UBUNTU-CVE-2023-20898
Dashboard / Vulnerabilities / UBUNTU-CVE-2023-20898
Summary:
Details: Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environments can get garbage data or the wrong data, which can lead to wrongful data disclosure, wrongful executions, data corruption and/or crash.
References: https://ubuntu.com/security/CVE-2023-20898, https://saltproject.io/security-announcements/2023-08-10-advisory/, https://www.cve.org/CVERecord?id=CVE-2023-20898
Affected packages
Package
Name: salt
Purl: pkg:deb/ubuntu/[email protected]+ds-1ubuntu0.1+esm2?arch=source&distro=esm-apps/xenial
Affected ranges
Type: ECOSYSTEM
Events:
Introduced- 0
Fixed -None
Affected versions
2015.5.3+ds-1
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
