CVE-2017-8109

Опубликовано: 25 апр. 2017

Источник: nvd

CVSS3: 7.8

CVSS2: 2.1

EPSS Низкий

Описание

The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients).

Ссылки

http://www.securityfocus.com/bid/98095
Third Party Advisory
VDB Entry
https://bugzilla.suse.com/show_bug.cgi?id=1035912
Issue Tracking
Patch
https://docs.saltstack.com/en/latest/topics/releases/2016.11.4.html
Patch
Release Notes
Vendor Advisory
https://github.com/saltstack/salt/issues/40075
Issue Tracking
Patch
Third Party Advisory
https://github.com/saltstack/salt/pull/40609
Issue Tracking
Patch
Third Party Advisory
https://github.com/saltstack/salt/pull/40609/commits/6e34c2b5e5e849302af7ccd00509929c3809c658
Issue Tracking
Patch
Third Party Advisory
http://www.securityfocus.com/bid/98095
Third Party Advisory
VDB Entry
https://bugzilla.suse.com/show_bug.cgi?id=1035912
Issue Tracking
Patch
https://docs.saltstack.com/en/latest/topics/releases/2016.11.4.html
Patch
Release Notes
Vendor Advisory
https://github.com/saltstack/salt/issues/40075
Issue Tracking
Patch
Third Party Advisory
https://github.com/saltstack/salt/pull/40609
Issue Tracking
Patch
Third Party Advisory
https://github.com/saltstack/salt/pull/40609/commits/6e34c2b5e5e849302af7ccd00509929c3809c658
Issue Tracking
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:saltstack:salt:2016.11:*:*:*:*:*:*:*

cpe:2.3:a:saltstack:salt:2016.11.0:*:*:*:*:*:*:*

cpe:2.3:a:saltstack:salt:2016.11.0:rc1:*:*:*:*:*:*

cpe:2.3:a:saltstack:salt:2016.11.0:rc2:*:*:*:*:*:*

cpe:2.3:a:saltstack:salt:2016.11.1:*:*:*:*:*:*:*

cpe:2.3:a:saltstack:salt:2016.11.2:*:*:*:*:*:*:*

cpe:2.3:a:saltstack:salt:2016.11.3:*:*:*:*:*:*:*

EPSS

Процентиль: 14%

0.00047

Низкий

7.8 High

CVSS3

2.1 Low

CVSS2

Дефекты

CWE-200

Связанные уязвимости

CVE-2017-8109

CVSS3: 7.8

ubuntu

почти 9 лет назад

CVE-2017-8109

CVSS3: 5.5

redhat

почти 9 лет назад

CVE-2017-8109

CVSS3: 7.8

debian

почти 9 лет назад

The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 co ...

GHSA-xcx4-5wq7-g5g7

CVSS3: 7.8

github

больше 3 лет назад

SaltStack Salt Information Exposure

SUSE-SU-2017:1582-1

suse-cvrf

больше 8 лет назад

Security update for Salt

EPSS

Процентиль: 14%

0.00047

Низкий

7.8 High

CVSS3

2.1 Low

CVSS2

Дефекты

CWE-200