GHSA-7wx3-vr2f-6p29

SaltStack Privilege Escalation vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2013-6617

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	salt	>= 0.11.0, < 0.17.1	0.17.1

Details

As written in the advisory (Markdown source, shown as plain text).

The salt master in Salt (aka SaltStack) 0.11.0 through 0.17.0 does not properly drop group privileges, which makes it easier for remote attackers to gain privileges.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2013-6617 advisory
https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2013-15.yaml web
https://github.com/saltstack/salt package
http://docs.saltstack.com/topics/releases/0.17.1.html web