CVE-2023-20897

MEDIUM5.3EPSS 0.18%

Salt vulnerable to denial of service

發布日:2023/9/5修改日:2025/2/13

描述

Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted.

受影響套件(2)

PyPI/saltfrom 0, < 3005.2
PyPI/salt>= 3006.0, < 3006.2, from 0, < 3005.2

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	MEDIUM5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

參考連結(6)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-20897
ADVISORYhttps://saltproject.io/security-announcements/2023-08-10-advisory/
PATCHhttps://github.com/saltstack/salt
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2023-166.yaml
WEBhttps://lists.fedoraproject.org/archives/list/[email protected]/message/OMWJIHQZXHK6FH2E3IWAZCYIRI7FLVOL
WEBhttps://saltproject.io/security-announcements/2023-08-10-advisory