SaltStack Privilege Escalation vulnerability

GHSA-7wx3-vr2f-6p29 · CVE-2013-6617 · PYSEC-2013-15

Published May 17, 2022 · Modified Dec 7, 2024

Description

The salt master in Salt (aka SaltStack) 0.11.0 through 0.17.0 does not properly drop group privileges, which makes it easier for remote attackers to gain privileges.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2013-6617
WEB https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2013-15.yaml
PACKAGE https://github.com/saltstack/salt
WEB http://docs.saltstack.com/topics/releases/0.17.1.html

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes