GHSA-vpjg-wmf8-29h9

Salt vulnerable to denial of service

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-20897

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	salt	< 3005.2	3005.2
PyPI	salt	>= 3006.0rc1, < 3006.2	3006.2

Details

As written in the advisory (Markdown source, shown as plain text).

Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-20897 advisory
https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2023-166.yaml web
https://github.com/saltstack/salt package
https://lists.fedoraproject.org/archives/list/[email protected]/message/OMWJIHQZXHK6FH2E3IWAZCYIRI7FLVOL web
https://saltproject.io/security-announcements/2023-08-10-advisory web