Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules.
Weakness
The product does not validate, or incorrectly validates, a certificate.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Salt | Saltstack | 2014.7.5 (including) | 2014.7.5 (including) |
| Salt | Ubuntu | artful | * |
| Salt | Ubuntu | upstream | * |
| Salt | Ubuntu | vivid | * |
| Salt | Ubuntu | wily | * |
| Salt | Ubuntu | yakkety | * |
| Salt | Ubuntu | zesty | * |
Potential Mitigations
Related Attack Patterns
References
- http://www.openwall.com/lists/oss-security/2015/05/19/2
- https://bugzilla.redhat.com/show_bug.cgi?id=1222960
- https://docs.saltstack.com/en/latest/topics/releases/2014.7.6.html
- https://groups.google.com/forum/#%21topic/salt-users/8Kv1bytGD6c
- http://www.openwall.com/lists/oss-security/2015/05/19/2
- https://bugzilla.redhat.com/show_bug.cgi?id=1222960
- https://docs.saltstack.com/en/latest/topics/releases/2014.7.6.html
- https://groups.google.com/forum/#%21topic/salt-users/8Kv1bytGD6c