fixed:

      * Convert oscap output to UTF-8
      * Make Salt compatible with Python 3.11
      * Ignore non-ascii chars in oscap output (bsc#1219001)
      * Fix detected issues in Salt tests when running on VMs
      * Make importing seco.range thread safe (bsc#1211649)
      * Fix problematic tests and allow smooth tests executions on containers
      * Discover Ansible playbook files as '*.yml' or '*.yaml' files (bsc#1211888)
      * Prevent exceptions with fileserver.update when called via state (bsc#1218482)
      * Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850)
      * Fixed KeyError in logs when running a state that fails

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of SaltStack hosted on the remote server is affected by multiple vulnerabilities: 

  - Syndic cache directory creation is vulnerable to a directory traversal attack. (CVE-2024-22231)

  - A specially crafted url can be created which leads to a directory traversal in the salt file server.     (CVE-2024-22232)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0506-1 advisory.

    Security issues fixed:

    - CVE-2024-22231: Prevent directory traversal when creating syndic cache directory       on the master (bsc#1219430)
    - CVE-2024-22232: Prevent directory traversal attacks in the master's serve_file       method (bsc#1219431)

    Bugs fixed:

    - Ensure that pillar refresh loads beacons from pillar without restart
    - Fix the aptpkg.py unit test failure
    - Prefer unittest.mock to python-mock in test suite
    - Enable 'KeepAlive' probes for Salt SSH executions (bsc#1211649)
    - Revert changes to set Salt configured user early in the stack (bsc#1216284)
    - Align behavior of some modules when using salt-call via symlink (bsc#1215963)
    - Fix gitfs '__env__' and improve cache cleaning (bsc#1193948)
    - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0513-1 advisory.

    release-notes-susemanager:

    - Update to SUSE Manager 4.3.11
      * Migrate from RHEL and its clones to SUSE Liberty Linux
      * Reboot required indication for non-SUSE distributions
      * SSH key rotation for enhanced security
      * Configure remote command execution
      * End of Debian 10 support
      * CVEs fixed:
        CVE-2023-32189, CVE-2024-22231, CVE-2024-22232
      * Bugs mentioned:
        bsc#1170848, bsc#1210911, bsc#1211254, bsc#1211560, bsc#1211912         bsc#1213079, bsc#1213507, bsc#1213738, bsc#1213981, bsc#1214077         bsc#1214791, bsc#1215166, bsc#1215514, bsc#1215769, bsc#1215810         bsc#1215813, bsc#1215982, bsc#1216114, bsc#1216394, bsc#1216437         bsc#1216550, bsc#1216657, bsc#1216753, bsc#1216781, bsc#1216988         bsc#1217069, bsc#1217209, bsc#1217588, bsc#1217784, bsc#1217869         bsc#1218019, bsc#1218074, bsc#1218075, bsc#1218089, bsc#1218094         bsc#1218490, bsc#1218615, bsc#1218669, bsc#1218849, bsc#1219577         bsc#1219850, bsc#1218146

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0509-1 advisory.

    Security issues fixed:

    - CVE-2024-22231: Prevent directory traversal when creating syndic cache directory       on the master (bsc#1219430)
    - CVE-2024-22232: Prevent directory traversal attacks in the master's serve_file       method (bsc#1219431)

    Bugs fixed:

    - Ensure that pillar refresh loads beacons from pillar without restart
    - Fix the aptpkg.py unit test failure
    - Prefer unittest.mock to python-mock in test suite
    - Enable 'KeepAlive' probes for Salt SSH executions (bsc#1211649)
    - Revert changes to set Salt configured user early in the stack (bsc#1216284)
    - Align behavior of some modules when using salt-call via symlink (bsc#1215963)
    - Fix gitfs '__env__' and improve cache cleaning (bsc#1193948)
    - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0508-1 advisory.

    Security issues fixed:

    - CVE-2024-22231: Prevent directory traversal when creating syndic cache directory       on the master (bsc#1219430)
    - CVE-2024-22232: Prevent directory traversal attacks in the master's serve_file       method (bsc#1219431)

    Bugs fixed:

    - Ensure that pillar refresh loads beacons from pillar without restart
    - Fix the aptpkg.py unit test failure
    - Prefer unittest.mock to python-mock in test suite
    - Enable 'KeepAlive' probes for Salt SSH executions (bsc#1211649)
    - Revert changes to set Salt configured user early in the stack (bsc#1216284)
    - Align behavior of some modules when using salt-call via symlink (bsc#1215963)
    - Fix gitfs '__env__' and improve cache cleaning (bsc#1193948)
    - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0507-1 advisory.

    Security issues fixed:

    - CVE-2024-22231: Prevent directory traversal when creating syndic cache directory       on the master (bsc#1219430)
    - CVE-2024-22232: Prevent directory traversal attacks in the master's serve_file       method (bsc#1219431)

    Bugs fixed:

    - Ensure that pillar refresh loads beacons from pillar without restart
    - Fix the aptpkg.py unit test failure
    - Prefer unittest.mock to python-mock in test suite
    - Enable 'KeepAlive' probes for Salt SSH executions (bsc#1211649)
    - Revert changes to set Salt configured user early in the stack (bsc#1216284)
    - Align behavior of some modules when using salt-call via symlink (bsc#1215963)
    - Fix gitfs '__env__' and improve cache cleaning (bsc#1193948)
    - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0510-1 advisory.

    Security issues fixed:

    - CVE-2024-22231: Prevent directory traversal when creating syndic cache directory       on the master (bsc#1219430)
    - CVE-2024-22232: Prevent directory traversal attacks in the master's serve_file       method (bsc#1219431)

    Bugs fixed:

    - Ensure that pillar refresh loads beacons from pillar without restart
    - Fix the aptpkg.py unit test failure
    - Prefer unittest.mock to python-mock in test suite
    - Enable 'KeepAlive' probes for Salt SSH executions (bsc#1211649)
    - Revert changes to set Salt configured user early in the stack (bsc#1216284)
    - Align behavior of some modules when using salt-call via symlink (bsc#1215963)
    - Fix gitfs '__env__' and improve cache cleaning (bsc#1193948)
    - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Syndic cache directory creation is vulnerable to a directory traversal attack in salt project which can
    lead a malicious attacker to create an arbitrary directory on a Salt master. (CVE-2024-22231)

  - A specially crafted url can be created which leads to a directory traversal in the salt file server. A
    malicious user can read an arbitrary file from a Salt master’s filesystem. (CVE-2024-22232)

ID	Name	Product	Family	Severity
261128	Linux Distros Unpatched Vulnerability : CVE-2024-22231	Nessus	Misc.	medium
417795	SCA: security update for salt (GHSA-q27c-j6j9-53w3)	Tenable Cloud Security	SCA Checks	medium
417795	SCA: security update for salt (GHSA-q27c-j6j9-53w3)	Tenable Self-Hosted Container Security	SCA Checks	medium
212187	GLSA-202412-09 : Salt: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
195103	SUSE SLES15 Security Update : SUSE Manager Salt Bundle (SUSE-SU-2024:1518-1)	Nessus	SuSE Local Security Checks	high
190892	SaltStack 3000 < 3005.5 / 3006 < 3006.6 Multiple Vulnerablities	Nessus	Misc.	high
190657	SUSE SLES15: python3-salt / salt / salt-api / salt-bash-completion / salt-cloud / etc (SUSE-SU-2024:0506-1)	Nessus	SuSE Local Security Checks	high
190653	SUSE SLES15 Security Update : SUSE Manager Server 4.3 (SUSE-SU-2024:0513-1)	Nessus	SuSE Local Security Checks	medium
190651	SUSE SLED15: python3-salt / salt / salt-api / salt-bash-completion / salt-cloud / etc (SUSE-SU-2024:0509-1)	Nessus	SuSE Local Security Checks	high
190649	SUSE SLES15: python3-salt / salt / salt-api / salt-bash-completion / salt-cloud / etc (SUSE-SU-2024:0508-1)	Nessus	SuSE Local Security Checks	high
190647	SUSE SLES15: python3-salt / salt / salt-api / salt-bash-completion / salt-cloud / etc (SUSE-SU-2024:0507-1)	Nessus	SuSE Local Security Checks	high
190635	SUSE SLED15: python3-salt / salt / salt-api / salt-bash-completion / salt-cloud / etc (SUSE-SU-2024:0510-1)	Nessus	SuSE Local Security Checks	high
408264	Alpine: multiple salt packages: security update to 3006.6-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
408264	Alpine: multiple salt packages: security update to 3006.6-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high

Detections

Analytics

CVE-2024-22231

medium

Tenable Plugins

medium

medium

medium

high

high

high

high

medium

high

high

high

high

high

high