Salt (aka SaltStack) before 0.17.1 allows remote attackers to execute arbitrary YAML code via unspecified vectors. NOTE: the vendor states that this might not be a vulnerability because the YAML to be loaded has already been determined to be safe.
References
| Link | Resource |
|---|---|
| http://docs.saltstack.com/topics/releases/0.17.1.html | Patch Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2013/10/18/3 | |
| http://docs.saltstack.com/topics/releases/0.17.1.html | Patch Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2013/10/18/3 |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 01:55
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://docs.saltstack.com/topics/releases/0.17.1.html - Patch, Vendor Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2013/10/18/3 - |
Information
Published : 2013-11-05 18:55
Updated : 2025-04-11 00:51
NVD link : CVE-2013-4438
Mitre link : CVE-2013-4438
CVE.ORG link : CVE-2013-4438
JSON object : View
Products Affected
saltstack
- salt
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')