SaltStack Salt Information Exposure

HIGH 7.8CVE-2017-8109 · GHSA-xcx4-5wq7-g5g7 · PYSEC-2017-82 · Published 25/04/2017 · updated 17/06/2026

In short

CVE-2017-8109 is a HIGH (CVSS 7.8) vulnerability affecting salt, salt (saltstack).
Chance of exploitation in the next 30 days (EPSS): 0.43%, higher than 37.7% of all vulnerabilities.
Fix: update to 2016.11.4 or later.

Package	Affected versions	Patched versions
salt PyPI	`≥ 2016.11, < 2016.11.4`	`2016.11.4`
salt saltstack	`= 2016.11= 2016.11.0= 2016.11.1= 2016.11.2= 2016.11.3`	No fix yet

Description

The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients).

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2017-8109 · ADVISORY
saltstack/salt · WEB
saltstack/salt#40609 · WEB
saltstack/salt#40609 · WEB
bugzilla.suse.com/show_bug.cgi · WEB
pypa/advisory-database · WEB
saltstack/salt · PACKAGE
securityfocus.com/bid/98095 · Third Party Advisory
docs.saltstack.com/en/latest/topics/releases/2016.11.4.html · Patch
GitHub Advisory GHSA-xcx4-5wq7-g5g7 · ADVISORY

More vulnerabilities in salt

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

salt

PyPI

≥ 2016.11, < 2016.11.4

2016.11.4

salt

saltstack

= 2016.11= 2016.11.0= 2016.11.1= 2016.11.2= 2016.11.3

No fix yet

Description

NVD description

More vulnerabilities in salt

See all →