Все бюллетени/sisyphus/ALT-PU-2013-1179-1
ALT-PU-2013-1179-1

Обновление пакета salt в ветке sisyphus

Версия0.17.2-alt1
Задание#109118
Опубликовано2013-11-24
Макс. серьёзностьCRITICAL
Серьёзность:

Закрытые проблемы (6)

CVE-2013-4435
MEDIUM6.0

Salt (aka SaltStack) 0.15.0 through 0.17.0 allows remote authenticated users who are using external authentication or client ACL to execute restricted routines by embedding the routine in another routine.

Опубликовано: 2013-11-05Изменено: 2026-04-29
CVSS 2.0СРЕДНЯЯ 6.0
CVSS:2.0/AV:N/AC:M/Au:S/C:P/I:P/A:P
Ссылки
CVE-2013-4436
CRITICAL9.3

The default configuration for salt-ssh in Salt (aka SaltStack) 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle (MITM) attack.

Опубликовано: 2013-11-05Изменено: 2026-04-29
CVSS 2.0КРИТИЧЕСКАЯ 9.3
CVSS:2.0/AV:N/AC:M/Au:N/C:C/I:C/A:C
Ссылки
CVE-2013-4437
CRITICAL10.0

Unspecified vulnerability in salt-ssh in Salt (aka SaltStack) 0.17.0 has unspecified impact and vectors related to "insecure Usage of /tmp."

Опубликовано: 2013-11-05Изменено: 2026-04-29
CVSS 2.0КРИТИЧЕСКАЯ 10.0
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
Ссылки
CVE-2013-4438
HIGH7.5

Salt (aka SaltStack) before 0.17.1 allows remote attackers to execute arbitrary YAML code via unspecified vectors. NOTE: the vendor states that this might not be a vulnerability because the YAML to be loaded has already been determined to be safe.

Опубликовано: 2013-11-05Изменено: 2026-04-29
CVSS 2.0ВЫСОКАЯ 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P
Ссылки
CVE-2013-4439
MEDIUM4.9

Salt (aka SaltStack) before 0.15.0 through 0.17.0 allows remote authenticated minions to impersonate arbitrary minions via a crafted minion with a valid key.

Опубликовано: 2013-11-05Изменено: 2026-04-29
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:N/AC:M/Au:S/C:P/I:P/A:N
Ссылки