What is GHSA-xcx4-5wq7-g5g7?

GHSA-xcx4-5wq7-g5g7 is a security advisory published by GitHub Security Advisories with High severity. SaltStack Salt Information Exposure

Which CVE IDs does GHSA-xcx4-5wq7-g5g7 cover?

GHSA-xcx4-5wq7-g5g7 covers the following CVE IDs: CVE-2017-8109. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xcx4-5wq7-g5g7?

GHSA-xcx4-5wq7-g5g7 has a CVSS v3 base score of 7.8, published by GitHub Security Advisories.

Which products are affected by GHSA-xcx4-5wq7-g5g7?

GHSA-xcx4-5wq7-g5g7 affects 1 product, including: pip/salt:\u003e= 2016.11, \u003c 2016.11.4.

GHSA-xcx4-5wq7-g5g7HighCVSS 7.8

SaltStack Salt Information Exposure

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

October 26, 2024

🔗 CVE IDs covered (1)

CVE-2017-8109 →

📋 Description

The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients).

🎯 Affected products1

pip/salt:>= 2016.11, < 2016.11.4

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2017-8109
https://github.com/saltstack/salt/issues/40075
https://github.com/saltstack/salt/pull/40609
https://github.com/saltstack/salt/pull/40609/commits/6e34c2b5e5e849302af7ccd00509929c3809c658
https://bugzilla.suse.com/show_bug.cgi?id=1035912
https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2017-82.yaml
https://github.com/advisories/GHSA-xcx4-5wq7-g5g7