GHSA-v89f-4mc4-h6w9

Salt has insufficient argument validation in several modules

Source: GitHub Advisory Database (reviewed) High CVE-2013-4435

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	salt	>= 0.15.0, < 0.17.1	0.17.1

Details

As written in the advisory (Markdown source, shown as plain text).

Salt (aka SaltStack) 0.15.0 through 0.17.0 allows remote authenticated users who are using external authentication or client ACL to execute restricted routines by embedding the routine in another routine.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2013-4435 advisory
https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2013-12.yaml web
https://github.com/saltstack/salt package
https://github.com/saltstack/salt/blob/master/doc/topics/releases/0.17.1.rst web
http://docs.saltstack.com/topics/releases/0.17.1.html web
http://www.openwall.com/lists/oss-security/2013/10/18/3 web