{"id":"CVE-2017-7893","aliases":["EUVD-2018-0135","GHSA-g283-88v5-rmq2","PYSEC-2018-50","UBUNTU-CVE-2017-7893"],"status":"published","title":"SaltStack Salt allows compromised salt-minions to impersonate the salt-master","description":"In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01373,"percentile":0.7219,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2018-04-23T22:00:00Z","modified":"2026-10-24T10:30:55Z","fixes":[{"ecosystem":"PyPI","package":"salt","fixed_in":["2016.3.6"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.3.6"}]}]},{"source":"osv","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.3.6"}]}],"versions":["0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.5","0.11.0","0.11.1","0.12.0","0.12.1","0.13.0","0.13.1","0.13.2","0.13.3","0.14.0","0.14.1","0.15.0","0.15.1","0.15.2","0.15.3","0.15.90","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.17.0","0.17.0rc1","0.17.1","0.17.2","0.17.3","0.17.4","0.17.5","0.8.7","0.8.9","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","0.9.9.1","2014.1.0","2014.1.0rc1","2014.1.0rc2","2014.1.0rc3","2014.1.1","2014.1.10","2014.1.11","2014.1.12","2014.1.13","2014.1.2","2014.1.3","2014.1.4","2014.1.5","2014.1.6","2014.1.7","2014.1.8","2014.1.9","2014.7.0","2014.7.0rc1","2014.7.0rc2","2014.7.0rc3","2014.7.0rc4","2014.7.0rc5","2014.7.0rc6","2014.7.0rc7","2014.7.1","2014.7.2","2014.7.3","2014.7.4","2014.7.5","2014.7.6","2014.7.7","2015.2.0rc1","2015.2.0rc2","2015.5.0","2015.5.1","2015.5.10","2015.5.11","2015.5.2","2015.5.3","2015.5.4","2015.5.5","2015.5.6","2015.5.7","2015.5.8","2015.5.9","2015.8.0","2015.8.0rc1","2015.8.0rc2","2015.8.0rc3","2015.8.0rc4","2015.8.0rc5","2015.8.1","2015.8.10","2015.8.11","2015.8.12","2015.8.13","2015.8.2","2015.8.3","2015.8.4","2015.8.5","2015.8.7","2015.8.8","2015.8.8.2","2015.8.9","2016.3.0","2016.3.0rc2","2016.3.0rc3","2016.3.1","2016.3.2","2016.3.3","2016.3.4","2016.3.5"]},{"source":"osv","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.3.6"}]}],"versions":["0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.5","0.11.0","0.11.1","0.12.0","0.12.1","0.13.0","0.13.1","0.13.2","0.13.3","0.14.0","0.14.1","0.15.0","0.15.1","0.15.2","0.15.3","0.15.90","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.17.0","0.17.0rc1","0.17.1","0.17.2","0.17.3","0.17.4","0.17.5","0.8.7","0.8.9","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","0.9.9.1","2014.1.0","2014.1.0rc1","2014.1.0rc2","2014.1.0rc3","2014.1.1","2014.1.10","2014.1.11","2014.1.12","2014.1.13","2014.1.2","2014.1.3","2014.1.4","2014.1.5","2014.1.6","2014.1.7","2014.1.8","2014.1.9","2014.7.0","2014.7.0rc1","2014.7.0rc2","2014.7.0rc3","2014.7.0rc4","2014.7.0rc5","2014.7.0rc6","2014.7.0rc7","2014.7.1","2014.7.2","2014.7.3","2014.7.4","2014.7.5","2014.7.6","2014.7.7","2015.2.0rc1","2015.2.0rc2","2015.5.0","2015.5.1","2015.5.10","2015.5.11","2015.5.2","2015.5.3","2015.5.4","2015.5.5","2015.5.6","2015.5.7","2015.5.8","2015.5.9","2015.8.0","2015.8.0rc1","2015.8.0rc2","2015.8.0rc3","2015.8.0rc4","2015.8.0rc5","2015.8.1","2015.8.10","2015.8.11","2015.8.12","2015.8.13","2015.8.2","2015.8.3","2015.8.4","2015.8.5","2015.8.7","2015.8.8","2015.8.8.2","2015.8.9","2016.3.0","2016.3.0rc2","2016.3.0rc3","2016.3.1","2016.3.2","2016.3.3","2016.3.4","2016.3.5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.16.0-1","0.16.4-2","0.17.1+dfsg-1","0.17.2-1","0.17.2-2","0.17.2-3","0.17.4-1","0.17.4-2","0.17.5-1","0.17.5+ds-1","0.17.5+ds-1ubuntu0.1~esm1","0.17.5+ds-1ubuntu0.1~esm2","0.17.5+ds-1ubuntu0.1~esm4","0.17.5+ds-1ubuntu0.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2015.5.3+ds-1","2015.8.1+ds-2","2015.8.3+ds-1","2015.8.3+ds-2","2015.8.3+ds-3","2015.8.5+ds-1","2015.8.7+ds-1","2015.8.8+ds-1","2015.8.8+ds-1ubuntu0.1~esm1","2015.8.8+ds-1ubuntu0.1","2015.8.8+ds-1ubuntu0.1+esm1","2015.8.8+ds-1ubuntu0.1+esm2"]}],"products":[{"vendor":"saltstack","product":"salt"}],"references":[{"url":"https://docs.saltstack.com/en/2017.7/topics/releases/2016.3.6.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7893","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2018-50.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g283-88v5-rmq2","tags":["advisory"]},{"url":"https://github.com/saltstack/salt","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2017-7893","tags":["report"]},{"url":"https://github.com/saltstack/salt/issues/48939","tags":["report"]},{"url":"https://patch-diff.githubusercontent.com/raw/saltstack/salt/pull/40159.patch","tags":["report"]},{"url":"https://patch-diff.githubusercontent.com/raw/saltstack/salt/pull/40206.patch","tags":["report"]},{"url":"https://github.com/saltstack/salt/issues/48939#issuecomment-410777638","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-7893","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-7893","description":"In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master.","status":"published","published":"2018-04-23T22:00:00Z","modified":"2024-08-05T16:19:28.351Z","updated_at":"2026-11-02T14:33:20.488433Z"}],"euvd":[{"id":"EUVD-2018-0135","description":"In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master.","status":"published","published":"2018-04-23T22:00:00Z","modified":"2024-08-05T16:19:28Z","updated_at":"2026-11-03T02:39:07.019497Z"}],"ghsa":[{"id":"GHSA-g283-88v5-rmq2","title":"SaltStack Salt allows compromised salt-minions to impersonate the salt-master","description":"In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master.","status":"published","published":"2022-05-13T01:47:12Z","modified":"2024-10-26T22:51:16Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T14:38:13.90937Z"}],"nvd":[{"id":"CVE-2017-7893","description":"In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master.","status":"published","published":"2018-04-23T22:29:00.227Z","modified":"2026-06-17T01:25:24.753Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:04:17.032862Z"}],"osv":[{"id":"CVE-2017-7893","description":"In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master.","status":"published","published":"2018-04-23T22:29:00.227Z","modified":"2026-10-24T10:30:55.716687115Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:06.868403Z"},{"id":"GHSA-g283-88v5-rmq2","title":"SaltStack Salt allows compromised salt-minions to impersonate the salt-master","description":"In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master.","status":"published","published":"2022-05-13T01:47:12Z","modified":"2024-12-06T05:37:36.387766Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T15:46:47.119724Z"},{"id":"UBUNTU-CVE-2017-7893","description":"In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master.","status":"published","published":"2018-04-23T22:29:00Z","modified":"2026-04-08T13:34:39.953219Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:15.773974Z"},{"id":"PYSEC-2018-50","description":"In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master.","status":"published","published":"2018-04-23T22:29:00Z","modified":"2026-06-10T17:02:37.925591673Z","updated_at":"2026-11-02T15:52:52.192131Z"}]}}