CVE-2017-8109

CVSS V2 Low 2.1 CVSS V3 High 7.8
Description
The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients).
Overview
  • CVE ID
  • CVE-2017-8109
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2017-04-25T17:59:00
  • Last Modified Date
  • 2017-05-05T17:58:51
Weakness Enumerations
CWE URL
CWE-200 http://cwe.mitre.org/data/definitions/200.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:saltstack:salt:2016.11:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:saltstack:salt:2016.11.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:saltstack:salt:2016.11.0:rc1:*:*:*:*:*:* 1 OR
cpe:2.3:a:saltstack:salt:2016.11.0:rc2:*:*:*:*:*:* 1 OR
cpe:2.3:a:saltstack:salt:2016.11.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:saltstack:salt:2016.11.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:saltstack:salt:2016.11.3:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:L/AC:L/Au:N/C:P/I:N/A:N
  • Access Vector
  • LOCAL
  • Access Compatibility
  • LOW
  • Authentication
  • NONE
  • Confidentiality Impact
  • PARTIAL
  • Integrity Impact
  • NONE
  • Availability Impact
  • NONE
  • Base Score
  • 2.1
  • Severity
  • LOW
  • Exploitability Score
  • 3.9
  • Impact Score
  • 2.9
CVSS Version 3
  • Version
  • 3.0
  • Vector String
  • CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • Attack Vector
  • LOCAL
  • Attack Compatibility
  • LOW
  • Privileges Required
  • LOW
  • User Interaction
  • NONE
  • Scope
  • UNCHANGED
  • Confidentiality Impact
  • HIGH
  • Availability Impact
  • HIGH
  • Base Score
  • 7.8
  • Base Severity
  • HIGH
  • Exploitability Score
  • 1.8
  • Impact Score
  • 5.9
References
Reference URL Reference Tags
https://github.com/saltstack/salt/pull/40609/commits/6e34c2b5e5e849302af7ccd00509929c3809c658 Issue Tracking Patch Third Party Advisory
https://github.com/saltstack/salt/pull/40609 Issue Tracking Patch Third Party Advisory
https://github.com/saltstack/salt/issues/40075 Issue Tracking Patch Third Party Advisory
https://docs.saltstack.com/en/latest/topics/releases/2016.11.4.html Patch Release Notes Vendor Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1035912 Issue Tracking Patch
http://www.securityfocus.com/bid/98095 Third Party Advisory VDB Entry
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2017-8109
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8109
History
Created Old Value New Value Data Type Notes
2022-05-10 09:43:40 Added to TrackCVE
2022-12-02 16:24:35 2017-04-25T17:59Z 2017-04-25T17:59:00 CVE Published Date updated
2022-12-02 16:24:35 2017-05-05T17:58:51 CVE Modified Date updated
2022-12-02 16:24:35 Analyzed Vulnerability Status updated