What is GHSA-vqh4-crjf-jjxx?

GHSA-vqh4-crjf-jjxx is a security advisory published by GitHub Security Advisories with High severity. Salt Improper Access Control

Which CVE IDs does GHSA-vqh4-crjf-jjxx cover?

GHSA-vqh4-crjf-jjxx covers the following CVE IDs: CVE-2016-1866. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vqh4-crjf-jjxx?

GHSA-vqh4-crjf-jjxx has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

Which products are affected by GHSA-vqh4-crjf-jjxx?

GHSA-vqh4-crjf-jjxx affects 1 product, including: pip/salt:\u003e= 2015.8.0rc1, \u003c 2015.8.4.

GHSA-vqh4-crjf-jjxxHighCVSS 8.1

Salt Improper Access Control

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

October 21, 2024

🔗 CVE IDs covered (1)

CVE-2016-1866 →

📋 Description

Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream.

🎯 Affected products1

pip/salt:>= 2015.8.0rc1, < 2015.8.4

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2016-1866
https://docs.saltstack.com/en/latest/topics/releases/2015.8.4.html
http://lists.opensuse.org/opensuse-updates/2016-03/msg00034.html
https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2016-23.yaml
https://github.com/advisories/GHSA-vqh4-crjf-jjxx