GCVE - cpe:2.3:a:saltstack:salt:0.17.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:saltstack:salt:0.17.0:*:*:*:*:*:*:*

part: a version: 0.17.0 update: *

Vendor	Saltstack (`505beb5a-4fc5-5540-9632-5d28b16aab0d`)
Product	Salt (`dd0d2bbf-d65f-5171-9eae-a243e2f3cc18`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/saltstack/salt`	purl2cpe	2026-06-01 10:16:14.738791
`pkg:rpm/fedora/salt`	purl2cpe	2026-06-01 10:16:14.738792
`pkg:rpm/opensuse/salt`	purl2cpe	2026-06-01 10:16:14.738793

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2013-6617`	vulnerable	2026-06-08 05:04:57.219722	Details available The salt master in Salt (aka SaltStack) 0.11.0 through 0.17.0 does not properly drop group privileges, which makes it easier for remote attackers to gain privileges. Published: 2013-11-05T18:00:00.000Z Updated: 2024-09-17T02:02:10.512Z Open on db.gcve.eu Reference links http://docs.saltstack.com/topics/releases/0.17.1.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-4439`	vulnerable	2026-06-08 05:04:46.735332	Details available Salt (aka SaltStack) before 0.15.0 through 0.17.0 allows remote authenticated minions to impersonate arbitrary minions via a crafted minion with a valid key. Published: 2013-11-05T18:00:00.000Z Updated: 2024-09-16T16:18:55.492Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2013/10/18/3 https://github.com/saltstack/salt/pull/7356 http://docs.saltstack.com/topics/releases/0.17.1.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-4437`	vulnerable	2026-06-08 05:04:46.721006	Details available Unspecified vulnerability in salt-ssh in Salt (aka SaltStack) 0.17.0 has unspecified impact and vectors related to "insecure Usage of /tmp." Published: 2013-11-05T18:00:00.000Z Updated: 2024-09-17T04:04:59.755Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2013/10/18/3 http://docs.saltstack.com/topics/releases/0.17.1.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-4436`	vulnerable	2026-06-08 05:04:46.720724	Details available The default configuration for salt-ssh in Salt (aka SaltStack) 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle (MITM) attack. Published: 2013-11-05T18:00:00.000Z Updated: 2024-09-16T22:41:15.246Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2013/10/18/3 http://docs.saltstack.com/topics/releases/0.17.1.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-4435`	vulnerable	2026-06-08 05:04:46.720335	Details available Salt (aka SaltStack) 0.15.0 through 0.17.0 allows remote authenticated users who are using external authentication or client ACL to execute restricted routines by embedding the routine in another routine. Published: 2013-11-05T18:00:00.000Z Updated: 2024-09-17T01:36:05.715Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2013/10/18/3 http://docs.saltstack.com/topics/releases/0.17.1.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.