Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-7f3f-x5f5-79gw

Опубликовано: 13 июн. 2025
Источник: github
Github: Прошло ревью
CVSS3: 5.6

Описание

Salt's file contents overwrite the VirtKey class

File contents overwrite the VirtKey class is called when “on-demand pillar” data is requested and uses un-validated input to create paths to the “pki directory”. The functionality is used to auto-accept Minion authentication keys based on a pre-placed “authorization file” at a specific location and is present in the default configuration.

Пакеты

Наименование

salt

pip
Затронутые версииВерсия исправления

>= 3007.0rc1, < 3007.4

3007.4

Наименование

salt

pip
Затронутые версииВерсия исправления

>= 3006.0rc1, < 3006.12

3006.12

EPSS

Процентиль: 18%
0.00057
Низкий

5.6 Medium

CVSS3

Дефекты

CWE-22
CWE-73

Связанные уязвимости

CVSS3: 5.6
ubuntu
3 месяца назад

File contents overwrite the VirtKey class is called when “on-demand pillar” data is requested and uses un-validated input to create paths to the “pki directory”. The functionality is used to auto-accept Minion authentication keys based on a pre-placed “authorization file” at a specific location and is present in the default configuration.

CVSS3: 5.6
nvd
3 месяца назад

File contents overwrite the VirtKey class is called when “on-demand pillar” data is requested and uses un-validated input to create paths to the “pki directory”. The functionality is used to auto-accept Minion authentication keys based on a pre-placed “authorization file” at a specific location and is present in the default configuration.

CVSS3: 5.6
debian
3 месяца назад

File contents overwrite the VirtKey class is called when \u201con-dema ...

CVSS3: 8.1
redos
20 дней назад

Множественные уязвимости salt

CVSS3: 8.1
redos
20 дней назад

Множественные уязвимости salt3006

EPSS

Процентиль: 18%
0.00057
Низкий

5.6 Medium

CVSS3

Дефекты

CWE-22
CWE-73