CVE-2023-34049 json
Salt security advisory release - 2023-OCT-27
published 2024-11-14 23 mo ago modified 2026-07-07 4 mo ago also GHSA-4277-m35q-7c9w , PYSEC-2026-1892 , EUVD-2024-3190
- cvss
- 6.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 10%
- public exploits
- 0
- none known
Summary
The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH. Do not make the copy path on the target predictable and ensure we check return codes of the scp command if the copy fails.
Patch / fix
- pypi salt 3005.4, 3006.4
- Salt SALT 3005.4, 3006.4
- salt_project salt 3005.4, 3006.4
- venv-salt-minion Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS, EL-9:Update:Products:SaltBundle:Update 3006.0-1.30.3
- saltbundle-swig EL-9:Update:Products:SaltBundle:Update 4.1.1-1.9.1
- saltbundlepy-py EL-9:Update:Products:SaltBundle:Update 1.10.0-1.9.4
- saltbundlepy-pip EL-9:Update:Products:SaltBundle:Update 20.2.4-1.6.1
- saltbundlepy-cffi EL-9:Update:Products:SaltBundle:Update 1.15.1-1.9.1
- saltbundlepy-lxml EL-9:Update:Products:SaltBundle:Update 4.9.3-1.12.1
- saltbundlepy-tomli EL-9:Update:Products:SaltBundle:Update 1.2.3-1.3.1
- saltbundlepy-wheel EL-9:Update:Products:SaltBundle:Update 0.40.0-1.3.1
suse advisories SUSE-EL-9-CLIENT-TOOLS-2023-4757SUSE-SU-2023:4757-1SUSE-SU-2023:4749-1SUSE-SU-2023:4748-1SUSE-SU-2023:4412-1SUSE-SU-2023:4390-1
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2023-34049 updated cvss 6.7
salt: allows an attacker to force Salt-SSH to run their script
-
Red Hat All currently supported Red Hat productsnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 23 mo ago
Exploit prediction
0.21% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.7 | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 6.7 | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 6.7 | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | salt | <3005.4 >=3006.0rc1, <3006.4 |
3005.4 3006.4 |
Affected products
- Salt SALT
- salt_project salt
Classification
- Weakness
-
- CWE-340 Generation of Predictable Numbers or Identifiers
References
-
github.com
/saltstack/salt/commit/286d55eb5a6e6bf9428405bdf5632b419bdf8444
web
-
github.com
/saltstack/salt/commit/7a14112f2a16ce70e3c3e1862c92e37af5f2c7a4
web
- saltproject.io /security-announcements/2023-10-27-advisory/
-
nvd.nist.gov
/vuln/detail/CVE-2023-34049
advisory
-
github.com
/saltstack/salt
package
-
saltproject.io
/security-announcements/2023-10-27-advisory
web
-
pypi.org
/project/salt
package
-
github.com
/advisories/GHSA-4277-m35q-7c9w
advisory
Sources
- CVE List CVE-2023-34049
- GitHub Advisory GHSA-4277-m35q-7c9w
- NVD CVE-2023-34049
- OSV PYSEC-2026-1892
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.