{"id":"CVE-2017-8109","aliases":["EUVD-2017-0126","GHSA-xcx4-5wq7-g5g7","PYSEC-2017-82","SUSE-SU-2017:1581-1","SUSE-SU-2017:1582-1","UBUNTU-CVE-2017-8109"],"status":"published","title":"SaltStack Salt Information Exposure","description":"The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients).","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00431,"percentile":0.37585,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2017-04-25T17:00:00Z","modified":"2026-10-20T10:50:10Z","fixes":[{"ecosystem":"PyPI","package":"salt","fixed_in":["2016.11.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2016.11"},{"fixed":"2016.11.4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2016.11"},{"fixed":"2016.11.4"}]}],"versions":["2016.11.0","2016.11.1","2016.11.2","2016.11.3"]},{"source":"osv","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2016.11"},{"fixed":"2016.11.4"}]}],"versions":["2016.11.0","2016.11.1","2016.11.2","2016.11.3"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.4-42.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.4-42.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.4-45.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Advanced Systems Management 12","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.4-45.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 12 SP2","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.4-45.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.0","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.4-45.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.0","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.4-45.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 3","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.4-45.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.4-45.2"}]}],"bundled":2}],"products":[{"vendor":"saltstack","product":"salt"}],"references":[{"url":"https://github.com/saltstack/salt/pull/40609/commits/6e34c2b5e5e849302af7ccd00509929c3809c658","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/saltstack/salt/issues/40075","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/saltstack/salt/pull/40609","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1035912","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","fix","web","report"]},{"url":"http://www.securityfocus.com/bid/98095","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://docs.saltstack.com/en/latest/topics/releases/2016.11.4.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Release Notes","Vendor Advisory","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-8109","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2017-82.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-xcx4-5wq7-g5g7","tags":["advisory"]},{"url":"https://github.com/saltstack/salt","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171581-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1011800","tags":["report"]},{"url":"https://bugzilla.suse.com/1012999","tags":["report"]},{"url":"https://bugzilla.suse.com/1017078","tags":["report"]},{"url":"https://bugzilla.suse.com/1020831","tags":["report"]},{"url":"https://bugzilla.suse.com/1022562","tags":["report"]},{"url":"https://bugzilla.suse.com/1025896","tags":["report"]},{"url":"https://bugzilla.suse.com/1027240","tags":["report"]},{"url":"https://bugzilla.suse.com/1027722","tags":["report"]},{"url":"https://bugzilla.suse.com/1030009","tags":["report"]},{"url":"https://bugzilla.suse.com/1030073","tags":["report"]},{"url":"https://bugzilla.suse.com/1032931","tags":["report"]},{"url":"https://bugzilla.suse.com/1035912","tags":["report"]},{"url":"https://bugzilla.suse.com/1035914","tags":["report"]},{"url":"https://bugzilla.suse.com/1036125","tags":["report"]},{"url":"https://bugzilla.suse.com/1038855","tags":["report"]},{"url":"https://bugzilla.suse.com/1039370","tags":["report"]},{"url":"https://bugzilla.suse.com/1040584","tags":["report"]},{"url":"https://bugzilla.suse.com/1040886","tags":["report"]},{"url":"https://bugzilla.suse.com/1043111","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5200","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8109","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171582-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-8109","tags":["report"]},{"url":"https://github.com/saltstack/salt/commit/8492cef7a5c8871a3978ffc2f6e48b3b960e0151","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-8109","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-8109","description":"The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients).","status":"published","published":"2017-04-25T17:00:00Z","modified":"2024-08-05T16:27:22.195Z","updated_at":"2026-11-02T14:33:14.89365Z"}],"euvd":[{"id":"EUVD-2017-0126","description":"The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients).","status":"published","published":"2017-04-25T17:00:00Z","modified":"2024-08-05T16:27:22Z","updated_at":"2026-11-03T02:39:05.933017Z"}],"ghsa":[{"id":"GHSA-xcx4-5wq7-g5g7","title":"SaltStack Salt Information Exposure","description":"The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients).","status":"published","published":"2022-05-17T02:46:54Z","modified":"2024-10-26T22:34:40Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:38:13.90937Z"}],"nvd":[{"id":"CVE-2017-8109","description":"The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients).","status":"published","published":"2017-04-25T17:59:00.18Z","modified":"2026-06-17T01:25:47.283Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:46.08744Z"}],"osv":[{"id":"CVE-2017-8109","description":"The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients).","status":"published","published":"2017-04-25T17:59:00.18Z","modified":"2026-10-20T10:50:10.511042553Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:06.868403Z"},{"id":"GHSA-xcx4-5wq7-g5g7","title":"SaltStack Salt Information Exposure","description":"The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients).","status":"published","published":"2022-05-17T02:46:54Z","modified":"2024-10-26T22:51:39.582387Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:59.835583Z"},{"id":"UBUNTU-CVE-2017-8109","description":"The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients).","status":"withdrawn","published":"2017-04-25T17:59:00Z","modified":"2025-07-16T07:18:30.848755Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:15.773974Z"},{"id":"PYSEC-2017-82","description":"The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients).","status":"published","published":"2017-04-25T17:59:00Z","modified":"2026-06-10T17:02:37.483348264Z","updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"SUSE-SU-2017:1581-1","title":"Security update for Salt","description":"\nThis update for salt provides version 2016.11.4 and brings various fixes and improvements:\n\n- Adding a salt-minion watchdog for RHEL6 and SLES11 systems (sysV) to restart salt-minion in case of crashes during upgrade.\n- Fix format error. (bsc#1043111)\n- Fix ownership for whole master cache directory. (bsc#1035914)\n- Disable 3rd party runtime packages to be explicitly recommended. (bsc#1040886)    \n- Fix insecure permissions in salt-ssh temporary files. (bsc#1035912, CVE-2017-8109)\n- Disable custom rosters for Salt SSH via Salt API. (bsc#1011800, CVE-2017-5200)\n- Orchestrate and batches don't return false failed information anymore.\n- Speed-up cherrypy by removing sleep call.\n- Fix os_family grains on SUSE. (bsc#1038855)\n- Fix setting the language on SUSE systems. (bsc#1038855)\n- Use SUSE specific salt-api.service. (bsc#1039370)\n- Fix using hostname for minion ID as '127'.\n- Fix core grains constants for timezone. (bsc#1032931)\n- Minor fixes on new pkg.list_downloaded.\n- Listing all type of advisory patches for Yum module.\n- Prevents zero length error on Python 2.6.\n- Fixes zypper test error after backporting.\n- Raet protocol is no longer supported. (bsc#1020831)\n- Fix moving SSH data to the new home. (bsc#1027722)\n- Fix logrotating /var/log/salt/minion. (bsc#1030009)\n- Fix result of master_tops extension is mutually overwritten. (bsc#1030073)\n- Allows to set 'timeout' and 'gather_job_timeout' via kwargs.\n- Allows to set custom timeouts for 'manage.up' and 'manage.status'.\n- Use salt's ordereddict for comparison.\n- Fix scripts for salt-proxy.\n- Add openscap module.\n- File.get_managed regression fix.\n- Fix translate variable arguments if they contain hidden keywords. (bsc#1025896)\n- Added unit test for dockerng.sls_build dryrun.\n- Added dryrun to dockerng.sls_build.\n- Update dockerng minimal version requirements.\n- Fix format error in error parsing.\n- Keep fix for migrating salt home directory. (bsc#1022562)\n- Fix  salt pkg.latest raises exception if package is not available. (bsc#1012999)\n- Timezone should always be in UTC. (bsc#1017078)\n- Fix timezone handling for rpm installtime. (bsc#1017078)\n- Increasing timeouts for running integrations tests.\n- Add buildargs option to dockerng.build module.\n- Fix error when missing ssh-option parameter.\n- Re-add yum notify plugin.\n- All kwargs to dockerng.create to provide all features to sls_build as well.\n- Datetime should be returned always in UTC.\n- Fix possible crash  while deserialising data on infinite recursion in scheduled state. (bsc#1036125)\n- Documentation refresh to 2016.11.4\n- For a detailed description, please refer to:\n  + https://docs.saltstack.com/en/develop/topics/releases/2016.11.4.html\n  + https://docs.saltstack.com/en/develop/topics/releases/2016.11.3.html\n  + https://docs.saltstack.com/en/develop/topics/releases/2016.11.2.html\n  + https://docs.saltstack.com/en/develop/topics/releases/2016.11.1.html\n","status":"published","published":"2017-06-16T11:48:45Z","modified":"2026-02-04T04:03:01.996963Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:1582-1","title":"Security update for Salt","description":"\nThis update for salt provides version 2016.11.4 and brings various fixes and improvements:\n\n- Adding a salt-minion watchdog for RHEL6 and SLES11 systems (sysV) to restart salt-minion in case of crashes during upgrade.\n- Fix format error. (bsc#1043111)\n- Fix ownership for whole master cache directory. (bsc#1035914)\n- Disable 3rd party runtime packages to be explicitly recommended. (bsc#1040886)\n- Fix insecure permissions in salt-ssh temporary files. (bsc#1035912, CVE-2017-8109)\n- Disable custom rosters for Salt SSH via Salt API. (bsc#1011800, CVE-2017-5200)\n- Orchestrate and batches don't return false failed information anymore.\n- Speed-up cherrypy by removing sleep call.\n- Fix os_family grains on SUSE. (bsc#1038855)\n- Fix setting the language on SUSE systems. (bsc#1038855)\n- Use SUSE specific salt-api.service. (bsc#1039370)\n- Fix using hostname for minion ID as '127'.\n- Fix core grains constants for timezone. (bsc#1032931)\n- Minor fixes on new pkg.list_downloaded.\n- Listing all type of advisory patches for Yum module.\n- Prevents zero length error on Python 2.6.\n- Fixes zypper test error after backporting.\n- Raet protocol is no longer supported. (bsc#1020831)\n- Fix moving SSH data to the new home. (bsc#1027722)\n- Fix logrotating /var/log/salt/minion. (bsc#1030009)\n- Fix result of master_tops extension is mutually overwritten. (bsc#1030073)\n- Allows to set 'timeout' and 'gather_job_timeout' via kwargs.\n- Allows to set custom timeouts for 'manage.up' and 'manage.status'.\n- Use salt's ordereddict for comparison.\n- Fix scripts for salt-proxy.\n- Add openscap module.\n- File.get_managed regression fix.\n- Fix translate variable arguments if they contain hidden keywords. (bsc#1025896)\n- Added unit test for dockerng.sls_build dryrun.\n- Added dryrun to dockerng.sls_build.\n- Update dockerng minimal version requirements.\n- Fix format error in error parsing.\n- Keep fix for migrating salt home directory. (bsc#1022562)\n- Fix  salt pkg.latest raises exception if package is not available. (bsc#1012999)\n- Timezone should always be in UTC. (bsc#1017078)\n- Fix timezone handling for rpm installtime. (bsc#1017078)\n- Increasing timeouts for running integrations tests.\n- Add buildargs option to dockerng.build module.\n- Fix error when missing ssh-option parameter.\n- Re-add yum notify plugin.\n- All kwargs to dockerng.create to provide all features to sls_build as well.\n- Datetime should be returned always in UTC.\n- Fix possible crash  while deserialising data on infinite recursion in scheduled state. (bsc#1036125)\n- Documentation refresh to 2016.11.4\n- For a detailed description, please refer to:\n  + https://docs.saltstack.com/en/develop/topics/releases/2016.11.4.html\n  + https://docs.saltstack.com/en/develop/topics/releases/2016.11.3.html\n  + https://docs.saltstack.com/en/develop/topics/releases/2016.11.2.html\n  + https://docs.saltstack.com/en/develop/topics/releases/2016.11.1.html\n","status":"published","published":"2017-06-16T11:49:27Z","modified":"2026-02-04T03:07:42.551163Z","updated_at":"2026-11-02T15:53:43.83457Z"}]}}