The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH. Do not make the copy path on the target predictable and ensure we check return codes of the scp command if the copy fails.

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2023:4749-1 advisory.

  - allows an attacker to force Salt-SSH to run their script [fedora-all] (CVE-2023-34049)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of SaltStack hosted on the remote server is affected by a security bypass vulnerability. The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4386-1 advisory.

  - allows an attacker to force Salt-SSH to run their script [fedora-all] (CVE-2023-34049)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4388-1 advisory.

  - allows an attacker to force Salt-SSH to run their script [fedora-all] (CVE-2023-34049)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4389-1 advisory.

  - allows an attacker to force Salt-SSH to run their script [fedora-all] (CVE-2023-34049)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2023:4412-1 advisory.

  - allows an attacker to force Salt-SSH to run their script [fedora-all] (CVE-2023-34049)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4387-1 advisory.

  - allows an attacker to force Salt-SSH to run their script [fedora-all] (CVE-2023-34049)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4390-1 advisory.

  - allows an attacker to force Salt-SSH to run their script [fedora-all] (CVE-2023-34049)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-3eda7b85f5 advisory.

    Fix for CVE-2023-34049

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-a6699df922 advisory.

    Fix for CVE-2023-34049

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-89e8f3efc5 advisory.

    Fix for CVE-2023-34049

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
186881	SUSE SLES15 Security Update : SUSE Manager Salt Bundle (SUSE-SU-2023:4749-1)	Nessus	SuSE Local Security Checks	medium
185733	SaltStack 3000 < 3005.4 / 3006 < 3006.4 Security Bypass	Nessus	Misc.	medium
185450	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : salt (SUSE-SU-2023:4386-1)	Nessus	SuSE Local Security Checks	medium
185449	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : salt (SUSE-SU-2023:4388-1)	Nessus	SuSE Local Security Checks	medium
185448	SUSE SLES15 Security Update : salt (SUSE-SU-2023:4389-1)	Nessus	SuSE Local Security Checks	medium
185447	SUSE SLES15 Security Update : SUSE Manager Server 4.3 (SUSE-SU-2023:4412-1)	Nessus	SuSE Local Security Checks	medium
185446	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : salt (SUSE-SU-2023:4387-1)	Nessus	SuSE Local Security Checks	medium
185445	SUSE SLES15 Security Update : salt (SUSE-SU-2023:4390-1)	Nessus	SuSE Local Security Checks	medium
185374	Fedora 39 : salt (2023-3eda7b85f5)	Nessus	Fedora Local Security Checks	medium
185365	Fedora 38 : salt (2023-a6699df922)	Nessus	Fedora Local Security Checks	medium
185348	Fedora 37 : salt (2023-89e8f3efc5)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2023-34049

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium