GHSA-f22j-37jj-cxw9HighCVSS 7.5

SaltStack MITM SSH attack in salt-ssh

Published
May 17, 2022
Last Modified
October 26, 2024

🔗 CVE IDs covered (1)

CVE-2013-4436 →

📋 Description

The default configuration for salt-ssh in Salt (aka SaltStack) 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle (MITM) attack.

🎯 Affected products1

  • pip/salt:= 0.17.0

🔗 References (5)